10. Principles for assigning access flags

(1) Subject to subrules (3) to (5), access flags must be set and maintained for registered healthcare provider organisations in a network in a manner which balances:

(a) reasonable healthcare recipient expectations about the sharing of health information as part of providing healthcare to the healthcare recipient; and

(b) arrangements within the organisation for access to health information collected by the organisation.

(2) A registered healthcare provider organisation that is a seed organisation must ensure that access flags assigned within its network are regularly reviewed and adjusted as necessary so that their assignment remains consistent with the principles in subrule (1).

(3) If the System Operator reasonably considers that access flags have not been assigned within a network, have been assigned in a manner that is inconsistent with the principles in subrule (1) or have been assigned in a manner that is otherwise inappropriate, the System Operator:

(a) must consult with, and consider the views (if any) of, the seed organisation of the network; and

(b) following consideration under paragraph (3)(a), may by written notice request the seed organisation to make reasonable changes to the access flags within the organisation’s network, including by adding, omitting or reassigning access flags.

(4) A notice from the System Operator under paragraph (3)(b) must be consistent with the principles in subrule (1).

(5) A registered healthcare provider organisation must not unreasonably refuse to comply with a request from the System Operator under paragraph (3)(b).

Note: Rule 28 requires seed organisations to structure their network in a manner that allows access flags to be assigned in accordance with the principles in this rule.

Division 5 Access control mechanisms relating to suspension or cancellation of access to a healthcare recipient’s My Health Record