11. Automatic cancellation when a healthcare recipient takes control

(1) The System Operator must automatically cancel access to a healthcare recipient’s My Health Record for all the healthcare recipient’s authorised representatives and nominated representatives upon the earlier of the following:

(a) the healthcare recipient taking control of his or her My Health Record;

(b) the healthcare recipient reaching the age of 18.

(2) A healthcare recipient takes control of his or her My Health Record if:

(a) the System Operator is no longer satisfied that the healthcare recipient has an authorised representative under section 6 of the Act; and

(b) the healthcare recipient has:

(i) verified his or her identity with the System Operator; and

(ii) if the healthcare recipient wishes to access his or her My Health Record online or adjust their My Health Record’s access control mechanisms online – organised his or her own My Health Record log-in details with the System Operator.

(3) Despite paragraph (1)(b), the System Operator must not cancel access to a healthcare recipient’s My Health Record for a person who is an authorised representative under subsections 6(1) or (2) of the Act if the System Operator is satisfied that the person will, when the healthcare recipient reaches the age of 18, be an authorised representative for the healthcare recipient under subsection 6(4) of the Act.

Note: Rule 24 requires the System Operator to verify the identity of a healthcare recipient where the healthcare recipient ceases to have an authorised representative.