44. User account management within healthcare provider organisations

Healthcare provider organisations must ensure that their information technology systems, which are used by people to access the My Health Record system via or on behalf of the healthcare provider organisation, employ reasonable user account management practices including:

(a) restricting access to those persons who require access as part of their duties;

(b) uniquely identifying individuals using the healthcare provider organisation’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;

(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;

(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of the healthcare provider organisation prevent access to the My Health Record system; and

(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.