45. Retention of record codes and document codes

Healthcare provider organisations must ensure that people using their information technology systems to access the My Health Record system via or on behalf of the organisation do not record, store or retain a copy of a healthcare recipient’s record code or document code for the purposes of accessing the healthcare recipient’s My Health Record, or a record in the healthcare recipient’s My Health Record, in the future.

Note: Where a record code or document code is used to access a My Health Record or a record in a My Health Record, the code is not stored in the healthcare provider organisation’s clinical information system. For example, using a record code places the organisation on the access list for the healthcare recipient’s My Health Record, and information about this permitted access is stored by the System Operator. It will not be necessary for a healthcare provider organisation to enter the record code each time access is needed to the same healthcare recipient’s My Health Record, provided the organisation remains on the access list for the healthcare recipient’s My Health Record.

Division 4 Security requirements for contracted service providers