47. Contracted service provider policies

(1) Contracted service providers must have a written policy that reasonably addresses the matters specified in subrule (4).

(2) Contracted service providers must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.

(3) Contracted service providers must enforce the policy mentioned in subrule (1) in relation to all its employees.

(4) Without limiting the matters a contracted service provider’s policy must reasonably address, the policy is, subject to subrule (5), to address the following:

(a) the manner of authorising persons accessing the My Health Record system via or on behalf of the contracted service provider’s linked healthcare provider organisation, including the manner of suspending and deactivating the user account of any authorised person:

(i) who leaves the contracted service provider;

(ii) whose security has been compromised; or

(iii) whose duties no longer require them to access the My Health Record system on behalf of a linked healthcare provider organisation;

(b) the training that will be provided to contracted service provider employees before they are authorised to access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on contracted service providers and individuals using the My Health Record system and the consequences of breaching those obligations;

(c) the physical and information security measures that are to be established and adhered to by the contracted service provider, including the user account management measures that must be implemented under rule 49; and

(d) mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the contracted service provider’s management.

(5) If in the reasonable opinion of a contracted service provider, a requirement in subrule (4) is not applicable to the provider due to the limited size of the provider, the provider’s policy need not address that requirement.

(6) Contracted service providers must ensure that:

(a) the policy mentioned in subrule (1) is:

(i) drafted in such a manner that the provider’s performance can be audited against the policy to determine if the provider has complied with the policy; and

(ii) kept up-to-date;

(b) each iteration of the policy contains a unique version number and the date when that iteration came into effect;

(c) without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified. The review must include consideration of: