49. User account management within contracted service providers

Contracted service providers must ensure that their information technology systems, which are used to access the My Health Record system via or on behalf of linked healthcare provider organisations, employ reasonable user account management practices including:

(a) restricting access to those persons who require access as part of their duties;

(b) uniquely identifying individuals using the contracted service provider’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;

(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;

(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system via or on behalf of linked a healthcare provider organisation prevent access to the My Health Record system; and

(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.