5. Default access controls

For the purposes of paragraph 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain default access controls that:

(a) permit all registered healthcare provider organisations involved in the care of a registered healthcare recipient to access the healthcare recipient’s My Health Record;

(b) include an access list of the registered healthcare provider organisations that are permitted to access the healthcare recipient’s My Health Record because the organisation is involved in the care of the registered healthcare recipient;

(c) permit registered healthcare recipients to view the access list for their My Health Record;

(d) remove a healthcare provider organisation from the access list for a healthcare recipient’s My Health Record if the organisation has not accessed the healthcare recipient’s My Health Record for a period of three years;

(e) permit registered healthcare recipients to:

(i) effectively remove records from their My Health Record; and

(ii) authorise the System Operator to restore records which have previously been effectively removed; and

(f) permit registered healthcare provider organisations that uploaded records to a healthcare recipient’s My Health Record to access those records, but only by request to the System Operator, if the healthcare provider organisation is no longer on the access list for the healthcare recipient’s My Health Record.

Note: The extent of access by registered healthcare provider organisations under paragraph (a), and the extent to which they will be omitted from the access list under paragraph (d), depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.

Division 2 Advanced access controls