59. Operator policies

(1) Operators must have a written policy that reasonably addresses the matters specified in subrule (4).

(2) Operators must communicate the policy mentioned in subrule (1), and ensure that the policy remains readily accessible, to all its employees.

(3) Operators must enforce the policy mentioned in subrule (1) in relation to all their employees.

(4) Without limiting the matters an operator’s policy must reasonably address, the policy is, subject to subrule (5), to address the following:

(a) the manner of authorising persons accessing the My Health Record system via or on behalf of the operator, including the manner of suspending and deactivating the user account of any authorised person:

(i) who leaves the operator;

(ii) whose security has been compromised; or

(iii) whose duties no longer require them to access the My Health Record system;

(b) the training that will be provided to operator employees before they are authorised to access the My Health Record system, including in relation to how to use the My Health Record system accurately and responsibly, the legal obligations on operators and individuals using the My Health Record system and the consequences of breaching those obligations;

(c) the physical and information security measures that are to be established and adhered to by the operator, including the user account management measures that must be implemented under rule 61; and

(d) mitigation strategies to ensure My Health Record system-related security risks can be promptly identified, acted upon and reported to the operator’s management.

(5) If in the reasonable opinion of an operator, a requirement in subrule (4) is not applicable to the operator due to the limited size of the operator, the operator’s policy need not address that requirement.

(6) Operators must ensure that:

(a) the policy mentioned in subrule (1) is:

(i) drafted in such a manner that the operator’s performance can be audited against the policy to determine if the operator has complied with the policy; and

(ii) kept up-to-date;

(b) each iteration of the policy contains a unique version number and the date when that iteration came into effect;

(c) without limiting paragraph (6)(a)(ii) – the policy is reviewed at least annually and when any material new or changed risks are identified. The review must include consideration of:

(i) factors that might result in:

(A) unauthorised access to the My Health Record system using the operator’s information systems;

(B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of an operator; and