6. Advanced access controls

(1) For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain advanced access controls that have the same functionality as default access controls and that:

(a) subject to rules 7 and 8, permit use of a record code to prevent registered healthcare provider organisations involved in the care of a registered healthcare recipient from accessing the healthcare recipient’s My Health Record unless:

(i) the record code is given to the organisation by:

(A) the healthcare recipient; or

(B) the System Operator at the request of the healthcare recipient; or

(ii) the organisation is already on the access list for the healthcare recipient’s My Health Record;

(b) if a registered healthcare recipient wishes, prevent registered healthcare provider organisations’ clinical information systems automatically checking and displaying whether the healthcare recipient has a My Health Record;

(c) permit registered healthcare recipients to control access to individual records in their My Health Record:

(i) by adjusting the advanced access controls for their My Health Record to only permit specified registered healthcare provider organisations on the access list for the healthcare recipient’s My Health Record to access specified records; or

(ii) using a document code,

in accordance with subrule (2); and

(d) permit registered healthcare recipients to be alerted by means of an electronic communication when their My Health Record is accessed by a third party.

(2) For the purposes of paragraph (1)(c), the System Operator must ensure that:

(a) registered healthcare recipients are able to prevent access to a record in their My Health Record, other than shared health summaries, healthcare recipient-entered health summaries and advance care planning information, unless:

(i) the registered healthcare provider organisation has been given a document code in relation to the record by:

(A) the healthcare recipient; or

(B) the System Operator at the request of the healthcare recipient; or

(ii) the healthcare recipient has set the advanced access controls for their My Health Record to permit the registered healthcare provider organisation, which is on the access list for the healthcare recipient’s My Health Record, to access the record;

(b) where a healthcare recipient has restricted access to a record using the access controls in paragraph (1)(c):

(i) the record will still be accessible to the registered healthcare provider organisation that uploaded the record to the My Health Record system, without the need to use the healthcare recipient’s document code;