61. User account management within operators

Operators must ensure that their information technology systems, which are used to access the My Health Record system, employ reasonable user account management practices including:

(a) restricting access to those persons who require access as part of their duties;

(b) uniquely identifying individuals using the operator’s information technology systems, and having that unique identity protected by a password or equivalent protection mechanism;

(c) having password and/or other access mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;

(d) ensuring that the user accounts of persons no longer authorised to access the My Health Record system prevent access to the My Health Record system; and

(e) suspending a user account that enables access to the My Health Record system as soon as practicable after becoming aware that the account or its password or access mechanism has been compromised.

Division 3 Security requirements for portal operators