8. Serious threat to public health or public safety

(1) The access control mechanisms established and maintained by the System Operator must permit registered healthcare provider organisations to assert to the System Operator that the collection, use or disclose of health information is necessary to lessen or prevent a serious threat to public health or public safety for the purposes of subsection 64(2) of the Act.

(2) Where access is authorised under subsection 64(2) of the Act, the access control mechanisms:

(a) must allow access to a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a record code;

(b) must allow access to all records in a healthcare recipient’s My Health Record regardless of whether a healthcare recipient has set up a document code; and

(c) must not permit access to records that have been effectively removed.

Note 1: Healthcare recipient-only notes are not available under subsection 64(2) of the Act― see subsection 64(3) of the Act.

Note 2: The extent of access by registered healthcare provider organisations under subsection 64(2) of the Act depends on how access flags have been assigned within the healthcare provider organisation’s network ― see rules 9 and 10.

Division 4 Access flags