9. Access control mechanisms must include use of access flags

For the purposes of paragraphs 15(b) and (c) and subsection 109(6) of the Act, the System Operator must establish and maintain access control mechanisms that comply with the following requirements:

(a) access flags must be used to determine which additional registered healthcare provider organisations (if any) are to be:

(i) added to the access list for a healthcare recipient’s My Health Record where a registered healthcare provider organisation accesses the healthcare recipient’s My Health Record in accordance with default access controls, advanced access controls or in the case of a serious threat to an individual’s life, health or safety; and

(ii) omitted from the access list for a healthcare recipient’s My Health Record where a healthcare provider organisation ceases to be on the access list;

(b) access flags must be set and maintained for a registered healthcare provider organisation in the context of the organisation’s network;

(c) the responsible officer and/or the organisation maintenance officer of a registered healthcare provider organisation that is the seed organisation within a network must be responsible for setting and maintaining the access flags for the registered healthcare provider organisations within the seed organisation’s network; and

Principles for setting and maintaining access flags

(d) access flags must be set and maintained in accordance with the principles in rule 10.

Note: A network consists of a seed organisation and one or more network organisations― see subsection 9A(4) of the Healthcare Identifiers Act 2010. A network organisation may, but is not required to, be part of the same legal entity as its seed organisation or be a related body corporate of its seed organisation. There can be one or more healthcare provider organisations within a single legal entity.