Getting started – a guide for general practice staff

If your practice is using My Health Record, there are certain participation requirements that all relevant members of your team will need to be aware of. Prior to registering to participate in the My Health Record system, your organisation will need to establish a security and access policy.

My Health Record Security and access policy

A My Health Record security and access policy template has been developed by the Office of the Australian Information Commissioner (OAIC), in collaboration with the Australian Digital Health Agency, to assist you and your team in developing a suitable policy for your practice.

The Australian Digital Health Agency also provides a security and access policy checklist to ensure that your practice’s policy addresses the requirements of Rule 42 of the My Health Records Rule.

This policy should be reviewed annually, at a minimum, and when any material, new or changed risks are identified.

Merely having a Security and Access policy is not sufficient to ensure the security and integrity of the My Health Record system and the information it contains. Healthcare provider organisations must actively communicate and enforce their Security and Access policy in relation to all employees and any healthcare providers to whom the organisation supplies services under contract. For further guidance on Rule 42, visit the OAIC’s website.

To participate in My Health Record, all healthcare organisations must first register with the Health Identifiers Service (HI Service). The HI Service is a national system for identifying healthcare providers, healthcare organisations and individuals receiving healthcare.

Healthcare organisations will either apply to register as a Seed Organisation (a standalone organisation, such as an independent general practice) or a Network Organisation (a subordinate department/division within a large organisation, such as a general practice with multiple sites). Most general practices would be registered as a Seed Organisation.

To register with the HI Service, your practice will need to nominate:

• a Responsible Officer (RO) who holds authority to act on behalf of your practice in its dealings with the System Operator of My Health Record. A person listed on the Australian Business Register for the business is typically nominated for this role. An organisation can only have one RO nominated in the HI service at a time.
• an Organisation Maintenance Officer (OMO) who holds authority to act on behalf of your practice in its day-to-day administrative dealings with the HI Service and My Health Record. Your practice manager or a senior staff member who is familiar with your practice’s clinical and administrative systems are appropriate fits for this role. Your organisation can nominate multiple OMOs in the HI Service system for the practice.

Steps on how to Register an Organisation with the HI Service (obtain HPI-O) can be found on the Australian Digital Health Agency’s website.

Once you have registered with the HI Service, your practice will receive a unique 16-digit number called a Healthcare Provider Identifier for Organisations (HPI-O).

For more information on managing the responsible officer (RO) and organisation maintenance officers (OMO) details in the Healthcare Identifiers (HI) Service, visit the Services Australia website.

Access via a Clinical Information System

You can access, view and upload information to a patient's My Health Record through your practice’s clinical information system (CIS) if it conforms to the requirements of the Australian Digital Health Agency, as the System Operator for My Health Record. A full list of conformant software products is available on the Agency website. 

CISs are linked to the My Health Record system either via a National Authentication Service for Health (NASH) certificate or a Contracted Service Provider (CSP) number. Find out how to connect to My Health Record through your practice’s CIS by contacting your software provider.

NASH certificates can be requested via HPOS. For more information, visit the Australian Digital Health Agency’s National Authentication Service for Health webpage. You can also download step-by-step instructions about how to Request or renew a NASH PKI Certificate.

CSP numbers are provided by your CIS vendor and linked via HPOS. Follow the steps in the Agency’s guide for Contracted Service Provider Linking in HPOS.

Once you have completed either the NASH or CSP linking process, contact your software provider to access support to appropriately configure your healthcare identifiers and certificates.

Access via the National Provider Portal

Alternatively, clinicians are able to view a My Health Record without a clinical information system through the National Provider Portal (NPP). You cannot upload documents to a My Health Record using the National Provider Portal. 

Where possible, it is recommended that My Health Record is accessed via your conformant clinical software, as it does not require an additional log in and is a better user experience.  For further information on how to set up access to My Health Record using either a CIS or NPP, visit the Agency’s website. 

All members of your practice team who use My Health Record must receive initial and ongoing training on the appropriate collection, use and disclosure of My Health Record information. General practices are legally obligated to provide staff members with My Health Record training before they are authorised to access My Health Record. Each user must be aware of both organisational and individual legislative obligations specific to the My Health Record system.

*Note, it is not appropriate to use a staff member or a patient's My Health Record for training purposes. The Australian Digital Health Agency has training simulators which provide self-paced learning and demonstrations of each of the software systems.

RACGP training resources

The RACGP has developed an education kit titled Introduction to My Health Record in General Practice to assist practices in meeting their training obligations.

The education kit can be worked through as a self-directed learning activity and covers:

• how to use the My Health Record system correctly and responsibly
• the legal obligations on healthcare provider organisations and individuals using the My Health Record system
• the consequences of breaching those obligations.

The education kit takes approximately one hour to work through. GPs can self-report this activity for the equivalent of 1 hour of CPD.

Your practice must comply with several ongoing My Health Record participation requirements, including:

• providing care to patients, regardless of whether they have a My Health Record or not
• ensuring information uploaded to My Health Record is accurate and up to date
• keeping the details of your practice’s RO and OMO up to date
• having a process in place to ensure that clinical information is not uploaded to the My Health Record system in cases where a patient has specified that they do not want their information to be uploaded
• annual review of your practice's My Health Record security and access (Rule 42) policy
• ensuring appropriate notification of data breaches where required.

Further information about the ongoing My Health Record participation obligations can be found here.

The Australian Digital Health Agency have also released guidance for coducting an Annual My Health Record health check for registered healthcare provider organisations to help ensure your practice complies with relevant legislative obligations and can be contacted by the System Operator when required.