WIXLIB

OrganisationReadiness ChecklistThis checklist supports healthcare organisations to registerand use My Health RecordAbout My Health RecordWhat is My Health Record andwhat are the benefits?My Health Record website, benefits for providers, YouTube case studies,webinars.Information on uploading, viewing and organisation registration.Online education about PRODAand HPOSProvider Digital Access (PRODA) provides secure access to onlinegovernment services. Access online PRODA education.Health Professional Online Services (HPOS) is a fast and secure way forhealth professionals and administrators to do business with ServicesAustralia. Access online HPOS education.Information required to register an organisation for My Health RecordBusiness ABN/ACNResponsible officer (RO)Trading nameOrganisation maintenanceofficer/s (OMO)Street addressMobile phonePostal address(to receive PIC code via SMSfor NASH PKI Certificate)EmailOrganisation typeCheck options on theServices Australia websiteImportant numbersHealthcare Provider Identifier –Organisation (HPI-O)The HPI-O identifies the healthcare provider organisation where healthcareis provided. It is available once the organisation has completed the onlineregistration process for the Healthcare Identifiers Service (HI Service).Healthcare Provider Identifier –Individual (HPI-I)An HPI-I identifies an individual healthcare provider. Ahpra-registeredhealth professionals can locate their HPI-I by accessing their account viathe Ahpra website or by calling HI Service (1300 419 495). Non-Ahpraregistered health professionals can apply for a HPI-I online via HealthProfessional Online Service (HPOS).PAGE 1

OrganisationReadiness ChecklistResponsible officer (RO) and organisation maintenance officer (OMO)Healthcare Provider Identifier –Organisation (HPI-O)Understand My Health Record roles and responsibilities including RO andOMO. The RO and OMO(s) are responsible for ensuring the steps in thisdocument are reviewed for their organisation. Each organisation can haveonly one RO but can have multiple OMOs. Make a record of the individualswho are the RO and OMO(s) in the organisation’s My Health Record securityand access policy or other appropriate place.If a change in RO is required, submit application to replace the RO for anorganisation with an existing HPI-O.OMO and/or RO registers fora PRODA account and selectsHPOSRO or OMO creates or signs into a PRODA account and clicks on HealthProfessional Online Services (HPOS) from the list of services.Nominating the OMO(s)Once the organisation is registered for My Health Record, ensure theperson responsible for the day-to-day administration of the organisation isnominated as an OMO in HPOS.OMOs can be added, removed or changed via HPOS as required.Policies and educationMy Health Record security andaccess policyIt is a legislative requirement that a My Health Record security and accesspolicy be implemented as described in the My Health Records Rule 2016.My Health Record policy templates are published by The Royal AustralianCollege of General Practitioners (RACGP), the Pharmaceutical Society ofAustralia and on the My Health Record website.RO and OMO ensures that a process is in place for auditing when staff haveaccessed My Health Record in the event of a breach investigation.National AuthenticationService for Health Certificatefor Healthcare ProviderOrganisations Public KeyInfrastructure (NASH PKI)Certificate PolicyUnder the National Authentication Service for Health Public KeyInfrastructure Certificate for Healthcare Provider Organisations Terms andConditions of Use, healthcare organisations using a NASH PKI are requiredto have policies and procedures in place governing use of the NASH PKICertificate. Full details are available on the Services Australia website. Atemplate NASH PKI Policy is available on the My Health Record website.Recognise privacy and securityobligationsBoth the My Health Record website and the Australian Digital HealthAgency Cyber Security Centre website hold information and resources tooptimise privacy and security for My Health Record and other healthcaresystems.Information regarding ongoing participation obligations are available on theMy Health Record website.Staff completed My HealthRecord trainingInternal My Health Record training is provided to organisation staff anda register of this training is maintained. See Recommended TrainingChecklist.PAGE 2

OrganisationReadiness ChecklistRegistering the organisation via HPOSRegister seed organisationfor the Healthcare IdentifiersService (HI Service) and MyHealth Record via HPOS. A seedorganisation is a legal entity thatprovides or controls the deliveryof healthcare services withinAustralia.My Health Record registration step by step guides are on the My HealthRecord website and the HPOS website.A network organisation is a subentity of a seed organisation thatprovides healthcare services.If required, register networkorganisations.If your organisation decides to register one or more network organisationsfollow these steps to add organisation(s) to create a network organisationunderneath the seed. You will be instantly provided with the new HPIOs of the network organisations created. Then follow these steps toregister these networks to access the My Health Record system. Eachnetwork organisation requests a separate NASH PKI certificate. Networkorganisations are asked to set access flags when registering the networkorganisation for My Health Record. There is more information about accessflags on the My Health Record website and in Division 4 of the My HealthRecords Rule 2016. Access flags allow networks to either inherit theirparent organisation's access (flag set to ‘no’) or have access separate fromtheir parents organisation's access (flag set to ‘yes’). A seed organisation isalways set to ‘yes’.The RO completes the registration request by accessing HPOS via PRODA.Follow these steps if you have had a change of ownership.To amend organisation details including updating the personal details of anRO or OMO and to deactivate, reactivate and retire an HPI-O use HPOS orthese forms.For further advice contact the HI Service on 1300 361 457.For further support regarding network organisations, contact the HIService.RO or OMO signs into their HPOSMessagesRO logs into HPOS and checks their HPOS Messages for the messagethat contains the HPI-O, details of the RO and OMO and how to apply for aNASH PKI Certificate when using conformant software to access My HealthRecord.Applying for a NationalAuthentication Service for HealthPublic Key Infrastructure (NASHPKI) Certificate for HealthcareProvider Organisations for usingconformant software to accessMy Health RecordRO or OMO logs into HPOS via PRODA and requests a NASH PKI Certificate.Ensure a mobile phone number is entered when prompted, to receive anSMS with the personal identification code (PIC) to download the NASHwithin 30 days.Once downloaded, the name of the NASH file is ‘Site’, which can berenamed ‘NASH’ once downloaded and the NASH PKI can be reused until itexpires.RO and OMO should plan for applying for, and installing, a new NASH withthe support of the software vendor at the expiry date. Certificates arevalid for 2 years and your organisation will be notified 6 weeks prior to acertificate expiring. If you downloaded the certificate from HPOS, you cancheck the expiry date on the HI Service Certificates tab.If the NASH PKI has expired or cannot be accessed, revoke the previousNASH PKI Certificate first and then request a new NASH PKI Certificate viaHPOS.Linking existing MedicarePKI Certificate, if required bysoftware providerCheck with the software provider whether a Medicare PKI Site Certificateis required for the HI Service and My Health Record. RO or OMO logs intoHPOS via PRODA and links existing Medicare PKI Certificate.If your organisation does not have a current Medicare PKI Site Certificatebut will be using conformant software, request a Medicare PKI Certificatevia HPOS or via the HW001 form.PAGE 3

OrganisationReadiness ChecklistLinking HPI-Is to HPI-O in HPOSis required for National ProviderPortal, and some softwareIt is a legislative requirement for organisations to maintain a list ofemployees authorised to access My Health Record. For those organisationsusing the National Provider Portal, the RO and/or OMO links all HPI-Is to theHPI-O via HPOS to allow appropriate individuals access to the HI Serviceand My Health Record. If using conformant software, check with thesoftware provider whether this step is required.If using software using acontracted service provider(CSP) (e.g. Aquarius, MMEx) thenlink HPI-O to CSP NumberRO/OMO links HPI-O to CSP number, which is provided by the CSP softwarevendor, in both the CSP Links tab and added under Manage CSP Links inHPOS.Is your software My HealthRecord Conformant? If not, youcan use the National ProviderPortal.Follow these step-by-step instructions to register the organisation andindividuals for the National Provider Portal. Click here to access theNational Provider Portal online or via PRODA.Software configurationCheck with the software vendoron whether a list of HPI-Is isrequired to be available forconfiguring the software. e.g.Most pharmacy software doesnot require this.Linking HPI-Is to HPI-O in HPOSis required for National ProviderPortal, and some software.The software vendor will support with configuring software. As part of thisset-up, all HPI-Is of staff using My Health Record may be required to beentered into the software for setting up access.For those organisations using the National Provider Portal, the RO and/orOMO links all HPI-Is to the HPI-O by managing HPI-I authorisation links. Ifusing conformant software, check with the software provider whether thisstep is required.NASH and Medicare PKICertificates to be configuredinto software as required by thesoftware vendorCall your software vendor or IT Support to arrange configuration support.Confirm HPI-O and HPI-Inumbers have been configuredinto softwareContact your software vendor or IT Support for configuration support.Software settings are updatedto ensure permission for staffaccessing My Health RecordContact your software vendor or IT Support for My Health Recordconfiguration support. Staff will require relevant viewing/uploadingpermissions enabled for My Health Record and Electronic Transfer ofPrescriptions.Check if conformant softwarecan access My Health RecordContact software vendor if there are connection errors or IndividualHealthcare Identifier (IHI) errors.Organisation has an electronictransfer of prescriptions productinstalled (if required)Set up Electronic Transfer of PrescriptionsWhen staff leave, close their user accounts. Unlink HPI-Is from theorganisation via HPOS as required.eRx Script Exchange (1300 700 921) or MediSecure (1800 472 747)PAGE 4