Assisted Registration - Guide for healthcare providers
This guide is for Healthcare provider organisations participating in the My Health Record system that wish to assist patients to register for a My Health Record.
Assisted Registration is a way for you to help individuals register for a My Health Record. You do this by submitting their details to the My Health Record System Operator (System Operator) using compatible software. When you do this you are also confirming that you have checked their identity and obtained their consent to being registered and having their health information uploaded to their My Health Record. If successful, the individual will be registered almost immediately and you will be able to upload clinical information about the individual to their My Health Record straight away.
A healthcare provider organisation providing Assisted Registration does not do so as an agent of the System Operator.
Any person who is 14 years or older who wants to register themselves and/or their child under 18 years old can register through Assisted Registration. An adult who does not have capacity cannot be registered through Assisted Registration (this means that a person acting on behalf of someone over 18 who does not have capacity cannot register them through Assisted Registration).
Individuals can register through these other channels:
- online at My Health Record website
- by phone – 1800 723 471
- through a Medicare Service Centre
- by mail – application forms are available from Medicare Service Centres and online at My Health Record website
Benefits of Assisted Registration
Assisted Registration was developed so that individuals could register for a My Health Record with support from healthcare provider organisations involved in their care and whose guidance they trust. By providing Assisted Registration in a point-of-care setting you can help your patients sign up for a My Health Record before they leave your practice, and your organisation will be able to immediately begin uploading health information to their My Health Record. Assisted Registration can also be provided at non-point‑of-care settings and, as a registered healthcare provider organisation, you can help individuals register for a My Health Record despite not being directly involved in their care.
To learn more about the benefits of the My Health Record system for individuals and healthcare providers, please visit benefits of having a My Health Record page or call the help line on 1800 723 471.
The legal obligations involved in providing Assisted Registration are set out in the My Health Records Rule 2016, , and the My Health Records (Assisted Registration) Rule 2015. This guide provides information on how to comply with these rules.
In addition to this guide there is:
- A readiness checklist
- Identification framework
- Application to register forms
- Essential information
Note on terminology
This guide refers to a patient and an individual interchangeably. They have the same meaning, which is an individual who has received, is receiving or may receive healthcare. The term individual is also used to refer to a parent applying to register a child for a My Health Record.
Any reference in this guide to parent refers to a person who has parental responsibility for a child.
Note on privacy
It is important that you are aware of your organisation’s privacy obligations under the Privacy Act 1988 or the privacy law of your state or territory, depending on the nature of your organisation. If your organisation chooses to provide Assisted Registration, it must do so in a manner that complies with its privacy obligations. If your organisation contracts another organisation to provide Assisted Registration on its behalf, it must take steps (such as contractual measures) to ensure that the other organisation handles personal information consistently with your organisation’s privacy obligations.
‘Steps for getting ready to provide assisted registration to your patients’
This section outlines the steps your organisation needs to take before it can begin providing Assisted Registration to individuals.
To offer Assisted Registration your organisation must:
- be registered to participate in the My Health Record system;
- install Assisted Registration software;
- develop and implement Assisted Registration policies as required under the My Health Records Rule 2016 (paragraph 42(4)(f) refers);
- have internet connectivity.
Healthcare provider organisations need to register with the System Operator in order to participate. If you are unsure about the registration requirements for your organisation, refer to Participating in the Personally Controlled Electronic Health Record system: a registration guide for healthcare organisations, available at My Health Record website. You can also call the help line on 1800 723 471.
Assisted Registration software is available in two forms:
- embedded in practice software, or
- a stand alone Assisted Registration Tool.
Since early 2013 practice software vendors have been updating their products to include Assisted Registration functionality. This has the benefit of integration with local systems so that time used in transcription of patients’ details can be reduced. Contact your software provider for information.
To obtain the Assisted Registration Tool your organisation’s Organisation Maintenance Officer (OMO) or Responsible Officer (RO) needs to send an email to Myhealthrecord.AssistedReg@health.gov.au and provide their full name, email address, contact phone number and the organisation’s name and HPI-O certificate details.
Privacy Collection Notice:
- If you are an Organisation Maintenance Officer (OMO) or Responsible Officer (RO) and you contact us to obtain the Assisted Registration Tool for your organisation, we will collect your personal information from you, including your name and contact details. We will also collect form you your organisation’s name and Healthcare Provider Identifier- Organisation (HPI-O) certificate details, which may contain personal information such as an individual’s name.
- We will collect, use and disclose this personal information for the purposes of verifying you as an OMO or a RO of the relevant organisation and to confirm that the organisation is registered to participate in the My Health Record System.
- Without this information your organisation will not be able to obtain the Assisted Registration Tool.
- As part of verifying your identity and your organisation, we will disclose the personal information to the Healthcare Identifiers Service Operator.
- The collection, use and disclosure of this personal information to provide your organisation with the Assisted Registration Tool is authorised under the My Health Records Act 2012, Healthcare Identifiers Act 2010 and Privacy Act 1988.
- We will not disclose personal information about you or others in your organisation overseas.
- We can be contacted, by calling 1800 723 471 (select option 1), by visiting your nearest Medicare service centre and by writing Privacy Officer, My Health Record system, GPO Box 9942, (In Your Capital City).
All registered healthcare provider organisations must develop, maintain and enforce a My Health Record system policy that addresses matters specified in rule 42 of the My Health Records Rule 2016, such as security mechanisms and access to individuals’ My Health Record.
Organisations that choose to provide Assisted Registration must also develop, maintain and enforce an Assisted Registration policy that addresses the four matters specified in subrule 42(4) of the My Health Records Rule 2016. These are set out in detail below.
The policy must be in writing and drafted in a way that it can be used (by your organisation and potentially by the System Operator) to determine whether your organisation has followed that policy. It is recommended that the policy reference other policies or processes of your organisation if they are relevant to its compliance with privacy or security requirements.
Your organisation must keep its policy up to date and review it at least once a year. This review must take account of any new risks or incidents that are identified, or changes to the system.
Each version of the policy must be identifiable and must be retained by your organisation. The System Operator may, at any time, request a copy of a particular policy from your organisation. If the System Operator considers that your policy does not reasonably address the matters specified in the My Health Records Rule 2016, it may affect your registration.
The policy must address the following four themes.
- How your organisation will authorise its employees to provide Assisted Registration
The policy must describe how employees will be selected and authorised to provide Assisted Registration, and who is responsible for this selection and authorisation. This includes specifying the person who is responsible for making these decisions, and how they record that decision. It should also specify how and in what circumstances they will decide to suspend or cancel the authorisation of an employee, and how that decision will be recorded.
It is recommended that your policy describe eligibility requirements for an employee to be authorised to provide Assisted Registration to a patient, including specific training (see 2) and security clearance.
You may consider authorising employees to undertake very specific tasks in relation to Assisted Registration which are tailored to their roles. For example, you might authorise front-of-house staff to provide Assisted Registration information to patients and verify patients’ identities, and you might authorise clinicians to submit the applications.
The term employee recognises contractors and other persons who provide services to an organisation regardless of whether they are remunerated for those services including medical students and volunteer workers.
- What training will be provided before an employee is authorised to provide Assisted Registration
The policy must describe the nature of training that an employee must undergo before being authorised to provide Assisted Registration to individuals. It should also specify who is responsible for providing training, and how training will be provided.
Training must be provided on the following matters:
- process – providing the necessary material to the individual and how your organisation will approach and treat patients, including vulnerable patients, patients who may need culturally appropriate approaches and patients who speak English as a second language;
- information – (before the application process begins) providing information to patients about Assisted Registration, the My Health Record system and how their personal information will be used. It should include steps to ensure the individual has sufficient time to understand and ask questions and to complete the application form (if your organisation is using one), and ensuring that the patient’s consent is fully informed;
- software – how to use the Assisted Registration Tool or equivalent software;
- privacy and security – the handling of the applications during the process and once processing is complete, in particular how the forms are secured (if your organisation is using them) and how the patient’s personal information is protected;
- handling of records – whether the organisation will store signed forms or alternative records of consent, and why, instead of disposing of them;
- Identity Verification Code (IVC) – the handling of IVCs, in particular whether your organisation will provide patients with the option of receiving these through your organisation, or have it sent directly to their email or mobile phone (if they choose);
- identification – your organisation’s policy for identifying an individual and exercising reasonable care in identifying the individual, in particular which process/es must be used and if there is a particular employee who has the authority to deal with unexpected identification questions (see 4).
You should also consider providing some form of training in respect of your organisation’s privacy obligations, legislative obligations and security obligations.
In developing this policy you should consider the setting/s in which your organisation will provide Assisted Registration (such as in the clinic or offsite), how applications will be processed (such as submitted immediately or within a certain number of days), and tailor the training as necessary. Consideration should also be given to how these arrangements may affect the risk of compromising your organisation’s security measures.
It is not sufficient to train an employee only in the use of the Assisted Registration Tool or equivalent software.
- How your organisation will confirm consent of an individual
Your organisation is required to obtain the individual’s consent. Consent is for:
- your organisation to assist the individual in making the application; and
- healthcare provider organisations to upload to the My Health Record system any record that includes health information about the individual.
As required by the My Health Records Rule 2016, if your organisation decides to use the paper form, the policy must describe whether;
- your organisation will immediately and securely dispose of the paper once the information is uploaded; or
- your organisation will securely store the paper form, in line with your organisation’s record retention policy.
Please note, disposal does not only relate to paper forms. Any electronic records of consent, e.g. PDF of form, must also be disposed of if not otherwise required.
- How authorised employees will identify an individual for the purposes of Assisted Registration
It is essential that the individual is correctly identified. Your organisation could do this by one of the following:
- individual presents for a consultation and has presented on at least three occasions (inclusive of the presentation at which Assisted Registration is being provided) and the Medicare or DVA card is sighted;
- by meeting another of the ‘Known Customer Models’ (the ‘Known Customer Model’ can be found on healthcare providers page); or
- by providing 100 points of Documentary Evidence of Identity.
Your organisation must ensure that the details of the individual as contained in their identity document(s) correspond with the individual’s details as recorded by your organisation’s system. You should sight the relevant documents, and note in the local records which documents were sighted, but should not take copies of the documents or record the document numbers.
The authorised employee who is conducting Assisted Registration is not to register an individual if the employee is not satisfied about the identity of the individual.
If your organisation chooses to provide Assisted Registration it must do so in a manner that complies with your privacy obligations. In order to do this you must be aware of your organisation’s privacy obligations under the Commonwealth’s Privacy Act 1988 or the privacy law of your state or territory, depending on the nature of your organisation (i.e. whether it is a private or public organisation). If your organisation contracts another organisation to provide Assisted Registration on your behalf, you must take steps (such as contractual measures) to ensure that the other organisation handles personal information consistently with your organisation’s privacy obligations.
If you’re uncertain of your privacy obligations, you can find helpful guidance on the Office of Australian Information Commissioner's website on: Rights and responsibilities page and on Health service providers page
If your organisation chooses to collect personal information from an individual other than that specified in the Assisted Registration application form, you will have to explain to them (in accordance with your privacy obligations) why the information is being collected and how it will be used.
Your organisation must also be mindful of the special privacy needs of individuals who may be regarded as particularly vulnerable, such as older persons, persons in aged care settings, persons attending a hospital, persons with a physical or mental disability, or persons requiring culturally appropriate approaches to advising them about Assisted Registration, such as those attending Aboriginal community controlled health organisations and those who speak English as a second language.
‘How to provide assisted registration to your patients’
Application and consent
When an authorised employee approaches a patient for Assisted Registration, the authorised employee needs to comply with their privacy obligations. The organisation’s privacy obligations will depend on the type of organisation it is – for example, a private sector healthcare provider organisation will be subject to the Australian Privacy Principles (under the Privacy Act 1988 (Cth)). If you’re unsure of your organisation’s privacy obligations, go to rights and responsibilities page and other privacy jurisdictions page.
Your organisation must:
- give the individual a copy ofthe Essential Information document to read. This document provides information the individual needs to know before they give their consent to being registered and, where necessary, consent to having their health information uploaded to their My Health Record.
- obtain the individual’s consent of the individual by either:
- using the application form Assisted Registration: Application to register for a My Health Record, if your organisation has decided to use forms; or
- seeking verbal agreement.
Your organisation is required by the My Health Records (Assisted Registration) Rule 2015 to inform the individual that they may apply to register for a My Health Record through other channels: at a Medicare office Service Centre, by telephone, in writing or online.
You should also give the individual some guidance about:
- how long they have to consider the information you have provided to them;
- how long they have to provide the information required to apply;
- the time your organisation will take to submit their application.
It is important when an individual applies that you obtain their informed consent. This means that the individual understands why their personal information will be collected by you and how this information will be used. They must know they will be registered for a My Health Record as a result of this process and that registered healthcare provider organisations will be permitted to upload the individual’s health information to the individual’s My Health Record. This consent must be given voluntarily and can only be given by an individual with the capacity to understand and communicate their consent. If the individual has any questions and your organisation is unable to answer them, the Assisted Registration must not proceed because consent obtained in this circumstance may not be regarded as informed consent.
Personal information and consent can only be collected using ‘fair means’. This means you cannot intimidate or deceive the individual or be unreasonably intrusive to obtain the individual’s personal information and consent for Assisted Registration purposes. For example, you should not collect personal information and consent:
- from an individual who is vulnerable (such as someone who appears stressed or distracted), traumatised or intoxicated;
- in a manner that disrespects the individual’s culture; or
- by misrepresenting the purpose of the collection or the consequences of not providing the information.
You must also be mindful of the unique privacy needs of certain individuals who may be regarded as particularly vulnerable, such as older persons, persons in aged care settings, persons attending a hospital (such as the emergency department), persons with a physical or mental disability, or persons requiring culturally appropriate approaches to advising them, Aboriginal and Torres Strait Islanders and those who speak English as a second language.
If your organisation chooses not to process the application while the individual is present, you need to consider how your organisation will contact the individual if their application is unsuccessful. If, for example, you want to collect the individual’s telephone number for this purpose, you must inform them of the reasons so they can make an informed decision as to whether or not to give that information to you.
Assisted Registration cannot be offered to everyone. An individual can only apply through Assisted Registration if:
- the individual is at least 14 years old and is applying to register themselves; or
- the individual is applying to register a child (under 18 years) for whom the individual has parental responsibility.
Assisted Registration cannot be used to register:
- another person for whom an individual has legal authority (for example, an adult without capacity); or
- an individual who wants to register using another name (i.e. a name that differs from the name on their Medicare card such as a de facto surname or preferred given name) or pseudonym (i.e. a different identity for which they have been issued a Pseudonymous Individual Healthcare Identifier by the Healthcare Identifiers Service Operator).
Once the individual has indicated they want to be registered for a My Health Record, the authorised employee will need to verify the identity of the individual.
The authorised employee must first ensure the individual is eligible to apply through Assisted Registration.
Next, the authorised employee must determine whether the individual is a known customer of your organisation in accordance with your organisation’s policy. The authorised employee must take reasonable care in identifying the individual and be satisfied that the individual is the person whose identity is to be asserted to the System Operator.
When checking the identification of the individual, the authorised employee must ensure that the personal details provided by the individual match the individual’s details as recorded by your organisation. These details include the patient’s surname, first name, sex, date of birth, and Medicare number. The authorised employee must also check that the individual’s name matches that on their Medicare card (i.e. spelling of name).
Your organisation should sight the relevant documents but should not take copies or record the document number unless it is necessary for another purpose of your organisation.
If the authorised employee is not satisfied as to the identity of the individual, regardless of whether the individual meets any prescribed criteria, the employee should not proceed with the Assisted Registration process.
An individual with parental responsibility for a child under 18 years can register the child through assisted registration. The individual making the application must assert they have parental responsibility for the child and:
- the child must be listed on the Medicare card of the individual applying; or
- the healthcare organisation must support the person’s assertion of parental responsibility. (Note this functionality is not available in the Assisted Registration Tool and is only available in some versions of software vendor products.)
The organisation may choose to support an assertion of parental responsibility if the parent and child are not listed on the same Medicare card. Support from a healthcare provider organisation about the individual’s parental responsibility recognises that healthcare provider organisations have established relationships with patients and, as part of providing treatment to a child, make decisions about a person’s authority to act on behalf of a child.
Support for a person’s assertion of parental responsibility is voluntary. The length and type of relationship healthcare providers have with their patient may affect whether or not they choose to provide this assertion. For example an organisation which has had a relationship with a family over a number of years may consider they can support an individual’s assertion of parental responsibility, but may not be confident in providing this assertion for someone presenting for the first time.
The child does not need to be present for the Assisted Registration process.
The authorised employee must enter the required information about the individual (and in relation to an application for a child, the required information about the child) into the Assisted Registration Tool or equivalent software. Once entered, the authorised employee will need to assert that they are satisfied as to the identity of the individual. This will be transmitted to the System Operator who will decide whether to register the individual.
‘After care steps of assisted registration with your patients’
The My Health Record system will send a message back to you via the Assisted Registration Tool or equivalent software advising if the registration has been successful.
If the application is successful, the System Operator will send the individual’s Identity Verification Code (IVC) in the manner elected by the individual (text message, email or through your organisation). This should happen almost immediately. If the individual has elected to receive their IVC through your organisation, the authorised employee will need to print this out for the individual, along with instructions on how the individual can access their My Health Record online. These instructions will be provided by the System Operator with the IVC.
If the application is unsuccessful, the individual may apply through other registration channels, such as online at My Health Record website or by phone on 1800 723 471.
Note: If the software reports that it cannot identify the individual’s healthcare identifier, the most likely reason is that the information submitted does not match the records held by the Medicare. If the authorised employee has confirmed that there are no data entry errors, the individual should be advised that they may need to confirm their details with Medicare.
Identity Verification Code
When an individual registers for a My Health Record (other than online), the individual is given an IVC to allow them to set up online access to their record online.
In Assisted Registration, the individual can elect to receive their IVC by:
- text message – to the mobile phone number elected by the individual;
- email – to the address elected by the individual; or
- through your organisation – in this case the System Operator will send the IVC directly to your organisation via the software, and the authorised employee must provide it to the individual.
Your organisation may choose not to offer option 3, in which case you must clearly provide other options to the individual.
Regardless of the option chosen, if an application is successful an IVC will be provided by the System Operator almost immediately after the authorised employee has completed the Assisted Registration process.
If a parent already has an IVC or online access to their own or another person’s My Health Record, the parent does not need to request an IVC in a child’s application. This is because the parent will be able to create a link to the child’s record using the IVC or online access they already have.
An IVC is valid for 30 days after it has been issued. If it expires before the individual uses it, or if the individual elected not to receive an IVC and has changed their mind, the individual can request a new IVC by calling the help line on 1800 723 471 or visiting a Medicare Service Centre.
An individual may choose not to receive an IVC if they don’t want online access.
Audit and compliance
The System Operator may, with reasonable notice to the organisation, request assistance in relation to any inquiry, investigation or complaint regarding the My Health Record system.
The System Operator will conduct random audits to monitor whether organisations are complying with the requirement to implement certain policies and whether organisations are acting in accordance with their policies. The System Operator will also consider the suitability of organisations’ policies.