8 3: Processes in the use of My Health Record system data for secondary purposes Description of process Responsibility Step Make an application for secondary use of My Health Record (MHR) Applicant system data using predefined format/method. Submit a risk management plan with the application. Step 2 Assess application in terms of the intended use. The Board Step 3 Consider additional matters for applications involving overseas The Board organisations or individuals. Step 4 Apply principles consistent with other health system data bodies. The Board Step 5 Manage the availability, access and, where appropriate, release, The Board usability, integrity and security of data. Step 6 Identify if ethics approval is required and, if so, request the applicant The to obtain it. Step 7 Obtain ethics approval (if requested) via a body certified by National Applicant Health and Medical Research Council. Step 8 Conditions of Use Agreement (CUA) The Step 8a Provide MHR system data and/or access to MHR system data as System Operator needed to allow approved requests to proceed. Step 8b Receive/access data from the MHR system from the Australian Data Custodian Digital Health Agency in order to prepare it for release to/access by the applicant. Step 8c Process, clean and ensure quality and usefulness of data. System Operator and Data Custodian Step 9 Conduct data linkage as requested. Data Integrator Step 10 expert supervision, assess the need to de-identify data using The Board the method deemed most appropriate to protect individuals’ privacy. Step 10a De-identify data using the method prescribed by the MHR Data Custodian Secondary Use of Data Governance Board (the Board). Step 11 Conduct a risk assessment to determine monitoring and assurance The Board processes, including consideration of the published minimum data security requirements. Step 12 Ensure CUA has been signed by the applicant. The Board Step 12a Sign Conditions of Use Agreement (CUA). Applicant
Processes in the use of My Health Record system data for secondary purposes Description of process Responsibility Step Make an application for secondary use of My Health Record (MHR) system data using predefined format/method. Submit a risk management plan with the application. Applicant Step 2 Assess application in terms of the intended use. The Board Step 3 Consider additional matters for applications involving overseas organisations or individuals. The Board Step 4 Apply principles consistent with other health system data bodies. The Board Step 5 Manage the availability, access and, where appropriate, release, usability, integrity and security of data. The Board Step 6 Identify if ethics approval is required and, if so, request the applicant to obtain it. The Step 7 Obtain ethics approval (if requested) via a body certified by National Health and Medical Research Council. Applicant Step 8 Conditions of Use Agreement (CUA) The Step 8a Provide MHR system data and/or access to MHR system data as needed to allow approved requests to proceed. System Operator Step 8b Receive/access data from the MHR system from the Australian Digital Health Agency in order to prepare it for release to/access by the applicant. Data Custodian Step 8c Process, clean and ensure quality and usefulness of data. System Operator and Data Custodian Step 9 Conduct data linkage as requested. Data Integrator Step 10 expert supervision, assess the need to de-identify data using the method deemed most appropriate to protect individuals’ privacy. The Board Step 10a De-identify data using the method prescribed by the MHR Secondary Use of Data Governance Board (the Board). Data Custodian Step 11 Conduct a risk assessment to determine monitoring and assurance processes, including consideration of the published minimum data security requirements. The Board Step 12 Ensure CUA has been signed by the applicant. The Board Step 12a Sign Conditions of Use Agreement (CUA). Applicant 3: 8