Portal Operator Registration
Agreement
My Health Record System
View only access

01022017
04072018

 Note: The purpose of this Agreement is to satisfy the System Operator that the person applying to be a viewonly portalView Only Portal operator:
- complies with the My Health RecordRecords Act and Rules, and
- agrees to be bound by the conditions of registration outlined in this document.
By entering into this Agreement you are applying to be a portal operator under section 47 of the My Health
Records Act 2012.
This Agreement comes into effect on the date both parties have executed this Agreement and you have signed
the required application and registration forms, making you a registered portal operatorRegistered Portal
Operator for the purposes of the My Health Records Act 2012.

Parties

Parties: System Operator and Portal Operator
System Operator

Australian Digital Health Agency

(“us”, “we”, “our”)
ABN 84 425 496 912
Contact person:
[insert]
Phone number:

Any queries you
have about this
agreement should
be directed to this
person.

[insert]
E-mail address:
[insert]
Postal address:
Level 25, 56 Pitt Street, Sydney NSW 2000
Portal Operator

Portal operators
will need to
authorise an
employee to be
their
Contactcontact
person for the
purposes of the
My Health Record
system, including
in connection with
this agreement.

[insert company name]

(“you”, “your”)
ABN [insert]
Contact person:
[insert]
Phone number:
[insert]
E-mail address:
[insert]
Postal address:
[insert]

The
Contactcontact
person may or
may not be the
same person who
executes this
agreement on
behalf of the
portal operator.
This is a matter

0102201704072018

2

 for the portal
operator.

Background

A

The My Health Record system (the System) is designed to
place individuals at the centre of their own healthcare. It
does this by enabling access to important health information
when and where it is needed by healthcare
recipientsRegistered Healthcare Recipients and their
healthcare providersHealthcare Providers.

B

A range of private and public sector entities will participate in
the System, including healthcare providerHealthcare Provider
organisations, registered repository operators and registered
portal operators and registered contracted service providers
to registered healthcare providersHealthcare Providers.

C

Rights and obligations for Participants are set out in a number
of places including:

D

I.

the My Health Records Act 2012, My Health Records
Rule 2016, Healthcare Identifiers Act 2010 and the
regulations made under those Acts; and

II.

in agreements similar to this one.

A portal operator wishing to operate an electronic interface
that facilitates access to the System must be a Registered
Portal Operator. This Agreement is a precondition to the
System Operator registering the Portal Operatorportal
operator as a Registered Portal Operator. This Agreement is
limited to a View Only Portal.

Definitions and
interpretation

1

Definitions and rules for interpreting this Agreement are set out in
clause 16.

Commencement
and term

2

2.1

Subject to clause 2.2, this Agreement commences on the date
it is executed by both parties and ends when it terminates in
accordance with clause 14.

2.2

The provisions of this Agreement, other than this clause 2 and
clause 16 (Definitions and interpretation), 8 (Costs) and 15
(Miscellaneous)), do not become binding unless and until you
complete the Production Environment Access Request Form
and the Portal Operator Registration Form and submit them
tothey are approved in writing by the System Operator
(Condition Precedent).

2.3

The Condition Precedent is for the benefit of the System
Operator and may only be waived in writing by the System
Operator in its absolute discretion.

0102201704072018

3

 Registration,
suspension and
cancellation of
registration of
portal operator

3

2.4

Despite any other provision of this Agreement or the
Production Environment Access Request Form or the Portal
Operator Registration Form, the System Operator will not be
obliged to register you as a Registered Portal Operator unless
the requirements in clause 3.1 are met.

3.1

In order to be registered and remain registered as a
Registered Portal Operator, you must have accurately
completed the Production Environment Access Request Form
and Portal Operator Registration Form and we must be
satisfied that:
(a) you satisfy all the requirements of the My Health
Records Act for registration as a Registered Portal
Operator; and

(c)(b) such registration would not compromise the security,
integrity or operations of the System.
3.2

Subject to the My Health Records Act and My Health Records
Rules, we may suspend or cancel your registration as a
Registered Portal Operator if, at any time:
(a) we are satisfied that you do not satisfy all such
requirements;

(c)(b) the cancellation or suspension is reasonably
necessary to prevent a contravention of the My Health
Records Act or this Agreement, or is in accordance with
the My Health Records Act or My Health Records Rules;

(e)(c) you fail to comply with the Interoperability
Requirements (to the extent applicable to the View
Only Portal) and subject to clause 4.4 of this
Agreement;

(g)(d) you request us in writing to suspend or cancel your
registration; or

(i)(e) otherwise in accordance with clause 14.2 of this
Agreement.
3.3

0102201704072018

If we suspend your registration as a Registered Portal
Operator under clause 3.2 (a), (b) or (c), and in our sole
opinion:

4

 (a) your non-compliance is able to be remedied; and
(b)
(b)

it is appropriate in all the circumstances and
consistent with all applicable Laws to afford to you a
period of time to remedy the non-compliance,

we will provide you with an opportunity within a defined
timeframe to become compliant and satisfy all requirements
of a Registered Portal Operator as set out in the My Health
Records Act, the My Health Records RuleRules, and this
Agreement. Nothing in this clause limits our rights to cancel
your registration under clause 3.2.

System
Operator
responsibilities

0102201704072018

4

3.4

This Agreement sets out conditions of your registration with
the System Operator as a Registered Portal Operator,
permitting you to provide a View Only Portal. in accordance
with this Agreement, the Interoperability Requirements, the
approved Production Environment Access Request Form,
Portal Operator Registration Form and all applicable Laws.
You must not copy, record or store any System data. Except
as required by compulsion of law, you must not use or
disclose any System data for any purpose other than
providing a View Only Portal.

3.5

You are not permitted, as a Registered Portal Operator for a
View Only Portal, to hold any records of any System data and,
if and to the extent you do hold any records of any System
data, without limitation to any remedy available to the
System Operator, you must delete all copies of that data.

4.1

We will endeavour to ensure the System is available as
required by healthcare recipientsRegistered Healthcare
Recipients and Participants. However, some parts of the
System, and some inputs such as telecommunications
services, are outside our control. We do not represent,
warrant or guarantee continuity of access to, or operation of,
the System or that the System will be error free.

4.2

The System and its functionality will change over time.
However, we will endeavour to consult with you or your
representatives about any significant changes which may
affect your access to the System.

4.3

We will notify you of any changes to the Interoperability
Requirements.

4.4

If we give notice under clause 4.3 of changes to the
Interoperability Requirements, we will allow reasonable time
for you to review, assess and modify your operations to allow
you to meet your obligations under this clause. You will
maintain your status as a Registered Portal Operator, unless

5

 we are satisfied that you fail to remedy a non-compliance
with the Interoperability Requirements within a reasonable
time.
4.5

Portal Operator
responsibilities

0102201704072018

5

We consent to you communicating with us electronically in
connection with the System provided that your electronic
communications are directed to our Contact person listed
above or any replacement Contact person we notify to you
from time to time.

Compliance with Privacy Act and other Laws
5.1

You agree that, if you are not bound by the Privacy Act 1988
(Cth) (Privacy Act),, you opt- in to be bound by the Privacy
Act and to be treated as an organisation as defined in Section
6C of the Privacy Act.

5.2

If clause 5.1 applies, you agree to notify the Information
Commissioner, within 30 days after the date of this
Agreement, that you have made the choice to be treated as
an organisation pursuant to Section 6EA.

5.3

You must yourself, and must ensure that all of your
employees, officers, contractors and agents who deal with
personal information (as defined under the Privacy
Act),Personal Information, are aware of and comply with the
Privacy Act and the Australian Privacy Principles, and you
must not do anything, and ensure that your employees,
officers, contractors and agents do not do anything which, if
done by us, would be a breach of an Australian Privacy
Principle. You must notify us immediately if you become
aware of a breach or possible breach of the Privacy Act, any
Australian Privacy Principle or any of your obligations under
this clause in connection with any use of the System or this
Agreement.

5.4

You must comply with, and ensure your employees, officers,
agents and contractors comply with all Commonwealth and
other applicable Laws, including the My Health
RecordsPrivacy Act, the My Health Records Act and the My
Health Records Rules. Nothing in this Agreement, including
the Interoperability Requirements, constitutes legal advice to
you. You must obtain your own legal advice regarding your
compliance with all applicable Laws.

5.5

You must give, subject to reasonable notice during
reasonable times and your reasonable security requirements
(except where there is an actual or apprehended breach of
the Law), the Auditor-General, the Privacy Commissioner, the
Ombudsman or his/her delegate, the Information
Commissioner, the FOI Commissioner and any of their
delegates access to your personnel, premises, materials and

6

 records in order for any of those persons to be able to inspect
and copy material and records for purposes associated with
this Agreement, including your performance under it.
Eligible Data Breach obligations
5.5A.1

If you become aware that there are reasonable grounds to
suspect that there may have been an Eligible Data Breach in
relation to any Personal Information held by you as a result
of this Agreement or your operation as a Registered Portal
Operator, you agree to:
(a) notify us in writing as soon as possible, which must be
no later than within three (3) days of becoming aware;
and
(b) unless otherwise directed by us, carry out an
assessment in accordance with the requirements of the
Privacy Act.

5.5A.2

Where you are aware that there are reasonable grounds to
believe there has been, or where we notify you that there
has been, an Eligible Data Breach in relation to any Personal
Information held by you as a result of this Agreement or
your operations as a Registered Portal Operator, you must:
(a) take all reasonable action to mitigate the risk of the
Eligible Data Breach causing serious harm to any of the
individuals to whom the Personal Information relates;
(b) unless otherwise directed by us, take all other action
necessary to comply with the requirements of the
Privacy Act; and
(c) take any other action as reasonably directed by us.

5.5A.3

In assessing whether an Eligible Data Breach may have
occurred, you must have regard to any relevant guidelines,
resources or information developed and made available by
the Office of the Australian Information Commissioner in
relation to Eligible Data Breaches.

Requirement to notify us of certain things
5.6

You must notify us of all matters you are required to notify
to us in accordance with the My Health Records Act, My
Health Records Rule, Privacy Act and other
relevantapplicable Laws, including:
(a) (a)
any privacy complaint in relation to your
handling of personal informationPersonal Information

0102201704072018

7

 in connection with being a Registered Portal Operator
for the purposes of this Agreement; and
(b) (b)
any data breach or suspected data breach
which is required to be notified in accordance with the
My Health Records Act, Privacy Act or which is required
to be notified to any person (including any individual or
the Information Commissioner) under any Law.
5.7

You must provide us with written notice within 14 days of
when you become aware that you cease to be eligible to be
registered as a Registered Portal Operator.

5.7A

You must notify us in writing within 2 Business Days of any:
(a) Material Change;
(b) Change of Control; or
(c) agreement or arrangement entered into which, if
completed, would cause a Material Change or Change
of Control (whether or not that agreement or
arrangement is subject to conditions).
You must also notify us in writing within 14 days of any
decision you make to cease providing the View Only Portal
(which, to avoid doubt, excludes outages due to scheduled or
unscheduled maintenance on the View Only Portal) and at
least 14 days before you cease providing the View Only
Portal.

Requirement to comply with directions
5.8

You must comply with any reasonable direction we make to
ensure that you or we comply with any applicable Law or
Commonwealth policy.

Portal Operator location is within Australia
5.9

You represent and warrant, and must ensure at all times
during the term of this Agreement, that:
(a) you, your central management and control and the
portal you operate will be located in Australia; and

(c)(b) if you hold records for the purposes of the System or
have access to information relating to such records, you
have not and will not:

0102201704072018

8

 (i)

(i) hold, take, process or handle such records or
information relating to such records; or

(ii) (ii) cause or permit another person to hold, take,
process or handle such records or information
relating to the records,
outside Australia.
Interoperability Requirements
5.10

Subject to clauseclauses 4.3 and 4.4, during the term of this
Agreement you must comply with the Interoperability
Requirements to the extent applicable to the View Only
Portal (including all relevant security requirements).

Communication
5.11

You consent to us communicating with you electronically in
connection with the System provided that our electronic
communications are directed to your Contact person listed
above or any replacement Contact person you notify to us
from time to time.

Consent
5.12

You must ensure that you facilitate access to the System only
where:
(a) the Registered Healthcare Recipient or their
Representative has provided consent; or

(c)(b) you are otherwise authorised by Law to do so.
5.13

You must ensure that, at or before the time that you seek
consent of a Registered Healthcare Recipient from that
recipient or his or her Representative, you explain each of
your acts and practices that do or may fall within the scope of
that consent.

5.14

To the extent practicable you must ensure that consents are
current and specific. You must minimise any use of any
bundled or general consents.

No endorsement

0102201704072018

9

 5.18

You must, unless otherwise agreed in writing by the System
Operator, include a statement on your View Only Portal (that
is sufficiently prominent to be easily noticed by users of the
View Only Portal), to the effect that, although the System
Operator has registered you as a Registered Portal Operator
pursuant to its obligations under the My Health Records Act,
such registration does not imply:
(a) that the System Operator endorses the View Only
Portal or any content, information or services provided
through it or by you or your Associates;
(b) any affiliation of the System Operator with you, other
than to register you as a Registered Portal Operator, in
accordance with the requirements of the My Health
Records Act, or your Associates; or
(c) any sponsorship by the System Operator of you or your
View Only Portal or any service or content provided by
you or your Associates.

5.19

You must ensure that your marketing or promotional material
and your terms of use of the View Only Portal do not state or
imply any of the things referred to in clause 5.18 (a) to (c).

Customer communications
5.20

You must ensure that your communications with each
Registered Healthcare Recipient:
(a) at the time they become your customer; and
(b) again, at the time they de-link their access to the
System through use of the View Only Portal,
make clear that if they wish to withdraw consent and cease
accessing the System through facilitation of your View Only
Portal, that does not mean they are deregistering with the
System Operator as a Registered Healthcare Recipient for a
My Health Record. You must advise your customers that, if
they wish to cease to be a Registered Healthcare Recipient
with a My Health Record, they should go to
www.myhealthrecord.gov.au.

Audit and
access

0102201704072018

6

6.1

You will be responsible for ensuring that you maintain
records (including Access Audit Logs) in line with
Commonwealth, state or territory requirements concerning
the retention of records. Upon our request you must provide
us with access to your records and associated audit logs.

10

 Changes to this
agreement

7

6.2

You agree that, during the term of this Agreement, you must
promptly provide to the System Operator, or its nominees, all
assistance reasonably requested for any purpose associated
with this Agreement or requested in accordance with any
applicable Law, including and subject to reasonable notice,
during reasonable times and your reasonable security
requirements (except where there is an actual or
apprehended breach of the Law), access to your premises,
materials, records and personnel associated with this
Agreement to audit or review your policies, procedures and
records that relate to the performance of your obligations
under this Agreement and compliance with applicable Laws.
The form and facilitation of access, and any additional terms
required to give effect to this clause, will be agreed in writing
prior to access.

7.1

If we consider it is necessary to vary the terms of this
Agreement:
(a) we will, except in urgent circumstances:

(ii)(i)

give you at least 28 days’ notice of the
changes (Variation Notice); and

(iv)(ii)

endeavour to consult with you; and

(b) (b)
we will give you a written copy of any new
and varied terms and an explanation of their purpose.
7.2

If you do not, within 28 days of the date of the Variation
Notice, confirm by notice to us that you agree to the new
terms:

1)(a) either party may terminate this Agreement by notice
to the other party (Termination Notice); and

3)(b) your registration as a Registered Portal Operator will
be cancelled effective from the date of the Termination
Notice.
Costs

8

Each party bears their own costs in the preparation,
negotiation and complying with their obligations under this
Agreement.

Indemnity

9

You indemnify us, our employees, other officials, officers, agents and
contractors (each an Indemnified Person) from and against any:

0102201704072018

11

 (a) (a)
Loss incurred by an Indemnified Person,
including in dealing with any claim made against or
threatened against the Indemnified Person;
(b) (b)
Loss of or damage to the property of an
Indemnified Person,
arising out of or in connection with:

ii)(c) your breach of this Agreement;
iv)(d) any negligent or Wilful act or omission of, or breach
of Law by, you, your employees, agents or contractors
arising out of or in connection with:

B.(i) this Agreement; or
C.(ii)

Representations
and warranties

10

your operations as a Registered Portal
Operator.

By executing this Agreement, you represent and warrant to us
that:
(a) (a)
the Portal Operator has full power and
authority to enter into, perform and observe its
obligations under this Agreement;

(c)(b) the execution, delivery and performance of this
Agreement has been duly and validly authorised by the
Portal Operator; and
(c) (c)
the information you have supplied in and
pursuant to this Agreement is accurate, complete, upto- date and not misleading.
Resolving
disputes

0102201704072018

11

11.1

If the parties are in dispute, each party must continue to
perform its obligations under this Agreement.

11.2

Neither party may commence legal proceedings relating to a
dispute arising under this Agreement until the dispute
resolution process required by this clause has been followed.
This clause 11.2 does not prevent a party commencing legal
proceedings for urgent interlocutory relief.

12

 11.3

A party claiming that there is a dispute must send the other
party a written notice setting out the nature of the dispute.

11.4

The parties must try to resolve a dispute notified under
clause 11.3 through direct negotiation, including by referring
the matter to persons within the parties who have the
authority to intervene and direct some form of resolution.

11.5

If:
(a) (a)
after 28 days from the date of the notice
under clause 11.3:

(ii)(i)

the parties have not resolved the dispute;

and

(iv)(ii)

the parties have not agreed to submit the
dispute to mediation or some alternative dispute
resolution procedure (including an agreement on
the identity of the mediator or the facilitator of
any other alternative dispute resolution); or

(b) (b)
the dispute has been submitted to mediation
or some other form of alternative dispute resolution
procedure, and the dispute is not resolved within 21
days of the submission, or a longer time agreed in
writing by the parties,
either party may commence legal proceedings.
11.6

Nothing in this clause 11 limits or restricts any function,
power, right or entitlement of the System Operator under
this Agreement or under the My Health Records Act or My
Health Records Rule.

11.7

This clause 11:
(a) does not apply to any action by us under or purportedly
under clauses 14.3 or 14.3A; and
(b) does not prevent a party commencing legal
proceedings for urgent interlocutory relief.

0102201704072018

13

 Insurance

12

12.1

You represent and warrant that you have taken out, and will
maintain for the periods set out in clauses 12.2 and 12.3 of
this Agreement, as applicable, all appropriate types and
amounts of insurances with a reputable insurer, that a
prudent insured would give effect to in relation to your
obligations under this Agreement, which insurances must
include the following:

Type
IT liability/professional
indemnity/product liability
insurance
Public Liability

Liability

0102201704072018

13

Coverage
$20,000,000 in respect of any
single claim and in the annual
aggregate
$20,000,000 in respect of any
single claim and in the annual
aggregate

12.2

If you take out a “claims made” insurance policy, you must
maintain the insurance policy during the term of this
Agreement and for seven years after the termination of this
Agreement.

12.3

If you take out an “occurrence” based insurance policy, you
must maintain the policy in effect during the term of this
Agreement.

12.4

You must provide us, on our request, with certificates of
currency evidencing the insurances effected in accordance
with this clause.

13.1

To the extent allowed by Law, we exclude all liability to you
in respect of any Loss that you might incur or suffer
(including as a result of negligence) in connection with this
Agreement, including your access or any of your end
users'users’ access to the System.

13.2

Your liability arising out of, or in connection with, a breach of
this Agreement, or in tort (including negligence) or for any
other common law, equitable, statutory or other cause of
action arising out of, or in connection with this Agreement
(including under any indemnity) is, subject to clauses 13.5
and 13.6, limited to a total aggregate amount of $500,000
per claim and a total aggregate amount of $1 million
(excluding GST) in any 12 month period.

13.3

Each party must use all reasonable endeavours to mitigate its
Losses arising out of or in connection with a breach of this
Agreement or any negligent or Wilful act or omission arising
out of or in connection with this Agreement.

13.4

Your liability (including under an indemnity) will be reduced
proportionately to the extent that our negligent or Wilful acts
or omissions or those of any other Indemnified Person (as

14

 defined in clause 9) or their breach of any Law contributed to
your liability.
13.5

The limitation on your liability under this Agreement
(including under any indemnity) does not apply in relation to:
(a) personal injury (including sickness and death);

(c)(b) loss of, or damage to, tangible property;
(e)(c) any claim alleging infringement of intellectual
property rights;

(g)(d) a breach of any obligation of confidentiality, security
matter or privacy under the Privacy Act;

(i)(e) a breach of the Interoperability Requirements;
(k)(f) fraud, breach of Law, Wilful misconduct or
repudiation of this Agreement; or

(m)(g)any liability arising under clause 9 for any third party
claims against any Indemnified Person.
Termination

14

14.1

You may terminate this Agreement by giving us at least
90 days’ written notice.
We may terminate the Agreement by giving at least 12
months’ written notice to you.
If the Agreement is terminated in accordance with this clause,
neither party will be liable to the other party for any Loss
arising from, or in connection with, the termination.

14.2

This Agreement will terminate immediately upon our
cancellation of your registration as a Registered Portal
Operator for any reason, including in accordance with clauses
3.2 or 14.3.

14.3

Without limiting our rights under applicable Law, we may
cancel your registration as a Registered Portal Operator
immediately by written notice to you if:
(a) you terminate this Agreement in accordance with
clause 14.1;

0102201704072018

15

 (c)(b) you do not agree to any changes to this Agreement,
proposed in accordance with clause 7.2;
(c) you become insolvent, any steps are takensubject to
wind you up or sections 415D, 434J and 451E of the
Corporations Act (as the case may be), an Insolvency
Event occurs in respect of you;
(d) you undergo a Material Change (other than a change of
legal name);) or Change of Control;
(e) you or any of your Associates who Control you :

(e)(i)

breach any Law; or

(ii) engage in any other conduct that we consider, in
our absolute discretion, could adversely affect our
reputation or the reputation of the My Health
Record system or the Commonwealth of Australia
or any of its agencies;
(f)

you fail to satisfy any of your obligations under this
Agreement and, where that that failure is capable of
remedy, do not remedy that failure within 14 days after
being given a written notice from us requiring you to do
so; or

(h)(g) you fail to satisfy any of your obligations under this
Agreement and, in our reasonable opinion, the failure is
not capable of remedy.
14.3A

Without limiting the termination rights at clauses 14.1, 14.2
and 14.3, if our Chief Executive Officer forms the view that
this Agreement with you may be contrary to the public
interest, we may terminate the Agreement by giving at
least 5 Business Days’ notice to you.
If the Agreement is terminated in accordance with this clause,
we will not be liable to you for any Loss arising from, or in
connection with, the termination.

14.4

Upon termination, suspension or cancellation of your
registration as a Registered Portal Operator:
(a)

0102201704072018

16

you must take reasonable steps to notify end users
who have or may have access to your View Only Portal
that you will be suspended from being, or will cease to
be, a Registered Portal Operator;

 Miscellaneous

.

0102201704072018

15

(b)

your right to access the System will cease immediately
at the time notified by us or as otherwise agreed in
writing; and

(c)

in addition to your obligation in clause 14.4(a), you will
take reasonable steps to minimise any Loss resulting
from that termination, suspension or cancellation as a
Registered Portal Operator.

14.5

Clauses 9, 11, 12, 13, 14 and 15 and any definitions or other
provisions necessary to give effect to these clauses survive
termination of this Agreement.

14.6

Termination of this Agreement does not affect any accrued
rights or remedies of a party.

15.1

This Agreement is governed by the Laws in force in New
South Wales. Each party submits to the non-exclusive
jurisdiction of the courts of that State and the courts of
appeal from them.

15.2

This Agreement constitutes the entire agreement between
you and us about its subject matter.

15.3

We acknowledge that you may wish to assign or novate this
Agreement to a Related Body Corporate. This will require our
prior written consent, which we will not unreasonably
withhold. Otherwise, you must not assign or novate this
Agreement without our prior written consent. We may assign
or novate our rights and obligations under this Agreement to
a body that takes over from us as the System Operator. If it is
proposed that another body will take over from us as System
Operator, we will endeavour to give you reasonable notice of
the change.

15.4

Except where this Agreement expressly states otherwise, a
party may, in its discretion, give conditionally or
unconditionally or withhold any approval or consent under
this Agreement.

15.5

This Agreement may be executed in counter-parts. All
executed counter-parts constitute one document.

15.6

Each party must, at its own expense, do everything
reasonably necessary (including executing documents) to give
full effect to this Agreement and any transactions
contemplated by it.

15.7

A term or part of a term of this Agreement that is illegal or
unenforceable may be severed from this Agreement and the
remaining terms or parts of the terms of this Agreement
continue in force.

17

 15.8

Notices may be given by means of electronic communications
as defined in the Electronic Transactions Act 1999 (Cth) sent
to the Contact person of the relevant party.

Confidentiality
15.9

A party must (and must ensure its employees, officers and
agents) keep Confidential Information of the other party
confidential and must not (and must ensure its employees,
officers and agents do not) use such Confidential Information
except to the extent necessary to exercise its rights and
perform its obligations under this Agreement. A party must
not disclose the Confidential Information of the other party to
a third party unless:
(a) the other party has first given their written consent;

(c)(b) the disclosure is made to the party's related bodies
corporateRelated Bodies Corporate, officers,
employees, or professional advisers, and those persons
undertake to keep confidential any information so
disclosed;

(e)(c) in relation to the System Operator, as permitted by
clause 15.10; or

(g)(d) the disclosure is made to the extent reasonably
needed to comply with any applicable Law,
but the party must promptly give notice of the intended
disclosure to, and consult with, the other party to the extent
practicable, and use its reasonable endeavours to minimise
disclosure to third parties and to ensure that the information
so disclosed will be treated confidentially.
15.10 The parties may disclose Confidential Information:
(a) (a)
to the extent required by Law or by a lawful
requirement of any government or governmental body,
authority or agency;
(b) (d)
in the case of the System Operator only, for
public accountability reasons, including disclosure on
request to other government agencies, and aon request
for information by parliament or a parliamentary
committee or the Minister with portfolio responsibility
for the System Operator;

0102201704072018

18

 (c) (d)
to their contracted third party service
providers for the purposes of or in connection with
your registration and operation as a Registered Portal
Operator where those third party service providers are
bound by duties of confidentiality the same or
substantially similar to clause 15.9.
Reasonable Assistance by System Operator
15.11

0102201704072018

We agree that, during the term of this Agreement, we will
provide reasonable assistance in relation to any inquiry,
investigation or complaint in connection with your
registration and operation as a Registered Portal Operator.
You acknowledge that “reasonable assistance” does not
include the expenditure of money by us.

19

 Definitions and
interpretation

16

16.1

Unless a contrary intention appears, the following definitions
apply:
Access Audit Log means a record of access to a Registered
Healthcare Recipient’s My Health Record facilitated through
your systems’ electronic interface with the System.
Agreement means this agreement, including its schedules,
annexures and attachments (if any).
Associate includes:
(a) any officer, employee, Related Body Corporate or
shareholder or member;
(b) any shareholder or member of any of a Related Body
Corporate or shareholder; and
(c) any other person who participates in conduct of your
business, or has any Control over you or your business.
Authorised Representative has the same meaning as in the
My Health Records Act.
Bankruptcy Act means Bankruptcy Act 1966.
Business Day means, in relation to the doing of any action in
a place, any day other than a Saturday, Sunday or public
holiday in the place where the act is to be performed.
Change of Control means:
(a) any change in your direct or indirect beneficial
ownership, other than as a result of ordinary trading
activity on a relevant stock exchange;
(b)

you dispose of the whole or any part of your assets,
operations or business other than in the ordinary
course of business; or

(c)

you dispose of the whole or any part of your assets,
operations or business used by you in connection with
the View Only Portal.

Confidential Information means information that:

0102201704072018

20

 (a)

is by its nature confidential;

(b)

is designated by a party as confidential; or

(c)

a party knows or ought to know is confidential;

but does not include the terms of this Agreement (unless
expressly provided otherwise) or information which:
(d)

is or becomes public knowledge other than by breach
of this Agreement or by any other unlawful means;

(e)

is in the possession of a party without restriction in
relation to disclosure before the date of receipt from
the other party; or

(f)

has been independently developed or acquired by a
third party; or

(g)

is notified to us pursuant to clause 5.7A regarding
your decision to cease providing the View Only Portal.

Contact person means, for each party, the person described
in the relevant part of the “Parties: System Operator and
Portal Operator” section of this Agreement or any
replacement Contact person notified by that party from time
to time.
Contact details means, for each party, the contact details
described in the relevant part of the “Parties: System
Operator and Portal Operator” section of this Agreement.
Control:
(a) has the meaning given in section 50AA of the
Corporations Act;
(b) in respect of an “entity” (as defined in the Corporations
Act) also includes the direct or indirect power to
directly or indirectly direct the management or policies
of the entity or control the membership or voting of the
board of directors or other governing body of the entity
(whether or not the power has statutory, legal or
equitable force or arises by means of statutory, legal or
equitable rights or trusts, agreements, arrangements,
understandings, practices, the ownership of any
interest in a “marketable security” (as defined in
section 9 of the Corporations Act), bonds or
instruments of the entity or otherwise); and
(c) also includes owning or controlling, directly or
indirectly, more than 50% of the shares or units in an
entity;
Corporations Act means the Corporations Act 2001 (Cth).
Eligible Data Breach has the same meaning as in the Privacy

0102201704072018

21

 Act.
Employee has the same meaning as in the My Health Records
Act.
Entity means:

(b)(a) a person; or
(d)(b) a partnership; or
(f)(c) any other unincorporated association or body; or
(h)(d) a trust; or
(j)(e) a part of an entity (under a previous application of
this definition).
External Administrator means an administrator, controller or
managing controller (each as defined in the Corporations
Act), trustee, provisional liquidator, liquidator or any other
person (however described) holding or appointed to an
analogous office or acting or purporting to act in an
analogous capacity.
Healthcare Provider has the same meaning as in the My
Health Records Act.
Healthcare Recipient has the same meaning as in the My
Health Records Act.
Information Commissioner means the Office of the Australian
Information Commissioner (OAIC).
Insolvency Event means, in respect of a person, any of the
following:
(a) it becomes insolvent within the meaning of section
95A, or is taken to have failed to comply with a
statutory demand under section 459F(1), or must be
presumed by a court to be insolvent under section
459C(2), or is the subject of a circumstance specified in
section 461 (whether or not an application to court has
been made under that section) or, if the person is a
Part 5.7 body, is taken to be unable to pay its debts
under section 585 of the Corporations Act;
(b) except with our consent:

0102201704072018

22

 (i)

it is the subject of a Liquidation, or an order or an
application is made for its Liquidation; or

(ii) an effective resolution is passed or meeting
summoned or convened to consider a resolution
for its Liquidation;
(c) an External Administrator is appointed to it or any of its
assets or a step is taken to do so or its Related Body
requests such an appointment;
(d) if a registered corporation under the Corporations Act,
a step is taken under section 601AA, 601AB or 601AC of
the Corporations Act to cancel its registration;
(e) if a trustee of a trust, it is unable to satisfy out of the
assets of the trust the liabilities incurred by it as and
when those liabilities fall due;
(f)

any event or conduct occurs which would enable a
court to grant a petition, or an order is made, for the
bankruptcy of an individual or his estate pursuant to
the Bankruptcy Act;

(g) any application (not withdrawn or dismissed within five
(5) Business Days) is made to a court for an order, a
meeting is convened, a resolution is passed or any
negotiations are commenced, for the purpose of
implementing or agreeing:
(i)

a moratorium of any debts of a person;

(ii) a personal insolvency agreement;
(iii) any other assignment, composition or
arrangement (formal or informal) with a person's
creditors;
(iv) any similar proceeding or arrangement by which
the assets of a person are subjected conditionally
or unconditionally to the control of that person's
creditors or a trustee; or
(v) any agreement or other arrangement of the type
referred to in this paragraph (g) is ordered,
declared or agreed to;
(h) a person becomes an insolvent under administration
(as defined in the Corporations Act);

0102201704072018

(i)

an analogous or equivalent event to any listed above
occurs in any jurisdiction; or

(j)

it stops or suspends payment to all or a class of
creditors generally;

23

 Interoperability Requirements means the requirements
published by the System Operator from time to time
specifying the technical and compliance prerequisites that
entities must meet in order to connect and remain connected
to the System, the current version of which, as at the date of
this Agreement, consist of the “Operational Requirements”,
“Security Requirements” and “Consent Requirements” set
out in the Schedule.
Law means any applicable statute, regulation, by-law,
ordinance or subordinate legislation in force from time to
time anywhere in Australia, and includes the common law as
applicable from time to time.
Liquidation means:
(a) a winding up, dissolution, liquidation, provisional
liquidation, administration, bankruptcy or other
proceeding for which an External Administrator is
appointed, or an analogous or equivalent event or
proceeding in any jurisdiction; or
(b) an arrangement, moratorium, assignment or
composition with or for the benefit of creditors or any
class or group of them.

0102201704072018

24

 Loss means any liability, expense, loss, damage or cost of any
kind (including legal costs on a full indemnity basis, whether
incurred by or awarded against a party).
Material Change means "“material change"” as defined in
the My Health Records Rules.
My Health Records Act means the My Health Records Act
2012 (Cth).
My Health Records Rules has the same meaning as in the My
Health Records Act.
Nominated Representative has the same meaning as in the
My Health Records Act.
Operator officer has the same meaning as in the My Health
RecordRecords Rule 2016.
Participant means Participant in the My Health
RecordsRecord system.
Participant in the My Health Records system has the same
meaning as in the My Health Records Act.
Party means a party to this Agreement.
Personal Information has the same meaning as in the Privacy
Act 1988 (Cth).
Portal Operator Registration Form means a document of
that name substantially in the form attached in Annexure B
to this Agreement, as amended by the System Operator from
time to time.
Privacy Act means the Privacy Act 1988 (Cth).
Production Environment Access Request Form means a
document of that name substantially in the form attached in
Annexure A to this Agreement, as amended by the System
Operator from time to time.
Related Body Corporate has the same meaning as in section
50 of the Corporations Act 2001.
Registered Healthcare Recipient has the same meaning as in
the My Health Records Act.
Registered Portal Operator means “registered portal
operator”, as defined in the My Health Records Act.

0102201704072018

25

 Representative means a Nominated Representative or an
Authorised Representative.
System means the My Health RecordsRecord system, as
defined in the My Health Records Act.
System Operator has the same meaning as in the My Health
Records Act.
View Only Portal means an electronic interface that
facilitates access to the System by Participants and
registeredRegistered Healthcare Recipients and does not
copy, record or store that data.
Wilful means performed intentionally and with either the
intention to cause damage, or with reckless disregard as to
the possibility of causing damage.
16.2

In this Agreement, unless the contrary intention appears:

(b)(a) the singular includes the plural and vice versa;
(d)(b) another grammatical form of a defined word or
expression has a corresponding meaning;

(f)(c) a reference to a statute or other law includes
regulations and other instruments under it and
consolidations, amendments, re-enactments or
replacements of any of them;

(h)(d) a reference to a document includes the document as
novated, altered, supplemented or replaced from time
to time;

(j)(e) a reference to a person includes the person’s
permitted successors, substitutes (including, without
limitation, persons taking by novation) and assigns;

(l)(f) a reference to a person includes a natural person,
partnership, body corporate, association, governmental
or local authority or agency or other entity;

(n)(g) a word or expression defined in the My Health
Records Act has the meaning given to it in the My
Health Records Act;

0102201704072018

26

 (p)(h) “including”, “includes”, “such as” and “in particular”
do not limit the generality of the words which precede
them or to which they refer;

(r)(i)any agreement, representation, warranty or indemnity
by two or more parties (including where two or more
persons are included in the same defined term) binds
them jointly and severally;

(t)(j) any agreement, representation, warranty or indemnity
in favour of two or more parties (including where two
or more persons are included in the same defined
term) is for the benefit of them jointly and severally;

(v)(k) a rule of construction does not apply to the
disadvantage of a party because the party was
responsible for the preparation of this Agreement or
any part of it; and

(x)(l) headings, footnotes and explanatory notes in the left
hand column are for convenience and do not affect
interpretation of this Agreement.
16.3

0102201704072018

The italicised notes in the left hand column have been
provided for convenience, and are for information only. They
do not form part of this Agreement.

27

 SCHEDULE - Interoperability Requirements

Part 1 Operational Requirements

28

SCHEDULE - Interoperability Requirements

Part 2 - Security Requirements

29

SCHEDULE - Interoperability Requirements

Part 3 - Consent Requirements

30

Signing page
Executed as a Deed on ------2018

2017______

System Operator
SIGNED, SEALED and DELIVERED by the Chief Executive Officer of the Australian Digital
Health Agency

________________________

Tim Kelsey
Chief Executive
Australian Digital Health Agency

Portal Operator

Executed as a Deed on ------2018

2017______

SIGNED, SEALED and DELIVERED by
[insert company name]
in the presence of:

)
)
)
)
)
)
)
)
)

_____________________________________
Signature of witness

_____________________________________
Full name and designation

_____________________________________
Date

0102201704072018

31

_____________________________________
Signature of representative who by executing this agreement
warrants that they are duly authorised to execute this deed
on behalf of
_____________________________________

_____________________________________
Full name and designation

 940-2-204?704072018

 

32

Annexure A - Production Environment Access Request Form

33

Annexure - Portal Operator Registration Form

34