Healthcare Identifiers Service Information Guide

Transcription

1 Healthcare Identifiers Service Information Guide Introduction and overview Audience This information guide is intended for all individual healthcare providers and organisations seeking to participate in the Healthcare Identifiers (HI) Service. This information will be useful to you if you are: an individual healthcare provider, such as a doctor, dentist and/or allied health professional a healthcare manager, such as an administrator, a hospital desk clerk or practice receptionist a chief executive of a healthcare organisation an officer of a contracted service provider that manages heathcare related information on behalf of a healthcare organisation. Benefits of the Healthcare Identifiers Service Communication of health information is a vital part of effective healthcare. The accurate identification of individuals is critical in all health communication. Mismatching of patients with their records and results is a documented problem for the health system and a clear link has been established between avoidable harm to patients and poor medical records management. Healthcare identifiers have been created to be used by healthcare providers to improve the security and efficient management of a health consumer s personal health information. Using an Individual Healthcare Identifier (IHI) provides a way for healthcare providers to more accurately match the right records to the person they are treating and improve accuracy when communicating information with other healthcare providers. This will help to avoid medical mix-ups or one person s information being recorded on another patient s file. Using identifiers will help give patients and healthcare providers confidence that the right health information is associated with the right patient at the point of care. Understanding healthcare identifiers The HI Service helps to identify people and organisations involved in healthcare across Australia, using a unique 16 digit identification number. There are three types of healthcare identifiers. Individual Healthcare Identifier (IHI) An IHI uniquely identifies individuals within Australia who receive healthcare, for example: Australian citizens permanent residents visitors to Australia. Healthcare Provider Identifier-Individual (HPI-I) A HPI-I uniquely identifies individuals who provide healthcare, for example: health professionals such as general practitioners and specialists nurses, dentists and pharmacists allied health professionals such as optometrists, speech therapists and social workers health professionals employed within public health services eligible alternative therapists such as acupuncturists and Chinese medicine practitioners. Healthcare Provider Identifier-Organisation (HPI-O) A HPI-O uniquely identifies organisations where healthcare services are provided, for example: hospitals medical practices pathology or radiology laboratories pharmacies state health departments. Healthcare identifiers can only be used for purposes described in the Healthcare Identifiers Act 2010 and Healthcare Identifiers Regulations 2010, including electronic referrals, discharges and medication management.

2 Introduction and overview Healthcare identifiers must be requested, collected and used in accordance with the Healthcare Identifiers Act 2010 and the Healthcare Identifiers Regulations A failure to do so can constitute an offence under the Healthcare Identifiers Act 2010 and the Privacy Act Important information about individual healthcare identifiers IHIs do not replace Medicare numbers and individuals will still need to use their Medicare card to claim benefits. Healthcare providers cannot refuse to provide healthcare if an individual does not have an IHI, the individual s IHI is not available, or the individual does not provide enough information to create an unverified IHI. Role of the Healthcare Identifiers Service Medicare Australia is the operator of the HI Service and manages the allocation, maintenance and disclosure of healthcare identifiers to authorised users. The HI Service is made up of the following elements. A national database of healthcare identifier numbers. This database does not store any clinical data. It only stores information relevant to healthcare identifiers. A Healthcare Provider Directory that lists contact details for healthcare providers and healthcare organisations. Access controls which provide secure online access to the HI Service for authorised individuals and organisations. As the operator of the HI Service, Medicare Australia is responsible for: operating and maintaining HI Service information technology systems ensuring the accuracy and security of the national database processing registrations from individual health professionals and organisations (HI Service registrations for Australian Health Practitioner Regulation Agency (AHPRA) registrants will occur automatically) disclosing IHIs to healthcare providers in accordance with strict legislative safeguards answering general enquiries about the HI Service from the public providing helpdesk services to authorised users of the HI Service (contact details are available at the end of this guide). Who can use the Healthcare Identifiers Service Healthcare Identifiers have been designed for use by individual healthcare providers and employees of healthcare organisations. Roles for each type of user have been developed so appropriate access to the system can be assigned for each. To use the HI Service an authorised user must be in one (or more) of the following roles. Responsible officer (RO) the officer of an organisation who accepts responsibility for the participation of their organisation in the HI Service. Organisation maintenance officer (OMO) the officer of an organisation who accepts responsibility for maintaining information about their organisation within the HI Service. Authorised employee an individual within an organisation who requires access to IHI records to assist with patient administration. Individual healthcare provider the health professional who provides healthcare services to the general public. The following information guides are available to help users understand their responsibilities when using the HI Service. Healthcare Identifiers Service Information Guide Responsible officer Healthcare Identifiers Service Information Guide Organisation maintenance officer Healthcare Identifiers Service Information Guide Authorised employee Healthcare Identifiers Service Information Guide Individual healthcare provider Individuals can act in more than one of these roles. Refer to relevant guide for information. Accessing the Healthcare Identifiers Service electronically Users can access the service with strict access credentials to perform their duties in the HI Service. Functions they are able to perform depends on their role(s). These credentials ensure that each user is able to access the HI Service with a high degree of security and information protection. There are two types of credentials that will be issued by the HI Service. An Individual Authentication Token or Individual Public Key Infrastructure (PKI). This token is a physical device required by ROs, OMOs and individual healthcare providers.

3 Introduction and overview An Organisation Authentication Certificate or Organisation PKI. This certificate is a software module required by an organisation accessing the HI Service. Once an authorised user has their access credentials, they can access the HI Service securely through their software system if it is compatible with the HI Service, or using Medicare Australia s Health Professional Online Services (HPOS). For information on developing software for the HI Service contact your software vendor. Understanding the Healthcare Provider Directory The Healthcare Provider Directory is a listing of healthcare providers registered with the HI Service. It can include contact and location details, as well as details of services provided. Once a healthcare provider is registered with the HI Service, they can choose to be listed in the Healthcare Provider Directory and nominate what information can be published. Users of the Healthcare Provider Directory can search for individual healthcare providers and organisations participating in the HI Service, using their unique identifier or demographic details. This will help when sending secure referrals, discharge summaries and forwarding test requests for patients. An organisation may want to link a healthcare provider s details to theirs in the Healthcare Provider Directory. The healthcare provider will need to provide their consent before this can take place. The Healthcare Provider Directory is not a public directory and is only available to healthcare providers and organisations registered with the HI Service. Understanding organisations There are two organisation types that operate within the HI Service. Seed organisation A seed organisation is a legal entity within Australia which provides or controls the delivery of healthcare services. It must be a healthcare provider organisation that has: one or more health professionals working for the entity and providing health services one RO one or more OMOs. Typically, seed organisations will be large healthcare provider organisations, for example, a major metropolitan hospital or a large medical practice. For smaller healthcare organisations or individuals who are sole traders, the practice can be registered as a seed organisation and the healthcare provider can be appointed as the RO and also the OMO. Refer to the Healthcare Identifiers Service Information Guide Responsible Officer for details on registering a seed organisation. Network organisation A network organisation is a healthcare provider organisation linked to either a seed or another network organisation, which has an OMO in the hierarchy acting on behalf of the organisation for HI Service purposes. A network organisation provides services as part of the seed organisation. It can be registered in order to identify an important business area or function within the seed organisation, such as a maternity ward or outpatient clinic within a hospital or surgeries managed under a larger medical practice. All eligible organisations, whether seed or network, will be issued with a Healthcare Provider Identifier - Organisation (HPI-O) upon registering with the HI Service. This identifier may be used to quickly and accurately identify the organisation in the course of healthcare delivery. Organisation hierarchies There can be one or more tiers of network organisations under a seed organisation (each network organisation may also have other network organisations linked underneath them if required), creating an organisation hierarchy. Refer to Diagram 1. There is no limit on the number of tiers that may exist under a single seed organisation or to the number of network organisations that may exist within a particular hierarchy.

4 Introduction and overview Diagram 1. Organisation Hierarchy Warwick Health (Seed Organisation) North Health (Network Organisation) Central Health (Network Organisation) South Health (Network Organisation) Port Hospital (Network Organisation) Maternity Ward 6A (Network Organisation) Emergency (Network Organisation) Seed organisation Network organisation In Diagram 1, Warwick Health Services (the seed organisation) has several network organisations immediately beneath, servicing the North, Central or South regions of Warwick Health. South Health has its own tier of network organisations, one of which is Port Hospital. Within Port Hospital there are more tiers which identify different health service delivery functions (for example, the Maternity or Emergency departments). For more information Online Call * *Call charges apply. 4820e.06.11

5 Healthcare Identifiers Service Information Guide Responsible officer Audience This information guide is intended for individuals authorised and responsible for registering a seed organisation and its hierarchy, who are accountable for the organisation s interaction with the Healthcare Identifiers (HI) Service. These individuals will act as a Responsible Officer (RO) when operating in this capacity. Required reading Make sure you have read the following material before reading this information guide. Healthcare Identifiers Service Information Guide Introduction and Overview Healthcare Identifiers Act 2010 Healthcare Identifiers Regulations Your responsibilities as a responsible officer As an RO you will be responsible for registering a seed organisation to participate in the HI Service. Your primary responsibility is to make sure your seed organisation, its network organisations and any authorised employees comply with the Healthcare Identifiers Act 2010 and supporting Healthcare Identifiers Regulations Your other responsibilities include: providing Medicare Australia (the HI Service Operator) with all relevant documentation to prove the organisation is eligible to participate in the HI Service being accountable for the authorised access to the HI Service by all organisations and employees in the seed organisation s hierarchy registering and linking at least one organisation maintenance officer (OMO) to the seed organisation creating a link between your organisation and a contracted service provider organisation if required. Refer to the Healthcare Identifiers Service Information Guide-Contracted Service Provider for more information. As an RO you are not authorised to search for an Individual Healthcare Identifier (IHI) or create an IHI within the HI Service. When registering an OMO you must supply accurate information about the individual you are registering. This is important as you will be responsible for the OMO s interactions with the HI Service, including any violations or breaches. For smaller healthcare organisations or individuals who are sole traders, you can also appoint yourself as an OMO. Refer to the Healthcare Identifiers Service Information Guide Organisation Maintenance Officer for the responsibilities of this role. Registering as a responsible officer You may register yourself as an RO: the same time as a seed organisation is registered as a replacement RO of an existing seed organisation. You will need to provide certified copies of supporting documentation with your form when registering with the HI Service. The form includes instructions on how to submit the information to Medicare Australia. For HI Service forms go to au then For health professionals > Healthcare Identifiers Service > Forms Maintaining your organisation s information The information provided to Medicare Australia about your organisation must be kept accurate and up-to-date. Maintenance of information for the seed organisation and network organisations is handled by the OMO. If you are also acting as an OMO, refer to the Healthcare Identifiers Service Information Guide Organisation maintenance officer for details about managing your organisation s information. 4820d Responsible officer_faweb_d1.indd 1 25/11/ :14:12 PM

6 Responsible officer Accessing the HI Service electronically Authentication Token Once you have been successfully registered as an RO you will be issued with an Individual Authentication Token or Individual Public Key Infrastructure (PKI) which will allow you to securely access the HI Service and protect the exchange of information. If you already have a token your permissions will be updated to allow you to perform your duties in the HI Service. For information about accessing the HI Service with PKI go to then For health professionals > Healthcare Identifiers Service > Accessing the HI Service with PKI. Once you have your Individual Authentication Token you can access the HI Service securely through your organisation s software system if it is compatible with the HI Service, or by using Medicare Australia s Health Professional Online Services (HPOS). For information on developing software for the HI Service contact your software vendor. For more information Online healthcareidentifiers@medicareaustralia.gov.au Call * *Call charges apply. 4820d d Responsible officer_faweb_d1.indd 2 25/11/ :14:13 PM

7 Healthcare Identifiers Service Information Guide Organisation maintenance officer Audience This information guide is intended for individuals responsible for maintaining information about their organisation(s) in the Healthcare Identifiers (HI) Service. These individuals will act as an organisation maintenance officer (OMO) when operating in this capacity. Required reading Make sure you have read the following material before reading this information guide. Healthcare Identifiers Service Information Guide Introduction and overview. Healthcare Identifiers Act Healthcare Identifiers Regulations Your responsibilities as an organisation maintenance officer As an OMO, you will be responsible for maintaining information associated with any organisation(s) you are linked to. The maintenance of this information allows your organisation(s) to be quickly and accurately identified for the purposes of healthcare delivery. Your duties as an OMO may include the following. Registering other OMOs to help with the task of maintaining information about your organisation(s). Organising a bulk offline Individual Healthcare Identifier (IHI) search of patients with records in your organisation s software systems. You will need to contact Medicare Australia and your software vendor to arrange this. As an OMO you are not authorised to search online for individual IHIs or create an IHI within the HI Service. Registering as an organisation maintenance officer You may be registered as an OMO in the following circumstances. At the same time a seed organisation is registered. This identifies you as a seed OMO and gives you authority to maintain information about any organisations in your hierarchy. The seed organisation s responsible officer (RO) will be responsible for registering you. At the same time as a network organisation is registered. This will give you authority to maintain information about your network organisation(s). You will also be able to update information of network organisations created underneath your organisation. An OMO above you in your organisation hierarchy will be responsible for registering you. At any other time to assist with maintenance activities. An OMO above you in your organisation hierarchy will be responsible for registering you. When registering another OMO you must provide accurate personal information about the individual. This is important as you may be held responsible for their interactions with the HI Service, including any violations or breaches. Maintaining your organisation s information As an OMO, you can update details about your organisation in the HI Service including: the name of your organisation the address of your organisation the contact details of your organisation entries your organisation has in the Healthcare Provider Directory, including any links to individual healthcare providers who work for your organisation. Refer to the Healthcare Identifier Service Information Guide Introduction and overview for information about the Healthcare Provider Directory.

8 Organisation maintenance officer To change or add names of legal entities and ABN details you must provide certified copies of supporting documentation to Medicare Australia. There is no limit to the amount of additional information you can provide about your organisation. You can provide as much or as little additional information as you feel is necessary to identify your organisation. You must, however, nominate a contact person and an address that Medicare Australia can use to contact your organisation. When creating or maintaining your organisation s information make sure the details you provide for your organisation(s), whether seed or network are unique within the HI Service, and consistent with how your organisation(s) is known in the community. This will make it easier for others to accurately identify your organisation and its Healthcare Provider Identifier Organisation (HPI-O). For example, using a name like Ward 5 or Medical Practice will not uniquely identify your organisation within either the HI Service or the health sector. It is recommended you consider using a name like Royal North Shore Hospital Maternity Ward, or North Shore Medical Practice as this will differentiate your organisation from other maternity or medical services and reduce confusion. Registering new organisations As an OMO, you can register new network organisations under your existing organisations. To register a new network organisation you will need to provide the name, address and contact details of the new organisation. Once your new organisation has been successfully registered you will receive a new HPI-O from the HI Service. You will also receive an Organisation Authentication Certificate or Organisation Public Key Infrastructure (PKI), which will allow you, your individual healthcare providers and your authorised employees to access the HI Service. Linking individual healthcare providers to your organisations The Healthcare Provider Directory can be used to search for individual healthcare providers and organisations participating in the HI Service, using their unique identifier or demographic details. This will help when sending secure referrals, discharge summaries and forwarding test requests for patients. You can link a current individual healthcare provider to one or more of your organisation(s) in the Healthcare Provider Directory. To do this you will need to: receive consent from the provider to make the link have at least one Healthcare Provider Directory entry for your organisation(s) know the Healthcare Provider Identifier-Individual (HPI-I) of the provider you want to link. If the individual healthcare provider no longer wants to be linked to your organisation you must remove the link immediately. If you do not know the HPI-I of the healthcare provider, you can search for their record in the Healthcare Provider Directory. If they already exist in the directory and you have found the correct record you can get their HPI-I. If you can t find the healthcare provider s record this it might be because they don t want to appear in the Healthcare Provider Directory. Accessing the HI Service electronically Authentication Token Once you have been successfully registered as an OMO you will be issued with an Individual Authentication Token or Individual Public Key Infrastructure (PKI), which will allow you to securely access the HI Service and protect the exchange of information. If you already have a token your permissions will be updated to allow you to perform your duties in the HI Service. Once you have your Individual Authentication Token you can access the HI Service securely through your organisation s software system if it is compatible with the HI Service, or by using Medicare Australia s Health Professional Online Services (HPOS). For information on developing software for the HI Service contact your software vendor. For more information Online healthcareidentifiers@medicareaustralia.gov.au Call * *Call charges apply. 4820a.06.11

9 Healthcare Identifiers Service Information Guide Authorised employees Audience This information guide is for authorised employees who access or maintain patient records within a healthcare organisation participating in the Healthcare Identifiers (HI) Service. Required reading Make sure you have read the following material before reading this information guide. Healthcare Identifiers Service Information Guide Introduction and overview. Your responsibilities as an authorised employee Authorised employees are responsible for making sure patient information in their local software system is correct, up-to-date and has a healthcare identifier assigned to it. This will help make sure the right health information is associated with the right individual at the point of care. Your duties as an authorised employee may include the following. Requesting and collecting the individual healthcare identifier (IHI) number of any new patients. Creating and updating unverified IHIs for patients who do not have an IHI, or who you can t find an IHI for (for example, a newborn baby or an overseas visitor). Creating and updating provisional IHIs for patients who can t be immediately identified. For example, an unconscious patient who is brought to a hospital and has no identification can have a provisional IHI created for them. Once they have regained consciousness or a family member identifies them, their provisional IHI can either be updated to an unverified IHI or merged with an existing verified IHI. Notifying the HI Service when patients are deceased. Healthcare identifiers must be requested, collected and used in accordance with the Healthcare Identifiers Act 2010 and the Healthcare Identifiers Regulations A failure to do so can constitute an offence under the Healthcare Identifiers Act 2010 and the Privacy Act Registering as an authorised employee Authorisation to access the HI Service will be provided by your organisation. Understanding individual healthcare identifiers IHIs can have a status of verified, unverified or provisional within the HI Service. Verified IHI When an IHI has a verified status it means the HI Service Operator (Medicare Australia) has evidence of an individual s identity, such as a passport, birth certificate or driver s licence. If an individual enrols in the Medicare program or registers with the Department of Veterans Affairs, Medicare Australia will automatically allocate a verified IHI if an unverified IHI does not exist. Unverified IHI When an IHI has an unverified status, it means the healthcare identifier was created at a healthcare facility and the individual has not provided evidence of identity to Medicare Australia. Provisional IHI When an IHI has a provisional status it means the identifier was created at a healthcare facility when the patient was unable to identify themselves (for example, they were unconscious). Provisional IHIs are temporary and expire after 90 days of no activity. You can update a provisional IHI to an unverified IHI or merge it with an existing verified IHI using your software system.

10 Authorised employees Things to be aware of when using the HI Service It is important to make sure that identifying information used for the purposes of searching for an IHI is as accurate and complete as possible. The HI Service processes all searches in good faith and on the understanding you are using the information the patient has given you. For example, for personal reasons, a patient may choose to use a name other than their given name (known as a pseudonym) or choose to be anonymous when seeking healthcare. You must use the information the patient has given you to search for, or create an IHI, even if you are aware of their real identity. Access to IHIs in the HI Service are recorded in an audit log, which captures user information and interactions with the HI Service. This information can be retrieved at any time by the healthcare individual. Penalties for unauthorised access apply under the Healthcare Identifiers Act If you are aware a patient s details are out-of-date and they are enrolled in Medicare, you should encourage them to contact Medicare Australia to have their details updated. If you suspect a patient has multiple IHIs, you should notify Medicare Australia. Medicare Australia will only merge an unverified IHI with a verified IHI where the patient s consent is provided. It is a matter for you to manage your patient records, including records where a patient appears to have multiple IHIs (such as a verified, unverified, or a provisional IHI) in accordance with the Healthcare Identifiers Act 2010, the Privacy Act 1988 and other relevant privacy laws. An IHI is not required for a healthcare individual to receive treatment. You cannot refuse treatment for a person who does not have an IHI, does not provide enough information to create an IHI, or who chooses to seek care anonymously or pseudonymously (using a name other than their given name). Accessing the HI Service electronically Authentication Certificate As an authorised employee you will be able to access the HI Service using your organisation s authentication credentials. The organisation access credentials are known as an Organisation Authentication Certificate or Organisation Public Key Infrastructure (PKI). This certificate is issued to an organisation after they have been successfully registered with the HI Service. You can access the HI Service securely through your organisation s software system if it is compatible with the HI Service, or by using Medicare Australia s Health Professional Online Services (HPOS). For information on developing software for the HI Service your OMO should contact your software vendor. For more information Online healthcareidentifiers@medicareaustralia.gov.au Call * *Call charges apply. 4820b.06.11

11 Healthcare Identifiers Service Information Guide Individual healthcare provider Audience This information guide is for individuals who are: an individual healthcare provider registered with the Australian Health Practitioner Regulation Agency (AHPRA), or a healthcare provider who is a member of a professional association that relates to the healthcare the member provides, and has uniform national membership requirements as outlined in the Healthcare Identifiers Act 2010 and the Healthcare Identifiers Regulations Required reading Make sure you have read the following material before reading this information guide. Healthcare Identifiers Service Information Guide Introduction and Overview. Healthcare Identifiers Act Healthcare Identifiers Regulations Your responsibilities as an individual healthcare provider As an individual healthcare provider registered with the HI Service you are responsible for keeping your personal information accurate and up-to-date, so you can be identified for the purposes of healthcare delivery. In the HI Service you can update details including: your name registration details speciality details (the type of health services you provide) address contact details entries in the Healthcare Provider Directory. Refer to the Healthcare Identifier Service Information Guide Introduction and overview for information about the Healthcare Provider Directory. To change information provided to the HI Service as part of your registration, you will need to provide Medicare Australia with certified copies of supporting documentation. If you are registered through the Australian Health Practitioner Regulation Agency (AHPRA) you need to notify AHPRA of any changes to your information. AHPRA will then inform Medicare Australia of these changes. There is no limit to the amount of additional information you can provide about yourself, but you must provide an address, and a telephone number or address that can be used by Medicare Australia to contact you. The details you provide should be consistent with how you are known in the community as this will make it easier for others to accurately identify you. As an individual healthcare provider you can also: request, collect and use Individual Healthcare Identifiers (IHIs) from the HI Service for your patients create unverified and provisional IHIs in the HI Service use the Healthcare Provider Directory to obtain details of other healthcare providers for the purposes of securely sending health information such as discharge summaries, test requests or referrals. Healthcare identifiers must be requested, collected and used in accordance with the Healthcare Identifiers Act 2010 and the Healthcare Identifiers Regulations Failure to do so can constitute an offence under the Healthcare Identifiers Act 2010 and the Privacy Act You can also act as an authorised employee within the HI Service. Refer to the Healthcare Identifiers Service Information Guide Authorised employees for more information about the responsibilities of this role.

12 Individual healthcare provider If you are the owner of a small healthcare organisation you can also act as the responsible officer and organisation maintenance officer for your organisation. Refer to the Healthcare Identifiers Service Information Guide Responsible officer and Healthcare Identifiers Service Information Guide Organisation maintenance officer for more information about the responsibilities of these roles. Registering as an individual healthcare provider You can register as an individual healthcare provider with the HI Service in one of two ways. Through AHPRA, current membership boards are as follows: Chiropractic Board of Australia Dental Board of Australia Medical Board of Australia (GPs and specialists) Nursing and Midwifery Board of Australia Optometry Board of Australia Osteopathy Board of Australia Pharmacy Board of Australia Physiotherapy Board of Australia Podiatry Board of Australia Psychology Board of Australia. Through the HI Service Operator (Medicare Australia). AHPRA will provide Medicare Australia with information for their registrants and notify registrants of their Healthcare Provider Identifier-Individual (HPI-I) number. Understanding individual healthcare identifiers Individual Healthcare Identifiers (IHIs) can have a status of verified, unverified or provisional within the HI Service. Verified IHI When an IHI has a verified status it means the HI Service Operator (Medicare Australia) has evidence of an individual s identity, such as a passport, birth certificate or driver s licence. If an individual enrols in the Medicare program or registers with the Department of Veterans Affairs, Medicare Australia will automatically allocate a verified IHI if an unverified IHI does not exist. Unverified IHI When an IHI has an unverified status, it means the healthcare identifier was created at a healthcare facility and the individual has not provided evidence of identity to Medicare Australia. Provisional IHI When an IHI has a provisional status it means the identifier was created at a healthcare facility when the patient was unable to identify themselves (for example, they are unconscious). Provisional IHIs are temporary and expire after 90 days of no activity. You can update a provisional IHI to an unverified IHI or merge it with an existing verified IHI using your software system. Things to be aware of when using the HI Service It is important to make sure identifying information used for the purposes of searching for an IHI is as accurate and complete as possible. The HI Service processes all searches in good faith and on the understanding you are using the information the patient has given you. For example, for personal reasons, a patient may choose to use a name other than their given name (known an a pseudonym) or choose to be anonymous when seeking healthcare. You must use the information the patient has given you to search for, or create an IHI, even if you are aware of their real identity. Access to IHIs in the HI Service are recorded in an audit log, which captures user information and interactions with the HI Service. This information can be retrieved at any time by the healthcare individual. Penalties for unauthorised access apply under the Healthcare Identifiers Act If you are aware a patient s details are out-of-date and they are enrolled in Medicare, you should encourage them to contact Medicare Australia to have their details updated. If you suspect a patient has multiple IHIs, you should notify Medicare Australia. Medicare Australia will only merge an unverified IHI with a verified IHI where the patient s consent is provided. It as a matter for you to ensure you manage your patient records, including records where a patient appears to have multiple IHIs (such as a verified, unverified, or a provisional IHI) in accordance with the Healthcare Identifiers Act 2010, the Privacy Act 1988 and other relevant privacy laws.

13 Individual healthcare provider An IHI is not required for a healthcare individual to receive treatment. You cannot refuse treatment for a person who does not have an IHI, who does not provide enough information to create an IHI, or who chooses to seek care anonymously or pseudonymously (using a name other than their given name). Accessing the HI Service electronically Authentication tokens and certificates Once you have been successfully registered with the HI Service you will be issued with an Individual Authentication Token or Individual Public Key Infrastructure (PKI), which will allow you to securely access the HI Service and protect the exchange of information. If you already have a token your permissions will be updated to allow you to perform your duties in the HI Service. You can also access the HI Service as an authorised employee using your organisation s access credentials, referred to as an Organisation Authentication Certificate or Organisation PKI. This certificate will be issued to an organisation after it has been successfully registered with the HI Service and a request for the certificate has been made. Once you have your Individual Authentication Token, or your organisation has its Organisation Authentication Certificate, you can access the HI Service securely through your organisation s software system if it is compatible with the HI Service, or by using Medicare Australia s Health Professional Online Services (HPOS). For information on developing software for the HI Service contact your software vendor. For more information Online healthcareidentifiers@medicareaustralia.gov.au Call * *Call charges apply. 4820c.06.11

14 Healthcare Identifiers Service Information Guide Contracted service provider A Contracted service provider (CSP) is an organisation that can act on behalf of a healthcare provider organisation. A CSP can obtain Healthcare Identifiers from the HI Service, and use or disclose healthcare identifiers in the course of providing IT services for communicating or managing health information on behalf of a healthcare provider organisation. Audience This information guide is for: Contracted service provider (CSP) officers who are authorised to register and act on behalf of a CSP organisation when using the Healthcare Identifiers (HI) Service responsible officers (ROs) of a healthcare provider organisation who will be linking a CSP organisation to the healthcare organisation(s) in their hierarchy. Healthcare provider organisations such as hospitals, general medical practices, pharmacies, pathology and diagnostic imaging facilities may wish to engage the services of a CSP to assist in the electronic interaction with the HI service. CSP organisations need to register with the HI Service. Required reading Ensure you have read the following material before reading this information guide. Healthcare Identifiers Service Information Guide Introduction and Overview Healthcare Identifiers Act 2010 Healthcare Identifiers Regulations Registering with the HI Service To register with the HI Service, a CSP organisation needs to have at least one (but no more than three) employee/s who are authorised to be the point of contact between the CSP and the HI Service. These employees, called CSP officers, will have specific responsibilities in relation to the HI Service. Your responsibilities as a CSP officer As a CSP officer you will be responsible for making sure the information the HI Service holds about your CSP organisation is up to date and correct. Your duties as a CSP officer may include the following. Providing Medicare Australia with relevant documentation to prove the CSP organisation is eligible to participate in the HI Service. Registering other CSP officers to help you maintain information about your organisation. Organising an Individual Healthcare Identifier (IHI) search of patients who s records you manage. This search is undertaken on behalf of healthcare provider organisation you are linked to. NOTE: Healthcare identifiers must only be requested, collected and used in accordance with the Healthcare Identifiers Act 2010 and the Healthcare Identifiers Regulations Failure to do so can constitute an offence under the Healthcare Identifiers Act 2010 and the Privacy Act Registering as a CSP officer To register as a CSP officer with the HI Service you must: register your own profile in the HI Service and provide 100 points of identification (unless you are a known Medicare Australia or HI Service customer who has previously provided 100 points of identification) provide a letter stating that you have authority to act on behalf of the CSP organisation in dealings with the HI Service. Responsible officers (ROs) and organisation maintenance officers (OMOs) in healthcare provider organisations can also be registered as CSP officers.

15 Contracted service provider As a CSP officer, you will need to register: when your CSP organisation is initially registered; and whenever the person performing the CSP officer role for your CSP organisation changes. You will need to provide certified copies of supporting documentation with your form when registering with the HI Service. The form includes instructions on how to submit the information to Medicare Australia. For HI Service forms go to then For health professionals > Healthcare Identifiers Service > Contracted service provider forms Maintaining your CSP organisation s information You can maintain the following information on behalf of your CSP organisation: the name of your organisation the address of your organisation the contact details of your organisation. To change or add names of legal entities and ABN details you must provide Medicare with certified copies of supporting documentation. There is no limit to the amount of additional information you can provide about your organisation. You can provide as much or as little additional information as you feel is necessary to identify your organisation. You must, however, nominate a contact person, telephone number or , and an address that Medicare can use to contact your organisation. Accessing the HI Service electronically Authentication tokens and certificates After your CSP organisation has been registered, you will be issued with an Organisation Authentication Certificate or Organisation Public Key Infrastructure (PKI). This will allow you to securely access the HI Service on behalf of the healthcare organisation to whom you are contracted. For information about accessing the HI Service with PKI go to then For health professionals > Healthcare Identifiers Service > Accessing the HI Service with PKI For more information Online healthcareidentifiers@humanservices.gov.au Call * *Call charges apply. Creating a link between a CSP organisation and a healthcare organisation When a CSP record is created it will automatically be set to a status of deactivated until a healthcare provider organisation record is linked to the CSP record. A healthcare provider organisation may link its record with a CSP s record, after it contracts that CSP to provide health information services. A CSP cannot access the HI Service until it is linked to an active healthcare organisation. The link between the healthcare organisation and the CSP organisation can only be made by the healthcare organisation s RO. For HI Service forms go to then For health professionals > Healthcare Identifiers Service > Contracted service provider forms 4820f.06.11