2. My Health Account new feature - guide for general practice administrators

My Health Account General practice team administrators’ guide – enabling people to confirm who they are through their general practice team released February 2022

Introducing My Health Account My Health Account is a Ministry of Health service that helps people to create a digital health identity.

We provide a secure way for health consumers to verify who they are online.

Digital Identity is used to prove who you are so you can gain access to online health services.

Overview for general practice teams How general practice teams can support people to create their My Health Account Some people are not able to create their My Health Account to access My Covid Record. This means that they cannot download a copy of their My Vaccine Pass as they do not have any of the documents needed to verify their identity.

We want to help around 300,000 My Health Account holders who are in this position. To do this, we would like your help. These are the roles involved in assisting people with their My Health Account:

Page 2 of 12

From later in February 2022, we are offering people a new pathway to verify their identity so they can gain access to their My Covid Record, My Vaccine Pass, and other future online health services.

People who are enrolled with a general practice team will be able to use information already held on their National Enrolment Service record to confirm their identity.

Most people’s contact details will be up to date and no assistance will be required from general practice teams. For those people who don’t often visit their general practice team, they may need to get in touch with their general practice team to update their details.

The new feature to help people verify their identity and create their My Health Account Through the great work of general practice teams, around four million patients have recorded their mobile phone number with their general practice team.

My Health Account is releasing a new feature to allow people to create their My Health Account using the mobile phone details recorded by their general practice team on their National Enrolment Service (NES) records.

The feature will allow My Health Account to attempt to match the details the person submits against their NHI and NES details, and then send a one-time code to the mobile phone number they have recorded on their NES details.

Once a match is made, and the one-time code is entered, people will be able to create their My Health Account and gain access to their My Covid Record, My Vaccine Pass, and other future online health services.

No clinical details are involved in this process.

Benefits of the new feature This new feature in My Health Account will mean: •

accurate and up-to-date patient records for general practice teams

•

more patients able to create their My Health Account

•

more patients able to access My Covid Record, download their My Vaccine Pass, and access other future online health services

•

we can provide a more equitable and accessible My Health Account digital identity service for people

Page 3 of 12

Quick reference guide for new My Health Account feature

Page 4 of 12

Helpful information for general practice administrators What to do when people call and ask to update their contact details Some people trying to set up their My Health Account using the new feature may be prevented from progressing for two reasons: 1. because they cannot find the name of their general practice (we provide a ‘drop down’ list within My Health Account to assist them). If this occurs, people will be prompted to call the Ministry of Health’s contact centre or their general practice team for assistance.

2. because their details are out-of-date, or don’t exist on the NES record (this will mainly be their mobile phone number contact). If this occurs, they will be prompted to contact their general practice team to update their details before returning to My Health Account to complete the account upgrade process.

General practice teams will play an important role in supporting their patients to update their contact details. People may contact their general practice team by telephone or email. It is most likely that their first point-of-contact will be general practice receptionists or administrators.

Things to consider before updating a person’s contact details General practice teams need to ensure that they confirm the identity of the person asking for their details to be updated. General practice teams may have their own policies and practices to mitigate the risk of identity theft or people registering with false information in order to obtain prescription drugs.

Name, address, mobile phone number, and email address details should only be updated once the person’s identity has been confirmed.

If there are any concerns about the validity of the request to update details, please ask the person to come to the general practice team in person with proof of identity.

Page 5 of 12

Verifying a person’s identity before updating personal details General practice teams generally have a robust process to confirm the person’s identity before updating any patient records to protect people’s privacy and prevent identity theft. This is normally done by: 1. asking them to provide the email address held on record by the general practice team 2. asking them to provide their NHI number 3. asking them to provide the contact mobile phone number held on record by the general practice team (noting that this is the contact detail that may be out of date) 4. asking them to answer a question that only they would know, such as: a. “Please tell us the details of any repeat prescriptions that you have” or b. “Please tell us if you have had a lab test within the last six months and, if yes, what it was for”.

Note: when verifying a person’s identity, do not ask for the person’s name, date of birth, or address in order to confirm their identity as this information is often easily discoverable, particularly on social media. This makes these details susceptible to socially-engineered attacks.

Updating contact details for 12 to 15-year-olds Anyone over 12 years of age can create a My Health Account.

General practice teams may be contacted by 12 to 15-year-olds asking for their contact details (mobile telephone number or email address) to be updated.

In these instances, it is common policy for general practice administrators to ask to speak to the young person’s guardian (parent, caregiver, or someone with legal appointment as a guardian) before making changes to the young person’s contact details.

General practice teams must follow the same robust process to confirm the person’s identity before updating any patient records for 12 to 15-year-olds.

Page 6 of 12

Any questions about My Health Account If Practice Administrators or Managers have any questions, you can: •

call us on 0800 222 478 or +64 6 927 6900 during standard office hours, 8am to 5pm Monday to Friday

•

email your query and/or feedback to support@identity.health.nz

Want to know more about My Health Account To find out more about My Health Account: •

Visit My Health Account on the Ministry of Health website

•

Details about the new My Health Account feature which allows people to confirm who they are using NES details recorded by their general practice team will be published on the My Health Account page when the new feature is released later in February.

Page 7 of 12

Appendix 1 – User journey for new My Health Account feature How a person can confirm their identity using details held by their general practice team Step 1: Person selects that they want to confirm who they are using their healthcare provider

Step 2: They consent to the information held by their general practice team to be used to confirm their identity

Page 8 of 12

Step 3: They search for and select their enrolled general practice using a typeahead search. Once selected, all that general practice team’s details are displayed so the user knows they have chosen the correct one.

Step 4: The user enters their personal details, which is used to search for their NHI

Page 9 of 12

Step 5: Once the NHI number is matched, their mobile phone number is retrieved from the NES records of that practice and the last four digits displayed (so they can identify if they still have that mobile phone number).

Step 6a: If the phone number is correct, a six-digit code is sent to the mobile phone

Page 10 of 12

Step 7a: The person enters the six-digit code into My Health Account, then the person is able to successfully confirm who they are and are either redirected back to My Covid Record or to their My Health Account landing page.

or

Step 6b: If the number displayed on the screen is wrong (they do not hold that mobile phone number), they can click on the “My number is wrong" button on the bottom left of the screen

Page 11 of 12

Step 7b: The person then gets a message asking them to contact their general practice team to update their contact details before continuing with the process to set up their account

Step 8b: The person updates their details with their general practice team Once the person verifies their identity and updates their details with their general practice team, they can return to My Health Account and go through the process again to set up their new account.

They follow the same steps. Once they confirm the phone number is correct, a sixdigit code is sent to the phone.

The person enters the six-digit code into My Health Account, then the person is able to successfully confirm who they are and are either redirected back to My Covid Record or to their My Health Account landing page.

Page 12 of 12