The person in charge of a health establishment in possession of a user’s health records must set up control
measures to prevent unauthorised access to those records and to the storage facility in which, or system by
which, records are kept.
