My Health Records Rules 2026
My Health Record Security Requirements for Australian Healthcare Providers
If your practice is registered to use My Health Record, the My Health Records Rules 2026 set what your security and access policy must cover, how often it is reviewed, when staff are trained, and which records you keep for five years and which for two. Since 1 October 2026 they apply to every registered organisation. If the System Operator asks in writing, you have 7 days to produce the policy or the records.
Last reviewed 19 October 2026 against the My Health Records Rules 2026 as made. Where this page says you must, the requirement comes from the Rules or the My Health Records Act 2012. Guidance from the Australian Digital Health Agency or the OAIC is labelled as guidance. General information only. This page is not legal advice.
Does your practice have to comply?
These obligations are conditions of being registered in the My Health Record system. If your staff open or upload to patients’ My Health Records through your clinical software, your organisation is registered and they apply to you. A practice that is not registered is outside these Rules, although the Privacy Act still covers its health information whatever its turnover.
Registered provider organisations
GP clinics, specialist rooms, allied health practices, pharmacies, pathology, imaging and hospitals registered to use the system. Everything on this page applies to you.
Contracted service providers
IT and health information management businesses registered as contracted service providers carry their own, parallel policy obligation. They may access the system only as far as the organisation instructs them to.
Linked clinicians
Individual practitioners linked to your organisation must now be given the policy and be able to find it. When the link ends, the policy must say how their access is closed.
Small no longer means less
The 2016 Rule let an organisation leave out a policy requirement it reasonably judged did not fit its limited size. The 2026 Rules have no such clause. The Department of Health says the policy can be tailored to the organisation, but an organisation cannot simply decide an obligation does not apply to it. A three-person physio practice has to address the same five matters as a hospital.
What changed under the My Health Records Rules 2026
The My Health Records Rules 2026 replaced the My Health Records Rule 2016 on 1 April 2026. Organisations registered before that date could keep working to their 2016 policy until 30 September 2026. Since 1 October 2026 the new policy requirements apply to every registered organisation. An organisation registering on or after 1 April 2026 had to meet them from the start.
| Area | Under the 2016 Rule | Under the 2026 Rules |
|---|---|---|
| Small organisations | Could leave out a requirement that did not fit their limited size | No size exemption. Every matter must be addressed |
| Training | Before a person was given access | Before access, every year, and after significant changes to the law or the system |
| Records of how the policy was applied | No specific requirement | Required, kept for five or two years, and produced within 7 days of a request |
| Old policy versions | Kept under whatever record-keeping duties already applied | Every version kept for five years from the day it took effect |
| Policy review | At least annually, and when material new or changed risks are identified | The same, plus whenever the System Operator asks |
| Who must be given the policy | Employees and providers the organisation supplies services to under contract | Adds individual healthcare providers linked to the organisation |
| Security measures | Physical and information security | Adds cybersecurity, regular system maintenance, encryption, regular back-up, and monitoring of the measures |
| Data breaches | Policy covered identifying who requested access to a record | Also covers the processes that keep you within the Act’s data breach duties |
Sources: My Health Records Rules 2026 (Cth), ss 21, 43 to 46 and 72 · Department of Health, My Health Records legislative instruments FAQs (April 2026)
What your security and access policy must cover
Section 21 of the Rules requires a written policy that addresses five matters. It also sets a test for the whole document: it must be written so that your performance can be audited against it. A policy that only states good intentions fails that test. One that says who does what, when, and where it is recorded passes it.
| Required matter | What the policy has to set out |
|---|---|
| 1. Authorising users | How people are authorised to access My Health Record through your organisation, how accounts are created and changed, and how an account is suspended or deactivated when someone leaves, is compromised, no longer needs access, or is a linked clinician whose link ends. |
| 2. Training | The training each user receives before access, every year, and after significant changes. It must cover using the system accurately and responsibly, the legal obligations, and the consequences of breaching them. |
| 3. Access identification and breaches | The processes that make sure you can identify anyone who accessed a record on your behalf, and that you meet your data breach notification duties under the Act. |
| 4. Security measures | Your physical, information, cyber, technical and organisational measures, including user account management, regular system maintenance, encryption, regular back-up, and how you monitor and review those measures. |
| 5. Risk escalation | How security risks are identified quickly, acted on, and reported to management. |
The Australian Digital Health Agency and the OAIC publish a joint security and access policy template. Use it, but adapt it. When the OAIC reviewed GP clinics’ policies in 2022, it found templates that had not been tailored to the clinic. The Agency’s guidance is that a policy does not have to be signed and does not have to be one document, but it strongly recommends keeping it in one place.
How often the policy must be reviewed
The policy must be kept up to date, and every version must carry a unique version number and the date it takes effect. Section 43 also sets three review triggers.
At least once a year
A fixed minimum. Your user account practices have their own separate annual review requirement as well.
When risks change
Whenever a material new or changed risk is identified, such as new clinical software, a new site, remote access or an incident.
When the System Operator asks
New in 2026. A request from the Agency to review the policy is a review trigger in its own right.
Each review must consider what could lead to unauthorised access, misuse or accidental disclosure of record information, any changes to the My Health Record system that affect you, and any legal or regulatory changes since the last review.
A review date on the cover page is not a review
The Rules require the review but do not prescribe how you record it. If the only trace is a policy that has not changed in three years, you have nothing to show that the review happened. Recommended practice: record each review with its date, who did it, what was considered and what changed, including when the answer is “nothing”.
Staff and contractor training requirements
Training is owed to every user, meaning anyone you authorise to access My Health Record through your organisation. That includes contractors and locums, not only employees. Each user must be trained at three points.
Before access
No account until the training is done. This was the only training requirement under the 2016 Rule.
Every year
New in 2026. A clinician trained at onboarding in 2023 is now overdue.
After significant changes
New in 2026. Significant changes to the Act, the regulations, the Rules or the My Health Record system all trigger training.
The content is set too: how to use the system accurately and responsibly, the legal obligations on your organisation and its users, and the consequences of breaching them. Users must also be made aware of, and trained in, your account management practices. General cyber awareness training does not cover this on its own. The Explanatory Statement to the Rules says training a person completed with another provider may be enough, but you have to assess that and keep the record. Training records are kept for five years.
Access and user account management
Section 21(4) lists account practices your policy must include for the systems people use to reach My Health Record. These are requirements, not suggestions.
Required by the Rules
- Access only for users whose duties require it
- Every user uniquely identified, with a password or equivalent protection
- Passwords or equivalents secure enough for the risk
- Accounts deactivated when a user is no longer authorised
- Access suspended as soon as practicable after a compromise is discovered
- The practices themselves reviewed at least once a year
- Users aware of, and trained in, the practices
Regulator guidance, not law
- OAIC tips include passwords of 14 or more characters and multi-factor authentication for remote access
- The Agency says audit logs should capture who accessed a record, when, whose record it was and what was viewed
- Both recommend regular checks of audit logs for unusual access
- The Rules do not mandate multi-factor authentication by name
Shared logins are the fastest way to fail this. Under section 74 of the Act, your organisation carries a civil penalty if it cannot identify the person who accessed a record through it.
What records you must keep, and for how long
A policy sitting in a folder is not the end of the obligation. Section 45 requires a record of how you applied it: the accounts you opened and closed, the training you delivered, the processes you ran and the security measures you put in place.
| Record | Keep for | Counted from |
|---|---|---|
| Each version of the security and access policy | 5 years | The day that version took effect |
| How users were authorised: accounts created, changed, suspended and deactivated | 5 years | The day the record was created |
| Training provided to users | 5 years | The day the record was created |
| How you applied your access identification and data breach processes, which the Agency says can include audit logs | 2 years | The day the record was created |
| How you applied your security measures, such as maintenance, encryption, back-up and account management | 2 years | The day the record was created |
The five-year clock runs on each record separately. A training record created in November 2026 has to exist until November 2031, whoever is practice manager by then and whatever software the practice uses.
What the System Operator can ask for, and how fast you must answer
If the System Operator asks, the question is not whether you remember doing it. It is whether you can produce the record within 7 days.
The policy, any version
A written request can ask for your current policy or the version in force on a specified date. You have 7 days from receiving it.
The application records
New in 2026. The same 7 days applies to any of the five-year or two-year records in the table above.
Help with an audit
With reasonable notice, you must promptly give all necessary assistance with an audit or investigation the System Operator conducts.
The OAIC is the privacy regulator for My Health Record, and the Agency’s guidance notes that the OAIC may also ask for your policy. When the OAIC surveyed 300 GP clinics in 2021, over 30% did not provide a security and access policy when asked, and the OAIC said it was considering further regulatory action against them.
What is at stake
Contravening the Rules is a civil penalty under section 78 of the Act: up to 100 penalty units, and up to five times that for a company, which is $182,000 at the current $364 penalty unit. The System Operator can also suspend or cancel the organisation’s registration if it is no longer eligible or has breached a condition of registration. For a practice whose clinicians rely on My Health Record every day, losing access is the consequence that bites first.
Contractors, IT providers and linked clinicians
Outsourcing the IT does not outsource the obligation. Your policy has to cover the systems your users reach My Health Record through, including the ones an IT provider runs for you.
Contractors and locums
They must be given the policy if you supply services to them under contract, and trained before access if they are users. You must take all reasonable steps to make sure they follow it.
Registered service providers
A registered contracted service provider has its own policy duty, may act only on your instructions, and must not hold or process My Health Record information outside Australia.
Your other IT suppliers
Software and IT businesses that are not registered carry no direct duty under the Rules. The OAIC suggests building your security expectations into their contracts. That is guidance, and it is sensible.
A practical checklist for a medical or allied health practice
Our practical reading of the Rules for a practice that is already registered. Each item ties back to a requirement above.
Now
- Update the policy to the 2026 Rules, with a new version number and effective date
- Remove any reliance on the old size exemption
- Give the policy to every employee, contracted provider and linked clinician
- Check every user who has not been trained in the last 12 months
- Keep the superseded 2016 version. It is still a record
Every time staff change
- Train before access, and record it
- Create a unique account, never a shared one
- Deactivate the account when someone leaves or a clinician unlinks
- Keep each account change on record for five years
Every year, at least
- Review the policy and record the review
- Review your account management practices
- Retrain every user
- Check that you could produce any required record within 7 days
The hard part is year three, not week one
Writing the policy takes an afternoon. Keeping five years of versions, training, account changes and reviews organised through staff turnover, a new practice manager and a software change is where practices come unstuck.
Where Cleverer fits
- Store your own security and access policy with its version history, an owner, a review date and reminders as the review falls due
- Record who adopted the policy and when, and which staff have acknowledged it
- Set up your own recurring checks, such as an annual policy review or a user account review, each with an owner, a due date and the evidence you expect
- Keep every completed check with its date, result and attachment, and track anything that failed until it is fixed
- Track privacy and cyber training with completion dates, certificates and refresher cycles
- Produce an evidence pack on demand when someone asks
What stays with you
- Cleverer does not provide My Health Record training. The system-specific training the Rules require comes from your own program or the Agency’s resources
- Account records and audit logs live in your clinical software and the Agency’s systems, not in Cleverer
- Cleverer does not assess whether your policy meets the Rules. That judgement is yours
The Privacy Act asks the same question more broadly. Healthcare providers are covered whatever their size, and APP 11 requires reasonable steps to protect personal information. For what that evidence looks like across the practice, see how to prove cyber compliance.
Primary sources
- My Health Records Rules 2026 (Cth), F2026L00392, ss 21, 40, 43 to 46 and 72
- My Health Records Act 2012 (Cth), ss 51, 74, 75, 77 and 78
- Explanatory Statement to the My Health Records Rules 2026
- Australian Digital Health Agency, participation obligations
- OAIC, My Health Record security and access policy guidance
- OAIC, Security and Access policy Assessment 1: general practice clinic survey (2022)
Five years of records. Seven days to produce them.
Keep the policy versions, reviews, checks and training evidence in one place, with an owner and a due date on each, so the answer to a request is already on file.
Common questions about My Health Record security requirements
Do the My Health Records Rules 2026 apply to small practices?
Yes, if the practice is registered in the My Health Record system. The 2016 Rule let a small organisation leave out requirements that did not fit its size. The 2026 Rules removed that. The policy can be tailored, but every required matter must be addressed.
How long do My Health Record security records need to be kept?
Each policy version, records of user account creation, changes, suspension and deactivation, and training records are kept for five years. Records of how you applied your access identification and data breach processes, and your security measures, are kept for two years. Policy versions are counted from the day each took effect, and other records from the day they were created.
How often must the security and access policy be reviewed?
At least once a year, whenever a material new or changed risk is identified, and whenever the System Operator asks. Each version needs a unique version number and the date it takes effect.
How often do staff need My Health Record training?
Before they are given access, every year after that, and after any significant change to the Act, the regulations, the Rules or the My Health Record system. The requirement covers every user, including contractors and locums. The records are kept for five years.
What happens if we cannot produce our policy within 7 days?
Missing the deadline is a contravention of the Rules, which carries a civil penalty under the Act. The System Operator can also suspend or cancel a registration where the organisation has breached a condition of registration or is no longer eligible. The 7 days runs from when you receive the written request.
Can we use the OAIC and Agency policy template?
Yes, and it is a sensible starting point. It has to be adapted to how your practice actually works. The OAIC’s 2022 review of GP clinic policies found templates that had not been tailored, and a policy that does not describe your real processes cannot be audited against them.
Does the policy have to be signed or kept in one document?
Neither is a legal requirement. The Agency strongly recommends a single document so staff can find everything in one place, and some accreditation bodies require policies to be signed, so check your accreditor’s standard.
