From 1 October 2026, healthcare provider organisations (HPOs) participating in the My Health Record system will be required to comply with updated Security and Access Policy requirements under Rule 21 of the My Health Records Rules 2026.
As part of the Digital Health Sprint Series, Gippsland PHN will be running practical sessions to support practices to understand the changes and prepare their Security and Access Policies for implementation. Further details and registration links will be available closer to the session dates.
The changes at a glance
- Policy scope and ownership
Rule 21 requires all organisations, regardless of their size, to maintain a written Security and Access Policy that addresses all required topics, while remaining appropriately tailored to local circumstances.
- User access management becomes more structured
Rule 21 places greater focus on procedures across the user account lifecycle, creating and modifying user access, suspending and deactivating accounts and regularly reviewing permissions.
- Training becomes ongoing
Training requirements extend beyond initial onboarding. Practices should consider annual refresher training and retaining training records for five years.
- Compliance obligations expand
Rule 21 expands expectations from identifying access to My Health Record under section 74 of the My Health Records Act 2012 to managing and responding to My Health Record-related data breaches under section 75.
Practices may wish to:
- Confirm that users accessing My Health Record can be uniquely identified
- Review how access activity is logged and monitored
- Include My Health Record breach processes within broader governance activities
How will compliance be monitored?
The Australian Digital Health Agency (ADHA) may undertake compliance activities to understand whether HPOs have implemented and are operating an appropriate My Health Record Security and Access Policy.
For further information and practical guidance, visit the Australian Digital Health Agency’s My Health Record participation obligations guidance.
Stay connected to the latest primary health news
Gippsland PHN produces a range of informative newsletters designed to keep you in the loop with industry news, important updates, insights, training and events opportunities, and much more.
Subscribe or update your preferences below.
