Healthcare practices handle highly sensitive patient information every day. Protecting that information involves more than securing computers and maintaining passwords. It also requires clear policies, appropriate staff access, regular training and documented processes for managing security risks. Australia’s My Health Records Rules 2026 introduced updated requirements for healthcare provider organisations participating in My Health Record, covering areas including user account management, staff training, cybersecurity, data breach response and record keeping. Existing registered organisations were required to align their Security and Access Policy with the updated Rules by 1 October 2026.[2][4] With that deadline now passed, practice managers should ensure their policies and procedures reflect the current requirements and that the documented processes are being followed in practice.
What Are the My Health Records Rules 2026?
The My Health Records Rules 2026 replaced the previous 2016 Rules and commenced on 1 April 2026. The updated framework sets out requirements for healthcare provider organisations that register with, or remain registered with, Australia’s My Health Record system.[2]
A key requirement is having a written My Health Record Security and Access Policy that explains how an organisation manages access to the system, protects patient information and responds to security risks. The policy must also be written in a way that allows the organisation’s performance to be audited against it.[2]
The Australian Digital Health Agency states that organisations must establish, maintain, communicate and enforce this policy. It must address the requirements specified in the Rules and be tailored to the organisation’s circumstances.[1]
Under the transition arrangements, existing registered healthcare provider organisations continued under the previous requirements until 1 October 2026. From that date, the new policy requirements apply. That date has now passed.[2]
Key takeaway: A Security and Access Policy is not simply a document to keep on file. It needs to reflect how your practice actually manages user access, staff training, patient information and security incidents.
Who Needs to Comply With the Updated Rules?
The requirements apply to healthcare provider organisations registered with My Health Record, regardless of their size or how frequently they use the system.
This means the obligations are relevant to small general practices, specialist clinics and larger healthcare organisations alike. Organisations are required to maintain an appropriate Security and Access Policy even if staff access My Health Record infrequently or the organisation is not actively using the system at a particular time while remaining registered.[1]
The policy should reflect how the organisation interacts with My Health Record. For example, a practice that views and uploads information through conformant clinical software may have different access procedures from an organisation that only uploads documents or uses the National Provider Portal to view records.
Practices should therefore review their own arrangements rather than assume a generic template or another organisation’s policy will meet their needs.
What Has Changed for Medical Practices?
The updated Rules strengthen expectations across several areas of security and access management. For practice managers, the practical task is to ensure that policies, responsibilities and supporting records address each relevant requirement.
1. User Access Management
Practices need documented procedures explaining how individuals are authorised to access My Health Record, how their accounts are created and modified, and how access is suspended or deactivated when it is no longer appropriate.
The policy must explain how a user’s account is suspended or deactivated when:[2]
- the user leaves the organisation
- the user’s security is compromised
- the user’s duties no longer require access to My Health Record
- the user is an individual healthcare provider who ceases to be linked to the organisation
Practices should review who has access, whether those permissions remain appropriate and who is responsible for making and recording changes.
2. Identifying Individual Users
Healthcare organisations must be able to identify the individual who accessed a patient’s My Health Record when required.
Each interaction with My Health Record is logged by conformant clinical software or the National Provider Portal, as applicable. Organisations must be able to establish which individual is associated with a user ID and communicate that person’s identity to the System Operator when requested.[1]
For practices, this reinforces the importance of individual user accounts, accurate user registers and clear processes for investigating access activity.
Shared logins can make it difficult to establish who performed a particular action. Practices should ensure that their access arrangements allow individual users to be identified in accordance with their obligations.
3. Staff Training and Training Records
Staff training is another important part of the updated requirements.
Before being authorised to access My Health Record, users must receive training covering:
Responsible system use: How to use My Health Record accurately and appropriately.
Legal obligations: The obligations that apply to the healthcare organisation and individuals using the system.
Consequences of non-compliance: The consequences of breaching those legal obligations.
Training must also be provided annually and following significant changes to the My Health Record system or its governing legislation. Organisations must maintain evidence of training, including appropriate registers or completion records.[1]
For practice managers, this means ensuring that training is not only delivered but also documented and retained for the required period.
4. Data Breach Management
The updated framework requires practices to have processes for identifying, containing, assessing and reporting actual or potential My Health Record data breaches.
A data breach may involve unauthorised collection, use or disclosure of information in a patient’s My Health Record. It can also involve an event or circumstance that compromises, or may compromise, the security or integrity of the system.[1]
A documented response process should establish who is responsible for investigating incidents, assessing risks, taking steps to contain a breach and making the required notifications. The Australian Digital Health Agency states that the policy should outline how the organisation will notify the System Operator and, where relevant, the Office of the Australian Information Commissioner (OAIC).[1]
Practices should not wait until a breach is confirmed before following the applicable process. The requirements cover breaches that have or may have occurred.
5. Cybersecurity and Information Security
The Security and Access Policy must address physical security, information security, cybersecurity, technical measures and organisational controls.
The exact measures should reflect the organisation’s size, systems, operations and risks. Examples identified in the official guidance and the Rules include:[1][2]
Access controls: Restricting access to authorised individuals, uniquely identifying users, protecting user identities and disabling accounts when access is no longer required.
Authentication: Using password or equivalent protection mechanisms that are sufficiently secure and robust. The Agency gives strong passwords or multi-factor authentication as examples of cybersecurity measures.
Device security: Protecting devices and workstations from unauthorised physical access and preventing confidential information from being viewed by unauthorised people.
System maintenance: Applying software updates and security patches in a timely manner and monitoring for vulnerabilities or unusual behaviour.
Data protection: Documenting relevant data protection, encryption and backup measures.
These measures should be reviewed regularly to ensure they remain appropriate and effective. The updated Security and Access Policy template provides further guidance on documenting relevant controls.[1]
6. Ongoing Risk Management and Policy Reviews
Security is not a one-off exercise. Practices need strategies for identifying My Health Record-related security risks, taking appropriate action and reporting relevant matters to management.
The Security and Access Policy must be reviewed at least annually, when material new or changed risks are identified, and when requested by the System Operator. Each review must consider factors that could lead to unauthorised access, misuse or accidental disclosure, any changes to the My Health Record system that may affect the organisation, and any relevant legal or regulatory changes since the last review.[2]
Each version of the policy must also carry a unique version number and the date it comes into effect.[1][2]
Changes to staff, systems, responsibilities or the way a practice accesses My Health Record may mean its existing procedures need to be reviewed.
Practice managers should ensure there is a clear policy owner, a documented review process and a way to record any changes or corrective actions.
Record-Keeping Requirements for My Health Record
One important aspect of the updated Rules is the requirement to retain records demonstrating how the organisation has implemented its Security and Access Policy.
The Australian Digital Health Agency identifies different retention periods depending on the type of record being maintained.[1]
Records generally retained for five years include:
User account management records, including evidence of accounts being created, modified, suspended or deactivated, as well as records of required staff training.
Each version of the Security and Access Policy must also be retained for five years from the date that version comes into effect.
Records generally retained for two years include:
Records relating to the identification of users accessing My Health Record, data breach management, and the implementation of physical security, information security, cybersecurity, technical and organisational measures.
Practical tip: Review where your practice stores its policy versions, staff training records, user access registers, incident records and security documentation. Make sure the responsible staff members can locate the required evidence when needed.
These records help demonstrate that the practice is implementing the procedures documented in its policy, rather than relying on written statements alone.
Time Limits and Consequences to Be Aware Of
The Rules include some short time limits that practice managers should have built into their procedures.[2]
Requests from the System Operator: If the System Operator asks for a copy of your Security and Access Policy, or for your application records, you must provide them within 7 days of receiving the request. The System Operator can ask for the current policy or a previous version.
Notifying the System Operator: Registered healthcare provider organisations must notify the System Operator in writing within 2 business days of certain events. These include becoming aware of a non-clinical error in information accessed or downloaded from My Health Record, a material change to the organisation, or a change to a responsible officer or organisation maintenance officer or their contact details.
The Australian Digital Health Agency notes that organisations that do not comply with the policy requirements may not be eligible to participate in My Health Record and may have their registration revoked. The OAIC is the privacy regulator for My Health Record and may consider regulatory action if an organisation does not have a compliant policy.[1]
A Practical My Health Record Compliance Checklist
For practice managers reviewing their arrangements following the 1 October 2026 deadline, the following checklist provides a starting point.
Review your policy: Confirm that your Security and Access Policy reflects the My Health Records Rules 2026 and the way your practice operates, and that each version has a unique version number and effective date.
Check user access: Review authorised users, individual identifiers, user permissions and processes for modifying or deactivating accounts.
Confirm responsibilities: Ensure the relevant staff members know who manages access, maintains the policy and responds to security incidents.
Review staff training: Confirm that authorised users have completed the required training and that completion records are retained.
Verify security controls: Review authentication, cybersecurity, device security, data protection, software maintenance and other relevant measures.
Check incident procedures: Ensure there is a clear process for reporting, assessing, containing and notifying relevant parties about actual or potential data breaches.
Know your time limits: Make sure someone can provide your policy and records to the System Operator within 7 days and report notifiable changes within 2 business days.
Audit your records: Confirm that required records are available and retained for the relevant periods.
Schedule future reviews: Record the next policy review date and establish a process for reviewing the policy when material risks or circumstances change.
The official Australian Digital Health Agency template is a useful starting point. However, the Agency makes clear that using a template does not automatically guarantee compliance. It needs to be completed and tailored to the circumstances of the individual organisation.[1]
Access the official My Health Record participation obligations and policy template →
What Role Does Practice Management Software Play?
Practice management and clinical software form an important part of the systems healthcare organisations use to manage patient information and control access to sensitive data.
However, software is only one component of a practice’s broader security arrangements. Compliance also depends on how the practice configures its systems, authorises staff, maintains its policies, delivers training and manages incidents.
When reviewing their software, practice managers should consider several questions.
User permissions: Can access to sensitive information be restricted according to staff roles and responsibilities?
Authentication: What authentication options are available to help protect user accounts against unauthorised access?
Individual accountability: Does the software support the access and user identification processes required for the practice’s particular systems and configuration?
Security controls: What measures are available to protect information, and what responsibilities remain with the practice or its IT provider?
My Health Record access: If clinical software is used to access My Health Record, how are relevant user identities and activity recorded, and how can the practice retrieve the information when required?
These questions can help practices evaluate whether their software and internal processes work together to support their security responsibilities.
How Zedmed Supports Practice Data Security
At Zedmed, protecting practice and patient information is an important consideration in the development and delivery of our practice management software.
Zedmed’s published security capabilities include several features that can support a practice’s broader approach to information security.
ISO 27001 certification: Zedmed is an ISO 27001-certified business, with independently audited information security management practices.
Duo two-factor authentication: Zedmed Cloud supports Duo two-factor authentication, adding an additional authentication step to help protect user logins.
Granular user permissions: Zedmed allows practices to customise user roles and permissions, helping restrict access to areas such as appointment books, clinical notes and financial reports according to staff responsibilities.
Cloud security: Zedmed Cloud runs on Amazon Web Services (AWS), providing cloud infrastructure with security capabilities that support the protection of information.
These capabilities are part of the broader security approach practices should consider when evaluating their clinical and practice management software.[3]
Importantly, no individual software feature or certification automatically makes a healthcare organisation compliant with the My Health Records Rules. Practices must ensure their own policies, processes, configurations and records meet the requirements applicable to them.
Why Security Is an Ongoing Priority for Healthcare Practices
Healthcare organisations manage information that is deeply personal to patients. Maintaining appropriate security requires a combination of technology, staff awareness, clear responsibilities and effective processes.
The updated My Health Records Rules reinforce the importance of managing user access, keeping staff appropriately trained, maintaining security controls and having documented processes for identifying and responding to risks.
For practice managers, this is an opportunity to review more than a single policy. It is a chance to examine whether the practice’s systems, staff procedures and record-keeping arrangements work together to protect patient information.
It is also a reminder that security should be considered when choosing and reviewing clinical software. Understanding the available controls, how user activity is managed and what responsibilities remain with the practice can help support a more informed decision.
What Should Your Practice Do Next?
The 1 October 2026 deadline for existing registered healthcare provider organisations to align their Security and Access Policy with the My Health Records Rules 2026 has passed.
If your practice has not yet completed its review, prioritise updating your policy and confirming that the required processes are implemented. If you have already completed the review, ensure your policy remains current, your staff understand their responsibilities and your supporting records are maintained.
Start with the official Australian Digital Health Agency guidance, tailor the policy to your practice and seek professional advice where necessary.
When reviewing your clinical software, consider the security controls available to your practice and how they fit into your wider approach to protecting patient information.
Explore how Zedmed supports practice data security →
This article is general information only and is not legal advice. Requirements may change and may apply differently to your organisation. Refer to the My Health Records Rules 2026 and Australian Digital Health Agency guidance, and seek professional advice about your own circumstances.
References
- Australian Digital Health Agency. My Health Record participation obligations. Guidance on the Security and Access Policy, user access, staff training, security measures, data breaches and record keeping. View resource →
- Federal Register of Legislation. My Health Records Rules 2026. Australian Government. Commencement, security and access policy requirements, record keeping, notification requirements and transitional provisions. View legislation →
- Zedmed. Data Security at Zedmed. Information about ISO 27001 certification, Duo two-factor authentication, user permissions and cloud infrastructure. View resource →
- Eastern Melbourne Primary Health Network (EMPHN). My Health Record legislative changes: action required before 1 October 2026. Published 21 September 2026. View resource →
