{"id":"F2026L00392","name":"My Health Records Rules 2026","slug":"my-health-records-rules-2026","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":443231,"registerId":"F2026L00392-fast-fetch-1775958120205","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"My Health Records Rules 2026","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nMy Health Records Rules 2026\n\nI, Mark Butler, Minister for Health and Ageing, make the following rules.\n\nDated   27 March 2026\n\nMark Butler\n\nMinister for Health and Ageing\n\n \n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Schedules\n\n5 Definitions\n\n6 Definition of authorised representative of a healthcare recipient—persons to which healthcare identifier not required to have been assigned\n\n7 Definition of nominated representative of a healthcare recipient—persons to which healthcare identifier not required to have been assigned\n\nPart 2—The System Operator and the functions of the Chief Executive Medicare\n\nDivision 1—Functions of the System Operator—requirements for access control mechanisms\n\n8 Access controls set by registered healthcare recipients for access by healthcare provider organisations and nominated representatives\n\n9 Default access controls\n\n10 Circumstances for automatic suspension of access to a healthcare recipient’s My Health Record\n\n11 Circumstances for automatic cancellation of access to a healthcare recipient’s My Health Record\n\nDivision 2—Functions of the System Operator—other functions conferred by this instrument\n\n12 Purpose of this Division\n\n13 Deleting information or a record in the My Health Record system in certain circumstances\n\n14 Suspending access to the My Health Record system if security, integrity or operations are or may be compromised\n\n15 Providing a mechanism to access My Health Record system\n\nPart 3—Registration\n\nDivision 1—Registering healthcare recipients\n\n16 Matters System Operator to have regard to\n\nDivision 2—Registering healthcare provider organisations\n\nSubdivision A—When organisations are eligible for registration—requirements organisations must comply with\n\n17 Purpose of this Subdivision\n\n18 Organisation officers must have authority to act on behalf of organisation\n\n19 Organisation must give System Operator and service operator certain information\n\n20 Organisations that are network organisations—seed organisation for network must be a registered healthcare provider organisation\n\n21 Organisation must have security and access policy\n\n22 Organisation must give System Operator security and access policy on request\n\nSubdivision B—Condition of registration—uploading of records, etc\n\n23 Kinds of records\n\n24 Prescribed circumstances\n\nDivision 3—Registering repository operators and portal operators\n\n25 Purpose of this Division\n\n26 Person must have an operator officer\n\n27 Person must have security and access policy\n\n28 Person must give security and access policy to System Operator with application for registration\n\n29 Person must have technical and after‑hours contacts\n\nDivision 4—Registering contracted service providers\n\n30 Purpose of this Division\n\n31 Person must have a contracted service provider officer\n\n32 Person must have security and access policy\n\n33 Person must give security and access policy to System Operator with application for registration\n\nDivision 5—Cancellation, suspension and variation of registration\n\n34 Requirements after registration is cancelled or suspended—retention, transfer or disposal of records\n\nPart 4—Other matters—conditions on the registration of participants in the My Health Record system\n\nDivision 1—Preliminary\n\n35 Purpose of this Part\n\nDivision 2—Registered healthcare provider organisations\n\n36 Complying with directions to delete information or a record\n\n37 Uploading records\n\n38 Notifying System Operator of certain matters\n\n39 Compliance with interoperability requirements\n\n40 Providing assistance to the System Operator on request\n\n41 Uploading advance care planning information\n\n42 Organisations that are network organisations—seed organisation for network must be a registered healthcare provider organisation\n\n43 Security and access policy—general\n\n44 Security and access policy—giving to System Operator on request\n\n45 Security and access policy—application record‑keeping\n\n46 Security and access policy—giving application records to System Operator on request\n\nDivision 3—Registered repository operators and portal operators\n\n47 Application\n\n48 Complying with directions to delete information or a record\n\n49 Ensuring operator officer carries out duties\n\n50 Notifying System Operator of certain matters\n\n51 Compliance with interoperability requirements\n\n52 Providing assistance to the System Operator on request\n\n53 Security and access policy—general\n\n54 Security and access policy—giving to System Operator on request\n\n55 Security and access policy—application record‑keeping\n\n56 Security and access policy—giving application records to System Operator on request\n\nDivision 4—Registered contracted service providers\n\n57 Application\n\n58 Complying with directions to delete information or a record\n\n59 Ensuring contracted service provider officer carries out duties\n\n60 Notifying System Operator of certain matters\n\n61 Compliance with interoperability requirements\n\n62 Providing assistance to the System Operator on request\n\n63 Security and access policy—general\n\n64 Security and access policy—giving to System Operator on request\n\n65 Security and access policy—application record‑keeping\n\n66 Security and access policy—giving application records to System Operator on request\n\n67 Accessing the My Health Record system or using health information included in a healthcare recipient’s My Health Record\n\nPart 5—Other requirements relating to the My Health Record system\n\n68 Purpose of this Part\n\n69 Requirements for System Operator—system availability\n\nPart 6—Other matters—authorised representatives and nominated representatives\n\n70 Requirement for System Operator—identity verification for healthcare recipients on ceasing to have an authorised representative\n\nPart 7—Opt‑out model for the participation of healthcare recipients in the My Health Record system\n\n71 Opt‑out model applies to all healthcare recipients in Australia\n\nPart 8—Application, transitional and saving provisions\n\nDivision 1—Provisions for this instrument as originally made\n\n72 Security and access policy requirements for certain registered entities existing immediately before 1 April 2026\n\nSchedule 1—Repeals of instruments\n\nMy Health Records (Assisted Registration) Rule 2015\n\nMy Health Records (National Application) Rules 2017\n\nMy Health Records (Opt‑out Trials) Rule 2016\n\nMy Health Records Rule 2016\n\n \n\nPart 1—Preliminary\n\n \n\n1  Name\n\n  This instrument is the My Health Records Rules 2026.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument 1 April 2026. 1 April 2026\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under the My Health Records Act 2012.\n\n4  Schedules\n\n  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.\n\n5  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) access control mechanisms (see paragraph 15(b) of the Act);\n\n(b) My Health Record;\n\n(c) My Health Record system;\n\n(d) participant in the My Health Record system;\n\n(e) record.\n\nIn this instrument:\n\naccess list, for a healthcare recipient’s My Health Record: see paragraph 9(2)(b).\n\nAct means the My Health Records Act 2012.\n\nadvance care planning information, for a healthcare recipient, means a document prepared by, or on behalf of, the recipient that states the recipient’s expressed wishes about the future provision of healthcare to the recipient.\n\ncontracted service provider officer: see subsection 31(2).\n\nhealthcare identifier has the same meaning as the Healthcare Identifiers Act 2010.\n\nhealthcare recipient‑entered personal health summary means the summary of information, including medications and allergies, entered into a healthcare recipient’s My Health Record by the healthcare recipient.\n\ninteroperability requirements, for the My Health Record system, means the conformance requirements and standards applicable to that system, published by the Australian Digital Health Agency, as existing from time to time.\n\nNote: The interoperability requirements could in 2026 be viewed on the Australian Digital Health Agency’s website (https://www.digitalhealth.gov.au).\n\nlinked has the same meaning as in the Healthcare Identifiers Act 2010.\n\nmaterial change, in relation to a participant in the My Health Record system, includes the following:\n\n (a) the participant enters into administration or becomes insolvent;\n\n (b) a change in the participant’s legal name;\n\n (c) a change in the participant’s legal structure;\n\n (d) the participant being involved in a merger or acquisition.\n\nnetwork of healthcare provider organisations has the same meaning as in the Healthcare Identifiers Act 2010.\n\nnetwork organisation within a network has the same meaning as in the Healthcare Identifiers Act 2010.\n\noperator officer: see subsection 26(2).\n\nopt‑out model: see section 71.\n\norganisation maintenance officer for a healthcare provider organisation has the same meaning as in the Healthcare Identifiers Act 2010.\n\nprofessional representative of a healthcare recipient means:\n\n (a) an individual who is an authorised representative of the healthcare recipient only as a result of the individual’s employment; or\n\n (b) an individual who is a nominated representative of the healthcare recipient if the agreement referred to in paragraph 7(1)(a) of the Act would not have been entered into but for the individual’s employment.\n\nresponsible officer for a healthcare provider organisation has the same meaning as in the Healthcare Identifiers Act 2010.\n\nseed organisation for a network has the same meaning as in the Healthcare Identifiers Act 2010.\n\nservice operator has the same meaning as in the Healthcare Identifiers Act 2010.\n\nsupport service has the same meaning as in the Healthcare Identifiers Act 2010.\n\n6  Definition of authorised representative of a healthcare recipient—persons to which healthcare identifier not required to have been assigned\n\n  For the purposes of paragraph 6(6)(b) of the Act, a healthcare identifier is not required to have been assigned to a person if the person is a professional representative of a healthcare recipient.\n\n7  Definition of nominated representative of a healthcare recipient—persons to which healthcare identifier not required to have been assigned\n\nFor the purposes of paragraph 7(3)(b) of the Act, a healthcare identifier is not required to have been assigned to a person if the person is a professional representative of a healthcare recipient.\n\nPart 2—The System Operator and the functions of the Chief Executive Medicare\n\nDivision 1—Functions of the System Operator—requirements for access control mechanisms\n\n8  Access controls set by registered healthcare recipients for access by healthcare provider organisations and nominated representatives\n\nPurpose\n\n (1) For the purposes of paragraph 15(b) of the Act, this section specifies requirements to which access control mechanisms referred to in subparagraph 15(b)(i) of the Act are subject.\n\nApplication of default access controls\n\n (2) The access control mechanisms must apply the default access controls specified in section 9 to a registered healthcare recipient’s My Health Record to the extent that the recipient has not set controls as described in this section.\n\nControls for access to a recipient’s My Health Record\n\n (3) The access control mechanisms must enable a registered healthcare recipient to do the following:\n\n (a) restrict access to the recipient’s My Health Record;\n\n (b) lift the restriction on a particular occasion.\n\nControls for access to certain information or records in a recipient’s My Health Record\n\n (4) The access control mechanisms must enable a registered healthcare recipient to do the following in relation to health information, information about support services provided, or to be provided, to a recipient, or a record, in the recipient’s My Health Record (other than a shared health summary, a healthcare recipient‑entered personal health summary and advance care planning information):\n\n (a) restrict access to information or a record;\n\n (b) lift the restriction on a particular occasion.\n\n (5) The access control mechanisms must ensure that if the recipient has restricted access to information or a record, a healthcare provider organisation providing healthcare to the recipient is not able to determine that the information or record exists solely by viewing the recipient’s My Health Record unless:\n\n (a) both:\n\n (i) the organisation is on the access list for the recipient’s My Health Record; and\n\n (ii) the recipient has specified that the organisation may access the information or record; or\n\n (b) the recipient lifts the restriction on a particular occasion for the organisation; or\n\n (c) the organisation uploaded the information or record to the My Health Record system.\n\n (6) If the recipient has restricted access to information or a record, the access control mechanisms must ensure that the healthcare provider organisation that uploaded the information or record to the My Health Record system will still be able to access the information or record without the need for the recipient to lift the restriction.\n\nElectronic notification of accessing or viewing of information\n\n (7) The access control mechanisms must permit a registered healthcare recipient to be notified by means of an electronic communication when:\n\n (a) a healthcare provider organisation does any of the following:\n\n (i) if the organisation is not on the access list for the recipient’s My Health Record—first accesses the recipient’s My Health Record;\n\n (ii) accesses the recipient’s My Health Record for the purposes of section 64 of the Act; or\n\n (b) a nominated representative of the recipient views health information included in the recipient’s My Health Record.\n\n9  Default access controls\n\nPurpose\n\n (1) For the purposes of paragraph 15(b) of the Act, this section specifies requirements to which access control mechanisms referred to in subparagraph 15(b)(ii) of the Act are subject.\n\nDefault access controls for access by healthcare provider organisations, authorised representatives and nominated representatives\n\n (2) The access control mechanisms must specify default access controls that:\n\n (a) permit a healthcare provider organisation providing healthcare to a registered healthcare recipient to access the recipient’s My Health Record; and\n\n (b) include a list (an access list) of the healthcare provider organisations that are permitted to access the recipient’s My Health Record because the organisations are providing healthcare to the recipient; and\n\n (c) permit the recipient to view the access list for the recipient’s My Health Record; and\n\n (d) remove a healthcare provider organisation from the access list for the recipient’s My Health Record if the organisation has not accessed the recipient’s My Health Record for a period of 3 years; and\n\n (e) permit a healthcare provider organisation that is no longer on the access list for the healthcare recipient’s My Health Record to access records in the recipient’s My Health Record on request made to the System Operator if the organisation uploaded the records to the recipient’s My Health Record.\n\nDefault access controls permitting healthcare recipients to delete health information\n\n (3) The access control mechanisms must specify default access controls that permit a registered healthcare recipient to delete health information or a record included in the recipient’s My Health Record.\n\n10  Circumstances for automatic suspension of access to a healthcare recipient’s My Health Record\n\nPurpose\n\n (1) For the purposes of paragraph 15(b) of the Act, this section specifies requirements to which access control mechanisms referred to in subparagraph 15(b)(iii) of the Act are subject.\n\nCircumstances\n\n (2) The access control mechanisms must specify the circumstances mentioned in column 1 of an item of the following table as circumstances in which access to a healthcare recipient’s My Health Record is to be automatically suspended for an entity mentioned in column 2 of the item.\n\n \n\n- Circumstances for automatic suspension of access for specified entities\n- Item Column 1 Circumstances Column 2 Entities\n- 1 The System Operator is notified by the service operator that the status of the healthcare identifier for an authorised representative of the recipient has been changed to deceased The following:(a) the authorised representative;(b) if the authorised representative was not a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative;(c) if the authorised representative was a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative, unless there is another professional representative of the recipient who is employed by the same employer as the authorised representative\n- 2 The System Operator is notified by the service operator that the status of the healthcare identifier for a nominated representative of the recipient has been changed to deceased The nominated representative\n- 3 The System Operator is investigating whether a person remains a nominated representative of the recipient The person\n- 4 The System Operator is investigating whether to cancel access to the recipient’s My Health Record by an authorised representative of the recipient The authorised representative and each nominated representative of the recipient nominated by the authorised representative\n- 5 The System Operator is investigating whether to cancel access to the recipient’s My Health Record by a nominated representative of the recipient The nominated representative\n- 6 The System Operator receives information that questions the basis on which the System Operator was satisfied of a matter under section 6 of the Act relating to whether a person is an authorised representative of the recipient The person and each nominated representative of the recipient nominated by the person\n- 7 The System Operator is notified by an entity that continuing access to the recipient’s My Health Record by an authorised representative poses, or is likely to pose, a serious risk to an individual’s life, health or safety The authorised representative and each nominated representative of the recipient nominated by the authorised representative\n- 8 The System Operator is notified by an entity that continuing access to the recipient’s My Health Record by a nominated representative poses, or is likely to pose, a serious risk to an individual’s life, health or safety The nominated representative\n\n\n11  Circumstances for automatic cancellation of access to a healthcare recipient’s My Health Record\n\nPurpose\n\n (1) For the purposes of paragraph 15(b) of the Act, this section specifies requirements to which access control mechanisms referred to in subparagraph 15(b)(iii) of the Act are subject.\n\nCircumstances\n\n (2) The access control mechanisms must specify the circumstances mentioned in column 1 of an item of the following table as circumstances in which access to a healthcare recipient’s My Health Record is to be automatically cancelled for an entity mentioned in column 2 of the item.\n\n \n\n- Circumstances for automatic cancellation of access for specified entities\n- Item Column 1 Circumstances Column 2 Entities\n- 1 The System Operator is notified by the service operator that the status of the healthcare identifier for an authorised representative of the recipient has been changed to retired The following:(a) the authorised representative;(b) if the authorised representative was not a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative;(c) if the authorised representative was a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative, unless there is another professional representative of the recipient who is employed by the same employer as the authorised representative\n- 2 The System Operator is notified by the service operator that the status of the healthcare identifier for a nominated representative of the recipient has been changed to retired The nominated representative\n- 3 The System Operator is notified that a nominated representative of the recipient has died The nominated representative\n- 4 Both:(a) a person ceases to be an authorised representative of the recipient under subsection 6(1) or (2) of the Act (which relate to healthcare recipients aged under 14); and(b) the System Operator is not satisfied that the person will be an authorised representative of the recipient under subsection 6(4) of the Act (which relates to healthcare recipients not capable of making decisions for themselves) when the healthcare recipient turns 18 The following:(a) the person;(b) each nominated representative of the recipient nominated by the person\n- 5 The recipient turns 18 and the System Operator is not satisfied under subsection 6(4) of the Act (which relates to healthcare recipients not capable of making decisions for themselves) in relation to the recipient Each person (if any) who was an authorised representative of the recipient and each nominated representative of the recipient nominated by the person\n- 6 A person ceases to be an authorised representative of the recipient under subsection 6(3) of the Act (which relates to healthcare recipients aged between 14 and 17 years) because:(a) the recipient turns 18; or(b) the recipient, by written notice given to the System Operator, withdraws the nomination of the person given under that subsection The following:(a) the person;(b) each nominated representative of the recipient nominated by the person\n- 7 A person is no longer an authorised representative of the recipient because the System Operator is no longer satisfied of a matter under section 6 of the Act relating to whether the person is an authorised representative of the recipient The following:(a) the person;(b) if the person was not a professional representative of the recipient—each nominated representative of the recipient nominated by the person;(c) if the person was a professional representative of the recipient—each nominated representative of the recipient nominated by the person, unless there is another professional representative of the recipient who is employed by the same employer as the person\n- 8 The System Operator is notified by an authorised representative of the recipient that the authorised representative no longer wishes to act as an authorised representative of the recipient The following:(a) the authorised representative;(b) if the authorised representative was not a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative;(c) if the authorised representative was a professional representative of the recipient—each nominated representative of the recipient nominated by the authorised representative, unless there is another professional representative of the recipient who is employed by the same employer as the authorised representative\n- 9 The System Operator is notified by a nominated representative of the recipient that the nominated representative no longer wishes to act as the nominated representative of the recipient The nominated representative\n- 10 A person is no longer an authorised representative of the recipient for a reason not mentioned in another item of this table The following:(a) the person;(b) if the person was not a professional representative of the recipient—each nominated representative of the recipient nominated by the person;(c) if the person was a professional representative of the recipient—each nominated representative of the recipient nominated by the person, unless there is another professional representative of the recipient who is employed by the same employer as the person\n- 11 A person is no longer a nominated representative of the recipient for a reason not mentioned in another item of this table The person\n\n\nDivision 2—Functions of the System Operator—other functions conferred by this instrument\n\n12  Purpose of this Division\n\n  For the purposes of paragraph 15(n) of the Act, this Division confers other functions on the System Operator.\n\n13  Deleting information or a record in the My Health Record system in certain circumstances\n\n  The System Operator may delete, or may direct another participant in the My Health Record system to delete, information or a record in the My Health Record system if the System Operator reasonably believes that:\n\n (a) the information or record contains a defamatory statement; or\n\n (b) the information or record affects, or is likely to affect, the security or integrity of the My Health Record system; or\n\n (c) both the following are satisfied:\n\n (i) the information or record was uploaded in contravention of paragraph 45(ba) of the Act;\n\n (ii) the information or record should be deleted to reduce the clinical risk that is, or may be, faced by a healthcare recipient if the information or record is not deleted.\n\nExample: The System Operator may decide to delete information or a record under paragraph (c) if the authoring individual healthcare provider’s registration with the national registration authority (within the meaning of the Healthcare Identifiers Act 2010) has been suspended for professional negligence, and the System Operator considers that deleting the record would reduce the clinical risk faced by the healthcare recipient to whom the record relates.\n\n14  Suspending access to the My Health Record system if security, integrity or operations are or may be compromised\n\nSuspension for certain entities\n\n (1) If the System Operator considers that the security, integrity or operations of the My Health Record system have been, or may be, compromised, the System Operator may suspend access to the My Health Record system for any of the following entities, or for a class or classes of any of the following entities:\n\n (a) a healthcare recipient;\n\n (b) an authorised representative of a healthcare recipient;\n\n (c) a nominated representative of a healthcare recipient;\n\n (d) a participant in the My Health Record system.\n\n (2) Without limiting subsection (1), the security, integrity or operations of the My Health Record system may be compromised if:\n\n (a) there is a security problem with the information technology systems of a participant in the My Health Record system, or with the credentials that enable the participant’s identity to be authenticated in electronic communications; or\n\n (b) there is an issue with verification of the identity of a healthcare recipient or an authorised representative or a nominated representative of the recipient; or\n\n (c) a participant has failed to comply with the interoperability requirements for the My Health Record system.\n\n (3) If a participant has failed to comply with the interoperability requirements for the My Health Record system, the System Operator may suspend the access to the My Health Record system by the participant in full or in part.\n\nExample: Under subsection 14(3), the System Operator may decide to suspend all access by a participant. Alternatively, the System Operator may decide to partially suspend access to the My Health Record system by preventing the participant uploading a class of documents (such as shared health summaries) until the participant complies with the interoperability requirements for the My Health Record system.\n\nNotice requirements\n\n (4) Unless subsection (6) or (7) applies, the System Operator must notify an entity whose access to the My Health Record system has been suspended under subsection (1) in accordance with subsection (5).\n\n (5) The notice must:\n\n (a) be in writing; and\n\n (b) be given as soon as practicable after the suspension occurs; and\n\n (c) specify:\n\n (i) the reasons for the suspension; and\n\n (ii) the steps, if any, that the System Operator requires the entity to take before the entity’s access to the My Health Record system is restored.\n\n (6) This subsection applies if the System Operator reasonably believes that the suspension of access relates to minor operational matters and is unlikely to last for more than 24 hours.\n\n (7) This subsection applies if:\n\n (a) the System Operator reasonably believes that the suspension of access affects a significant number of healthcare recipients; and\n\n (b) the System Operator notifies the general public.\n\nRestoring access following suspension\n\n (8) The System Operator must restore access to the My Health Record system for the entity as soon as practicable after the System Operator is satisfied that the security, integrity or operations (as applicable) of the My Health Record system are no longer compromised or are no longer at risk of compromise.\n\n15  Providing a mechanism to access My Health Record system\n\n  The System Operator may provide a mechanism that permits registered healthcare provider organisations to access the My Health Record system.\n\nPart 3—Registration\n\nDivision 1—Registering healthcare recipients\n\n16  Matters System Operator to have regard to\n\n  For the purposes of paragraph 41(1)(c) of the Act, and paragraphs 3(1)(b) and 6(3)(c) of Schedule 1 to the Act, the matters are the following:\n\n (a) if the healthcare recipient is a child—whether:\n\n (i) the birth mother of the recipient has a healthcare identifier; and\n\n (ii) the service operator has evidence confirming the identity of the birth mother;\n\n (b) otherwise—whether:\n\n (i) the healthcare recipient has a healthcare identifier; and\n\n (ii) the service operator has evidence confirming the identity of the recipient.\n\nDivision 2—Registering healthcare provider organisations\n\nSubdivision A—When organisations are eligible for registration—requirements organisations must comply with\n\n17  Purpose of this Subdivision\n\n  For the purposes of paragraphs 43(b) and 109(3)(a) of the Act, this Subdivision specifies requirements that a healthcare provider organisation must comply with to be eligible for registration.\n\n18  Organisation officers must have authority to act on behalf of organisation\n\nOrganisations that are seed organisations for a network or are not part of a network\n\n (1) Subsection (2) applies to a healthcare provider organisation that is a seed organisation for a network, or is not part of a network.\n\n (2) The following persons must be authorised to act on behalf of the organisation in the organisation’s dealings with the System Operator:\n\n (a) the responsible officer for the organisation;\n\n (b) the organisation maintenance officer for the organisation.\n\nOrganisations that are network organisations within a network\n\n (3) Subsection (4) applies to a healthcare provider organisation that is a network organisation within a network.\n\n (4) The following persons must be authorised to act on behalf of the organisation in the organisation’s dealings with the System Operator:\n\n (a) the responsible officer for the organisation;\n\n (b) the organisation maintenance officer for the organisation;\n\n (c) the organisation maintenance officer for the seed organisation for the network.\n\n19  Organisation must give System Operator and service operator certain information\n\n (1) A healthcare provider organisation must:\n\n (a) give the System Operator a list of all identified healthcare providers (within the meaning of the Healthcare Identifiers Act 2010) that are individual healthcare providers and will be authorised to access the My Health Record system via or on behalf of the organisation using a mechanism provided by the System Operator under section 15 of this instrument; and\n\n (b) if the organisation is a seed organisation for a network—give the service operator a record of the linkages between healthcare provider organisations within the network.\n\n (2) The list mentioned in paragraph (1)(a) and the record mentioned in paragraph (1)(b) must be in the approved form.\n\n20  Organisations that are network organisations—seed organisation for network must be a registered healthcare provider organisation\n\n (1) This section applies to a healthcare provider organisation that is a network organisation within a network.\n\n (2) The seed organisation for the network must be a registered healthcare provider organisation.\n\n21  Organisation must have security and access policy\n\n (1) A healthcare provider organisation must have a written security and access policy that:\n\n (a) addresses the matters mentioned in subsection (2); and\n\n (b) is drafted in such a manner that the organisation’s performance can be audited against the policy to determine if the organisation has complied with the policy.\n\n (2) For the purposes of paragraph (1)(a), the matters are the following:\n\n (a) the procedures the organisation will use to authorise a person (a user) to access the My Health Record system, or use health information included in a healthcare recipient’s My Health Record, via or on behalf of the organisation, including procedures for creating and modifying user accounts, and how a user’s account will be suspended or deactivated if:\n\n (i) the user leaves the organisation; or\n\n (ii) the user’s security is compromised; or\n\n (iii) the user’s duties no longer require the user to access the My Health Record system; or\n\n (iv) the user is an individual healthcare provider that ceases to be linked to the organisation;\n\n (b) the training, that must include the training referred to in subsection (3), that will be provided to a user:\n\n (i) before the user is authorised to access the My Health Record system; and\n\n (ii) annually; and\n\n (iii) following any significant changes to the Act, regulations made under the Act, this instrument or the My Health Record system;\n\n (c) the processes that the organisation will use to ensure that the organisation does not contravene section 74 or 75 of the Act;\n\n (d) the physical security, information security, cybersecurity and technical and organisational measures that the organisation will implement, including the following:\n\n (i) user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the organisation, that must include the practices referred to in subsection (4);\n\n (ii) regular system maintenance;\n\n (iii) data protection, including data encryption and regular back‑up;\n\n (iv) monitoring and reviewing the measures;\n\n (e) the strategies that the organisation will use to ensure that security risks in relation to the My Health Record system will be promptly identified, acted upon and reported to the organisation’s management.\n\nTraining to be provided to users\n\n (3) For the purposes of paragraph (2)(b), the training is training in relation to the following:\n\n (a) how to use the My Health Record system accurately and responsibly;\n\n (b) the legal obligations of healthcare provider organisations and users using the My Health Record system;\n\n (c) the consequences of breaching those legal obligations.\n\nUser account management practices to be implemented\n\n (4) For the purposes of subparagraph (2)(d)(i), the user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the organisation are the following:\n\n (a) restricting access to only users who require access as part of their duties;\n\n (b) uniquely identifying users using the organisation’s information technology systems and protecting the identity of users with a password or equivalent protection mechanism;\n\n (c) having password or other equivalent protection mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;\n\n (d) deactivating the account of a user who is no longer authorised by the organisation to access the My Health Record system via or on behalf of the organisation;\n\n (e) suspending the access of a user as soon as practicable after becoming aware that the account or the password or other equivalent protection mechanism has been compromised;\n\n (f) reviewing the practices at least annually;\n\n (g) ensuring that users are aware of, and trained in, the practices.\n\n22  Organisation must give System Operator security and access policy on request\n\n  A healthcare provider organisation must, on request by the System Operator, give the System Operator a copy of the organisation’s security and access policy.\n\nSubdivision B—Condition of registration—uploading of records, etc\n\n23  Kinds of records\n\n  For the purposes of subparagraph 45(b)(ii) of the Act, the kind of record specified is records other than the following:\n\n (a) a record mentioned in subparagraph 45(b)(i) of the Act;\n\n (b) advance care planning information.\n\n24  Prescribed circumstances\n\n (1) For the purposes of subparagraph 45(ba)(i) of the Act, the circumstances are that, at the time the record is prepared, fees to maintain the individual’s registration are not more than 6 months overdue.\n\n (2) For the purposes of subparagraph 45(ba)(ii) of the Act, the circumstances are that, at the time the record is prepared, fees to maintain the individual’s credentials are not more than 6 months overdue.\n\nDivision 3—Registering repository operators and portal operators\n\n25  Purpose of this Division\n\n  For the purposes of paragraphs 48(a) and 109(3)(b) of the Act, this Division specifies requirements that a person must comply with to be eligible for registration as a repository operator or a portal operator.\n\n26  Person must have an operator officer\n\n (1) The person must have at least one, but no more than three, operator officers.\n\n (2) An individual is the operator officer for a person if:\n\n (a) the individual is an employee of the person; and\n\n (b) the individual’s duties include the following:\n\n (i) receiving communications from the System Operator about the operation of the My Health Record system;\n\n (ii) acting as a liaison between the System Operator and the person;\n\n (iii) maintaining the System Operator’s records of the professional and business details of the person and the individual.\n\n27  Person must have security and access policy\n\n (1) A person must have a written security and access policy that:\n\n (a) addresses the matters mentioned in subsection (2); and\n\n (b) is drafted in such a manner that the person’s performance can be audited against the policy to determine if the person has complied with the policy.\n\n (2) For the purposes of paragraph (1)(a), the matters are the following:\n\n (a) the procedures the person will use to authorise a person (a user) to access the My Health Record system, or use health information included in a healthcare recipient’s My Health Record, via or on behalf of the person, including procedures for creating and modifying user accounts, and how a user’s account will be suspended or deactivated if:\n\n (i) the user leaves the person; or\n\n (ii) the user’s security is compromised; or\n\n (iii) the user’s duties no longer require the user to access the My Health Record system;\n\n (b) the training, that must include the training referred to in subsection (3), that will be provided to a user:\n\n (i) before the user is authorised to access the My Health Record system; and\n\n (ii) annually; and\n\n (iii) following any significant changes to the Act, regulations made under the Act, this instrument or the My Health Record system;\n\n (c) the processes that the person will use to ensure that the person does not contravene section 75 of the Act;\n\n (d) the physical security, information security, cybersecurity and technical and organisational measures that the person will implement, including the following:\n\n (i) user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the person, that must include the practices referred to in subsection (4);\n\n (ii) regular system maintenance;\n\n (iii) data protection, including data encryption and regular back‑up;\n\n (iv) monitoring and reviewing the measures;\n\n (e) the strategies that the person will use to ensure that security risks in relation to the My Health Record system will be promptly identified, acted upon and reported to the person’s management.\n\nTraining to be provided to users\n\n (3) For the purposes of paragraph (2)(b), the training is training in relation to the following:\n\n (a) how to use the My Health Record system accurately and responsibly;\n\n (b) the legal obligations of repository operators or portal operators (as applicable) and users using the My Health Record system;\n\n (c) the consequences of breaching those legal obligations.\n\nUser account management practices to be implemented\n\n (4) For the purposes of subparagraph (2)(d)(i), the user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the person are the following:\n\n (a) restricting access to only users who require access as part of their duties;\n\n (b) uniquely identifying users using the person’s information technology systems and protecting the identity of users with a password or equivalent protection mechanism;\n\n (c) having password or other equivalent protection mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;\n\n (d) deactivating the account of a user who is no longer authorised by the person to access the My Health Record system via or on behalf of the person;\n\n (e) suspending the access of a user as soon as practicable after becoming aware that the account or the password or other equivalent protection mechanism has been compromised;\n\n (f) reviewing the practices at least annually;\n\n (g) ensuring users are aware of, and trained in, the practices.\n\n28  Person must give security and access policy to System Operator with application for registration\n\n  The person must give the System Operator a copy of the person’s security and access policy with the person’s application for registration as a repository operator or a portal operator.\n\n29  Person must have technical and after‑hours contacts\n\n  The person must have:\n\n (a) a point of contact and technical support for the person during ordinary business hours Monday to Friday, other than public holidays; and\n\n (b) at least 2 points of contact who have the authority, and are able, to resolve, or coordinate the resolution of, any technical, security or operational issues affecting the person outside ordinary business hours and on public holidays.\n\nDivision 4—Registering contracted service providers\n\n30  Purpose of this Division\n\n  For the purposes of paragraphs 48(a) and 109(3)(b) of the Act, this Division specifies requirements that a person must comply with to be eligible for registration as a contracted service provider.\n\n31  Person must have a contracted service provider officer\n\n (1) The person must have at least one, but no more than three, contracted service provider officers.\n\n (2) An individual is the contracted service provider officer for a person if:\n\n (a) the individual is an employee of the person; and\n\n (b) the individual’s duties include the following:\n\n (i) receiving communications from the System Operator about the operation of the My Health Record system;\n\n (ii) acting as a liaison between the System Operator and the person;\n\n (iii) maintaining the System Operator’s records of the professional and business details of the person and the individual.\n\n32  Person must have security and access policy\n\n (1) A person must have a written security and access policy that:\n\n (a) addresses the matters mentioned in subsection (2); and\n\n (b) is drafted in such a manner that the person’s performance can be audited against the policy to determine if the person has complied with the policy.\n\n (2) For the purposes of paragraph (1)(a), the matters are the following:\n\n (a) the procedures the person will use to authorise a person (a user) to access the My Health Record system, or use health information included in a healthcare recipient’s My Health Record, via or on behalf of the person, including procedures for creating and modifying user accounts, and how a user’s account will be suspended or deactivated if:\n\n (i) the user leaves the person; or\n\n (ii) the user’s security is compromised; or\n\n (iii) the user’s duties no longer require the user to access the My Health Record system;\n\n (b) the training, that must include the training referred to in subsection (3), that will be provided to a user:\n\n (i) before the user is authorised to access the My Health Record system; and\n\n (ii) annually; and\n\n (iii) following any significant changes to the Act, regulations made under the Act, this instrument or the My Health Record system;\n\n (c) the processes that the person will use to ensure that the person does not contravene section 75 of the Act;\n\n (d) the physical security, information security, cybersecurity and technical and organisational measures that the person will implement, including the following:\n\n (i) user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the person, that must include the practices referred to in subsection (4);\n\n (ii) regular system maintenance;\n\n (iii) data protection, including data encryption and regular back‑up;\n\n (iv) monitoring and reviewing the measures;\n\n (e) the strategies that the person will use to ensure that security risks in relation to the My Health Record system will be promptly identified, acted upon and reported to the person’s management.\n\nTraining to be provided to users\n\n (3) For the purposes of paragraph (2)(b), the training is training in relation to the following:\n\n (a) how to use the My Health Record system accurately and responsibly;\n\n (b) the legal obligations of contracted service providers and users using the My Health Record system;\n\n (c) the consequences of breaching those legal obligations.\n\nUser account management practices to be implemented\n\n (4) For the purposes of subparagraph (2)(d)(i), the user account management practices for information technology systems that are used by users to access the My Health Record system via or on behalf of the person are the following:\n\n (a) restricting access to only users who require access as part of their duties;\n\n (b) uniquely identifying users using the person’s information technology systems and protecting the identity of users with a password or equivalent protection mechanism;\n\n (c) having password or other equivalent protection mechanisms that are sufficiently secure and robust given the security and privacy risks associated with unauthorised access to the My Health Record system;\n\n (d) deactivating the account of a user who is no longer authorised by the person to access the My Health Record system via or on behalf of the person;\n\n (e) suspending the access of a user as soon as practicable after becoming aware that the account or the password or other equivalent protection mechanism has been compromised;\n\n (f) reviewing the practices at least annually;\n\n (g) ensuring users are aware of, and trained in, the practices.\n\n33  Person must give security and access policy to System Operator with application for registration\n\n  The person must give the System Operator a copy of the person’s security and access policy with the person’s application for registration as a contracted service provider.\n\nDivision 5—Cancellation, suspension and variation of registration\n\n34  Requirements after registration is cancelled or suspended—retention, transfer or disposal of records\n\n (1) For the purposes of subsection 55(1) of the Act, this section applies to an entity that was a registered portal operator or a registered repository operator if the registration of the entity was cancelled under Division 4 of Part 3 of the Act.\n\n (2) The requirements to which an entity that was a registered portal operator is subject are that the entity must not retain access to a record held by the entity in relation to a healthcare recipient’s My Health Record without the prior written approval of the System Operator.\n\n (3) The requirements to which an entity that was a registered repository operator is subject are that the entity must not transfer or dispose of information held by the entity in relation to a healthcare recipient’s My Health Record without the prior written approval of the System Operator.\n\nPart 4—Other matters—conditions on the registration of participants in the My Health Record system\n\nDivision 1—Preliminary\n\n35  Purpose of this Part\n\n  For the purposes of paragraph 109(3)(c) of the Act, this Part specifies conditions on the registration of participants in the My Health Record system.\n\nDivision 2—Registered healthcare provider organisations\n\n36  Complying with directions to delete information or a record\n\n  A registered healthcare provider organisation must comply with a direction given to the organisation by the System Operator under section 13.\n\n37  Uploading records\n\n (1) A registered healthcare provider organisation must take reasonable steps to ensure that a record is not uploaded to the My Health Record system by the following entities if the record is inaccurate, incorrect, misleading, defamatory or out of date:\n\n (a) the organisation;\n\n (b) an employee of the organisation;\n\n (c) an individual healthcare provider linked to the organisation.\n\n (2) Subsection (1) does not apply in relation to a record if:\n\n (a) the record was created by a person who was not, at the time the record was created, an employee of the organisation; and\n\n (b) there is nothing in the record that would indicate to a reasonable person in the circumstances that the record was not accurate, correct or up‑to‑date, or was misleading or defamatory.\n\n (3) This section does not affect any other obligation of an entity referred to in subsection (1) to:\n\n (a) keep clinical records about a healthcare recipient; or\n\n (b) communicate health information to a healthcare recipient.\n\n38  Notifying System Operator of certain matters\n\n (1) If circumstances mentioned in column 1 of an item of the following table apply in relation to a registered healthcare provider organisation, the organisation must notify the System Operator of the matter mentioned in column 2 of the item.\n\n \n\n- Circumstances and matters\n- Item Column 1 Circumstances Column 2 Matter\n- 1 the organisation becomes aware or suspects that there is a non‑clinical error relating to information or a record that has been accessed via, or downloaded from, the My Health Record system by the organisation or an employee of the organisation details of the error\n- 2 the organisation undergoes a material change details of the change\n- 3 there is a change in a responsible officer for the organisation or an organisation maintenance officer for the organisation details of the change\n- 4 there is a change in the contact details for a responsible officer for the organisation or an organisation maintenance officer for the organisation details of the change\n- 5 an entity becomes a contracted service provider of the organisation the entity’s name, ABN (if known) and ACN (if known), and the date the entity became a contracted service provider of the organisation\n- 6 an entity ceases to be a contracted service provider of the organisation the entity’s name, ABN (if known) and ACN (if known), and the date the entity ceased to be a contracted service provider of the organisation\n\n\nExample: A registered healthcare provider organisation must notify the System Operator under item 1 if the organisation or an employee of the organisation becomes aware of an uploaded record that appears to have been corrupted during upload.\n\n (2) The notification referred to in subsection (1) must be given to the System Operator:\n\n (a) in writing; and\n\n (b) within 2 business days of the circumstance occurring.\n\n39  Compliance with interoperability requirements\n\n  A registered healthcare provider organisation must comply with the interoperability requirements for the My Health Record system.\n\n40  Providing assistance to the System Operator on request\n\n (1) A registered healthcare provider organisation must, on request by the System Operator, promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.\n\n (2) Subsection (1) does not apply unless the System Operator gives the organisation reasonable notice of the assistance required.\n\n41  Uploading advance care planning information\n\n (1) A registered healthcare provider organisation may upload to a repository advance care planning information for a healthcare recipient only if the recipient instructs the organisation to upload the information.\n\n (2) If the organisation uploads advance care planning information in accordance with subsection (1), the organisation must keep a record of:\n\n (a) the recipient’s instructions; and\n\n (b) how the recipient’s instructions were provided.\n\n42  Organisations that are network organisations—seed organisation for network must be a registered healthcare provider organisation\n\n (1) This section applies to a healthcare provider organisation that is a network organisation within a network.\n\n (2) The seed organisation for the network must be a registered healthcare provider organisation.\n\n43  Security and access policy—general\n\nCommunicating and making policy accessible\n\n (1) A registered healthcare provider organisation must communicate the organisation’s security and access policy, and ensure that the policy remains readily accessible, to the following entities:\n\n (a) an employee of the organisation;\n\n (b) a healthcare provider to whom the organisation supplies services under contract;\n\n (c) an individual healthcare provider linked to the healthcare provider organisation.\n\nComplying with policy\n\n (2) The organisation must:\n\n (a) comply with the policy; and\n\n (b) take all reasonable steps to ensure that the entities mentioned in subsection (1) comply with the policy.\n\nKeeping policy up‑to‑date\n\n (3) The organisation must ensure the following:\n\n (a) the policy is kept up‑to‑date;\n\n (b) each iteration of the policy contains a unique version number and the date the iteration comes into effect;\n\n (c) without limiting paragraph (a), the policy is reviewed:\n\n (i) at least annually; and\n\n (ii) when any material new or changed risks are identified; and\n\n (iii) on request by the System Operator;\n\n (d) a review mentioned in paragraph (c) must include consideration of:\n\n (i) factors that might result in:\n\n (A) unauthorised access to the My Health Record system using the organisation’s information systems; or\n\n (B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of the organisation; or\n\n (C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record; and\n\n (ii) any changes to the My Health Record system that may affect the organisation; and\n\n (iii) any relevant legal or regulatory changes that have occurred since the last review.\n\nRecord‑keeping\n\n (4) The organisation must keep a record of each iteration of the policy for 5 years starting on the day the iteration comes into effect.\n\n44  Security and access policy—giving to System Operator on request\n\n (1) A registered healthcare provider organisation must comply with a request from the System Operator under this section within 7 days of the organisation receiving the request.\n\n (2) The System Operator may request in writing that a registered healthcare provider organisation give it a copy of the organisation’s security and access policy. The request may be for the organisation’s current policy or an iteration of the policy that was in effect on a specified date.\n\n45  Security and access policy—application record‑keeping\n\n (1) A registered healthcare provider organisation must keep a record of the following:\n\n (a) the organisation’s application of the procedures mentioned in paragraph 21(2)(a);\n\n (b) the organisation’s provision of the training mentioned in paragraph 21(2)(b);\n\n (c) the organisation’s application of the processes mentioned in paragraph 21(2)(c);\n\n (d) the organisation’s application of the measures mentioned in paragraph 21(2)(d).\n\nExample: The kinds of records the organisation must keep under this section include:\n\n(a) records of the creation, modification, suspension and deactivation of user accounts; and\n\n(b) logs of individuals’ access to the My Health Record system.\n\n (2) The organisation must retain a record mentioned in paragraph (1)(a) or (b) for 5 years starting on the day the record was created.\n\n (3) The organisation must retain a record mentioned in paragraph (1)(c) or (d) for 2 years starting on the day the record was created.\n\n46  Security and access policy—giving application records to System Operator on request\n\n (1) A registered healthcare provider organisation must comply with a request from the System Operator under this section within 7 days of the organisation receiving the request.\n\n (2) The System Operator may request in writing that a registered healthcare provider organisation give it a copy of a record mentioned in section 45.\n\nDivision 3—Registered repository operators and portal operators\n\n47  Application\n\n  This Division applies to a person who is a registered repository operator or portal operator.\n\n48  Complying with directions to delete information or a record\n\n  The person must comply with a direction given to the person by the System Operator under section 13.\n\n49  Ensuring operator officer carries out duties\n\n  The person must ensure that its operator officers carry out the duties referred to in paragraph 26(2)(b).\n\n50  Notifying System Operator of certain matters\n\n (1) If circumstances mentioned in column 1 of an item of the following table apply in relation to a person, the person must notify the System Operator of the matter mentioned in column 2 of the item.\n\n \n\n- Circumstances and matters\n- Item Column 1 Circumstances Column 2 Matter\n- 1 the person becomes aware or suspects that there is a non‑clinical error relating to information or a record that has been accessed via, or downloaded from, the My Health Record system by the person or an employee of the person details of the error\n- 2 the person undergoes a material change details of the change\n- 3 there is a change in an operator officer for the person details of the change\n- 4 there is a change in the contact details for an operator officer for the person details of the change\n\n\nExample: A person must notify the System Operator if the person or an employee of the person becomes aware of an uploaded record that appears to have been corrupted during upload.\n\n (2) The notification referred to in subsection (1) must be given to the System Operator:\n\n (a) in writing; and\n\n (b) within 2 business days of the circumstance occurring.\n\n51  Compliance with interoperability requirements\n\n  The person must comply with the interoperability requirements for the My Health Record system.\n\n52  Providing assistance to the System Operator on request\n\n (1) The person must, on request by the System Operator, promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.\n\n (2) Subsection (1) does not apply unless the System Operator gives the person reasonable notice of the assistance required.\n\n53  Security and access policy—general\n\nCommunicating and making policy accessible\n\n (1) The person must communicate the person’s security and access policy, and ensure that the policy remains readily accessible, to the following entities:\n\n (a) each employee of the person;\n\n (b) each user (within the meaning of paragraph 27(2)(a)).\n\nComplying with policy\n\n (2) The person must:\n\n (a) comply with the policy; and\n\n (b) take all reasonable steps to ensure that the entities mentioned in subsection (1) comply with the policy.\n\nKeeping policy up‑to‑date\n\n (3) The person must ensure the following:\n\n (a) the policy is kept up‑to‑date;\n\n (b) each iteration of the policy contains a unique version number and the date the iteration comes into effect;\n\n (c) without limiting paragraph (a), the policy is reviewed:\n\n (i) at least annually; and\n\n (ii) when any material new or changed risks are identified; and\n\n (iii) on request by the System Operator;\n\n (d) a review mentioned in paragraph (c) must include consideration of:\n\n (i) factors that might result in:\n\n (A) unauthorised access to the My Health Record system using the person’s information systems; or\n\n (B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of the person; or\n\n (C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record; and\n\n (ii) any changes to the My Health Record system that may affect the person; and\n\n (iii) any relevant legal or regulatory changes that have occurred since the last review.\n\nRecord‑keeping\n\n (4) The person must keep a record of each iteration of the policy for 5 years starting on the day the iteration comes into effect.\n\n54  Security and access policy—giving to System Operator on request\n\n (1) The person must comply with a request from the System Operator under this section within 7 days of the person receiving the request.\n\n (2) The System Operator may request in writing that a person give it a copy of the person’s security and access policy. The request may be for the person’s current policy or an iteration of the policy that was in effect on a specified date.\n\n55  Security and access policy—application record‑keeping\n\n (1) The person must keep a record of the following:\n\n (a) the person’s application of the procedures mentioned in paragraph 27(2)(a);\n\n (b) the person’s provision of the training mentioned in paragraph 27(2)(b);\n\n (c) the person’s application of the processes mentioned in paragraph 27(2)(c);\n\n (d) the person’s application of the measures mentioned in paragraph 27(2)(d).\n\nExample: The kinds of records the person must keep under this section include:\n\n(a) records of the creation, modification, suspension and deactivation of user accounts; and\n\n(b) logs of individuals’ access to the My Health Record system.\n\n (2) The person must retain a record mentioned in paragraph (1)(a) or (b) for 5 years starting on the day the record was created.\n\n (3) The person must retain a record mentioned in paragraph (1)(c) or (d) for 2 years starting on the day the record was created.\n\n56  Security and access policy—giving application records to System Operator on request\n\n (1) The person must comply with a request from the System Operator under this section within 7 days of the person receiving the request.\n\n (2) The System Operator may request in writing that a person give it a copy of a record mentioned in section 55.\n\nDivision 4—Registered contracted service providers\n\n57  Application\n\n  This Division applies to a person who is a registered contracted service provider.\n\n58  Complying with directions to delete information or a record\n\n  The person must comply with a direction given to the person by the System Operator under section 13.\n\n59  Ensuring contracted service provider officer carries out duties\n\n  The person must ensure that its contracted service provider officers carry out the duties referred to in paragraph 31(2)(b).\n\n60  Notifying System Operator of certain matters\n\n (1) If circumstances mentioned in column 1 of an item of the following table apply in relation to a person, the person must notify the System Operator of the matters mentioned in column 2 of the item.\n\n \n\n- Circumstances and matters\n- Item Column 1 Circumstances Column 2 Matters\n- 1 the person becomes aware or suspects that there is a non‑clinical error relating to information or a record that has been accessed via, or downloaded from, the My Health Record system by the person or an employee of the person details of the error\n- 2 the person undergoes a material change details of the change\n- 3 there is a change in a contracted service provider officer for the person details of the change\n- 4 there is a change in the contact details for a contracted service provider officer for the person details of the change\n- 5 the person becomes the contracted service provider of a registered healthcare provider organisation the following:(a) the name of the provider;(b) the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011 (if applicable);(c) the healthcare identifier assigned to the organisation under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010\n- 6 the person ceases to be the contracted service provider of a registered healthcare provider organisation the following:(a) the name of the provider;(b) the organisation’s business name on the register established under section 22 of the Business Names Registration Act 2011 (if applicable);(c) the healthcare identifier assigned to the organisation under paragraph 9(1)(a) of the Healthcare Identifiers Act 2010\n\n\nExample: A person must notify the System Operator if the person or an employee of the person becomes aware of an uploaded record that appears to have been corrupted during upload.\n\n (2) The notification referred to in subsection (1) must be given to the System Operator:\n\n (a) in writing; and\n\n (b) within 2 business days of the circumstance occurring.\n\n61  Compliance with interoperability requirements\n\n  The person must comply with the interoperability requirements for the My Health Record system.\n\n62  Providing assistance to the System Operator on request\n\n (1) The person must, on request by the System Operator, promptly provide all necessary assistance in relation to any inquiry, audit, review, assessment, investigation or complaint in connection with the My Health Record system conducted, handled, requested or facilitated by the System Operator.\n\n (2) Subsection (1) does not apply unless the System Operator gives the person reasonable notice of the assistance required.\n\n63  Security and access policy—general\n\nCommunicating and making policy accessible\n\n (1) The person must communicate the person’s security and access policy, and ensure that the policy remains readily accessible, to the following entities:\n\n (a) each employee of the person;\n\n (b) each user (within the meaning of paragraph 32(2)(a)).\n\nComplying with policy\n\n (2) The person must:\n\n (a) comply with the policy; and\n\n (b) take all reasonable steps to ensure that the entities mentioned in subsection (1) comply with the policy.\n\nKeeping policy up‑to‑date\n\n (3) The person must ensure the following:\n\n (a) the policy is kept up‑to‑date;\n\n (b) each iteration of the policy contains a unique version number and the date the iteration comes into effect;\n\n (c) without limiting paragraph (a), the policy is reviewed:\n\n (i) at least annually; and\n\n (ii) when any material new or changed risks are identified; and\n\n (iii) on request by the System Operator;\n\n (d) a review mentioned in paragraph (c) must include consideration of:\n\n (i) factors that might result in:\n\n (A) unauthorised access to the My Health Record system using the person’s information systems; or\n\n (B) the misuse or unauthorised disclosure of information from a healthcare recipient’s My Health Record by persons authorised to access the My Health Record system via or on behalf of the person; or\n\n (C) the accidental disclosure of information contained in a healthcare recipient’s My Health Record; and\n\n (ii) any changes to the My Health Record system that may affect the person; and\n\n (iii) any relevant legal or regulatory changes that have occurred since the last review.\n\nRecord‑keeping\n\n (4) The person must keep a record of each iteration of the policy for 5 years starting on the day the iteration comes into effect.\n\n64  Security and access policy—giving to System Operator on request\n\n (1) The person must comply with a request from the System Operator under this section within 7 days of the person receiving the request.\n\n (2) The System Operator may request in writing that a person give it a copy of the person’s security and access policy. The request may be for the person’s current policy or an iteration of the policy that was in effect on a specified date.\n\n65  Security and access policy—application record‑keeping\n\n (1) The person must keep a record of the following:\n\n (a) the person’s application of the procedures mentioned in paragraph 32(2)(a);\n\n (b) the person’s provision of the training mentioned in paragraph 32(2)(b);\n\n (c) the person’s application of the processes mentioned in paragraph 32(2)(c);\n\n (d) the person’s application of the measures mentioned in paragraph 32(2)(d).\n\nExample: The kinds of records the person must keep under this section include:\n\n(a) records of the creation, modification, suspension and deactivation of user accounts; and\n\n(b) logs of individuals’ access to the My Health Record system.\n\n (2) The person must retain a record mentioned in paragraph (1)(a) or (b) for 5 years starting on the day the record was created.\n\n (3) The person must retain a record mentioned in paragraph (1)(c) or (d) for 2 years starting on the day the record was created.\n\n66  Security and access policy—giving application records to System Operator on request\n\n (1) The person must comply with a request from the System Operator under this section within 7 days of the person receiving the request.\n\n (2) The System Operator may request in writing that a person give it a copy of a record mentioned in section 65.\n\n67  Accessing the My Health Record system or using health information included in a healthcare recipient’s My Health Record\n\n (1) This section applies if the person is a contracted service provider of a healthcare provider organisation.\n\n (2) The person must access the My Health Record system, or use health information included in a healthcare recipient’s My Health Record, only to the extent the person has been instructed to do so by the organisation.\n\n (3) If the person accesses the My Health Record system, or uses health information included in a healthcare recipient’s My Health Record, the person must give the System Operator the healthcare identifier of the healthcare provider organisation that instructed the person to access the system or to use the health information.\n\nPart 5—Other requirements relating to the My Health Record system\n\n \n\n68  Purpose of this Part\n\n  For the purposes of paragraph 109(3)(d) of the Act, this Part specifies requirements relating to the My Health Record system that apply to healthcare recipients or participants in the My Health Record system.\n\n69  Requirements for System Operator—system availability\n\n  The System Operator must, on request by another participant in the My Health Record system, provide the participant with details of when the My Health Record system was unavailable.\n\nPart 6—Other matters—authorised representatives and nominated representatives\n\n \n\n70  Requirement for System Operator—identity verification for healthcare recipients on ceasing to have an authorised representative\n\n (1) This section is made for the purposes of paragraph 109(7)(b) of the Act.\n\n (2) This section applies if:\n\n (a) a healthcare recipient ceases to have any authorised representatives; and\n\n (b) the recipient has not previously verified the recipient’s identity with the System Operator.\n\n (3) The System Operator must require the recipient to verify the recipient’s identity before the recipient is able to access their My Health Record.\n\nPart 7—Opt‑out model for the participation of healthcare recipients in the My Health Record system\n\n \n\n71  Opt‑out model applies to all healthcare recipients in Australia\n\n  For the purposes of clause 2 of Schedule 1 to the Act, Part 2 of that Schedule (the opt‑out model) applies to all healthcare recipients in Australia.\n\nPart 8—Application, transitional and saving provisions\n\nDivision 1—Provisions for this instrument as originally made\n\n72  Security and access policy requirements for certain registered entities existing immediately before 1 April 2026\n\n (1) This section applies to an entity if, immediately before 1 April 2026, the entity was any of the following:\n\n (a) a registered healthcare provider organisation;\n\n (b) a registered repository operator;\n\n (c) a registered portal operator;\n\n (d) a registered contracted service provider.\n\n (2) The following sections of the My Health Records Rule 2016 (as applicable), as in force immediately before 1 April 2026, continue to apply to the entity on and after 1 April 2026 until immediately before 1 October 2026:\n\n (a) for a registered healthcare provider organisation—sections 42 and 44;\n\n (b) for a registered repository operator or a registered portal operator—sections 59 and 61;\n\n (c) for a registered contracted service provider—sections 47 and 49.\n\n (3) Section 21, 27 or 32 of this instrument (as applicable) applies to the entity on and after 1 October 2026.\n\nSchedule 1—Repeals of instruments\n\n \n\n1  Repeals of instruments\n\nRepeal the following instruments:\n\nMy Health Records (Assisted Registration) Rule 2015\n\nMy Health Records (National Application) Rules 2017\n\nMy Health Records (Opt‑out Trials) Rule 2016\n\nMy Health Records Rule 2016\n\n \n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"This instrument consolidates and replaces earlier My Health Record rules (Schedule 1) and expressly applies the opt‑out participation model to all healthcare recipients in Australia (section 71). It broadens and formalises operational scope by imposing new, detailed registration, security, training and record‑keeping obligations on providers and operators (see sections 21, 27, 32, 45–46, 55–56, 65–66) and grants the System Operator express powers to delete content and suspend access for security or integrity reasons (see sections 13–14)."},"complexity_factors":["Multiple participant categories with distinct obligations (registered healthcare provider organisations, repository operators, portal operators, contracted service providers, authorised/nominated representatives) — dispersed duties increase complexity (see Parts 3–4).","Detailed security and access policy requirements, including auditability, mandatory training, user account management practices and review cycles — significant compliance burden for organisations (see sections 21, 27, 32, 43, 53, 63).","Extensive record‑keeping and disclosure obligations with fixed retention periods and short compliance windows for System Operator requests (7 days) and notifications (2 business days) — increases operational pressure (see sections 45–46, 55–56, 65–66, 38(2)).","Automated default controls, removal of inactive providers after 3 years, and recipient deletion rights introduce behavioural and technical requirements for access control mechanisms (see sections 8–9).","Complex automated suspension and cancellation triggers tied to healthcare identifier status, investigatory stages and safety reports — many conditional rules that require system logic and judgment (see sections 10–11).","System Operator discretionary powers to delete records and suspend participants where security, integrity or defamatory concerns arise, including examples and notice regimes — centralised enforcement discretion (see sections 13–14).","Interoperability compliance requirement linked to external conformance standards maintained by the Australian Digital Health Agency — technical dependency and updating risk (see definition of interoperability requirements and sections 21(2)(d), 39, 51, 61).","Transitional arrangements and repeal of prior instruments consolidate rules but require staged adoption by existing registrants (see section 72 and Schedule 1).","Cross‑references to the My Health Records Act 2012 and Healthcare Identifiers Act 2010 create legal interdependence and require coordinated interpretation across instruments (see sections 3, definitions and multiple cross-references throughout)."],"plain_english_summary":"These Rules set detailed operational requirements for the My Health Record system: who may access records, default and user-set access controls, automated suspension/cancellation triggers, and System Operator powers to delete or suspend content. They also impose registration, security, training and record‑keeping duties on healthcare provider organisations, repository/portal operators and contracted service providers. The Rules affect healthcare recipients (control and notification rights), and organisations that access or host records, because they create obligations, enforcement powers and ongoing compliance costs."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"This instrument consolidates and replaces four previous rules (My Health Records Rule 2016, Assisted Registration Rule 2015, National Application Rules 2017, and Opt-out Trials Rule 2016) into a single comprehensive instrument. The scope remains consistent with the original My Health Records Act 2012 framework—governing registration, access controls, and system operation. While the instrument is substantially longer than its predecessors due to consolidation and modernised security requirements, it does not expand beyond the original statutory purpose of regulating the My Health Record system."},"complexity_factors":["Extensive cross-referencing to the My Health Records Act 2012 and Healthcare Identifiers Act 2010 (at least 15 external statutory references)","Multiple parallel regulatory structures with near-identical requirements for different entity types (healthcare provider organisations, repository operators, portal operators, and contracted service providers each have separate but structurally similar Divisions in Parts 3 and 4)","Nested conditional logic in access control mechanisms (sections 8-11) with multiple exceptions and triggers for automatic suspension/cancellation","Detailed tabular structures for circumstances and notification requirements (sections 10, 11, 38, 50, 60)","27 defined terms in section 5, plus incorporation by reference of external definitions","Transitional provisions creating overlapping temporal jurisdictions (section 72 creates a 6-month grace period where old rules continue alongside new requirements)","Technical interoperability requirements incorporated by reference to external standards published by Australian Digital Health Agency"],"plain_english_summary":"This instrument sets the operating rules for Australia’s My Health Record: who can access records, how providers and tech operators must register and secure systems, how representatives are managed, and powers for the System Operator to suspend or remove records. It confirms the opt-out default.\n\nIt affects patients (all Australians unless they opt out), clinicians, healthcare organisations, IT contractors and the System Operator, and matters because it governs who can see and control sensitive medical data and how privacy and safety are enforced."}},"importantCases":[],"_links":{"self":"/api/acts/my-health-records-rules-2026","history":"/api/acts/my-health-records-rules-2026/history","analysis":"/api/acts/my-health-records-rules-2026/analysis","conflicts":"/api/acts/my-health-records-rules-2026/conflicts","importantCases":"/api/acts/my-health-records-rules-2026/important-cases","documents":"/api/acts/my-health-records-rules-2026/documents"}}