My Health Record (Share by Default) Rules 2025

The instrument introduces several key concepts that define the scope and trigger of the new default sharing regime. “Prescribed healthcare provider organisation” is a defined term in the My Health Records Act; the instrument specifies two types: (a) a proprietor of diagnostic imaging premises at which covered healthcare is rendered by or on behalf of a radiologist; and (b) a proprietor of a pathology laboratory at which covered healthcare is rendered by or on behalf of a pathologist. “Proprietor” is given the same meaning as in the Health Insurance Act , typically the entity that owns or controls the premises. “Kinds of healthcare” determine which services are in scope. For diagnostic imaging, these are: R‑type diagnostic imaging services (items in Part 2 of the Diagnostic Imaging Services Table), medical services in Part 4 of the General Medical Services Table, health services treated as equivalent by a determination under section 3C(1) of the Health Insurance Act, and “any other kind of healthcare rendered by or on behalf of a radiologist for which a report is created”. This last catch‑all is very broad: any consultation or procedure by a radiologist that generates a written report would be captured, even if not listed in a Medicare table. For pathology, the scope is similarly broad: items in the Pathology Services Table, services treated as equivalent, and any other healthcare by a pathologist that generates a report. “Specified information” is limited to information included in a report or other document that is authorised by the radiologist or pathologist who rendered the healthcare. The instrument explicitly excludes images from the sharing obligation (section 7(2) for imaging; no equivalent exclusion for pathology because pathology reports typically do not include images in the same sense). “Period for sharing” is 24 hours, beginning at the time the information is first provided to any of: the healthcare provider who requested the service, the healthcare provider treating the recipient, or the healthcare recipient themselves. This is a tight window: the clock starts ticking when the first copy leaves the proprietor’s control, not when the report is finalised or when it is uploaded to the My Health Record system. “Excluded purposes” remove certain testing from the obligation: workplace drug or alcohol testing, court ordered testing, and law enforcement testing are excluded for both imaging and pathology. Pathology also excludes services performed solely for research or a clinical trial, but only if the information is not provided to the treating practitioner or the patient , meaning if the results are later fed back to a clinician for treatment decisions, the exemption is lost and the default sharing obligation applies. The instrument also specifies “kinds of health information that may be collected, used or disclosed” under section 70AA(3)(b) of the Act: the type of report or document, and the time and date the service was requested or rendered. This permits the proprietor to record and disclose this metadata without further consent, which may be relevant for auditing, quality assurance and secondary uses.

The primary duty‑bearers are proprietors of diagnostic imaging premises and proprietors of pathology laboratories where services are rendered by or on behalf of a radiologist or pathologist. This includes corporate pathology chains, hospital‑based imaging departments, and independent radiology practices. Individual radiologists and pathologists are not directly named as duty‑bearers, but their authorisation of a report is a necessary condition for the sharing obligation to arise (section 7(1)(b) and 12(b)). In practice, the proprietor will need to ensure that radiologists and pathologists working at the premises issue reports in a format that can be uploaded, and that the timing of “authorisation” is clear. Healthcare recipients (patients) are affected because their diagnostic and pathology reports will now be uploaded to their My Health Record by default unless they have taken steps to restrict access or the service falls within an exclusion. Patients who have chosen to not have a My Health Record or who have placed access controls under the Act may still have information uploaded , the instrument does not carve out patients who have opted out of the system; it simply requires the proprietor to share information with “the My Health Record system”, not necessarily to make it visible to all. The interaction with patient consent and access controls under the Act is a critical downstream issue. Requesting and treating healthcare providers are affected indirectly because they will receive reports more quickly and reliably via the My Health Record, which may improve continuity of care but also reduce their ability to control the flow of sensitive information. Other healthcare provider organisations (e.g., general practices, hospitals, specialists) are affected because they will need to adjust their workflows to retrieve reports from the My Health Record rather than relying on fax, email, or paper delivery. The instrument does not impose obligations on them to check the system. The Australian Digital Health Agency (which operates the My Health Record) is affected because it must accommodate a large increase in upload volume from 1 July 2026. Vendors of practice management software and pathology/radiology information systems are affected because they must develop and implement integrations to push reports to the My Health Record within 24 hours reliably. Medicare (through the Health Insurance Act definitions) is relevant because the scope of services is largely defined by Medicare Benefits Schedule items, but the instrument also catches non‑Medicare services that produce a report, meaning services provided to private patients, in‑hospital services, and those not eligible for a benefit are still covered if they meet the definition of healthcare rendered by a radiologist or pathologist.

The instrument does not itself create rights; it imposes duties on specified organisations and specifies additional permitted uses of health information. The central duty is the obligation to share information under section 78A(1) of the My Health Records Act, which this instrument particularises. The duty falls on the proprietor of the diagnostic imaging premises or pathology laboratory. The information that must be shared is limited to reports and other documents authorised by the radiologist or pathologist; raw images are excluded. The sharing must occur within 24 hours of the information first being provided to any of: the requesting provider, the treating provider, or the patient. This is a strict timeline: if the proprietor provides the report to a referring doctor by email at 10:00 AM, the upload to the My Health Record must occur by 10:00 AM the next day, regardless of weekends or public holidays. The proprietor has no discretion to delay for internal review, billing clearance, or patient consent checks. Rights of patients to control their My Health Record are preserved under the My Health Records Act, but the instrument does not modify those rights. A patient who has placed a “restricted access” code on their record may still have reports uploaded; the Act may allow the patient to later remove or restrict visibility, but the initial upload is mandatory. The instrument also expands the kinds of information that the proprietor may collect, use or disclose without further consent under section 70AA(3)(b): metadata about the type of report and the timing of request and rendering. This allows the proprietor to use that information for secondary purposes such as quality assurance, but the instrument does not authorise broader disclosure to third parties. Exclusions provide a right (in effect, an exemption) for certain testing: workplace drug/alcohol testing, court ordered testing, law enforcement testing, and (for pathology only) research/clinical trial testing with no clinical feedback. The burden of proving that an exclusion applies falls on the proprietor; they would need to maintain records to justify non‑sharing. The instrument does not create a right for patients to opt out of the sharing of individual reports; that is left to the Act. The obligation is to share with the “My Health Record system”, which may mean the central infrastructure, not necessarily to make the report viewable by all healthcare providers if the patient has imposed access restrictions. The instrument’s phrasing “shared with the My Health Record system” is ambiguous on this point: it may require upload regardless of access controls.

The instrument itself does not prescribe penalties; it is a legislative instrument that sets out the particulars of an obligation contained in the My Health Records Act 2012. The Act contains civil penalty provisions for non‑compliance with section 78A, including the failure to share information within the specified period. Under section 78A of the Act, a civil penalty provision applies to a healthcare provider organisation that fails to share the specified information. The maximum penalty is likely to be substantial (civil penalties under the Act can be up to 500 penalty units for an individual and 5,000 penalty units for a body corporate, amounts that are indexed). The Office of the Australian Information Commissioner (OAIC) enforces the My Health Record system rules and can issue infringement notices or seek court orders for civil penalties. The instrument’s effect is to make non‑compliance with the 24‑hour upload requirement a breach of the Act. Because the obligation is strict (no defence of reasonable steps or technological difficulty), a proprietor that fails to upload a report within 24 hours has contravened the law even if the delay was due to a software failure or human error. The Act does provide for a “reasonable excuse” defence in some contexts, but it is narrow. The instrument also creates exposure in relation to the collection, use and disclosure of health information: if a proprietor collects or uses metadata (type of report, time/date) beyond the scope specified in section 9 or section 14, it may breach section 70AA of the Act, which also carries civil penalties. Enforcement is likely to be complaint‑driven, but the OAIC also conducts own‑motion investigations. There is no private right of action under the My Health Records Act for individuals harmed by a breach, but individuals can complain to the OAIC. The practical risk for proprietors is that a single missed upload could trigger a complaint and an investigation, leading to substantial legal costs and reputational damage. Furthermore, because the instrument applies to reports authorised by radiologists and pathologists, a dispute about whether a report was “authorised” could lead to enforcement action if the OAIC takes a broad view of authorisation (e.g., any sign‑off or verification before issuing). The penalties are not trivial: for a large pathology chain, a single contravention could cost tens of thousands of dollars, and a systemic failure could result in multiple penalties.

The instrument operates within a web of federal and state legislation. Primarily, it is made under the My Health Records Act 2012 (Cth) and must be read together with that Act. The Act defines the concept of “prescribed healthcare provider organisation” and sets the framework for sharing obligations, enforcement, and patient rights. The instrument fills gaps left by the Act: it specifies which organisations are prescribed, which services trigger the obligation, what information to share, and the timeframe. It also specifies additional collection, use and disclosure permissions under section 70AA of the Act. The Health Insurance Act 1973 (Cth) is heavily cross‑referenced. The definitions of “diagnostic imaging service”, “diagnostic imaging premises”, “pathology service”, “pathologist”, “radiologist”, “R‑type diagnostic imaging service”, “medicare benefit”, and “proprietor” all derive from the Health Insurance Act. This means that any amendment to the Health Insurance Act’s definitions or to the Medicare tables could change the scope of this instrument without the instrument itself being amended. For example, if a new item is added to the Diagnostic Imaging Services Table, it will automatically be captured under section 6(1)(a) unless the instrument is updated to exclude it. The Health Insurance (Diagnostic Imaging Services Table) Regulations and the Health Insurance (Pathology Services Table) Regulations are directly incorporated. The instrument also references determinations under section 3C(1) of the Health Insurance Act, which treat certain health services as if they were items in the tables; those determinations can be made by the Minister. The Privacy Act 1988 (Cth) applies generally, but the My Health Records Act is a more specific regime that displaces the Privacy Act for matters covered by the My Health Record system. The instrument does not alter that. The specified metadata collection under sections 9 and 14 is permitted under the My Health Records Act and therefore does not require separate consent under the Privacy Act. However, state and territory health records legislation may impose additional obligations on electronic health information sharing; the My Health Records Act generally prevails to the extent of any inconsistency (Constitution s 109). The Corporations Act 2001 and Work Health and Safety laws may be indirectly relevant if failures to share cause harm, but those are not addressed in the instrument. For research and clinical trial exclusions, the Therapeutic Goods Act 1989 and clinical trial regulatory frameworks may affect the characterisation of a service as “solely” for research. The instrument creates a carve‑out only if information is not provided to the treating practitioner or patient; if results are fed back for clinical decision‑making, the exclusion is lost and the sharing obligation applies, even if the primary purpose was research.

This instrument was made on 9 December 2025 by the Minister for Health and Ageing, Mark Butler, and is scheduled to commence on 1 July 2026. It is a new legislative instrument, not an amendment to a prior one. As of the date of this analysis (the instrument as made), there have been no amendments. The instrument is a standalone rule under the My Health Records Act. Any future amendments would require the Minister to make a new legislative instrument amending or replacing these rules, subject to disallowance by Parliament. Because the instrument relies heavily on definitions from the Health Insurance Act and its regulations, it may be indirectly affected by amendments to those instruments without needing to be formally amended. For example, if the Minister adds a new Medicare item for a diagnostic imaging service, the scope of this rule expands automatically. Similarly, if the Health Insurance Act definition of “proprietor” changes, the class of prescribed healthcare provider organisations changes accordingly. The instrument is not subject to sunsetting provisions in the Legislation Act 2003 (it was made after 1 April 2003 and will be recorded on the Federal Register of Legislation, subject to periodic review). The commencement deferral to 1 July 2026 suggests that the Australian Digital Health Agency and affected providers have an 18‑month implementation period. There is no provision for transitional arrangements or phased implementation within the instrument itself, meaning the obligation applies fully from day one.

Because the instrument has not yet commenced (it commences on 1 July 2026), there is no litigation history. No court or tribunal has interpreted its provisions. However, litigation can be anticipated in a few areas. First, the scope of “report or other document that is … authorised by the radiologist” (s 7) may be contested: what constitutes authorisation, and who bears the onus of proving authorisation existed before the 24‑hour clock started? Second, the exclusion for research and clinical trials in pathology (s 11(3)) could generate disputes about what “sole purpose” means and whether the provision of incidental clinical feedback removes the exclusion. Third, the interaction with patient‑imposed access controls: if a patient has placed a “record‑level” restriction, does the obligation to share with the “My Health Record system” require the proprietor to upload the report despite the restriction, or does the Act’s access control framework prevail? The instrument is silent, so litigation may clarify that the upload is mandatory and the patient’s right is only to limit who can see it. Fourth, the definition of “proprietor” may cause confusion for hospital‑based services where the premises are owned by a health service but the pathology laboratory is operated by a separate corporate entity. The Health Insurance Act definition of “proprietor” may not align with the contractual reality. Challenges to the constitutional validity of the instrument are unlikely given the Commonwealth’s head of power over health insurance and digital health (external affairs, corporations, communications). There have been prior cases concerning the My Health Record system, notably challenges to the compulsory nature of the system under the Abbott government’s opt‑out model, but those resolved politically. The “share by default” shift may prompt judicial review if a patient or provider argues that the instrument exceeds the regulation‑making power under the My Health Records Act. The Minister’s power to make rules under section 110 of the Act is broad, but must be consistent with the Act’s objects; litigation could test whether the instrument impermissibly overrides patient consent rights.

Several traps await those who assume the instrument is straightforward. The catch‑all clause for “any other kind of healthcare” that results in a report. For diagnostic imaging, section 6(1)(d) covers any healthcare rendered by or on behalf of a radiologist for which a report is created, regardless of whether Medicare pays a benefit. This may capture services such as interventional radiology reports, screening services not listed in the Medicare table, and reports produced for medicolegal purposes if they are part of healthcare. The exclusion for workplace, court and law enforcement testing is narrow; it does not exclude insurance‑related testing, pre‑employment screening, or fitness‑for‑duty assessments unless a court orders them. Proprietors must either upload such reports or risk non‑compliance. The 24‑hour period begins when the report is first provided to any of three recipients, not when it is “authorised”. A proprietor might send a preliminary report to a treating doctor by fax while a formal authorised report is still being verified. The preliminary communication could start the clock. Once the information is “first provided” (even if marked draft), the 24‑hour window runs. Proprietors must ensure that their workflows either delay any transmission until the authorised report is ready, or accept that the upload must occur within 24 hours of the first transmission irrespective of the final version. Images are excluded, but the report may reference image findings. This could lead to incomplete clinical records: a report without the underlying images may be less useful for future clinicians, but the instrument does not require image sharing. The exclusion for research/clinical trials in pathology is contingent on information not being provided to the treating practitioner or patient. If a research study later returns individual results to a participant’s GP (which is common in genomic research), the exclusion evaporates and the report must be uploaded, even if the research ethics approval assumed it would not be shared. The definition of “proprietor” relies on the Health Insurance Act, which may not clearly cover all arrangements. For example, a radiology practice that leases rooms in a hospital may not be the “proprietor” of the premises; the hospital may be. The instrument only applies to a proprietor of “diagnostic imaging premises” or “pathology laboratory”. If a radiologist renders services at multiple locations, the proprietor of each location must comply. The instrument does not exempt reports that contain extremely sensitive information (such as genetic results, HIV status, or pregnancy screening) from the default upload. Patients may not be aware that these reports are automatically uploaded; the instrument places no obligation on the proprietor to inform the patient. The specified metadata that may be collected (type of service, time and date) is not limited to what is necessary for the share‑by‑default obligation. Proprietors could in theory mine this data without further consent for internal analytics or benchmarking, raising potential ethical concerns. There is no grace period for weekends or public holidays. If a report is provided to a treating doctor on a Friday afternoon, the upload must occur by Saturday afternoon on a purely electronic system, which may require weekend staffing or automated uploads. The authorised report requirement means that informal verbal reports or draft reports that are not signed off by the radiologist/pathologist are not within the sharing obligation, but if such reports are later confirmed by a formal authorised report, the clock starts only when the formal report is first provided to a recipient. However, if the formal report is provided electronically, it may be captured automatically, but the proprietor must ensure the software correctly identifies the time of first provision.

Any entity that is a proprietor of diagnostic imaging premises or a pathology laboratory must take several steps by 1 July 2026. First, determine whether you are a proprietor for the purposes of the Health Insurance Act and whether your premises are diagnostic imaging premises or a pathology laboratory. If you own or control the premises where a radiologist or pathologist renders services that generate reports, you are likely captured. Second, audit all services rendered by or on behalf of radiologists and pathologists at those premises. Create a list of every Medicare item number (R‑type diagnostic imaging services, pathology services, and general medical services under Part 4) that is billed, and also identify any non‑Medicare services that produce a report (e.g., private fee‑for‑service, worker’s compensation, medicolegal, corporate health assessments). Use the definitions in sections 6 and 11 and the exclusions to classify each service. Ensure that the exclusions (workplace drug/alcohol testing, court ordered testing, law enforcement testing, research/clinical trial with no clinical feedback for pathology) are robustly documented: maintain a clear audit trail showing that the service was rendered for an excluded purpose and that no report was given to a treating practitioner or patient. Third, implement a technical solution to automatically upload authorised reports to the My Health Record system within 24 hours of the information being first provided to a requesting provider, treating provider, or patient. This requires integration with the Australian Digital Health Agency’s APIs and with your practice management or laboratory information system. The system must detect the “first provision” event, not just the final authorisation. Consider disabling the transmission of any report (including draft reports) to external parties until the authorised report is ready, or programme the system to trigger the 24‑hour count at the moment of transmission and automatically upload a copy to the My Health Record within the window. Manual workflows will likely be insufficient. Fourth, train radiologists and pathologists to authorise reports promptly and to understand that a delay in authorisation does not stop the 24‑hour clock if a draft report has already been communicated. Fifth, review data collection practices under sections 9 and 14: you may now collect and retain metadata about the type of report and the time/date of request and rendering. Ensure that any other metadata collected (e.g., referring doctor, patient identifiers) is not used beyond what is permitted by the My Health Records Act. Sixth, develop a compliance monitoring system to track upload times and flag breaches. If a report is missed or uploaded late, you must have a process to correct it and to report to the OAIC if required. The Act requires that information be “shared” within the period; late sharing may still be a contravention even if eventually done. Seventh, update patient information and consent procedures even though consent is not required for sharing. Patients should be informed that their diagnostic imaging and pathology reports will be uploaded to their My Health Record by default. If a patient objects, they should be directed to the My Health Record access control mechanisms or to opt out of the system entirely. Eighth, consider the impact on clinical workflows: requesting providers may no longer receive reports directly by fax or email; they may need to log into the My Health Record system to retrieve them. This may cause friction unless you continue to provide reports through existing channels as well. The instrument does not prohibit other methods of delivery, so duplication is permissible but must not interfere with the 24‑hour upload requirement. Ninth, prepare for audits and enforcement by the OAIC. Keep logs of all uploads, including timestamps and evidence of authorised reports. The OAIC may request these during an investigation. Tenth, seek legal advice on borderline cases, such as services rendered by a radiologist that are not clearly within an item, or complex corporate structures where the proprietor is uncertain. Document your interpretations and the reasons for any decision not to upload a report. The cost of non‑compliance can be significant, so a conservative approach (upload in all borderline cases) may be advisable until guidance is issued.