My Health Records (Information Commissioner Enforcement Powers) Guidelines 2026

The Guidelines organise activity around a small set of recurring statutory concepts. First, the My Health Record system itself, its System Operator and various categories of participant (registered healthcare provider organisations, repository operators, portal operators, the National Repositories Service operator, and registered contracted service providers) are defined as the regulated cohort for these rules (see definitions in s 3.2 and the description of the System Operator at s 4.4). The Guidelines repeatedly tie investigative and enforcement activity to interference with privacy arising from conduct connected with health information in a healthcare recipient’s My Health Record (see ss 4.3-4.6, 5.6-5.7).

Second, the Guidelines distinguish two statutory pathways for investigation and enforcement: exercising powers under the Privacy Act (Part V and Part VIB) or exercising powers under the My Health Records Act (s 73 investigatory power and the specific enforcement powers in Part 3 of the Guidelines). The Commissioner may choose to investigate under the Privacy Act (including Commissioner-initiated investigations under s 40 of the Privacy Act) or under s 73 of the My Health Records Act; the Guidelines indicate the Commissioner will generally conduct Commissioner-initiated My Health Record investigations under the Privacy Act unless there is reason to do otherwise (ss 5.3-5.5, 6.2-6.5). Investigative powers available under Part V include requiring documents and attendance for examination on oath, entry to premises, and compulsory conferences; Part VIB adds entry, search and seizure powers that require consent or a warrant (ss 5.8-5.10).

Third, the Guidelines identify the enforcement toolbox and the statutory instruments that make those tools usable in practice. The Commissioner can accept enforceable undertakings under s 80 of the My Health Records Act or s 80V of the Privacy Act (ss 8.1-8.3). The Commissioner may make determinations under s 52 of the Privacy Act following an investigation (ss 9.1-9.6). The Commissioner may seek injunctions under s 81 of the My Health Records Act or s 80W of the Privacy Act (ss 10.1-10.3). Civil penalty applications tied to My Health Records Act contraventions are permitted under s 79 of the My Health Records Act (ss 11.1-11.4), but the Guidelines note interaction with the Privacy Act civil penalty provisions (ss 11.3-11.4). Compliance notices and infringement notices under the Privacy Act (ss 80UC and 80UB respectively) are described, including their relationship to other enforcement remedies and the practical effects of choosing one path over another (ss 12.1-12.2, 13.1-13.3).

Finally, procedural and policy concepts run through the Guidelines. The Commissioner will apply a consistent regulatory approach, taking into account the objects of the My Health Records Act and the Privacy Act, whether harms are systemic or substantial, whether action has an educative or deterrent effect, public interest considerations, and whether enforcement will clarify law or policy (s 7.1). Publication and transparency are explicit options: the Commissioner may publish information about enforcement activity and will generally publish enforceable undertakings (ss 7.6-7.7). Information sharing is a distinct concept: s 73A authorises disclosure to the System Operator where it will enable monitoring or improvement of operation or security; the Guidelines note that such disclosure may assist the System Operator in exercising registration cancellation, suspension or variation powers (ss 4.8(7), 7.3-7.4).

The instrument speaks primarily to the Information Commissioner and to the class of persons and entities participating in the My Health Record system, but it also affects complainants, courts and third‑party agencies that may receive referrals.

Participants in the My Health Record system are defined directly in the Guidelines and include: the System Operator; registered healthcare provider organisations; the operator of the National Repositories Service; registered repository operators; registered portal operators; and registered contracted service providers to the extent they provide services to registered healthcare providers (s 3.2). These participants are subject to obligations under the My Health Records Act and, in most instances, to the Privacy Act as well (ss 4.5-4.7). The Guidelines note that APP entities must take reasonable steps to implement practices, procedures and systems to comply with Australian Privacy Principles and to deal with inquiries and complaints (s 5.2).

The System Operator is singled out for two concrete roles: operational responsibility for running the My Health Record system and the National Repositories Service (s 4.4), and the potential recipient of investigative material from the Commissioner to enable monitoring or improvement of system operation or security under s 73A (s 4.8 and s 7.3). The Guidelines make explicit that a disclosure to the System Operator might enable administrative action by the System Operator, such as cancellation, suspension or variation of registration (s 7.4).

Entities of varying scale bear financial and operational consequences. Where the Commissioner believes civil penalty contraventions have occurred, the Commissioner may seek civil penalties under the My Health Records Act or the Privacy Act (ss 11.1-11.4). Infringement notices may be issued, which specify an amount to be paid as an alternative to court proceedings (s 13.1). Compliance notices may be issued to direct practical steps to come into compliance (s 12.1). Both compliance and infringement notices may be issued by the Information Commissioner or by a Senior Executive Service member authorised by the Commissioner (ss 12.1, 13.1).

Complainants and individuals whose privacy is alleged to have been interfered with are affected in that the Guidelines set out the pathways for lodging complaints, for conciliation, for Commissioner‑initiated investigations, and for determinations and enforcement (ss 5.3-5.5, 9.1-9.6). Courts are affected because enforcement applications, injunctions and civil penalty proceedings will be brought in specified courts: the Federal Court, the Federal Circuit and Family Court (Division 2), or a State/Territory court with jurisdiction over My Health Records matters (definition of Court in s 3.2; see ss 9.3, 10.1-10.2, 11.1).

Other public agencies can be affected by referrals. The Commissioner may decline to investigate where there is an alternative complaint body (s 14.2), may refer matters to law enforcement for criminal investigation (s 14.3) and may refer criminal offences to the Commonwealth Director of Public Prosecutions (s 14.3). The Guidelines therefore place the Commissioner at an interagency nexus between regulated entities, complainants, the System Operator and prosecutorial authorities.

The Guidelines do not create new substantive duties beyond the My Health Records Act and the Privacy Act, but they set out the administrative duties and rights that flow from those Acts in the My Health Record context and describe how the Commissioner will exercise statutory powers.

Duties for participants are anchored in existing legislative obligations. Participants must comply with the My Health Records Act’s privacy framework and supplementary obligations (ss 4.3-4.6). APP entities are required under APP 1 to implement practices, procedures and systems to ensure compliance with the APPs and to handle related inquiries and complaints (s 5.2). The Guidelines also frame practical regulatory duties: where a complaint is lodged, the Commissioner may request that the complainant first seek resolution with the participant and may request that the participant take reasonable steps to resolve it (s 5.4). If resolution by the participant is unreasonable or unsuccessful, participants must expect Commissioner investigation and potential enforcement action (s 5.5).

Rights and procedures available to regulated entities and individuals are described. A person who makes a complaint may have it dealt with under the Privacy Act (ss 5.3, 9.1). The Commissioner has the power to attempt conciliation before taking enforcement action (s 4.8(1) and s 6.6). A respondent to a Privacy Act investigation may be the subject of a determination under s 52, and the Commissioner may apply to a Court to enforce that determination if the respondent fails to comply (ss 9.1, 9.3-9.5). Entities have procedural avenues when statutory notices are issued: an infringement notice gives an entity the option to pay the amount specified as an alternative to court proceedings, and the Regulatory Powers Act and the Privacy Act provide mechanisms for an extension of time to pay or withdrawal of the notice (s 13.1-13.2).

Enforcement tools impose rights and duties of further specificity. The Commissioner may accept a written enforceable undertaking, but that undertaking must be given by a person authorised to bind the respondent and must be expressed to be an undertaking under s 114 of the Regulatory Powers Act (ss 8.4-8.5). Compliance notices under s 80UC of the Privacy Act are discretionary and must outline practical steps to correct contraventions; they operate as an alternative enforcement pathway to infringement notices and civil penalties (s 12.1-12.2). The Guidelines also specify that a civil penalty cannot be sought for certain provisions if a compliance notice relating to the same conduct remains in force and was complied with, or if an application to the Court for review of the notice is pending (s 11.5).

The Commissioner’s procedural duties are also set out. The Commissioner will act consistently with the Commissioner’s privacy regulatory approach under the Privacy Act and have regard to published policies on complaint handling, investigations and enforcement (s 6.1). The Commissioner is to act as a model litigant in litigation (s 7.5). Investigatory powers under Part V and Part VIB of the Privacy Act must be exercised consistent with statutory safeguards: for example, Part VIB entry/search/seizure powers require consent or prior judicial authorization (s 5.10).

The Guidelines catalogue the statutory enforcement mechanisms, the contexts in which they may be used, and procedural constraints that affect when and how penalties are imposed.

Civil penalties: The My Health Records Act contains civil penalty provisions within the Commissioner’s remit provided in s 79 of the Act. The Commissioner must commence an application for a civil penalty within four years of the alleged contravention (s 11.1). The Guidelines explain that civil penalty provisions in the My Health Records Act and the Privacy Act (notably the ‘serious interference with privacy’ and ‘interference with privacy’ provisions in ss 13G and 13H of the Privacy Act) may both be available for particular conduct that involves My Health Record information; the Commissioner may choose to seek penalties under the Privacy Act in those circumstances (ss 11.3-11.4). Importantly, a civil penalty order cannot be sought in relation to certain civil penalty provisions if a compliance notice has been issued for the same conduct and the entity has complied with the notice, or if the entity has a pending Court application to review the notice (s 11.5).

Injunctions: The Commissioner can apply to a Court for injunctive relief to restrain or compel actions under s 81 of the My Health Records Act (enforceable under Part 7 of the Regulatory Powers Act) and under s 80W of the Privacy Act (s 10.1-10.2). When considering whether to seek an injunction, the Commissioner will take into account the matter’s facts, the factors at s 7.1 and the Commonwealth’s model litigant obligations (s 10.3).

Enforceable undertakings: The Commissioner may accept written undertakings under s 80 of the My Health Records Act or s 80V of the Privacy Act, with enforcibility under Part 6 of the Regulatory Powers Act (ss 8.1-8.3). Undertakings must be executed by persons authorised to bind the respondent (s 8.4) and must be written and expressed to be undertakings under the Regulatory Powers Act (s 8.5).

Compliance notices and infringement notices: Compliance notices under s 80UC of the Privacy Act are discretionary remedial instruments intended to require practical steps for compliance and may precede an infringement notice (s 12.1). The Privacy Act prescribes the content and requirements of a compliance notice and its interaction with other enforcement tools (s 12.2). Infringement notices under s 80UB of the Privacy Act are available where the Commissioner reasonably believes an infringement notice provision has been contravened; the notice specifies the alleged contravention and an amount to be paid with procedures for extension or withdrawal set out in the Regulatory Powers Act (ss 13.1-13.2). The Guidelines note there are prescribed circumstances in which an infringement notice may not be issued (s 13.3 referencing s 80UC(10) of the Privacy Act and s 103(2) of the Regulatory Powers Act).

Investigatory powers and coercive tools: The Commissioner’s investigatory toolkit under Part V of the Privacy Act includes requiring production of documents, attendance and answers under oath, entry to premises and in certain circumstances holding hearings or compulsory conferences (s 5.9). Part VIB adds entry, search and seizure powers when the Commissioner is investigating an offence or a civil penalty provision, but those powers require consent to entry or prior judicial authorisation in the form of a warrant and are subject to proportionality conditions (s 5.10).

Referral to prosecution and other bodies: The Guidelines confirm that criminal offences under the My Health Records Act and the Privacy Act exist and that the Commissioner can refer such matters to the Commonwealth Director of Public Prosecutions (s 14.3). The Guidelines give an example of a criminal offence in the Privacy Act , repeated failure by a body corporate to comply with a requirement to give information or produce documents under the Privacy Act (subsection 66(1AA) of that Act) , as a matter that may be referred (s 14.3). The Commissioner may also decline to investigate or refer complaints to alternative complaint bodies under ss 41 and 50 of the Privacy Act where appropriate (s 14.2).

Publication and transparency of enforcement: The Commissioner may publish information about use of enforcement powers, subject to exceptions such as referrals to law enforcement or other legal prohibitions; accepted enforceable undertakings will generally be published (ss 7.6-7.7).

The Guidelines sit expressly at the intersection of the My Health Records Act, the Privacy Act and the Regulatory Powers Act, and they reference the AIC Act and Acts Interpretation Act for definitional and power‑making contexts.

Cross‑application of investigative regimes: The Guidelines clarify that contraventions of the My Health Records Act in connection with health information held in a My Health Record are interferences with privacy for the purposes of the Privacy Act (s 5.7). Consequently, investigatory powers under Part V and Part VIB of the Privacy Act apply to conduct that might contravene the My Health Records Act (ss 5.8-5.10). Commissioner‑initiated investigations under s 40 of the Privacy Act will generally be conducted under the Privacy Act rather than the My Health Records Act unless there is a reason to proceed under the latter (ss 6.2-6.4).

Regulatory Powers Act enforcement architecture: The Guidelines map each enforcement tool to the corresponding provisions of the Regulatory Powers Act, indicating which procedural and enforcement standards apply. For example: enforceable undertakings accepted under s 80 of the My Health Records Act or s 80V of the Privacy Act are enforceable under Part 6 of the Regulatory Powers Act (s 8.3); civil penalty orders for My Health Records contraventions are sought under Part 4 of the Regulatory Powers Act (s 11.2); injunctions are enforceable under Part 7 (s 10.1); and infringement notices operate with Part 5 of the Regulatory Powers Act (s 13.2). This mapping confers on each enforcement mechanism the procedural framework and review pathways set out in the Regulatory Powers Act.

Interaction with state and territory laws: The Guidelines note that in addition to the My Health Records Act and the Privacy Act, other participants in the My Health Record system are subject to relevant State and Territory privacy laws (s 4.7). The Guidelines do not attempt to reconcile inconsistencies but identify that multiple statutory privacy regimes may be relevant.

Administrative law and litigation obligations: The Guidelines reference the Commonwealth’s model litigant obligations and Best Practice Guides published by the Administrative Review Council as materials the Commissioner will have regard to when investigating and deciding on enforcement action (ss 7.5, 6.1 note). Definitions and power‑making references draw on the Acts Interpretation Act 1901, for example noting s 33(3) relating to power to repeal instruments and the operation of s 33A for acting appointments (s 2.2 note; s 3.2 note).

Information sharing with the System Operator: Under s 73A of the My Health Records Act, the Commissioner may disclose investigative information to the System Operator when satisfied such disclosure will enable the System Operator to monitor or improve system operation or security. The Guidelines reiterate that such disclosure may assist the System Operator to exercise administrative registration powers (s 7.3-7.4). This creates a direct interaction between evidentiary material gathered under an investigation and the System Operator’s administrative enforcement tools.

Referral and prosecutorial interface: The Guidelines acknowledge criminal offences and the Commissioner’s role in referring potential criminal conduct to prosecutorial authorities, such as the Commonwealth Director of Public Prosecutions (s 14.3). They also reference the statutory ability to decline to investigate where alternate complaint mechanisms exist (s 14.2), reflecting statutory choice points between federal regulation and other legal or administrative routes.

The instrument itself records only the immediate amendment context: it repeals the My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 upon commencement (s 2.2). The Guidelines come into effect on the day after registration in the Federal Register (s 2.1). The instrument cites the Acts Interpretation Act to note that where an Act confers power to make an instrument it includes the power to repeal or vary such instruments (note to s 2.2). The Definitions section also notes that the Acts Interpretation Act’s provisions about acting appointments (s 33A) apply to the Information Commissioner (s 3.2 note), which is an interpretive cross‑reference rather than an amendment to underlying Acts.

No other amendment history, transitional arrangements, or retrospective modification of obligations is recorded in the text. The Guidelines are a new legislative instrument that supplants the prior guidelines; they do not themselves amend the primary Acts. The document contains no schedule of previous amendments or a history table beyond the repeal of the 2016 Guidelines (s 2.2). For a record of prior versions or legislative change, the document points users to the Federal Register of Legislation (the note under "Note 1").

Practitioners should therefore treat this instrument as the current Guidelines as of the stated commencement date and consult the Register for any subsequent legislative instruments, disallowances or replacement instruments. The Guidelines do not include transitional or grandfathering provisions for enforcement actions commenced under the 2016 Guidelines; instead, the Commissioner simply states the 2016 instrument is repealed and that the Commissioner will have regard to the 2026 Guidelines from commencement (s 2.2-2.3).

The Guidelines themselves do not provide any litigation history. They refer to courts by definition and specify which courts may hear enforcement applications: the Federal Court of Australia; the Federal Circuit and Family Court of Australia (Division 2); and a State or Territory court with jurisdiction over matters arising under the My Health Records Act (definition of Court at s 3.2; see also ss 9.3, 10.1-10.2). The instrument references statutory causes of action and the procedural paths by which the Commissioner may seek enforcement, such as civil penalty applications under s 79 of the My Health Records Act and determinations under s 52 of the Privacy Act (ss 9.1-9.6, 11.1-11.4).

No cases, judgments or precedents are named or summarised in the Guidelines. The text does not claim any existing court interpretations of the My Health Records Act or of the Commissioner’s enforcement powers. Where the Guidelines discuss legal thresholds or constraints, they do so by referring to statutory provisions (for example, the four‑year limitation for civil penalty applications in s 11.1 or the warrant/consent condition for Part VIB powers in s 5.10) rather than to judicial interpretation.

Because the Guidelines are an administrative instrument setting out a policy approach and procedural expectations, any litigation that may arise in future,such as enforcement proceedings, judicial review of compliance notices, or challenges to the Commissioner’s use of Part VIB powers,will be initiated in the courts identified in s 3.2. The Guidelines indicate the Commissioner will have regard to administrative review best practice guides and model litigant obligations when engaged in litigation (ss 6.1 note, 7.5), but they do not record any prior litigation applying or testing the Guidelines’ content.

Practitioners seeking case law on the operation of these powers must therefore look to decisions that interpret the underlying Acts (My Health Records Act, Privacy Act, and the Regulatory Powers Act) rather than to decisions that apply these Guidelines specifically, as the instrument contains no internal litigation history.

Several procedural, timing and strategic traps appear from the text of the Guidelines. These are matters that regulated entities and advisers should note because the Guidelines present choices and constraints that can affect the availability and sequencing of enforcement options.

Dual statutory pathways and regulatory discretion: The Commissioner may investigate under the Privacy Act or under s 73 of the My Health Records Act and may prefer the Privacy Act for Commissioner‑initiated investigations unless there is reason otherwise (ss 5.3, 6.2-6.5). That choice can change available remedies, review pathways and procedural rules, so respondents cannot assume a single fixed route for resolution. The Commissioner also retains discretion to select and combine enforcement powers as considered appropriate (ss 4.10, 7.2).

Compliance notice bar to civil penalties: A key interaction trap is that a civil penalty order cannot be sought for certain civil penalty provisions if a compliance notice for the same conduct has been issued and complied with, or if the entity has applied to the Court for review and the application has not been finally determined (s 11.5). Issuance of a compliance notice therefore changes the enforcement calculus and may forestall civil penalty proceedings in particular circumstances.

Time bar for civil penalties: Civil penalty proceedings for My Health Records Act contraventions must be brought within four years of the alleged contravention (s 11.1). Parties should be aware of that limitation for both claims and potential defences and preserve records accordingly.

Entry, search and seizure constraints: Part VIB powers require consent to entry or a warrant and are subject to conditions to prevent arbitrary use (s 5.10). While this is a protection, it also means that subpoenas, warrants and consent procedures may be engaged in a way that affects timing and evidence preservation; respondents should consider retention and legal advice early if an investigation appears likely.

Who can issue notices and who signs undertakings: Compliance and infringement notices can be issued by the Commissioner or by an SES member of staff authorised by the Commissioner (ss 12.1, 13.1). Enforceable undertakings must be executed by a person authorised to bind the respondent organisation (s 8.4) and must be in the form required by the Regulatory Powers Act (s 8.5). Organisations should ensure appropriate delegation and authorisation for negotiating and executing undertakings.

Publication risk: The Commissioner may publish information about enforcement actions and will generally publish accepted enforceable undertakings (ss 7.6-7.7). Entities entering into undertakings should assess reputational and commercial implications because publication is likely.

Information sharing with the System Operator: The Commissioner may disclose investigation-related material to the System Operator where it will enable system monitoring or security improvement (s 7.3). Such disclosure may lead the System Operator to exercise administrative registration powers (s 7.4). Entities should be aware that an investigative file may trigger separate administrative consequences beyond Commissioner enforcement action.

Infringement notice limitations and choices: The Privacy Act and the Regulatory Powers Act prescribe circumstances in which an infringement notice cannot be issued (s 13.3, citing s 80UC(10) of the Privacy Act and s 103(2) of the Regulatory Powers Act). Where an infringement notice is available, it allows an entity to pay the specified amount in lieu of court proceedings (s 13.1), but payment is an admission of liability in practical terms that can foreclose contest. Entities should consider discretionary use of compliance notices and the procedural consequences of choosing to pay an infringement notice.

Intersection with multiple regimes: The Guidelines note that participants are often subject to the Privacy Act and relevant State and Territory privacy laws in addition to the My Health Records Act (s 4.7). This multi‑regime exposure may create different reporting, notification and compliance obligations across jurisdictions; entities should map obligations carefully.

Lack of bindingness of Guidelines: Finally, the Commissioner explicitly retains discretion to apply the available powers as considered appropriate in the facts (s 4.10). The Guidelines are guidance, not a fetter on statutory discretion; practitioners should not view any procedural statement as a binding rule that limits the Commissioner’s statutory powers.

The Guidelines point to a pragmatic, stepped approach for participants that aligns statutory obligations with administrative expectations. The following actions are direct corollaries of the text and should be considered by participants and their advisers.

Operationalise APP 1 obligations: APP 1 requires APP entities to manage personal information in an open and transparent way and to take reasonable steps to implement practices, procedures and systems to ensure compliance (s 5.2). Entities participating in the My Health Record system should document and implement systems for complaints handling, record retention, access controls and privacy governance that map to their APP obligations.

Establish internal complaint resolution pathways: The Commissioner will, where practicable, seek early and efficient dispute resolution and may ask complainants to lodge complaints with the participant first and to take reasonable steps to resolve them (s 5.4). Entities should maintain clear, documented complaint handling procedures that enable timely and demonstrable attempts at resolution, including escalation pathways and timelines to show “reasonable steps” were taken.

Prepare for Commissioner investigations: The Commissioner has broad investigatory powers under Part V of the Privacy Act and s 73 of the My Health Records Act (ss 5.6-5.9). Entities should maintain accessible records, designate liaison officers who can promptly respond to notices requiring production of documents or attendance, and ensure that staff understand obligations to preserve relevant records and to escalate legal support when compelled to provide information.

Authorise appropriate signatories and delegations: Enforceable undertakings must be given by a person authorised to bind the respondent (s 8.4) and compliance and infringement notices may be issued by SES staff (ss 12.1, 13.1). Organisations should ensure that delegation and authorisation matrices are current so that the right officers can negotiate and sign undertakings and engage with the Commissioner’s office.

Respond carefully to compliance and infringement notices: Compliance notices set out practical, measurable steps for compliance and may bar civil penalty proceedings if complied with (ss 12.1, 11.5). Infringement notices provide a monetary alternative to litigation but carry substantive consequences (s 13.1). When served, entities must consider whether to comply with the steps in a compliance notice promptly or whether to contest the notice through the statutory review pathways; advisers should assess the strategic implications of compliance versus litigation.

Assess risk of disclosure to the System Operator: The Commissioner may disclose investigation-related material to the System Operator to enable system monitoring or security improvements, with potential administrative outcomes for registration (ss 7.3-7.4). Entities should evaluate potential system registration impacts and prepare mitigation documentation , for example, evidence of remediation, security posture, and compliance program improvements , that could be used to respond to both the Commissioner and the System Operator.

Design remediation that can form the basis of an undertaking: Because the Commissioner may accept enforceable undertakings and will generally publish them (ss 8.1-8.3, 7.7), entities should consider remediation plans that are concrete, time‑bounded and capable of verification. Undertakings must be in writing and expressed to be under s 114 of the Regulatory Powers Act (s 8.5), so remediation commitments should be drafted in a format acceptable under that provision.

Retain records and monitor limitation periods: The four‑year limitation for civil penalty proceedings (s 11.1) means entities should retain records and audit trails relevant to potential contraventions for at least that period. Retention policies should align with legal advice on potential exposures and regulatory reporting obligations.

Coordinate cross‑jurisdictional compliance: Participants subject to State and Territory privacy laws as well as the Privacy Act and the My Health Records Act should harmonise reporting and remediation processes to satisfy multiple obligations (s 4.7). This includes ensuring breach notification processes are consistent and that legal advice considers cross‑jurisdictional remedies and timelines.

Engage early with the Commissioner’s queries: The Guidelines emphasise conciliation and early resolution (s 4.8(1), s 5.4). Engaging early and constructively with the Commissioner can facilitate conciliation, reduce the likelihood of escalated enforcement and may affect the choice of remedy the Commissioner pursues.

Ensure readiness for forensic and evidential demands: Part VIB powers (requiring consent or warrant) may be used in serious cases (s 5.10). Entities should ensure that IT forensics, chain of custody procedures and evidence preservation processes are in place so that, if an entry, search or seizure occurs or is threatened, the entity can cooperate while protecting privileged material and legal interests.

Maintain transparency and consider reputational exposure: Because the Commissioner may publish enforcement actions and generally publishes enforceable undertakings (ss 7.6-7.7), entities should prepare communications strategies that align with legal positions and remedial steps, and should draft undertakings with an eye to what will be publicly disclosed.

These compliance steps are direct responses to the procedural features and enforcement options described in the Guidelines (Part 2 and Part 3). They reflect the practical behaviours the Guidelines expect participants to adopt: documented governance and complaint handling, readiness for investigation and enforcement, capacity to negotiate and comply with undertakings and notices, and an ability to coordinate across the statutory regime that governs My Health Record participation.