My Health Records Regulations 2026

This instrument is compact and largely definitional, working by prescription and cross‑reference to the Act and to the Healthcare Identifiers Act 2010. The principal concepts it uses, and their operational effect within the regulatory scheme, are these.

Act and external statutory anchors: The instrument identifies the My Health Records Act 2012 as the empowering Act (s3). It also treats the Healthcare Identifiers Act 2010 as the source of prescribed “other information” for particular identification purposes (s5, ss7-9). The Australian Digital Health Agency (ADHA) is defined by reference to the Public Governance, Performance and Accountability (Establishing the Australian Digital Health Agency) Rule 2016 (s5).

System Operator: The instrument prescribes the Australian Digital Health Agency to be the System Operator for the purposes of paragraph 14(1)(b) of the Act (s10). That prescription determines which entity carries the System Operator functions defined in the Act, and therefore who will make operational decisions under the Act’s scheme, including registration and identity handling tasks referenced elsewhere in these Regulations.

“Other information” cross‑references: The instrument repeatedly supplies the meaning of “other information” used in specific paragraphs of the Act by mapping it to the “other information” prescribed under the Healthcare Identifiers Act 2010 (ss7-9). This is a legal device to ensure the identification requirements in the My Health Records Act use the same data items as those already prescribed for healthcare identifiers, aligning identification standards between the two regimes.

Nominated healthcare provider class: The instrument prescribes that, for paragraph 5(c)(iii) of the Act, the nominated healthcare provider class includes individuals who hold a Certificate IV in Aboriginal and/or Torres Strait Islander Primary Health Care Practice (s6). This is a definitional expansion that affects who can be registered or identified as nominated providers under the Act.

Registration metadata: For eligibility and registration purposes, the instrument prescribes additional “other information” to be used in assessing or recording a healthcare recipient’s registration status. This includes whether the recipient’s identity has been verified, whether a healthcare identifier is provisional, and, in Schedule 1 contexts, whether the recipient is deceased or likely deceased and whether that death has been verified (s11).

Prescribed record content: The instrument prescribes that certain information relating to provision of healthcare under five listed Commonwealth Acts be included in a My Health Record, but explicitly excludes information that relates to compensation or benefits under those Acts (s13). The Acts listed relate to nuclear test participants, defence rehabilitation and compensation, treatment benefits, and veterans’ entitlements.

Identity verification authorities: The instrument designates the Attorney‑General’s Department and the System Operator as the prescribed entities for particular columns in the Act’s table items relating to identity verification (s14). That allocates which bodies are responsible for discrete identity‑verification functions established in the Act.

Repeal and transition: Finally, the instrument repeals the previous My Health Records Regulation 2012 in full (Schedule 1), signalling a regulatory reset of the subordinate rules that govern practical aspects of the My Health Records scheme.

The Regulations affect a defined set of actors by prescribing who counts for particular legal characterisations, which organisations perform particular functions, and what kinds of data are to be included or treated as registration metadata. Those primary affected groups are set out below, with the statutory basis.

Australian Digital Health Agency (ADHA): The ADHA is prescribed as the System Operator for the purposes of paragraph 14(1)(b) of the Act (s10). As the System Operator entity, ADHA will be the body tasked with discharge of functions the Act allocates to the System Operator, including registration (as referenced in s12) and identity verification responsibilities allocated in s14(2).

Healthcare recipients: The instrument prescribes additional registration‑related information in relation to healthcare recipients. For the purposes of eligibility and registration, the System Operator must record or take into account whether the recipient’s identity has been verified and whether a healthcare identifier has been assigned provisionally (s11(1)). For Schedule 1 (which deals with slightly different registration items), additional information is required: whether the recipient is, or likely is, deceased, and whether death has been verified (s11(2)). These provisions directly affect how healthcare recipients’ My Health Records are created, flagged and managed.

Individual healthcare providers and healthcare provider organisations: The Regulations map “other information” required under particular paragraphs of the Act to the “other information” prescribed under the Healthcare Identifiers Act 2010 (ss7-9). That mapping affects healthcare provider organisations and individual providers because it determines which identity fields and supporting data are required for providers to be identified or linked to records.

Persons with Certificate IV in Aboriginal and/or Torres Strait Islander Primary Health Care Practice: The instrument expressly prescribes this cohort as a class of nominated healthcare providers for the purposes of the Act (s6). That affects individuals in that professional category by changing their legal status under the My Health Records regime.

Attorney‑General’s Department: The Attorney‑General’s Department is prescribed for specific identity verification functions (s14(1)). The Department will therefore be the reference Commonwealth body for certain verification tasks set out in the Act’s table items.

State and Territory public health statutory functions: The instrument prescribes particular State and Territory public health Act provisions for the purpose of subsection 41(4) of the Act and subclause 9(3) of Schedule 1 to the Act (s12). Specifically, it lists provisions from the NSW Public Health Act 2010, the Queensland Public Health Act 2005, and the ACT Public Health Act 1997. Relevant State or Territory authorities exercising powers under those listed provisions are therefore engaged with the System Operator’s registration functions in the ways the Act contemplates.

Persons whose healthcare is provided under the five named Commonwealth Acts: Section 13 prescribes that information which relates to the provision of healthcare under the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006, the Military Rehabilitation and Compensation Act 2004, the Safety, Rehabilitation and Compensation (Defence-related Claims) Act 1988, the Treatment Benefits (Special Access) Act 2019, and the Veterans’ Entitlements Act 1986 is prescribed information to be included in a My Health Record, subject to an explicit exclusion for compensation or benefit information. Individuals whose healthcare arises under those Acts will be affected, because certain healthcare‑provision information must be included in their records (s13(2)).

Organisations processing identity data and registration systems: Any organisation that creates, uploads, or relies upon My Health Records will need to align processes with the definitions and prescribed “other information” in ss7-11. That will include clinical software suppliers, health services, and any private or public entities that integrate with the System Operator’s processes.

Legal and compliance advisers, and data custodians: Because the Regulations prescribe which entities are responsible for identity verification (s14) and what data counts for registration and record content (ss7-13), legal and compliance teams within affected organisations must adapt policies and technical mappings to the prescribed definitions and the repeal of the 2012 Regulation (Schedule 1).

The Regulations do not, on their face, create new private rights or penalties within the subordinate instrument; they operate by definition and prescription to allocate administrative responsibilities and to standardise which data items are to be used for identification, registration and record content purposes (see ss3, 5-14).

The Regulations are primarily prescriptive about definitions and institutional allocation of functions rather than a catalogue of new statutory duties or private rights. Nevertheless, they create concrete administrative duties by naming who performs certain functions and by specifying which information must be recorded or included in My Health Records. The key operational duties and the limited rights implicated by the instrument are set out below, with section citations.

Duty to treat the Australian Digital Health Agency as the System Operator: Section 10 prescribes ADHA as the System Operator for paragraph 14(1)(b) of the Act. Any procedural or operational duty that the Act imposes on the System Operator therefore falls to ADHA. The instrument itself does not re‑state the Act’s System Operator duties, but the prescription determines which body is expected to carry them out and be accountable for them under the Act.

Duty to use specified identification information: Sections 7-9 map the “other information” referenced in particular paragraphs of the Act to the “other information” prescribed for corresponding paragraphs of the Healthcare Identifiers Act 2010. The practical effect is a duty on those operating registration and identity systems to collect and use the same set of additional identifying data items as prescribed by the Healthcare Identifiers Act for the purposes identified in the Act. Entities that perform identification tasks under the Act will therefore be obliged to align their information‑handling practices to those prescribed items.

Registration data recording duties: Section 11 prescribes that, when assessing eligibility for registration (subparagraph 40(b)(v) of the Act) and in Schedule 1 contexts (subparagraph 4(b)(v) of Schedule 1 to the Act), the System Operator is to treat specific items as “other information” in relation to a healthcare recipient. These items include whether identity has been verified, whether a healthcare identifier has been assigned provisionally, and for Schedule 1 matters, whether the recipient is deceased or likely deceased and whether the death has been verified (s11(1)-(2)). This imposes an administrative duty to record and act upon these particular metadata items during registration processes.

Duty to include prescribed information in My Health Records: Section 13 prescribes information that is to be included in a My Health Record for the purposes of column 4 of item 9 of the table in subsection 58A(1) and the comparable Schedule 1 table item. The regulation limits the prescribed information to information that relates to the provision of healthcare to the recipient under five named Commonwealth Acts, excluding information relating to compensation or benefits (s13(2)). Entities creating or uploading My Health Records must therefore adhere to this content prescription when dealing with those specific table items.

Identity verification duties allocated between Commonwealth entities: Section 14 prescribes that, for particular columns of the table in subsection 58A(1) and the comparable Schedule 1 table item, the Attorney‑General’s Department is to be treated as the prescribed verifying agency in column 1, while the System Operator is prescribed for column 2 (s14(1)-(2)). That allocates verification responsibilities and, by implication, duties to those two Commonwealth entities to carry out identity verification in the manner the Act contemplates.

Repeal duty and transition: Schedule 1 repeals the My Health Records Regulation 2012 in full. Agencies and regulated parties must therefore treat the 2012 instrument as no longer law as from commencement (see Schedule 1), and ensure compliance with the new 2026 Regulations and any operational changes they introduce.

Implied duties and rights under the Act: The Regulations repeatedly refer to expressions and provisions in the Act that define duties, powers and rights (for example, the definitions listed in s5). The Regulations do not create or expand private rights themselves; any private rights or statutory obligations that flow from the Act remain governed by the Act. The Regulations influence how those duties and rights are operationally implemented by prescribing who counts for particular legal characterisations, what identifying information must be used, which authority is the System Operator, and what specific record content is required in particular contexts.

Observations on who bears implementation costs: The instrument causes administrative duties to fall on the System Operator (ADHA), on entities participating in registration and identity verification processes, and on organisations that generate or upload My Health Records. Those actors will need to adapt systems and processes to the definitions and content prescriptions in ss6-14; the Regulations do not itself allocate funding or explicit fee‑shifting rules.

The Regulations do not introduce express new offences or civil penalty provisions. They operate by prescriptive definition, designation of responsible entities, and inclusion or exclusion of particular data types. The statutory text of the instrument contains no standalone enforcement or penalty clauses. The enforcement context therefore derives from three points.

Absence of penalty provisions in the instrument: The Regulations themselves contain no sections creating offences, prescribing fines, or setting civil penalty regimes. The instrument is made under the My Health Records Act 2012 (s3) and it therefore operates within that Act’s enforcement architecture. Any penalties or enforcement mechanisms remain those provided by the Act and other applicable Commonwealth or State legislation; the Regulations do not amend or restate those enforcement provisions.

Administrative enforcement through prescribed entities: By prescribing the Australian Digital Health Agency as the System Operator (s10) and by prescribing the Attorney‑General’s Department and the System Operator for particular identity verification roles (s14), the Regulations allocate operational responsibilities to these Commonwealth bodies. Administrative action to enforce compliance with the Act’s requirements, or to correct record content or registration status, will be carried out through the exercise of statutory powers vested in these bodies under the Act. The Regulations therefore influence enforcement indirectly by directing which bodies act.

Interactions with State and Territory public health laws: Section 12 prescribes particular State and Territory public health Act provisions for the purposes of subsection 41(4) of the Act and subclause 9(3) of Schedule 1 to the Act. Those prescriptions may import State/Territory administrative powers and obligations into the System Operator’s handling of registration matters. Enforcement that relies upon those state provisions will be governed by the State or Territory laws listed, as they apply under the Act’s cross‑references.

Practical enforcement implications: Because the Regulations require the recording and use of particular identifiers and metadata (ss7-11) and prescribe what material must be placed into a My Health Record for certain categories of healthcare (s13), non‑compliance by organisations that operate systems or create records could give rise to administrative correction measures by the System Operator or other Act‑based remedies. The instrument itself does not set out procedures for audits, notices, or sanctions.

Transitional enforcement uncertainty: The regulation repeals the My Health Records Regulation 2012 in whole (Schedule 1). The instrument contains no explicit transitional enforcement or compliance timetable apart from a single commencement date for the whole instrument (s2). Practitioners and regulated entities will need to look to the Act and to agency guidance to determine enforcement processes or transitional compliance expectations, as the Regulations do not specify these matters.

In short, enforcement consequences flow from the Act’s enforcement framework and from the allocation of administrative duties effected by the Regulations; the instrument itself contains no new penalty clauses and does not re‑allocate enforcement powers beyond prescribing which Commonwealth and State/Territory entities are to fulfill specified roles (ss10-14).

The Regulations are designed to operate tightly with the My Health Records Act 2012 and to align the Act’s identification and registration processes with the Healthcare Identifiers Act 2010, while also referencing other Commonwealth and State/Territory statutes for prescribed content and registration contexts. The principal statutory interactions evident in the text are as follows.

My Health Records Act 2012: The Regulations are made under that Act (s3) and repeatedly reference specific provisions and table items in the Act and its Schedule 1. The text supplies prescribed meanings for “other information” used in specified paragraphs of the Act (for instance, paragraph 5(c)(iii) via s6, paragraph 9(1)(h) via s7, paragraph 9(2)(f) via s8 and paragraph 9(3)(i) via s9). It also prescribes the System Operator for paragraph 14(1)(b) of the Act (s10), and addresses registration provisions by supplying “other information” for subparagraph 40(b)(v) and for subparagraph 4(b)(v) of Schedule 1 to the Act (s11). The Regulations therefore modify how the Act’s identification, registration and record content table items are to be operationalised.

Healthcare Identifiers Act 2010: Sections 7-9 repeatedly say that the “other information” required for particular paragraphs of the Act is the same as the “other information” prescribed for specific paragraphs of the Healthcare Identifiers Act 2010. That cross‑reference ensures alignment between the two regimes' identification datasets. Practically, any changes or definitions under the Healthcare Identifiers Act’s prescription will be the source for what counts as identifying information under those provisions of the My Health Records Act.

Public Governance, Performance and Accountability (Establishing the Australian Digital Health Agency) Rule 2016: Section 5 defines Australian Digital Health Agency by reference to section 8 of this PGPA Establishing Rule. The Regulations thereby rest the System Operator identification on the ADHA’s statutory establishment under the PGPA framework.

Commonwealth Acts relating to defence, veterans and treatment benefits: Section 13 prescribes that the prescribed information to be included in a My Health Record, for specified table items of the Act, is information relating to the provision of healthcare under five Commonwealth Acts: the British nuclear tests treatment Act 2006, Military Rehabilitation and Compensation Act 2004, Safety, Rehabilitation and Compensation (Defence-related Claims) Act 1988, Treatment Benefits (Special Access) Act 2019, and the Veterans’ Entitlements Act 1986 (s13(2)). The instrument explicitly excludes information that relates to compensation or benefits under those Acts. That creates a content‑level interaction: My Health Records must include certain healthcare service information tied to those Acts, but not compensatory or benefits material.

State and Territory public health Acts: Section 12 prescribes specific provisions of State and Territory public health Acts (NSW, Qld, ACT) for the purposes of subsection 41(4) of the Act and subclause 9(3) of Schedule 1 to the Act. By doing so, the Regulations integrate certain State public health powers with the System Operator’s registration activities where the Act contemplates such interplay. This creates an operational bridge between Commonwealth registration functions and particular State/Territory public health statutory powers named in s12.

Repeal of My Health Records Regulation 2012: Schedule 1 repeals the earlier subordinate instrument in full. This deletes prior regulatory content and replaces it with the 2026 Regulation’s definitions and prescriptions. Any interaction between ongoing programs and the 2012 Regulation will now be governed by the new 2026 provisions and by whatever transitional measures the Act or agencies provide.

Overall, the Regulations are a bridge between the My Health Records Act and the Healthcare Identifiers Act, an allocator of institutional roles (ADHA, Attorney‑General’s Department), and a localiser of record content and registration metadata across Commonwealth and specified State/Territory statutes. They do not, however, itself modify the substantive rights, penalties or enforcement provisions of the Act; those remain in the Act and in the other statutes cited.

The instrument is newly made and contains limited internal amendment history. The text includes a commencement table and a single Schedule that effects a full repeal of the My Health Records Regulation 2012. The concrete amendment record contained in the instrument is therefore narrow.

Commencement: Section 2 sets out the commencement detail. The whole instrument is stated to commence on 1 April 2026 (s2(1), table). The instrument contains the standard note that the table relates only to the provisions of the instrument as originally made and will not be updated to reflect later amendments (s2, note). No other staged commencements or retroactive commencement provisions are declared.

Repeal of the previous regulation: Schedule 1, item 1 states that the whole of the My Health Records Regulation 2012 is repealed. The Schedule therefore makes a single, complete repeal of the subordinate instrument previously governing My Health Records matters. The Regulations do not set out transitional provisions, savings clauses, or specific saving of regulatory decisions under the 2012 instrument; they simply state the repeal (Schedule 1).

No recorded historical amendments in the instrument text: Beyond the single repeal of the 2012 Regulation and the commencement statement, the instrument contains no entries for past amendments, no amendment chronology and no embedded amending items that alter other Commonwealth instruments except as described in s4 (which states that instruments specified in a Schedule are amended or repealed as set out in the applicable Schedule). In this case, the only Schedule is a repeal of the 2012 regulation.

Implications for practitioners: The absence of transitional detail in the instrument itself means that affected organisations must rely on the Act, on agency guidance, or on other Commonwealth instruments for transitional arrangements, if any. The instrument’s repeal of the 2012 Regulation is absolute in text; any operative provisions of the 2012 instrument cease to have effect once the repeal takes effect on the commencement date (s2, Schedule 1).

No amendment history beyond initial making: Because the Regulations are presented as originally made, and the instrument includes the standard statement about the commencement table being only for the original instrument (s2, note), any future amendments will be reflected in later legislative instruments or legislative updates, but those do not appear in this instrument. The instrument itself therefore provides a single‑step replacement scheme effective 1 April 2026 and a full repeal of its 2012 predecessor.

The text of the My Health Records Regulations 2026 contains no reference to litigation, court decisions or precedent. There is no litigation history recorded in the instrument. The instrument is an administrative subordinate instrument that prescribes definitions, institutional responsibilities and content requirements; it does not itself document legal disputes or judicial determinations.

As a matter of legal practice, the instrument’s content identifies a limited set of administrative actors and data items whose decisions could be challengeable under general administrative law principles, but the instrument contains no case law or reported litigation. The Regulations prescribe the Australian Digital Health Agency as the System Operator (s10), and prescribe identity verification roles to the Attorney‑General’s Department and the System Operator (s14). Those administrative allocations create discrete decision‑making functions that, in theory, could be the subject of judicial review under the Administrative Decisions (Judicial Review) Act or equivalent if a party affected by an exercise of power sought review. The instrument itself does not create statutory rights of appeal or procedural review; any review pathways are those provided by the Act or by general administrative law. The Regulations do not specify appeal procedures or internal review processes.

Because the Regulations repeal the My Health Records Regulation 2012 (Schedule 1), litigation that relied upon provisions of the 2012 Regulation would need to consider whether any proceedings or rights under that instrument were saved by other law. The Regulation provides no transitional saving clauses; practitioners should therefore consult the Act and agency communications for transitional arrangements or directives that may affect ongoing litigation or administrative reviews.

The instrument’s lack of recorded litigation does not indicate the absence of potential legal issues. The prescriptions made , for example, the mapping of “other information” to the Healthcare Identifiers Act (ss7-9), the definition of nominated healthcare providers (s6), and the content prescription for records relating to the five named Commonwealth Acts (s13) , could be challenged in fact patterns where affected parties dispute an administrative decision about identity verification, record content inclusion/exclusion, or the System Operator’s exercise of statutory powers. Any such litigation would be taken under the general legal framework rather than under provisions in these Regulations themselves.

In sum, there is no litigation history recorded in the instrument; the Regulations allocate administrative functions and prescribe data fields that could give rise to future disputes, but the instrument contains no litigation record or references to cases.

The Regulations are short and technical, but contain a number of details that can trip up practitioners if not checked carefully. Below are specific practical traps and points of attention, with section references and brief explanation of the legal mechanism that produces each risk.

“Other information” is not self‑standing , it is cross‑referenced to the Healthcare Identifiers Act: Sections 7-9 do not list specific data items. Instead they say that the “other information” required by particular paragraphs of the Act is the same as the “other information” prescribed for corresponding paragraphs of the Healthcare Identifiers Act 2010. Practitioners must therefore examine the Healthcare Identifiers Act’s prescriptions to know which data items are required. Failure to do so will produce mismatches between compliance expectations under the My Health Records Act and the actual data fields required by the Healthcare Identifiers Act (ss7-9).

Nominated healthcare provider class is narrowly prescribed in s6: The instrument adds one class of individuals as nominated healthcare providers , those with a Certificate IV in Aboriginal and/or Torres Strait Islander Primary Health Care Practice (s6). If an organisation treats “nominated healthcare provider” generically and does not map in its systems to this specific class, it may fail to recognise persons who are expressly included by these Regulations. Conversely, the Regulations do not expand other classes; only this one class is added.

Provisional healthcare identifiers must be flagged in registration metadata: Section 11 requires that registration metadata include whether a healthcare identifier has been assigned provisionally. Systems that treat an identifier as binary (present/absent) will need to be modified to capture a provisional status flag and to treat provisional identifiers differently where the Act or agency policy requires it (s11(1)(b), s11(2)(b)).

Deceased status and verification for Schedule 1 contexts: Section 11(2) prescribes, for Schedule 1 purposes, that registration metadata include whether a healthcare recipient is, or is likely to be, deceased and whether the death has been verified. That produces a duty to capture and store sensitive life‑status information for specific registration processes and to have a verification chain for death determinations (s11(2)(c)-(d)). Systems that do not currently record or verify death in a manner compatible with whatever Schedule 1 Act requirement is being implemented will face operational changes.

Prescribed record content excludes compensation and benefits: Section 13(2) prescribes that the information to be included in a My Health Record is information that relates to provision of healthcare under five named Acts, but explicitly excludes information that relates to compensation or benefits under those Acts. Organisations and clinicians must therefore segregate clinical healthcare provision information from compensation or benefits information and ensure the latter is not treated as prescribed record content under the table items in question. Misclassification could lead to incorrect record uploads or omissions (s13(2)).

Which Commonwealth bodies verify identity is set out by column: Section 14 prescribes the Attorney‑General’s Department for column 1 and the System Operator for column 2 of the relevant table items. Practitioners must map their identity verification workflows to those columns; relying on other Commonwealth or private identity providers without mapping them to the prescribed columns could misalign with the Act’s expectations (s14(1)-(2)).

System Operator is ADHA , check delegation and subcontracts: Because s10 prescribes ADHA as the System Operator, parties dealing with the System Operator must route queries, notices and technical integrations to ADHA or to ADHA‑nominated delegates. The Regulations do not spell out delegation rules or commercial arrangements; those will be governed by the Act and agency practice.

Repeal of the 2012 Regulation , watch for lost transitional rules: Schedule 1 repeals the My Health Records Regulation 2012 in whole. If entities relied on transitional or procedural rules in the 2012 Regulation, those have been removed. The 2026 Regulations contain no explicit savings or transitional provisions; affected parties need to confirm transition arrangements with the ADHA or through the Act (Schedule 1).

No new penalty provisions in the Regulations: Because the Regulations do not create offences or penalties, enforcement and sanction provisions remain within the Act or other laws. Parties should not look to these Regulations for new compliance‑sanction detail (see s3 and the absence of penalty sections).

Commencement is a single date: The whole instrument commences on 1 April 2026 (s2). This creates a single cutover date for the new definitions, prescriptions and the repeal. Practitioners must ensure technical and policy changes are in place by that date.

Limited scope for rights expansion in the Regulations: The instrument does not create new private rights or procedural entitlements; it reshapes the administrative apparatus. Do not assume the Regulations change access rights or consent frameworks unless those are provided in the Act itself.

In short, the principal practical “gotchas” arise from cross‑references (you must consult the Healthcare Identifiers Act), the inclusion/exclusion rule in s13, the need to capture provisional or deceased status metadata at registration, the change of the System Operator to ADHA, and the complete repeal of the 2012 Regulation without express transitional clauses.

Compliance with the My Health Records Regulations 2026 requires administrative and technical adjustments by the System Operator, entities handling registration and identity verification, and organisations uploading or managing My Health Records. The Regulations are prescriptive about who does what and what data is treated as authoritative; the steps below are designed to be concrete and mapped to the relevant sections.

1. Map identity and “other information” fields to the Healthcare Identifiers Act prescriptions (ss7-9)

• Action: Obtain and review the Healthcare Identifiers Act 2010 prescriptions referenced by ss7-9 to determine the precise data items that constitute the “other information” for the specified paragraphs of the Act.
• Reason: The Regulations do not list the fields themselves; they explicitly adopt the Healthcare Identifiers Act’s “other information” as the operative dataset (ss7-9).

2. Update registration systems to capture verification and provisional identifier flags (s11)

• Action: Implement recording fields and business logic that capture (a) whether the healthcare recipient’s identity has been verified, and (b) whether any assigned healthcare identifier is provisional.
• Reason: Section 11(1) prescribes those metadata items as relevant to eligibility for registration under subparagraph 40(b)(v) of the Act; Schedule 1 contexts have an expanded list (s11(2)).

3. Add deceased‑status and death‑verification processes for Schedule 1 contexts (s11(2))

• Action: For processes involving Schedule 1 to the Act, capture whether the healthcare recipient is, or likely is, deceased, and whether the death has been verified. Establish verification procedures and record retention rules consistent with privacy and recordkeeping obligations.
• Reason: s11(2)(c)-(d) prescribes these items for Schedule 1 registration contexts.

4. Align identity verification workflows with prescribed bodies (s14)

• Action: Map the identity verification steps in your operational manuals: column 1 verification tasks must be allocated to the Attorney‑General’s Department; column 2 tasks must be allocated to the System Operator (ADHA) under s14(1)-(2). Where third‑party verifications are used, document how they feed into the prescribed columns.
• Reason: s14 identifies which Commonwealth bodies are the prescribed verifiers for the columns referenced in the Act’s table items.

5. Implement content rules for records touching the five named Commonwealth Acts (s13)

• Action: Identify patient cohorts whose care falls under the five named Acts in s13(2). For those records, include healthcare‑provision information as prescribed and ensure information related to compensation or benefits is excluded from the prescribed My Health Record content. Build classification rules in clinical and records systems to enforce the exclusion of compensation/benefits data.
• Reason: s13(2) prescribes inclusion of healthcare provision information associated with the listed Acts, but expressly excludes compensation/benefits material.

6. Treat the Australian Digital Health Agency as the System Operator and coordinate with it (s10)

• Action: Ensure contractual and operational interfaces, technical integrations, contact points and notices are directed to ADHA as the System Operator. Confirm with ADHA any delegation arrangements, service level expectations, or integration standards.
• Reason: s10 prescribes ADHA as the System Operator for paragraph 14(1)(b) of the Act.

7. Update privacy notices, consents and governance documentation

• Action: Review and update privacy policies, patient information notices and data governance documentation to reflect the changes in what is prescribed to be recorded and which entities perform identity verification and System Operator functions. Specifically mention the inclusion/exclusion rule in s13 where relevant.
• Reason: The Regulations change data handling and responsible entities; documentation should reflect the operational reality and privacy obligations.

8. Audit existing My Health Record integrations against the repeal of the 2012 Regulation (Schedule 1)

• Action: Conduct an audit to identify any reliance on the My Health Records Regulation 2012, and develop a transition plan to replace or revise processes affected by its repeal effective 1 April 2026. Seek ADHA guidance where the 2012 Regulation previously supplied operational detail now absent.
• Reason: Schedule 1 repeals the 2012 Regulation in full; those provisions no longer have effect.

9. Engage with the Attorney‑General’s Department and ADHA for clarification and operational guidance

• Action: Where identity verification workflows, death verification or provisional identifier handling are operationally unclear, seek formal guidance from the Attorney‑General’s Department and ADHA. Document any agency guidance relied upon for audit trails.
• Reason: s14 prescribes those two agencies for identity verification responsibilities; practical questions about procedures will be resolved by them.

10. Maintain records of verification and registration metadata for audit and administrative purposes

• Action: Ensure systems retain the metadata required by s11 (verification status, provisional identifier status, deceased status where applicable) in an auditable format and with appropriate retention policies and security controls.
• Reason: Those metadata items are prescribed by the Regulations and will be material to administrative decisions about registration and record content.

11. Confirm state law interfaces where relevant (s12)

• Action: If your organisation’s activities involve registration actions touched by the State/Territory provisions listed in s12, confirm how the System Operator will engage with the relevant State/Territory authorities and what statutory powers are being relied upon.
• Reason: Section 12 prescribes particular State/Territory public health Act provisions as relevant for certain registration functions.

12. Document legal basis for data inclusions/exclusions and internal decision‑making

• Action: Keep a cross‑reference register that links specific data items and operational decisions to the relevant Regulation or Act provision (e.g., s13 for veterans‑related healthcare information). Use that register to support compliance audits and to respond to regulatory queries.
• Reason: The Regulations rely heavily on cross‑reference; an auditable mapping reduces compliance risk.

These steps focus on direct, documentable actions traceable to the Regulation’s operative sections: definitions and cross‑references (ss5-9), registration metadata (s11), System Operator designation (s10), prescribed record content (s13), identity verification allocations (s14), state law interfaces (s12) and repeal of the 2012 instrument (Schedule 1). Where the Regulations are silent on procedural detail , for example, on how the Attorney‑General’s Department will operationalise column 1 verifications , organisations should seek agency guidance and document responses as part of their compliance records.