New My Health Record rules require updated security policies
09 Oct 2026
Healthcare practices across Australia must review their My Health Record security and access policies under the new My Health Record Rules 2026. The changes apply to all registered healthcare provider organisations, including those with policies created under the previous 2016 rules.
The updated requirements cover staff training, user account management, data security and procedures for handling data breaches. Practices must also maintain records to demonstrate that their policies are being followed.
The South Western Sydney Primary Health Network (SWSPHN) has released a video guide and downloadable templates to help practices update their policies and supporting documents.
The resources include:
- A security and access policy template
- A user access register
- A staff training register
- A data breach and incident response template
- An annual compliance review checklist
Practices should adapt the templates to match their own systems, staff responsibilities and procedures.
Further guidance is available from the Australian Digital Health Agency through its My Health Record participation obligations and updated security policy fact sheet.
New My Health Record rules require updated security policies
Source: South Western Sydney Primary Health Network (SWSPHN).