New My Health Record security rules start in October
23 Sep 2026
The Office of the Australian Information Commissioner (OAIC), working with the Australian Digital Health Agency, has released an updated My Health Record Security and Access Policy Template to help healthcare organisations meet the new requirements.
From 1 October, registered healthcare provider organisations will need to comply with rules 21 and 43 of the My Health Records Rules 2026. These requirements replace the previous arrangements under rule 42 of the My Health Records Rule 2016.
The updated template and guidance are designed to help organisations understand the changes, review their existing policies and meet their ongoing My Health Record obligations.
The Australian Digital Health Agency has also released a fact sheet explaining the key changes organisations should consider when reviewing their security and access policies.
Healthcare provider organisations are encouraged to review and update their policies before the new requirements come into effect.
More information, including the updated template, fact sheet and participation requirements, is available from the Australian Digital Health Agency.
New My Health Record security rules start in October
Source: Australian Digital Health Agency / Office of the Australian Information Commissioner