My Health Record legislation updates
The My Health Records Regulations 2026 and My Health Records Rules 2026 came into effect on 1 April 2026.
Allied health providers accessing My Health Record should ensure they:
Have a written Security and Access Policy in place. Access to My Health Record is not permitted without one. The Australian Digital Health Agency (ADHA) provides resources to support policy development.
Create and maintain a user accounts log, recording when staff access is created, suspended or deactivated. Records must be retained for five years.
Maintain staff training records. Staff accessing My Health Record should receive training initially, annually and whenever major system changes occur. Training records must be retained for five years. ADHA training modules and fact sheets are available online.
Compliance timeframes
Registered for My Health Record before 1 April 2026: transition period ends 1 October 2026.
Registered on or after 1 April 2026: requirements apply immediately.
The Department of Health, Disability and Ageing has published FAQs to support implementation of the new Regulations and Rules.