My Health Record legislation changes 2026

If your practice uses My Health Record, there are some important rule changes to be aware of.

The My Health Records Rule 2016 has been replaced by the My Health Records Rules 2026, in effect from 1 April 2026.

What’s changed

Most requirements remain the same, but there are a few key updates:

• Updated requirements for user account management

• Changes to training and security measures

• A new requirement to include processes for responding to My Health Record data breaches

The rules covering your security and access policy are now in Rules 21 and 43, replacing the previous Rules 42 and 44.

• https://www.legislation.gov.au/F2016L00095/latest/text

What your practice needs to do

• Have a security and access policy in place and keep it up to date

• Keep records showing how the policy is being applied (see Rule 45 for retention requirements)

Key deadlines

• If you were registered before 1 April 2026:

  • Update your policy by 1 October 2026

• If you registered from 1 April 2026:

  • Your policy must meet the 2026 Rules from the start

Need more information?

You can find guidance on updating your policy on the Australian Digital Health Agency website under My Health Record participation obligations.