Who needs a My Health Record security and access policy
Every healthcare provider organisation registered with My Health Record must have a written My Health Record security and access policy, and must communicate and enforce it. That includes registered GP clinics, allied health practices, pharmacies and residential aged care homes.
Size and usage don't matter. The Office of the Australian Information Commissioner (OAIC) says in its security and access policy guidance that registered organisations need a policy "regardless of the organisation's size or how often they access the My Health Record system." The Australian Digital Health Agency (the Agency), which operates the system, says on its participation obligations page that it applies even if you don't actively use My Health Record.
Two common surprises:
- You may be registered without realising it. The Agency says organisations may have registered when they registered with the Healthcare Identifiers Service or for electronic prescribing. You can check in PRODA or by calling the Healthcare Identifiers Service on 1300 361 457.
- Upload only still counts. "Access" covers viewing and uploading, so the policy must say how uploading users are authorised too.
General information, not legal advice
This article summarises guidance from the OAIC and the Australian Digital Health Agency, and the wording of the My Health Records Rules 2026, as at 26 October 2026. It is not legal advice. Your organisation is responsible for its own policy; check the current rules and get legal or professional advice if you are unsure how they apply to you.
How CSG fixes this
We map how you reach My Health Record: Bp Premier, MedicalDirector, your aged care system or the National Provider Portal. Our GP and medical practice IT support already covers the HI Service and HPOS, so we help your responsible officer confirm your registration and list every system and user that touches My Health Record.
Rule 42 is now rule 21: what changed on 1 October 2026
Most guidance and templates still say "Rule 42". That was rule 42 of the My Health Records Rule 2016, with rule 44 covering user account management. The 2016 Rule has been repealed and replaced by the My Health Records Rules 2026, which commenced on 1 April 2026.
The Agency's fact sheet on the revised requirements says they "are now set out in rule 21 and rule 43, replacing rule 42 and rule 44 of the 2016 Rule." Under section 72 of the 2026 Rules, organisations registered before 1 April 2026 could keep working to the old rules until 30 September 2026. Rule 21 has applied to them since 1 October 2026, so a policy built on the old Rule 42 or an older template is likely to be missing required content.
| Topic | New under the 2026 Rules |
|---|---|
| User accounts | Procedures for creating and modifying accounts, and for deactivating an individual healthcare provider who stops being linked to you |
| Training | Refresher training annually and after significant changes |
| Legal obligations | Processes for meeting data breach obligations under section 75 of the My Health Records Act 2012 |
| Security measures | Cyber security, technical and organisational measures, including maintenance, encryption, backup, monitoring and review |
| Communication | The policy must also reach individual healthcare providers linked to you |
| Review and versions | Review on request by the System Operator, and keep each version for 5 years |
| Records (rule 45) | Keep records showing how the policy is applied |
The 2016 Rule's allowance for very small organisations to skip requirements "due to the limited size of the organisation" has no equivalent in rule 21.
The OAIC and the Agency have published an updated My Health Record Security and Access Policy template (DOCX). The OAIC warns that "using a template does not guarantee compliance", so tailor it.
How CSG fixes this
We compare your policy with rule 21, mark the missing IT sections, and document the controls actually running in your environment, so the policy describes what you really do, not what a template assumes.
What rule 21 says your policy must cover
Rule 21(1) requires a written policy that addresses five matters and "is drafted in such a manner that the organisation's performance can be audited against the policy": specific steps someone can check.
The OAIC's 2022 assessment of 20 GP clinics against the old Rule 42 found 3 clinics had no policy, 14 of the 20 policies did not address mitigation strategies for security risks, and none addressed remote access, although 7 clinics said they used it.
1. Authorising users, and suspending or deactivating accounts
The policy must set out how you authorise users, "including procedures for creating and modifying user accounts", and how an account is suspended or deactivated if the user leaves, their security is compromised, their duties no longer require access, or they are an individual healthcare provider who stops being linked to your organisation.
How CSG fixes this
We set up role based access in Bp Premier, MedicalDirector or your aged care system, so only staff who need My Health Record get it. Our offboarding procedure disables a leaver's clinical software, Microsoft 365 and remote access accounts, and a compromised account is suspended and reset straight away. Each change is logged, giving you the records rule 45 asks for.
2. Training before access, every year, and after significant changes
Training must be given before a user is authorised, annually, and after significant changes to the Act, the Rules or the system. Rule 21(3) says it covers using the system "accurately and responsibly", the legal obligations of organisations and users, and "the consequences of breaching those legal obligations". The Agency publishes a recommended training list and expects you to keep a training register or completion certificates.
How CSG fixes this
The My Health Record content comes from the Agency's free training. Our cyber security service adds awareness training on phishing, social engineering and healthcare privacy obligations.
3. Identifying who accessed a record
The policy must set out how you comply with sections 74 and 75 of the Act. Section 74 means telling the System Operator, when asked, who accessed a record: software logs a user ID, and you must know whose it is. Section 75 covers data breaches, below.
How CSG fixes this
We make sure nobody shares a clinical software account, check audit logging is on, help you match user IDs to staff, and make sure the logs are kept.
4. Unique user identification and secure access (the old rule 44)
Rule 21(2)(d) covers "the physical security, information security, cybersecurity and technical and organisational measures" you implement. Rule 21(4) carries over the old rule 44's account management practices:
- "restricting access to only users who require access as part of their duties"
- "uniquely identifying users using the organisation's information technology systems and protecting the identity of users with a password or equivalent protection mechanism"
- passwords or equivalent mechanisms "sufficiently secure and robust" for the risk
- deactivating users who are no longer authorised, and suspending access "as soon as practicable" after a compromise
- "reviewing the practices at least annually", and training users in them.
Rule 21(2)(d) also names regular system maintenance, "data protection, including data encryption and regular back-up", and monitoring the measures. The Agency's examples include multi factor authentication (MFA), antivirus, timely patches and privacy screens. The OAIC says remote access should use unique logins and MFA.
How CSG fixes this
We enforce MFA across clinical and administrative systems, including email and remote access, and manage privileged access to clinical software. Workstations are locked down with endpoint protection, and high risk patches go on within 48 hours. Patient data is encrypted (AES-256 at rest, TLS 1.3 in transit) and backed up to immutable storage in Australian data centres with tested restores. Our reports are the evidence behind each measure.
5. Identifying, acting on and reporting security risks
The policy must describe how security risks are "promptly identified, acted upon and reported to the organisation's management." The OAIC and the Agency both point to regular reviews of audit logs showing who accessed which record, when, and what was viewed. In the OAIC assessment, 11 of the 20 clinics did not review their audit logs at all.
How CSG fixes this
Our 24/7 threat monitoring sends alerts that matter to a person on our team, who acts and tells the contact your policy names. Periodic security reviews give management a summary of findings.
Communicating the policy, reviewing it and keeping records
Rule 43 requires you to keep the policy "readily accessible" to employees, healthcare providers you supply services to under contract, and linked individual healthcare providers, and to "take all reasonable steps" to ensure they comply. A practice that rents rooms and shared IT to independent doctors must enforce it with them, the OAIC says.
Each version needs a unique number and start date. Review it "at least annually", when "material new or changed risks are identified", and on request by the System Operator, and keep every version for 5 years. If the Agency asks for a copy, rule 44 gives you 7 days.
Rule 45 is new: keep records showing how the policy is applied.
| Record | Example | Keep for |
|---|---|---|
| Accounts | Accounts created, changed, suspended or deactivated | 5 years |
| Training | Training register, certificates | 5 years |
| Who accessed a record | Audit logs | 2 years |
| Data breach processes | Documented processes, action taken | 2 years |
| Security measures | Maintenance, encryption and backup activity | 2 years |
Organisations that don't comply may have their registration revoked, the Agency warns.
A policy nobody can audit is not a policy. Rule 21 asks for steps someone can check, and rule 45 asks for the records to prove it.
How CSG fixes this
At your IT planning sessions we update the IT sections of your policy and hand over the year's evidence: account changes, patching reports and restore test results. The annual review starts from evidence, not memory.
Data breaches involving My Health Record
My Health Record has its own breach rules under the My Health Records Act 2012, separate from the Privacy Act's Notifiable Data Breaches scheme. The Agency's data breaches page says a breach includes unauthorised collection, use or disclosure of information in a person's My Health Record, or anything that has or may have compromised the system's security or integrity.
According to the Agency, you must notify it of "any potential or actual data breaches, as soon as possible", even if it has been resolved or isn't confirmed; a malware infection that could allow unauthorised access is its example. You also notify the OAIC (unless you are a state or territory authority) and ask the Agency to notify affected patients.
Other breaches may fall under the Notifiable Data Breaches scheme; see our guide to data breaches in general practice.
How CSG fixes this
We build your incident response plan with you, aligned to the Notifiable Data Breaches scheme, and add the My Health Record notification steps. If something happens, we contain it (disabling accounts, resetting passwords, isolating a computer) and keep the evidence the Agency's form asks for.
A checklist and policy outline
- Confirm whether you are registered with My Health Record, through PRODA or the Healthcare Identifiers Service
- Check whether your policy was written under rule 42 of the 2016 Rule, and update it to rule 21 of the 2026 Rules
- Record how staff access My Health Record, including any remote access
- Give every user a unique login and limit access to people who need it
- Name who creates, changes, suspends and deactivates accounts
- Turn on MFA for remote access and email
- Train users before access, yearly and after significant changes, and keep the register
- Turn on audit logging and review it regularly
- Add My Health Record steps to your data breach response plan
- Share the policy with staff, contractors and linked providers
- Version it, review it yearly, and keep every version for 5 years
Policy outline (our structure, not the regulator's template)
Our suggested structure, not the official template. Start from the OAIC and Agency template and check it against the current rules.
- Policy details: version, start date, owner, who it applies to
- Access and roles: software, National Provider Portal, remote access, responsible officer
- Authorising users: creating, changing, suspending and deactivating accounts
- Training: before access, annually, after changes
- Identifying users and data breaches (sections 74 and 75)
- Security measures: accounts, MFA, physical security, patching, encryption, backup, monitoring
- Risk strategies: audit log reviews, reporting to management
- Records kept under rule 45, and review history
How CSG helps clinics and aged care providers
We are a Gold Coast based team, supporting organisations across South East Queensland and Tweed Heads since 1999, ISO/IEC 27001:2022 certified and working to the ACSC Essential Eight.
The fixes above are the IT side of your policy. For general practices we bring specialist experience with Best Practice (Bp Premier), MedicalDirector and Pracsoft. We support allied health and specialist practices through our healthcare IT support, and aged care homes through our aged care IT support, including user account provisioning and access control for systems such as Leecare. The RACGP 6th edition's criterion F9.B also asks for unique individual identification, although accreditation is still assessed against the 5th edition; see our RACGP 6th edition guide.
The policy and its decisions stay with your organisation; we make sure the controls it describes are real and documented. Audited controls, not assumed controls. Talk to our team or call us on (07) 5551 2333.