My Health Record: editable Security and Access Policy template now available and annual training requirement remains

With the 1 October 2026 deadline now in effect, healthcare provider organisations should ensure they have updated their My Health Record Security and Access Policy and related processes to align with the revised requirements. Practices can revisit EMPHN’s previous article on the My Health Record legislative updates and watch the EMPHN Lunch and Learn: My Health Record – What’s New in 2026 webinar for a summary of the changes.

To support implementation, EMPHN has made available an editable Word version of the updated Security and Access Policy template for practices to adapt locally.

A key point to note is the workforce training requirement. Under the revised rules, My Health Record training must occur before access is granted and be refreshed annually, with training records retained by the organisation.

EMPHN, together with other PHNs, has advocated that an annual training cadence for all clinicians may appear disproportionate to the level of risk in many settings. However, the requirement remains in place and practices should ensure annual training and record-keeping arrangements are established.

The Australian Digital Health Agency has advised the PHN network that its approach is focused on supporting healthcare provider organisations to understand and meet their obligations under the revised rules. Practices that are actively reviewing their policies, implementing the required changes and maintaining appropriate records should feel confident they are taking reasonable steps towards compliance.

Practices are also reminded to review their ongoing My Health Record participation obligations, including requirements relating to:

• Privacy and security
• Authorised access
• Organisational details
• Workforce training and record-keeping requirements

Resources