My Health Record legislative changes: action required before 1 October

Healthcare provider organisations participating in My Health Record have until 1 October 2026 to ensure their Security and Access Policy aligns with the My Health Records Rules 2026, which replaced the 2016 Rules on 1 April 2026.

The updated Rules strengthen requirements relating to:

• User account management
• Staff training and training records
• Cybersecurity and information security measures
• My Health Record data breach response processes
• Record keeping and audit requirements
• Annual review of Security and Access Policies

These changes sit alongside the Better Faster Access reforms, which support more timely sharing of key health information through My Health Record, including pathology and diagnostic imaging results.

Resources

To support organisations in meeting the new requirements, the Australian Digital Health Agency has released an updated Security and Access Policy template:

You can also revisit EMPHN’s recent My Health Record – What’s New in 2026 webinar, which covers the legislative changes, Better Faster Access reforms and practical compliance requirements for healthcare organisations.