-
On this page
Download the Digital Health annual report
Updated: 27 October 2026Executive summary
This annual report sets out the Australian Information Commissioner’s digital health compliance and regulatory activity during 2025–26, in accordance with section 106 of the My Health Records Act 2012 (MHR Act) and section 30 of the Healthcare Identifiers Act 2010 (HI Act).
The Australian Government administers 2 key systems that underpin digital health in Australia: the Healthcare Identifiers Service (HI Service) and the My Health Record (MHR) system. The legislation establishing the HI Service and MHR system include important privacy provisions, which recognise the special sensitivity of health information, and protect and restrict its collection, use and disclosure.
The Office of the Australian Information Commissioner (OAIC) is the independent privacy regulator for both systems, and our privacy oversight of these 2 systems is the focus of this annual report. Both systems involve the management of personal information. For the purposes of this report, we refer to them collectively as ‘digital health’.
This report provides statistics about digital health regulatory activities undertaken by the OAIC during 2025–26, including privacy complaints received and decided, privacy investigations, and other enforcement action such as enforceable undertakings and legal proceedings.
The number of new digital health privacy complaints made to the OAIC increased significantly in 2025–26. The OAIC received 23 new privacy complaints relating to the MHR system, compared with 4 in 2024–25, representing a 475% increase. One privacy complaint relating to the HI Service was received in 2025–26, which is also an increase, from no complaints in 2024–25. Detailed statistics are provided throughout this report.
This report also provides information about data breach notifications (DBNs) reported to the OAIC and which breaches related to digital health. In 2025–26, we received 24 data breach notifications in relation to the MHR system, compared with 18 data breach notifications in relation to the MHR system in 2024–25.
To support the effectiveness of our digital health regulatory oversight, the OAIC has continued to contribute to policy measures relating to digital health and privacy in 2025–26, including:
- remaking the My Health Record (Information Commissioner Enforcement Powers) Guidelines, which are a legislative instrument
- providing advice to stakeholders, including the Australian Digital Health Agency (ADHA), Services Australia and the Department of Health, Disability and Ageing about privacy-related matters relevant to the MHR system and HI Service, including:
- the Department of Health, Disability and Ageing’s review of the MHR legislative instruments and HI Regulations 2020 (HI Regulations)
- the Department of Health, Disability and Ageing’s ongoing review of the MHR Act
- the Department of Health, Disability and Ageing’s framework for the use of MHR data for research and public health purposes
- the expansion to the MHR through the implementation of Share by Default changes
- the ADHA’s guidance for Pathology and Diagnostic Imaging providers relating to obligations under rule 42 of the MHR Rule 2016.
- engaging with stakeholders such as the Australian Health Practitioner Regulation Agency (AHPRA), the Australian Commission on Safety and Quality in Health Care (ACSQHC), Therapeutic Goods Administration (TGA), ADHA, Private Healthcare Australia and the Royal Australian College of General Practitioners (RACGP) about developments in health technologies that may impact on digital health and privacy, such as AI scribes
- developing and promoting guidance materials, public and professional addresses to promote digital health compliance and awareness and monitoring developments in the MHR system and the HI Service.
Elizabeth Tydd
Australian Information Commissioner
24 September 2026
Carly Kind
Privacy Commissioner
21 September 2026
Part 1 Overview
Many Australians view their health information as being particularly sensitive. This sensitivity has been recognised in the MHR Act and HI Act, which regulate the collection, use and disclosure of information, and give the Information Commissioner a range of enforcement powers.
This sensitivity is also recognised in the Privacy Act 1988 (Privacy Act), which imposes additional protections for heath information and characterises this personal information as ‘sensitive information’ under the Act.
Regulatory work of the OAIC
The OAIC is the independent privacy regulator, and has additional powers and functions in respect of enforcing privacy protections for the MHR system and HI Service. In addition to this compliance and enforcement role, the OAIC performs an important proactive education and guidance function.
In 2025–26, the OAIC’s regulatory oversight of the MHR system included:
- education and guidance
- responding to enquiries
- investigating and resolving complaints
- handling data breach notifications
- conducting privacy assessments and investigations
- contributing to policy development through stakeholder engagement.
Year in review summary
Table 1 summarises the digital health activities relating to the MHR system and the HI Service undertaken by the OAIC during the 2025–26 financial year.
Activity | MHR | HI Service |
|---|---|---|
Telephone enquiries | 9 | 0 |
Written enquiries | 4 | 1 |
Complaints[1] received | 23 | 1 |
Complaints finalised | 6 | 1 |
Commissioner-initiated investigations commenced | 0 | 0 |
Commissioner-initiated investigations finalised | 0 | 0 |
Assessments completed or in progress | 2 | 0 |
Enforceable undertakings accepted | 0 | 0 |
Proceedings taken in relation to civil penalty provisions, enforceable undertakings or injunctions | 0 | 0 |
Data breach notifications received | 24 | 1 |
Data breach notifications finalised | 24 | 0 |
Part 2 The OAIC and the MHR system
The OAIC performs a range of functions in relation to the MHR system. These functions include legislative compliance and regulatory and other activities, such as providing privacy related advice and developing guidance materials for internal and external stakeholders.
The Information Commissioner has the following roles and responsibilities under the MHR Act and the Privacy Act:
- Develop statutory and regulatory guidance for consumers and other system participants, such as healthcare providers, registered repository operators and the ADHA.
- Respond to enquiries and requests for regulatory policy advice from stakeholders about the system’s privacy framework and the appropriate management of MHR information.
- Receive, assess, investigate and determine privacy complaints received about the MHR system.
- Investigate, on the Commissioner’s own initiative, acts and practices that may contravene the MHR Act in connection with health information contained in a healthcare recipient’s MHR or a provision of Part 4 or 5 of the MHR Act.
- Receive and assess data breach notifications and assist impacted entities to manage data breaches in accordance with the MHR legislative requirements.
- Investigate failures to notify eligible data breaches.
- Conduct assessments of participants in the system to ensure their compliance with privacy obligations.
- Exercise a range of enforcement powers in relation to contraventions of the MHR Act or contraventions of the Privacy Act relating to the MHR system, including making determinations, accepting enforceable undertakings, seeking injunctions and seeking civil penalties.
The OAIC liaises with professional industry bodies in the health sector in the course of undertaking our activities.
OAIC compliance and regulatory activities
Complaints and investigations relating to the MHR system
The OAIC received 23 complaints about the MHR system during 2025–26, which is an increase of 475% on the previous year.[2]
In relation to the 23 complaints, the OAIC’s review of the matters demonstrates that most complaints received were about unauthorised access to MHR personal information by health service providers.
The OAIC finalised 22 complaints. Of these, 6 were from the 23 MHR system complaints, and 16 were complaints lodged in 2024–25.
Our complaints process may also include making referrals to relevant entities that may be best placed in handling the complaint or parts of the complaint in line with the Privacy Act and MHR Act, such as ADHA and Australian Federal Police.
As of 30 June 2026, the OAIC had not opened any investigations into privacy complaints received from individuals about the system during the reporting period.
The OAIC made no determinations under the Privacy Act during 2025–26 in relation to compliance with the MHR Act.[3]
Assessments relating to the MHR system
In 2025–26, the OAIC further progressed 2 assessments of private hospitals, examining their preparedness to respond to data breaches in the MHR system. These assessments remain underway.
Assessment subject | Number of entities assessed | Year opened | Status |
|---|---|---|---|
Private hospital preparedness to respond to data breaches in the MHR system4 | 1 | 2024–25 | Ongoing |
Private hospital preparedness to respond to data breaches in the MHR system[4] | 1 | 2024–25 | Ongoing |
Enforceable undertakings
The OAIC has not entered into any enforceable undertakings in relation to MHR compliance in 2025–26.
Court proceedings (civil penalty provisions, enforceable undertakings or injunctions)
The Commissioner has not initiated any court proceedings in relation to civil penalty provision privacy contraventions, enforceable undertakings or seeking an injunction to prevent non-compliance with privacy provisions in relation to MHR system in 2025–26, or in any previous years.
Data breach notifications
In 2025–26, the OAIC received 24 data breach notifications (DBNs) in relation to the MHR system and closed 24 notifications.
In relation to the 24 DBNs relating to MHR, over 62% of matters reported to the OAIC arose from the incorrect use of the emergency access function by health service providers under the My Health Records Act. The remaining DBNs primarily concerned reports of unauthorised access to personal information by health service providers.
Notified in the period | Closed in the period | ||||||
|---|---|---|---|---|---|---|---|
Notifying party | No. of data breach notifications | No. of healthcare recipients affected | No. of affected recipients holding a MHR | No. of data breach notifications | No. of healthcare recipients affected | No. of affected recipients holding a MHR | |
Australian Digital Health Agency | 0 | 0 | 0 | 0 | 0 | 0 | |
Services Australia | 0 | 0 | 0 | 0 | 0 | 0 | |
Health care provider organisations | 24 | 63 | 63 | 24 | 63 | 63 | |
Total | 24 | 63 | 63 | 24 | 63 | 63 | |
*Totals across agencies may not match due to different reporting obligations
MHR system enquiries and guidance
Enquiries
MHR system enquiries
The OAIC enquiries team received 9 telephone enquiries and 4 written enquiries about the system during the 2025–26 reporting period.
Guidance
For health service providers
In 2025–26, the OAIC closed preliminary inquiries with diagnostic imaging network I-MED Radiology Network Limited (I-MED), Harrison.ai and Annalise.ai. The OAIC’s inquiries followed media reports in September 2024 relating to I-MED’s disclosure of medical imaging scans to Annalise.ai, a former joint venture between I-MED and Harrison.ai, a healthcare artificial intelligence company.
The OAIC made inquiries to determine if the Privacy Commissioner should open an investigation under the Privacy Act. The inquiries focused on the form and content of the patient data I-MED provided to Annalise. ai, the process of the data flow, and the steps taken to de-identify the data. Based on the information obtained through the preliminary inquiries, the Commissioner was satisfied the patient data shared with Annalise.ai had been de-identified sufficiently, and that it was no longer personal information for the purposes of the Privacy Act.
The OAIC’s report into preliminary inquiries of I-MED provides more information on the OAIC’s inquiries and conclusion. The report is published in the public interest to inform the community of the outcome. It also provides a beneficial example of good privacy practices and demonstrates how the use of de-identified data can allow an entity covered by the Privacy Act to effectively carry out its functions and activities, including through the adoption of new and innovative data-driven technologies.
In 2025–26, the OAIC also remade the MHR (Information Commissioner Enforcement Powers) Guidelines 2026 legislative instrument. The OAIC undertook a public consultation process and updated the guidelines to reflect legislative updates to the Privacy Act and MHR Act since 2016. The guidelines ensure a more consistent regulatory approach to oversight of the MHR system and the regulation of entities under the Privacy Act.
For consumers
The OAIC website features a dedicated health information privacy section for individuals, including privacy advice for the MHR system. MHR privacy advice is also highlighted through a microsite which features FAQs, a video and information of how to make a complaint.
Liaison
Liaison with the Australian Digital Health Agency
The OAIC has continued liaising regularly with the ADHA as required during the reporting period, to discuss privacy matters relating to the MHR system and guidance projects.
Other activities
Monitoring developments in digital health and the MHR system
The OAIC actively monitors developments in digital health to inform our regulatory role.
During the reporting period, OAIC staff met with various health focused agencies and regulatory bodies to discuss the uptake in AI scribes across the medical profession, provide advice on matters, including the transfer of health data overseas by AI tools, and the use of health data for research purposes. Agencies and bodies included the AHPRA, the ACSQHC, TGA, ADHA, Austrade and the RACGP.
Part 3 The OAIC and the HI Service
The OAIC performs a range of functions in relation to the HI Service. This includes handling complaints and enquiries, and monitoring developments to support informed guidance and advice about privacy aspects of the HI Service in the broader digital health context.
The OAIC is the independent regulator of the privacy aspects of the HI Act and the HI Regulations. The HI Act implements a national system for assigning unique identifiers to individuals, healthcare providers and healthcare provider organisations. The identifiers are assigned and administered through the HI Service, currently operated by the Chief Executive of Medicare.
The HI Service is a foundation service for a range of digital health initiatives in Australia, particularly the MHR system. Under the system, healthcare identifiers:
- are used to identify healthcare recipients who register for a MHR
- enable the ADHA to authenticate the identity of all individuals who access a MHR and to record activity through the audit trail
- help ensure the correct health information is associated with the correct healthcare recipient’s MHR.
There are 3 types of healthcare identifiers issued by the HI Service, namely:
- Individual Healthcare Identifiers (IHI) – for individuals receiving healthcare in Australia.
- Healthcare Provider Identifier – Individual (HPI-I) – for individual healthcare providers, such as GPs, allied health professionals, nurses, dentists and pharmacists.
- Healthcare Provider Identifier – Organisation (HPI-O) – for organisations delivering healthcare, such as hospitals and general practices.
The HI Act imposes a high standard of privacy on healthcare identifiers, and they may only be accessed, used and disclosed for limited purposes.
Registration with the HI Service is a prerequisite for a healthcare provider organisation to be registered for the MHR system.
The Information Commissioner has the following roles and responsibilities under the HI Act and the Privacy Act:
- Provide a range of regulatory policy advice and guidance material.
- Receive, assess, investigate and determine privacy complaints about the HI Service.
- Conduct compliance assessments.
- Investigate, on the Commissioner’s own initiative, acts and practices that may be a misuse of healthcare identifiers.
- Receive and assess data breach notifications.
- Investigate failures to notify eligible data breaches and respond as appropriate.
OAIC compliance and regulatory activities
Complaints and investigations relating to the HI Service
The OAIC received one privacy complaint about healthcare identifiers in 2025–26, which remains the same as the previous year. We finalised the complaint without the need for investigation.
The OAIC did not commence any investigations about the HI Service during the reporting period. As of 30 June 2026, there were also no open investigations.
Other HI Service activities
Advice
HI Service enquiries
The OAIC enquiries team did not receive any phone enquiries about health care identifiers. During the reporting period, one written enquiry about the handling of healthcare identifiers was received.
Other activities
Monitoring developments in digital health and the HI Service
The OAIC monitors developments in digital health to ensure it is positioned to offer informed advice about privacy aspects of the HI Service in the broader digital health context. During the reporting period the OAIC:
- monitored developments relating to digital health and the HI Service through news and digital health websites
- attended various forums and stakeholder meetings related to digital health which considered the HI Service in the broader digital health context.
Footnotes
[1] A complaint may cover more than one issue.
[2] This percentage is based on there being 4 MHR complaints in 2024–25.
[3] Section 73 of the MHR Act provides that an act or practice which contravenes a provision of Part 4 or 5 of the MHR Act is taken to be an interference with the privacy of a healthcare recipient for the purposes of the Privacy Act. The Commissioner is empowered, under s 73(3) (a) of the MHR Act, to investigate such an act or practice. Section 40(2) of the Privacy Act empowers the Commissioner to commence an investigation on her own initiative.
[4] Two separate entities are being assessed.
