My Health Record security and access policy –guidance

Healthcare provider organisations have certain obligations under the My Health Records Act 2012 (Cth) (the Act) and My Health Records Rules 2026 (the Rules).

Legislation

Rule 21 requires healthcare provider organisations establish a security and access policy prior to registering with the My Health Record system.[1]

Rule 43 requires healthcare provider organisations to communicate the policy to relevant parties, ensure compliance, review the policy regularly and keep a record of each iteration of the policy for 5 years.[2]

Rule 45 requires healthcare provider organisations to keep records showing how the organisation has implemented each of the matters that must be addressed in the policy.[3]

The OAIC may commence regulatory action if an organisation is found to be non-compliant with their rule 21, rule 43 or rule 45 obligations.

In addition to the requirements set out in the Rules, most healthcare provider organisations have privacy obligations set out in the Australian Privacy Principles (APPs) under the Privacy Act 1988.[4] In particular, healthcare provider organisations must take reasonable steps to comply with APPs 1.2 (open and transparent management of personal information) and 11 (security of personal information).[5]

Policy guidance

Organisations registered with the My Health Record system must have a Security and Access policy regardless of the organisation’s size or how often they access the My Health Record system.

Security and Access policies are critical in supporting healthcare provider organisations to protect the sensitive information of their patients. They also build staff awareness of obligations under My Health Record legislation. At a minimum, your Security and Access policy must reasonably address the following matters:

1. (a) how people are authorised to access the My Health Record system, and how access is deactivated or suspended when certain circumstances arise[6]
2. (b) the training that is provided to employees before they access the My Health Record system, including how to use the system accurately and responsibly, the legal obligations on healthcare provider organisations and individuals and the consequences of breaching those obligations[7]
3. (c) the process for ensuring certain information is given to the System Operator when requested in compliance with s74 of the Act[8] and the process for reporting and notification of data breaches in compliance with s75 of the Act[9]
4. (d) the physical and information security measures taken by the healthcare provider organisation and authorised people accessing the My Health Record system[10]
5. (e) mitigation strategies to promptly identify, act upon and report security risks[11]

Merely having a Security and Access policy is not sufficient to ensure the security and integrity of the My Health Record system and the information it contains. Healthcare provider organisations must actively communicate and enforce their Security and Access policy in relation to all employees and any healthcare providers to whom the organisation supplies services under contract.[12]

Tips

Although your Security and Access policy must address the matters listed above, the following tips will help you to develop, implement, and maintain an effective policy to support effective security and access governance in your organisation. If your organisation chooses to implement any of these measures, you could reinforce these practices by mentioning them in your Security and Access policy.

• One policy document
  Your Security and Access policy should be contained in a single document, rather than distributed across multiple documents. This allows readers to easily access organisational processes and obligations in one place.[13]
• Mitigation strategy: Audit log reviews
  Proactively reviewing audit logs is an effective means of detecting and investigating unauthorised access to the My Health Record system.[14] Audit logs can often be accessed via your clinical software. Audit logs should record when the My Health Record system is accessed, including the user’s identity, date, and time of access, whose My Health Record was accessed and the information that was accessed.
• Passwords and passphrases
  To ensure that passwords and passphrases are sufficiently complex and robust,[15] you should:
• use long passwords or passphrases (for example, 14 or more characters) with a combination of letters, numbers, and symbols
• change passwords every 30-90 days.
• Training
  Training ensures staff are aware of their My Health Record and privacy obligations and handle personal information accordingly.[16] As well as training all staff (employees and contractors) before they can access the My Health Record system,[17] you should provide:
• annual refresher training to staff regarding their My Health Record access obligations[18]
• ad hoc training when there are changes to legislation or My Health Record system functionalities.[19]

Training is required regardless of how large your organisation is, or how often you use the My Health Record system.

• Remote access security
  The My Health Record system can be accessed remotely. If your organisation has this functionality, you should ensure that it is secured using unique login details and other access processes such as multifactor authentication.[20]
• Templates
  Templates can be a useful tool when developing a Security and Access policy. However, using a template does not guarantee compliance under the Rules. When using a template to prepare a Security and Access policy, you should:
  • refer to Rule 21, 43 and 45 of the My Health Record Rules 2026 to ensure that the template addresses all legislative requirements
  • review, update and tailor your Security and Access policy to reflect your individual practices and circumstances to ensure it can be effectively enforced.

  The OAIC’s template broadly addresses the requirements, however, you should adjust it by adding details that reflect your organisation’s practices and circumstances. Persons using this template should seek appropriate legal or other professional advice as required.

• Enforcing your policy in contract 
  To ensure that the My Health Record system is used responsibly and securely, you must communicate and enforce your Security and Access policy against the organisations and individuals that use your systems to access the My Health Records system, including staff, contractors, and healthcare providers you supply services to.[21]

Example: Supplying services to other healthcare providersIf a medical practice rents out rooms to other independent doctors or healthcare provider organisations and provides shared IT that facilitates access to the My Health Record system, the medical practice must enforce its Security and Access policy with these independent parties.

All relevant contracts facilitating access to the My Health Record system, such as employment contracts or contracts to share IT services with independent healthcare providers, should include provisions that allow you to monitor users’ access to the My Health Record system and explicitly require them to:

• comply with your Security and Access policy
• implement physical and information security measures to mitigate the risk of unauthorised access to the My Health Record system
• implement processes to ensure that security and privacy risks can be identified and acted upon
• report suspected or actual breaches
• Organisational changes
  In addition to the minimum requirements to review your Security and Access policy at least annually[22] and when any material new or changed risks are identified,[23] you should review your Security and Access policy when the structure of your organisation changes, as this may impact the application of your Security and Access policy in practice.