The My Health Record legislative framework has been updated to ensure the My Health Record system remains contemporary, clear and aligned with modern digital health practices.
The new My Health Records Regulations 2026 and My Health Records Rules 2026 modernise and clarify requirements, including those relating to security and record-keeping, while improving readability and supporting practical implementation across the sector.
The changes commenced on 1 April 2026.
- For existing participants (registered for My Health Record prior to 1 April 2026): you should aim to comply with the 2026 Rules as soon as possible. However, a six-month transition period will apply allowing you time to adapt. The transitional arrangements are in place from 1 April 2026 until immediately before 1 October 2026. During this period you can continue to apply the relevant sections of the 2016 Rule, including the record-keeping and the security and access policy requirements.
- For new participants (registered for My Health Record on or after 1 April 2026): you are required to meet the obligations set out in the 2026 Rules. The 2016 Rule has been repealed and no longer applies.
My Health Records Rules 2026 Now in Effect
Organisations should review and update their Security and Access Policy as required.
To support implementation, the Office of the Australian Information Commissioner and Australian Digital Health Agency have released:
- An updated 2026 Security and Access Policy Template
- A fact sheet outlining the key changes and practical steps for compliance
- Practical templates developed by Medical Business Services to assist organisations in reviewing and updating policies in line with the new requirements
Importantly, the changes do not alter the purpose of the My Health Record system, reduce privacy or security protections, or change how consumers or healthcare providers interact with My Health Record system, and there is no reduction in privacy protections or consumer controls. Strong safeguards remain in place, and existing consumer-facing functionality continues unchanged.
The Department of Health, Disability and Ageing has published FAQs on these new Regulations and Rules.
The Australian Digital Health Agency (Agency) has updated its public and educational material to reflect these changes.