If your practice is connected to My Health Record, the rules come with IT jobs: a written security and access policy, a proper way of authorising and removing users, trained staff, security measures that match the policy, and records that show you’ve done it. Most of it comes down to knowing who can reach patient records, and being able to show it. Here’s what that means in practice.

The My Health Records Rules 2026 started on 1 April 2026. Practices that were already registered had until 1 October 2026 to bring their policy and records up to the new standard, so that date has now passed. If your policy hasn’t been updated, now is the time. This post is general information, not legal advice.

My Health Record security requirements: start with the policy

Every healthcare organisation registered with My Health Record must have a written security and access policy, however big or small it is and however often it uses the record. The 2026 Rules also removed the old limited-size exemptions. You can tailor the policy to the size of your practice, but you can’t opt out of it.

At a minimum, the policy has to cover how people are authorised to use the record and how their access is removed or suspended, the training staff get before they use it, how data breaches are reported, the physical and information security measures you use, and how you’ll spot and act on security risks. It has to be reviewed at least once a year, and you need to keep a copy of each version for five years.

The Office of the Australian Information Commissioner (OAIC) publishes a policy template, updated in October 2026, and the Australian Digital Health Agency has a checklist. A template is a starting point, not a guarantee. It needs tailoring to how your practice really works. A policy that sits in a drawer won’t protect you, and the OAIC can take regulatory action if the rules aren’t met.

The IT side of the policy

A lot of the policy only works if your IT backs it up. In practice that means:

• Individual logins. Everyone who uses the record has their own, with access matched to their role. With shared logins, you can’t tell who accessed what.
• Access added and removed properly. Someone approves new users, and access is removed straight away when a GP or staff member leaves or changes roles.
• Multi-factor authentication. The rules don’t name a particular technology, but the OAIC recommends it for remote access, and it’s one of the most effective protections around. Our guide to multi-factor authentication explains how it works.
• Audit logs you can actually use. Your clinical software can record who opened which record, and when. Reviewing those logs is one of the best ways to spot access that shouldn’t have happened.
• Computers that are patched and protected, with clinical software kept updated and screens positioned and locked so patient information isn’t visible to the wrong people.
• Tested backups.
• Third parties follow your policy. That includes contractors, visiting providers who share your IT, and your own IT provider if they have access to your systems. A good provider will agree to this in writing.

Our cybersecurity solutions cover many of these controls, and our post on cybersecurity for medical practices covers the wider picture.

Training, and the records that prove it

Staff need training before they use My Health Record. The OAIC also suggests an annual refresher, and extra training when the legislation or the system changes.

The 2026 Rules add clearer record-keeping. Training records have to be kept for five years. Records showing how you apply your security measures, such as user access, system maintenance, data protection, encryption and backups, have to be kept for two years and produced if you’re asked. A simple spreadsheet and a folder you can find in a hurry will go a long way.

If something goes wrong

If a security incident involves My Health Record information, the My Health Records Act can require your practice to report it to both the Australian Digital Health Agency and the OAIC, and your policy has to explain how you’ll do that. A breach that doesn’t involve My Health Record, such as one affecting other patient records, may fall under the Notifiable Data Breaches scheme instead. Which applies depends on the circumstances, so have a clear incident response process written down and get advice quickly if you suspect a breach.

The gaps we see most often

• A shared login on the front desk
• Accounts for former staff that are still active
• Locums and casual staff using someone else’s details
• Remote access for suppliers that nobody is tracking
• Computers that haven’t been updated in months
• A policy that hasn’t been updated for the 2026 Rules
• No record that staff were trained

How we help at Hyetech

We’ve supported Victorian medical practices for close to two decades. We understand that a practice needs reliable systems and sensible security controls to protect patient information and keep the doors open. We help manage the IT behind your practice: networks, Microsoft 365, user access, endpoint security, updates, backups and internet. We also help manage staff access, monitor systems, and come onsite when something needs hands-on attention. Where we access your systems, we’re happy to work within your security and access policy.

To be clear, no IT provider can make a practice compliant on its own. We help you put in place and manage the IT controls that support your obligations. The policy, and the obligations themselves, stay with you. You can read more on our medical and allied health IT support page. If telehealth is part of your practice, our post on telehealth internet requirements is worth a look too.

Questions to ask your IT provider

• Do you understand the My Health Record requirements for our practice?
• Will you follow our security and access policy whenever you access our systems?
• How quickly can you remove access when someone leaves?
• Can you show us who has access to what, and help us review the audit logs?
• When did you last test our backups?
• Who looks after remote access for our software suppliers?

Frequently asked questions

Do small practices need a My Health Record security and access policy?

Yes. If your organisation is registered, you need one regardless of size or how often you use the system. The 2026 Rules also removed the old limited-size exemptions, although you can tailor the policy to your practice.

Did the rules change this year?

Yes. The My Health Records Rules 2026 started on 1 April 2026. Practices that were already registered had until 1 October 2026 to update their policy and records, so check that yours has been done.

Who is responsible for it?

The practice or organisation is responsible for the policy, for making sure staff and contractors follow it, and for keeping the records that show how it was applied.

What should we do when a staff member leaves?

Remove their access straight away, and make sure your policy says how that happens. It’s one of the clearest expectations for practice owners.

Does it apply to allied health clinics?

If your clinic is registered and connected to My Health Record, the same kind of requirements apply. Check the Agency’s guidance for your type of practice.

Do we have to report a breach?

If a breach involves My Health Record information, you can be required to report it to both the Australian Digital Health Agency and the OAIC. Other patient information may fall under the Notifiable Data Breaches scheme. Get advice early.

Does using an IT provider make us compliant?

No. A good provider can help you put the IT controls in place and keep them running, but the policy and the obligations stay with your practice.

Not sure if your practice is set up properly?

Talk to the Hyetech team for a free IT review. We’ll check who has access to what, whether your systems are up to date, and what we’d tighten first. Book a free review.