The Office of the Australian Information Commissioner (OAIC), in collaboration with the Australian Digital Health Agency (the Agency), has developed an updated My Health Record Security and Access Policy Template to help healthcare provider organisations meet their obligations under the new My Health Records Rules 2026 (the Rules).
From 1 October 2026, all healthcare provider organisations registered with My Health Record must comply with the security and access policy requirements set out in rules 21 and 43 of the Rules. These requirements replace security and access policy requirements previously set out in rule 42 of the My Health Records Rule 2016.
The updated template and supporting guidance material are designed to help organisations:
To support implementation, the Agency has also developed a fact sheet outlining the key changes organisations should consider when reviewing their existing security and access policies, including a practical summary of the updates required to align with the 2026 Rules.
If your service would like support reviewing, updating or implementing its Security and Access Policy, or guidance on meeting the requirements of the My Health Records Rules 2026, please contact Gloria Mwikya, Digital Health and Innovation Manager, at [email protected].
Two major artificial intelligence companies, OpenAI and Anthropic, have recently launched healthcare-specific platforms: ChatGPT Health and Claude for Healthcare. These platforms allow users to upload or connect personal health information, including medical records, pathology and imaging results, and data from wearable devices.
The Bulk Billing Practice Incentive Program (BBPIP) commenced on 1 November 2025. The program provides a quarterly incentive of 12.5% of Medicare Benefits Schedule (MBS) revenue for practices that bulk bill all Medicare-eligible patients for all eligible services.
