Policy guidance for Pathology and Diagnostic Imaging providers

Under Rule 21 of the My Health Records Rules 2026, organisations (including pathology and diagnostic imaging organisations) seeking to register with My Health Record must develop, communicate and enforce a written security and access policy covering several mandatory topics. The topics that must be covered by the policy include:

In addition to the guidance on this page, it is recommended that pathology and diagnostic imaging providers refer to the guidance provided on the My Health Record participation obligations webpage, when developing a security and access policy for their organisation.

This guidance is intended as general in nature only and should not be considered legal advice. Organisations are responsible for appropriately tailoring the policy to their individual circumstances.

Please note: Organisations must establish a My Health Record security and access policy prior to registering with My Health Record, noting that they will be required to attest at the time of registration that they have a policy in place.

‘Access’ refers to both viewing and uploading information to My Health Record. This means organisations that register with My Health Record for the purpose of uploading documents only (but do not intend to view any information in My Health Record) are also required to have a security and access policy in place prior to registering for My Health Record.
 

Authorising, suspending and deactivating access

Authorising access

The policy must outline how staff will be authorised to access My Health Record, or use information in the My Health Record system, on behalf of the organisation, including how user accounts will be created or modified. The information included in this section may vary depending on whether staff members will be both viewing and uploading information to My Health Record, or uploading only:

  1. Uploading Only:
  • If staff members will only be uploading information to My Health Record and will not be viewing My Health Record information, this should be clearly stated in the policy. The policy should also outline how users will be authorised to upload documents to My Health Record.
  • Where documents are uploaded to My Health Record as part of a bulk upload process, this should be specified in the policy. If all bulk uploads are to take place through a single authorised user, this should be outlined in the policy, in addition to the process for authorising this user.
  1. Viewing and Uploading:
  • If the conformant software enables both viewing and uploading of information in My Health Record, the policy must outline how the organisation will authorise staff to view and upload information, as well as the individual(s) responsible for granting and managing this (such as the Responsible Officer (RO) or Organisation Maintenance Officer (OMO)).

Suspending or deactivating access

The policy must specify how access to My Health Record will be suspended or deactivated in specific situations. This includes identifying the person responsible for these actions (e.g. RO or OMO) and setting out the process for immediate action where:

  • A user leaves the organisation
  • A user’s security has been compromised
  • A user has changed duties and no longer requires access to the system
  • A user is an individual healthcare provider that ceases to be linked to the organisation

Training

An organisation’s policy must state that all users of My Health Record will undergo training before accessing the system for the first time, annually, and when there are significant changes to the My Health Record system or its governing legislation. At a minimum, the policy must state that training will cover how to use the system accurately and responsibly, the legal obligations on individuals and organisations that access My Health Record, and the consequences of breaching those legal obligations.

The Agency provides general and specific training resources to support compliance with My Health Record training requirements, including:

Identification of users

The policy must outline how users are identified each time they access or upload to My Health Record. The policy should state that each user will have a unique account and login credentials, which will be captured by the conformant clinical software whenever a record is accessed or a document is uploaded. For bulk uploads, the policy should state that the software will capture the user ID of the authorised person performing the upload.

The policy should also specify that the identity of authorised users is automatically communicated to the System Operator by the organisation’s conformant clinical software each time a record is accessed or a document uploaded. Further, the policy should identify the RO or OMO as the individual responsible for providing this information, or any additional details, when requested by the System Operator.

Ensuring compliance with My Health Record data breach obligations

The policy must outline the process for complying with section 75 of the My Health Records Act 2012, including identifying whether an actual or potential My Health Record data breach has occurred and how it will be managed within the organisation.

Under the My Health Records Act 2012, a data breach involves: 

  • unauthorised collection, use or disclosure of health information in an individual’s My Health Record has or may have occurred; or
  • an event has or may have occurred, or circumstance have or may have arisen, that compromise, have compromised or may have compromised, the security or integrity of the My Health Record system.

The policy must also outline how the organisation will meet its obligations under section 75 of the My Health Records Act 2012 to notify the Australian Digital Health Agency (the System Operator) and, where relevant, the Office of the Australian Information Commissioner (OAIC) of the breach, contain the breach and mitigate future breaches. Refer to data breach notification obligations for more information.

Physical security, information security, cybersecurity, technical and organisational measures, including user account management processes

All pathology and diagnostic imaging organisations must include physical security, information security, cybersecurity, and technical and organisational measures in their policies, even if only uploading to My Health Record. The measures apply to all organisations, regardless of their size, scale, or technical capability, to ensure compliance with baseline security requirements.

It is recommended that pathology and diagnostic imaging providers refer to the guidance provided on the My Health Record participation obligations webpage.

Strategies for identifying, responding to, and reporting system-related security risks

The policy must describe strategies for ensuring My Health Record security risks are promptly identified, acted upon, and reported to the organisation’s management. This applies to organisations that are only uploading to the My Health Record system as well as organisations whose staff are authorised to view information in My Health Record. These strategies should be adapted based on the number of staff who can access and view My Health Record, the locations from which reports are being viewed and/or uploaded and proportionate to the organisation’s size and risks. 

It is recommended that pathology and diagnostic imaging providers refer to the guidance provided on the My Health Record participation obligations webpage.

Record-keeping

Each iteration of the organisation’s security and access policy should have a unique version number and should detail where each reviewed version is stored, ensuring it is accessible to all employees. The policy must also be reviewed at least annually, as well as when any new or changed risks are identified, and when requested by the System Operator.

Once registered with the My Health Record system, organisations must keep records relating to how they implement various elements of their security and access policy.

To comply with Rule 45 of the My Health Records Rules 2026, an organisation must keep a record of: 

  • how the organisation authorises access to the My Health Record system, including records of the user accounts created, changed, suspended or deactivated – records must be retained for five years
  • training that has been provided to employees before they access the My Health Record system, annually and following significant changes to the legislation or system – records must be retained for five years
  • how the organisation ensures a person who requests access to a healthcare recipient’s My Health Record can be identified and the person’s identity communicated to the System Operator (for example, this may include audit logs) – records must be retained for two years
  • how the organisation ensures that it is able to identify, manage and respond to My Health Record data breaches and that these processes comply with obligations under section 75 of the My Health Records Act 2012  (for example, evidence of documented processes and any action planned or taken) – records must be retained for two years
  • how the organisation has implemented physical security, information security, cybersecurity, and technical and organisational measures at the organisation (for example, documented application of the user account management practices, system maintenance activities, data protection, encryption and back-up procedures that have been employed and when) – records must be retained for two years.