My Health Record legislation changes

The My Health Record (MHR) 2026 Rules have replaced the 2016 Rules, updating how registered organisations manage security, staff training and record keeping. If your organisation is already connected to MHR, start reviewing your policy now, ahead of the 1 October 2026 transition deadline.

MHR is a secure, national summary of a person’s key health information, accessible to authorised care teams unless the individual has restricted access.

The 2026 Rules apply to every registered organisation regardless of size; the small-organisation exemption is removed. Organisations registered before 1 April 2026 have until 1 October 2026 to update their policy. Those registering from 1 April 2026 must meet the 2026 Rules from the outset.

Read the full participation obligations.

The 2026 Rules focus on a small number of specific gaps. In practice, this means:

• A documented MHR data breach response process, added to your security and access policy.
• Staff training completed before 1 October 2026, with records kept for five years.
• Updated record-keeping requirements, including audit logs, policy versions, and (where applicable) advance care planning instructions.
• The small-organisation exemption removed: all organisations, and every HPI-O, must now meet the same baseline requirements.

For Residential Aged Care Homes these updates align closely with the strengthened Aged Care Quality Standards, with no new system to set up. Your risk and incident management (Outcomes 2.4 and 2.5), training (Outcome 2.9), and information management (Outcome 2.7) systems already do this work; the 2026 Rules require a small number of MHR-specific additions to each.

If you’re already registered, the priority now is reviewing your policy, scheduling training and confirming record keeping arrangements ahead of 1 October 2026. If you’re not yet connected, there’s no better time to register: your policy is built to the 2026 Rules from the outset.

We can help with questions about the Rules, connections to the right contacts at the Australian Digital Health Agency, or step-by-step support with registration.

Find out what the 2026 Rules mean for your organisation and what to do before 1 October:

• Free webinar Wednesday 9 September 12:30pm-1:30pm. Register here

• My Health Record 2026 Rules in action
• Get support by emailing digitalhealth@hnc.org.au

• My Health Record 2026 Rules in action, and how these fit with your Quality Standards
• My Health Record for Residential Aged Care
• Residential Aged Care templates and resources
• Get support by emailing digitalhealth@hnc.org.au