EXPLANATORY STATEMENT
My Health Records Act 2012
My Health Records Regulations 2026
Purpose and operation
The My Health Records Regulations 2026 (the Instrument) repeals the My Health Records Regulation 2012 (2012 Regulation) and remakes relevant provisions from that instrument to continue to support the effective operation of the My Health Records (MHR) system, which is established under the My Health Records Act 2012 (the Act).
The Instrument prescribes the Australian Digital Health Agency as the System Operator of the MHR System. It also prescribes key matters to support the registration of healthcare recipients for a My Health Record.
The Instrument aligns certain definitions across legislation, by importing relevant definitions from the Healthcare Identifiers Act 2010 (HID Act) and provides for the Service Operator under the HID Act (HI service operator) to share critical information with the MHR System Operator to support My Health Record registrations.
The Instrument also provides additional detail in respect of the definition of ‘nominated healthcare provider’ in section 5 of the Act, and the interaction of state and territory laws.
Background
The Act provides for the establishment and operation of the national MHR system, to provide access to health information relating to consumers’ healthcare.
Healthcare identifiers, assigned under the HID Act, provide a key foundation of the MHR system. Under the HID Act, the HI service operator assigns unique healthcare identifiers to consumers, healthcare providers and healthcare provider organisations so that health information can be safely and accurately matched with those consumers and providers. A healthcare identifier is a key prerequisite for consumers to be registered for a MHR and for providers to access the MHR system.
This Instrument will replace the
2012 Regulation, following review of the existing instrument prior to it sunsetting.
Authority
Subsection 112(1) of the MHR Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
Reliance on subsection 33(3) of the Acts Interpretation Act 1901
Subsection 33(3) of the Acts Interpretation Act 1901 provides that where an Act confers a power to make, grant or issue any instrument of a legislative or administrative character (including rules, regulations or by-laws), the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument.
Commencement
This instrument commences on 1 April 2026.
Consultation
Public consultation on the review of legislative instruments made under the Act, including the 2012 Regulation, were held in August 2025, complemented by ongoing collaboration with the Australian Digital Health Agency and Services Australia. There was general agreement that the majority of provisions in the 2012 Regulation should be remade.
General
The instrument is a legislative instrument for the purposes of the Legislation Act 2003.
Details of the instrument are set out in Attachment A.
This instrument is compatible with the human rights and freedoms recognised or declared under section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. A full statement of compatibility is set out in Attachment B.
ATTACHMENT A
Details of the My Health Records Regulations 2026
PART 1—PRELIMINARY
Section 1 – Name
This section provides that the title of the Instrument is the My Health Records Regulations 2026.
Section 2 – Commencement
This section provides for the Instrument to commence on 1 April 2026.
Section 3 – Authority
This section provides that the instrument is made under the My Health Records Act 2012.
Section 4 - Schedules
This section provides that each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule.
There is one schedule that repeals the My Health Records Regulation 2012.
Section 5 – Definitions
This section defines terms that are used in the instrument. Specifically, ‘Act’ means the MHR Act, ‘Australian Digital Health Agency’ means Agency established by section 8 of the Public Governance, Performance and Accountability (Establishing the Australian Digital Health Agency) Rule 2016, and ‘Healthcare Identifiers Act’ means the Healthcare Identifiers Act 2010.
The note to this section clarifies that a number of terms used in the instrument are defined in the MHR Act, including healthcare provider organisation, healthcare recipient and individual healthcare provider.
Section 6 – Nominated healthcare provider
Section 5 of the MHR Act provides that a healthcare provider is the ‘nominated healthcare provider’ of a healthcare recipient if:
- an agreement is in place to this effect; and
- the provider has been assigned a healthcare identifier under the HID Act; and
- the healthcare provider is registered by a registration authority as a:
- medical practitioner;
- registered nurse; or
- Aboriginal health practitioner, Torres Strait Islander health practitioner or Aboriginal and Torres Strait Islander health practitioner of a class prescribed by the regulations.
The role of a nominated healthcare provider, for the purposes of the Act, is to create and update a consumer’s shared health summary for inclusion in a consumer’s MHR.
This section prescribes the class of providers under subparagraph (c)(iii) of section 5 of the Act to be those with an approved Certificate IV in Aboriginal and/or Torres Strait Islander Primary Health Care Practice.
Section 7 – Identifying information—individual healthcare provider
Under subsection 9(1) of the MHR Act, certain information about healthcare providers is defined as ‘identifying information’. Paragraph 9(1)(h) provides that regulations may prescribe other information as ‘identifying information’ for the purposes of this definition.
Section 7 of the Instrument provides that information that is prescribed for the purposes of paragraph 7(1)(g) of the HID Act is also identifying information of an individual healthcare provider for the purposes of the Act.
Under the 2012 Regulations, other information that was prescribed in the Healthcare Identifiers Regulation 2020 (HID Regulation) was duplicated. This provision, which incorporates any other ‘identifying information’ prescribed as such under the HID Regulation, means that the definition for the purposes of the Act and the HID Act will remain in alignment.
Section 8 – Identifying information—healthcare provider organisation
Under subsection 9(2) of the MHR Act, certain information about a healthcare provider organisation is defined as ‘identifying information’. Paragraph 9(2)(f) provides that regulations may prescribe other information for the purposes of this definition.
Section 8 of the Instrument provides that information that is prescribed for the purposes of paragraph 7(2)(e) of the HID Act is also identifying information of a healthcare provider organisation, for the purposes of the Act.
The effect of the provision is that the types of identifying information under the HID Act and the MHR Act will remain in alignment, enabling the HI service operator to share relevant identifying information with the MHR System Operator for MHR system purposes.
Section 9 – Identifying information—healthcare recipient
Under subsection 9(3) of the MHR Act, certain information about a healthcare recipient is defined as ‘identifying information’. Paragraph 9(3)(i) provides that regulations may prescribe other information for the purposes of this definition.
Section 9 of the Instrument provides that other information that is prescribed for the purposes of paragraph 7(3)(i) of the HID Act is also identifying information of an individual healthcare recipient, for the purposes of the Act.
The effect of the provision is that the types of identifying information under the HID Act and the MHR Act will remain in alignment, supporting the registration of healthcare recipients and other MHR purposes.
PART 2—SYSTEM OPERATOR
Section 10 – Identity of the System Operator
This section prescribes the Australian Digital Health Agency as the System Operator of the MHR system for the purposes of paragraph 14(1)(b) of the MHR Act.
PART 3—REGISTRATION
Section 11 – When a healthcare recipient is eligible for registration—other information
This section prescribes certain information about a healthcare recipient that is required to determine eligibility for registration to the MHR system.
Section 12 – Registration of healthcare recipient by the System Operator
Section 41 of the Act has the effect that information may be uploaded to a consumer’s My Health Record, unless the consumer expressly advises that they do not want a particular record, or records, to be uploaded, or a state or territory law is prescribed which requires consent prior to upload.
This section of the Instrument specifies the state and territory laws for which consent is required from the consumer prior to upload of information to their My Health Record.
Certain state and territory laws operate to prevent the disclosure of a person’s identity or confidential information in connection with certain notifiable diseases, and other health information, unless certain conditions apply, such as requiring the consent of the person. Those laws would normally be overridden by section 41 of the MHR Act in combination with section 109 of the Constitution. However, section 41(4) allows regulations to prescribe certain state and territory laws to remain effective.
The laws that are preserved are described below:
- Public Health Act 2010 (NSW) – section 56
- Public Health Act 2005 (Qld) – sections 55, 77-79, 105-107, 175-177, 220-222 and 238-240
- Public Health Act 1997 (ACT) – sections 110 and 111
These state and territory laws were identified through extensive consultation with representatives of state and territory health departments prior to the making of the 2012 Regulation. This Instrument updates the preserved privacy provisions, to reflect some amendments to relevant state and territory laws. Recent consultations with relevant states and territories have confirmed the above provisions which should continue to be preserved.
The effect of preserving the laws described above is that healthcare providers cannot upload a record to a consumer’s MHR unless they meet the requirements in the prescribed laws applicable in the relevant state or territory.
PART 4—COLLECTION, USE AND DISCLOSURE OF INFORMATION
Section 13 – Prescribed information to be included in a My Health Record
This section has the effect that the Veterans’ Affairs and Defence Departments may collect, use and disclose the healthcare identifier and identifying information of a healthcare recipient or their representative, where the collection, use or disclosure is for the purpose of including information related to the provision of healthcare to the healthcare recipient in the healthcare recipient’s My Health Record, other than information related to compensation or benefits under the Acts listed in subsection 13(2).
Section 14 – Verifying identity of healthcare recipients etc.
This section provides that the Attorney General’s Department (AGD) may disclose identifying information of a healthcare recipient or their representative to the System Operator for the purposes of verifying the identity of the healthcare recipient or representative.
The AGD manages and operates identity verification services, including the Document Verification Service (DVS). The DVS confirms whether the personal details on an identity document match the original information held in the issuing government record. This provision supports the use of the DVS to assist the System Operator to verify the identity of healthcare recipients and authorised and nominated representatives.
Schedule 1 – Repeals
Item 1 – The whole of the instrument
This item provides for the repeal of the My Health Records Regulation 2012.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
My Health Records Regulations 2026
This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Instrument
The instrument will provide the details necessary to support the operation of the My Health Record (MHR) system, as established by the My Health Records Act 2012 (the Act).
The instrument will:
- ensure that the Healthcare Identifiers service operator can carry out its functions and share critical information with the MHR System Operator;
- assist in the interpretation of a nominated healthcare provider as defined by the MHR Act;
- prescribe those state and territory laws that will be preserved by the Act and remain subject to specific conditions, including express consumer consent, in order for certain information to be uploaded to a consumer’s My Health Record.
Human rights implications
The instrument engages the following human rights:
Right to equality and non-discrimination
Article 1 of the International Convention on the Elimination of all Forms of Racial Discrimination guarantees that special measures can be taken by governments to ensure the development and protection of certain racial groups or individuals in order to achieve the full and equal enjoyment of human rights and fundamental freedoms, provided those measures do not result in separate rights for different racial groups and are discontinued after the objectives of the measures have been achieved.
The Regulation, together with the Act, ensures that all members of the Australian community, including Aboriginal and Torres Strait Islander communities that may not have access to medical practitioners, will not be disadvantaged in terms of the nature of information contained in their MHR. Specifically, they will be able to nominate an Aboriginal and/or Torres Strait Islander health practitioner as a nominated healthcare provider who will be able to create and update a shared health summary for their MHR which contains key health information about the consumer’s allergies and adverse reactions, medicines, medical history and immunisations.
The Right to Privacy
Article 17 of the International Covenant on Civil and Political Rights guarantees protection from unlawful interference with a person’s privacy and from unlawful attacks on a person’s honour and reputation.
The MHR Act provides that information may be uploaded to a consumer’s My Health Record, unless the consumer provides express advice to the contrary, or a prescribed law of a state or territory applies. Certain state and territory laws prohibit the disclosure of a person’s identity or confidential information in relation to certain notifiable diseases and other health information, except where specific consent is granted by the person to whom the information relates. Such laws would normally be overridden by the Act because they are inconsistent with the purpose of the MHR Act. However, the MHR Act also provides that the regulations may prescribe that certain laws may be preserved. Accordingly, this instrument prescribes state and territory laws, as identified by those jurisdictions, in relation to the disclosure and uploading of certain health information, that will be unaffected by the Act.
Conclusion
The instrument is compatible with human rights because it promotes better health outcomes for Australians by enabling consumers to have better access to their health information. The instrument engages the right to privacy for the legitimate objective of promoting better access to health services and to the extent that the right to privacy is limited, this is reasonable, necessary and proportionate in the circumstances.
Mark Butler
Minister for Health and Ageing