My Health Record compliance deadline is 1 October — five days away

There is a compliance deadline that most GP practices are not aware of, and it is five days away.

From 1 October 2026, the Australian Digital Health Agency will enforce updated security and access policy requirements for all healthcare organisations registered with My Health Record before 1 April 2026. The rules technically came into effect in April, but the enforcement period begins next Wednesday. If your practice does not have the required policies documented by then, you risk having your My Health Record access suspended.

This is not a technology upgrade. It is a documentation and governance exercise. For most practices, the compliance work can be completed in an afternoon using the ADHA’s own template.

What the rules actually require

Under the updated participation obligations, every registered healthcare organisation — including solo practitioners — must have documented policies for the following:

User account management. A written process for creating and modifying user accounts, including what information is required before an account is set up and who in the practice authorises account changes.

Offboarding when a practitioner leaves. A procedure for suspending or deactivating My Health Record access when a staff member or practitioner ceases to work at the practice. This includes locum GPs, trainees, and allied health staff with access.

Annual security training. All authorised My Health Record users must complete a refresher on security obligations annually, and the practice must retain records of who completed it.

Data breach procedures. A documented plan for identifying, reporting, and responding to a suspected data breach involving My Health Record. This includes knowing the notification obligations under the My Health Records Act 2012.

Technical security measures. A statement of the technical safeguards in place, such as multi-factor authentication, password policies, and device management.

Records associated with training and user procedures must be retained for two to five years depending on category.

Who is affected

The legislation defines “healthcare provider organisation” broadly — it covers entities that provide healthcare or support services, including single-person operations. A solo GP, a sole-practitioner physiotherapist, a one-person GP-after-hours service — all of these count.

If you registered your practice with My Health Record before 1 April 2026, the compliance requirements apply to you. If you registered after that date, you were subject to the new rules from the start.

The stakes

Registered organisations that do not comply are not eligible to participate in My Health Record and may have their registration revoked. The Office of the Australian Information Commissioner can also pursue regulatory action.

For most patients, their GP’s My Health Record access has become a central part of how their health information moves across the system — prescription history, specialist letters, pathology, discharge summaries. A practice that loses My Health Record access abruptly is a real disruption to patient care.

The ADHA has not yet publicly specified the audit and enforcement mechanisms beyond stating that enforcement begins 1 October. This ambiguity is not a reason to delay — it is a reason to complete the documentation this weekend rather than test the enforcement timeline.

The fastest path to compliance

The ADHA has published a security and access policy template that conforms to the updated requirements. Download it, work through each section for your practice context, and save a dated copy. For a solo practitioner, this is a two-hour task. For a larger practice with multiple staff and shared access, it takes longer — but the template structure does most of the heavy lifting.

For most practices the gap between what they already do informally and what the policy requires to be written down is smaller than it appears. The offboarding procedure, for example, is probably already happening — it just needs to be documented.

Why this matters beyond the compliance checkbox

The underlying security rationale is sound. My Health Record stores sensitive health information for most Australians, and the system’s security depends on every access point being well-managed. A practitioner who leaves a practice but retains active My Health Record access represents a genuine security risk — not a hypothetical one.

The annual training requirement is also worth taking seriously rather than treating as a tick-box. Staff who understand what My Health Record access means — and what the notification obligations are if something goes wrong — are the actual security layer. Policies without awareness are paperwork.

The 1 October deadline is this week. If you are a practitioner who manages your own practice, this is the weekend to act.

Verdict: yes — if your practice uses My Health Record, documentation needs to be done before Wednesday.

---

Sources cited

1. My Health Record security deadline looms — Medical Republic, 25 September 2026: https://www.medicalrepublic.com.au/my-health-record-security-deadline-looms/129398
2. My Health Record participation obligations — ADHA: https://www.digitalhealth.gov.au/healthcare-providers/initiatives-and-programs/my-health-record/register-and-set-up-access/participation-obligations