From 1 October 2026, all healthcare provider organisations registered with My Health Record must ensure their security and access policy complies with the My Health Record Rules 2026. This includes organisations with an existing policy developed under the My Health Records Rule 2016.
The updated requirements cover user account management, staff training, security measures and processes for responding to My Health Record data breaches. Organisations must also keep records showing how they apply their policy.
Use the video guide and templates below to help your practice update its policy and maintain supporting records. Adapt the templates to reflect your practice’s systems, staff responsibilities and procedures.
Watch the video guide
SWSPHN has created a video to help you complete the security and access policy template. Watch the video as you work through the template and add information specific to your practice.
Download templates
Download and adapt these Word templates to suit your practice.
Security and access policy template
Word document
User access register
Word document
Staff training register
Word document
Data breach and incident response template
Word document
Annual compliance review checklist
Word document
Further information
For guidance on the requirements, visit the Australian Digital Health Agency’s resources:
- My Health Record participation obligations
- Revised security and access policy requirements fact sheet
Need help?
Contact SWSPHN’s Digital Health team at DigitalHealth@swsphn.com.au for support.