The Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Act 2025 (Act) received Royal Assent on 14 February 2025. The Act makes amendments to the My Health Records Act 2012 (Cth), Health Insurance Act 1973 (Cth) and National Health Act 1953 (Cth) to establish a legislative framework requiring key health information to be shared with the My Health Record system.
It comes in response to recommendations in the 2020 Review of the My Health Records Legislation, 2022 Strengthening Medicare Taskforce Report and the Productivity Commission's 2023 Advancing Prosperity inquiry report to modernise and transform the My Health Records System into a default 'opt-out' model ensuring health information is shared more efficiently to enable coordinated care and to reduce duplicate testing and unnecessary medical appointments.
What are the key changes to the My Health Records System?
Registered healthcare providers under the My Health Records Act 2012 (Cth) (e.g., pathology laboratories, imaging providers, general practices and hospitals) and approved registered repository operators (who hold records of information included in My Health Records for the purposes of the My Health Record system) will be required to register and upload health information by default to the My Health Record system.
The Minister may make rules on the health information to be uploaded to the My Health Record (upload rules). The upload rules will be developed at a future date and will cover:
- which healthcare providers and services are subject to the default sharing system (noting the Minister has advised that pathology and diagnostic imaging providers and services will be named first, with others added over time)
- type of information to be uploaded
- time period for sharing with My Health Record; and
- additional information on the exceptions.
Upfront Medicare benefits can still be claimed, subject to the information being uploaded within the specified time.
Healthcare providers will also be able to apply to the Australian Digital Health Agency for an extension of the time required to register. In considering the extension application, the Australian Digital Health Agency is required to take into account the healthcare provider organisation's size and technological readiness, potential disruption to the provision of healthcare and any other matters that are considered relevant.
If healthcare providers are not sharing information with My Health Record, they will be required to display notices which indicate that they are not sharing information with the My Health Record system in prominent locations (including premises, websites and online booking systems).
Patients will still be able to request to opt-out of the My Health Records system. If reasonable concerns exist regarding a patient's health, safety or wellbeing (if the information is uploaded), registered healthcare providers have the discretion not to upload the information. Registered healthcare providers are required to keep a record with evidence of the exception to not share the information with My Health Record for a period of 2 years starting on the date the service was provided. If the health information is not uploaded to My Health Record and no exception applies, the Commonwealth will be able to pursue the Medicare benefit paid to the registered healthcare provider as a debt.
What are the civil penalties?
Civil penalties apply if the healthcare provider does not:
- register when required - 250 penalty units (presently equivalent to $82,500);
- share the information according to the upload rules to the My Health Record - 30 penalty units (presently equivalent to $9,900); or
- keep a record of the exception to upload - 10 penalty units (presently equivalent to $3,300).
Where does privacy, patient autonomy and information control fit in?
The reforms to the My Health Record system did raise privacy concerns which were discussed in the Senate Community Affairs Legislation Committee Report. Key among them were the privacy risks in large centralised databases like My Health Record being attractive targets for cyberattacks, as well as respect for patient autonomy so that healthcare recipients are able to control their health information (including which healthcare providers can access their My Health Record information and the right to opt out of having specific results or data shared). Overall, there was widespread support for establishing a default opt-out model for sharing information to the My Health Record as this will reduce the risk of adverse outcomes, repetitive tests, and ultimately enhance patient care.
What should healthcare providers do now?
Healthcare providers should familiarise themselves with the new obligations as well as the privacy safeguards and clinical discretion provisions that protect patient autonomy and allow for the withholding of information in certain circumstances.
To ensure a smooth transition to the new system, healthcare providers should review their existing privacy frameworks and update their systems and processes to comply with the new requirements.
MinterEllison provides full-service IT legal and consultancy services with extensive experience in privacy and health regulation. Please contact us if you would like assistance in preparing for these changes.
