My Health Record Security Readiness Assessment
For practices that participate in My Health Record: review your security and access policy, user access, training and records against the My Health Records Rules 2026.
Who this is for
Medical centres and healthcare provider organisations that participate in My Health Record. The My Health Records Rules 2026 took effect on 1 April 2026, and the revised requirements apply to existing participants from 1 October 2026.
If your practice does not participate in My Health Record, your privacy and security duties still apply. See the Privacy Act and APP 11 assessment instead.
What we assess
- 01
Security and access policy
Whether you maintain a documented, auditable security and access policy as Rule 21 requires.
- 02
User access management
Unique user identification, authorised access and prompt removal or suspension of access.
- 03
Staff training
Training before access is granted, annually and after significant changes.
- 04
Technical measures and monitoring
Security measures such as encryption and backups, maintenance and monitoring of systems.
- 05
Reviews and records
Whether the policy is reviewed at least annually and the required records are kept.
- 06
Incident response
Readiness to report and manage security events, including the possibility of suspension under Rule 14.
How the assessment works
- 01
Confirm participation
We confirm how your practice participates and which requirements apply.
- 02
Review
We compare your policy, access, training and records with the requirements.
- 03
Identify gaps
Gaps are rated by risk and linked to the relevant rule.
- 04
Report and plan
You receive a readiness report and a plan to close the gaps.
What you receive
- My Health Record security and access policy gap assessment
- Review of user access, training and record-keeping practices
- Prioritised remediation roadmap
- Executive summary
Records the Rules require you to keep include policy versions, account authorisations and training records for 5 years, and user identification, breach management and security measure records for 2 years. Please check the current Rules and guidance from the Australian Digital Health Agency.
Official reference: My Health Records Rules 2026 (F2026L00392). This page is not legal advice.
Is your practice cyber secure?
Find out where your practice may be exposed to cybersecurity risks and what improvements should be prioritised. We are independent and software-agnostic: we assess your whole IT environment, whether you use Best Practice, MedicalDirector, Zedmed, cloud applications, local servers or paper records.
Please do not send patient records or personal health information through this website or in your first email.
Discuss a Healthcare Cyber Security Assessment
Tell us about your practice and what you need reviewed. We reply to talk through scope, then send a written proposal.
Request a scoping callRelated pages
- Healthcare Cyber Security Assessment
- Australian Privacy Act & APP 11 Security Assessment
- Ten healthcare scenarios
- Knowledge Centre
Content reviewed 24 October 2026. This page describes an independent gap assessment service, not a formal compliance certification or a legal opinion. Assessments do not guarantee regulatory compliance or prevent all cyber incidents.