Under new Health Record privacy Law, no information can be released to law enforcement or a government agency without your consent or an order from a judicial officer. To date the Agency’s official operating policy has been that no information within My Health Record can be released without an order from a judicial officer. The Agency has never received such a request and has never released information. Under new laws, no information can be released to law enforcement or a government agency without your consent or an order from a judicial officer.

Under new laws, no-one is permitted to access, or ask you to disclose, any information within your My Health Record for insurance or employment purposes. The Australian Digital Health Agency will not approve the release of an individual’s personal or health information to a third party except where it is for the provision of healthcare or is otherwise authorised or required by law. Under these laws, no-one is permitted to access, or ask you to disclose, any information within your My Health Record for insurance or employment purposes.

The My Health Record system meets the strictest cyber security standards. It has robust multi-tiered security controls to protect the system from malicious attack. The system has been built and tested to Australian Government standards to protect the confidentiality, integrity, and availability of information within an individual’s My Health Record. The Agency actively monitors and responds to threats and risks within the cyber security environment and uses the internationally recognised management framework, Information Technology Infrastructure Library (ITIL).

If you wish, you can allow others, such as a partner, family member or other trusted friend, to access your record by making them a nominated representative.

At present, the policy decision has been taken that My Health Record data will not be made available for research and public health purposes. Data in the My Health Record system will be de-identified for use in research and public health purposes. You can request your information is not included in these data sets in the profile section of your My Health Record.

My Health Record cannot be accessed on the open internet. Healthcare provider organisations must be authorised to connect to the My Health Record system and conformant clinical software containing an authenticated digital certificate.

All access and use of the My Health Record system is monitored by the Australian Digital Health Agency Cyber Security Centre. If an individual’s My Health Record is deliberately accessed without authorisation, new harsher penalties may apply. These may include up to five years in jail and up to $315,000 in fines.

From 14 years, a young person can manage their own My Health Record. Under new My Health Record privacy laws, when a child turns 14, their authorised representatives, usually their parent/s or guardian/s, will automatically be removed from being able to access their child’s record. If the young person would like a parent or guardian or other trusted person to have access to their record, they can add them as a nominated representative. Technical changes to the My Health Record system to reflect these new laws were implemented on 4 February 2019. On this date, all existing authorised representatives for teenagers over the age of 14 were removed from their teenager’s record.

Your previous medical history such as older test results and medical reports will not be in your new My Health Record. When your new My Health Record is activated, when you or your doctor or pharmacist access it for the first time, there may be little or no information in it. There may be around two years’ worth of Medicare/PBS claims history from your doctor’s visits and medicines a pharmacist has dispensed for you. If you want details of your medical history to be added to your My Health Record, ask your GP to add a summary next time you see them.

It’s your choice what information is in your My Health Record, and who you share it with. You can let your doctor or pathology or diagnostic imaging service know during your visit if you don’t want them to upload documents or reports to your record. This is also called ‘withdrawing consent’ for upload. Your health information may be held in local medical records systems such as computers and paper files as part of your care, but it will not be added to your My Health Record unless you reinstate your consent for them to do so. In some circumstances, certain pathology reports may not appear in your My Health Record, even if you have not withdrawn consent. This is in accordance with legislation. For example, reports may not be uploaded on a person’s AIDS or HIV status if there are disclosure restrictions set by state or territory legislation. As an additional privacy control, you can restrict which healthcare organisations can look at your record or individual documents in it by setting secure access codes. You can also permanently delete documents at any time, with no backups kept.

In November 2018, new laws were made to provide even more privacy protections for people using My Health Record – this includes the ability to permanently delete your record at any time. When you delete a My Health Record, all information in the record, including any backups, will be permanently deleted from the system. Deleted information cannot be recovered. Your health information will no longer be available to you and your healthcare providers, including in an emergency. How to permanently delete a record.

The last day to opt out of having a My Health record was 31 January 2019. Records have now been created for eligible Australians who didn’t opt out. If you have now decided that you don’t want a My Health Record, you can cancel it at any time, and your record will be permanently deleted. If you decide to cancel your record, no backup copies will be kept in the My Health Record system, and your information cannot be recovered. Note that any copies stored on your healthcare provider’s own record-keeping systems will not be deleted. Learn more about deleting your record.

Any My Health Record that has previously been cancelled will also be permanently deleted from the system. The process to permanently delete these records will start from 23 January 2019 and is expected to take up to 90 days.

If you don’t have a My Health Record, your health information cannot be uploaded to it.