My Health Record data breaches: the separate notification duty under section 75

The rule. Section 75 of the My Health Records Act 2012 (Cth) makes notification mandatory for entities in the My Health Record system: the System Operator (the Australian Digital Health Agency), registered healthcare provider organisations, registered repository operators, registered portal operators and registered contracted service providers. The OAIC's Guide to mandatory data breach notification in the My Health Record system (version 3.0, October 2023) explains how the duty works. The Agency's own data breaches page (last updated 1 July 2026) carries the notification form.

What counts as a breach. There are three kinds: an actual or possible contravention of the Act involving unauthorised collection, use or disclosure of health information in a person's My Health Record; any event that has or may have compromised, or may compromise, the security or integrity of the My Health Record system; and any circumstances that have or may have arisen with the same effect. The second and third apply whether or not anyone broke the Act. The Agency gives the example of malware on a provider's computer that could allow unauthorised access to information in the system, which must be reported immediately while the malware is being removed.

When the duty is triggered. It applies when the entity becomes aware that such a breach has or may have occurred and the breach did, may have, or may involve that entity. Suspected breaches count, and the Agency says you must notify even if the breach is already resolved. Involvement can come from the actions of a staff member or contractor, from the entity's access to or use of the system, or from the entity's own IT that feeds into or interoperates with My Health Record. There is no serious-harm test and no 30-day assessment window, which is the biggest difference from the NDB scheme.

Who you tell. Most registered entities must report to both the OAIC and the Agency as soon as practicable after becoming aware. A state or territory authority or instrumentality reports to the Agency only, not the OAIC, though it may also tell its local privacy regulator. Reporting to only one of the two when both are required is itself a failure to report. Containment must not wait for the report, but the report must not wait for full facts either: the OAIC says send a preliminary notice in urgent cases and add detail as it becomes available. Use the OAIC's My Health Record data breach form and the Agency's separate online form (a PDF version also exists).

Telling patients. A provider or operator cannot notify affected patients directly under this scheme. It must ask the Agency to do so, as soon as practicable, where the breach is confirmed, or where it is suspected but reasonably likely to have occurred and the effects might be serious for at least one person. The Agency says this request is required even if the provider has already contacted the patients itself. If a confirmed breach affects a significant number of people, the Agency must also notify the general public. Give patient identities to the Agency only; the OAIC asks you not to include them in your notice to it.

What to include. Both regulators want, where known: a description of the breach; the kind of information involved; how many people were or may have been affected; when it happened and when and how you found out; the cause, and whether it was accidental or deliberate; whether it is contained; what you have done to mitigate it and prevent a repeat; whether it looks systemic or isolated; other entities involved; any similar past breach; the controls already in place; whether a data breach response plan existed and was activated; and a named contact.

Consequences. The Information Commissioner can seek a civil penalty of up to 100 penalty units against a registered provider, repository operator, portal operator or contracted service provider that fails to report as soon as practicable, or reports to only one of the two bodies. Failing to carry out the required response steps (contain, assess, request notification and prevent recurrence) is not a civil penalty matter, but it can lead to an investigation and to the Agency varying, suspending or cancelling the entity's registration.

Where the NDB scheme takes over. A breach that never touches the My Health Record system, such as a lost USB stick of local patient records or data already downloaded into a practice's own clinical system, is not a section 75 breach. It may still be an eligible data breach under the Privacy Act's NDB scheme, which covers all private health service providers. A single incident can trigger both, for example ransomware on practice systems that also connect to My Health Record, so run the two assessments side by side.

What to do. Add a My Health Record branch to your incident response plan: one question at triage (could this involve our access to, or systems connected to, My Health Record?), with a yes sending the matter straight to the Agency and OAIC forms without waiting for a serious-harm decision. Keep the forms, contact points and the list of required details in your runbook, name who files them, record the time you became aware, and log each follow-up update you send to both bodies as the investigation continues.