Aligning security awareness training with the My Health Record framework means mapping staff modules to three obligations: the My Health Records Act 2012, the My Health Records Rule 2016, and the Notifiable Data Breaches scheme under the Privacy Act 1988. Healthcare provider organisations connected to My Health Record carry these duties regardless of practice size, and generic phishing training leaves the specific unauthorised-access and breach-reporting rules untouched.
TL;DR
- Security awareness training my health record must cover the My Health Records Act 2012 and Rule 2016 duties, not just phishing.
- Cyber Aware maps role-based modules to unauthorised access, breach reporting and record-access logging obligations.
- The Notifiable Data Breaches scheme gives entities 30 days to assess a suspected eligible data breach.
- Contracted IT vendors and billing staff carry the same access obligations as clinical staff.
Why this matters
Most general security awareness platforms teach staff to spot phishing and report suspicious links. That's necessary but not sufficient for anyone touching My Health Record data. The Act creates specific offences around unauthorised collection, use and disclosure of health information in the system, and every access event leaves a trail the patient can see themselves.
A workforce that's never told what counts as a reportable access event under the Notifiable Data Breaches scheme will treat a curious record look-up as harmless. It isn't. In 2026, that gap is still the most common failure point auditors flag in healthcare compliance reviews — not weak passwords, but staff who don't know a quick peek at a record is a breach.
How to align training with the My Health Record framework
Start by mapping each framework element to a specific training module rather than bundling everything into one generic privacy course.
| Framework element | What it requires | Training module focus |
|---|---|---|
| My Health Records Act 2012 (Part 4) | Prohibits unauthorised collection, use or disclosure of health information in the system | Role-specific access rules and need-to-know handling |
| My Health Records Rule 2016 | Sets registration and participation obligations for provider organisations | Onboarding checklist for newly authorised users |
| Privacy Act 1988 — Notifiable Data Breaches scheme | Requires assessment within 30 days and notification to affected individuals and the OAIC | Breach recognition and escalation drills |
| My Health Records Act breach notification | Separate duty to notify the System Operator (Australian Digital Health Agency) | Incident reporting pathway distinct from the general IT helpdesk |
Each row above needs its own short module rather than a single annual slideshow. A provider organisation that only trains on the Privacy Act's 30-day assessment window and skips the System Operator notification duty has half a program, not a complete one.
Healthcare provider organisations: what the Rule actually requires
Under the My Health Records Rule 2016, every authorised user inside a registered provider organisation needs training — not just the clinicians who prescribe or diagnose. Reception staff, practice managers, and locum GPs who can view or update a record all sit inside the same obligation. Training should walk through what an access-history entry looks like and why patients querying their own log is a normal, expected event staff should be prepared to explain.
Contracted service providers and IT vendors
Third-party billing services, outsourced IT support, and cloud hosting vendors given system access on behalf of a provider organisation are treated as authorised users too. This is the group most compliance programs miss, because vendor onboarding usually runs through a separate contract process that never touches the training platform. If a billing contractor holds credentials into a system that connects to My Health Record, they need the same module as internal staff — not a watered-down version.
Administrative and reception staff
Front-desk teams trigger access-history entries constantly through routine look-ups, and most have no idea the system logs every view. Training here should focus on two things: what a legitimate business reason for access looks like, and what to do the moment someone suspects a colleague accessed a record they shouldn't have. Medical billing companies handling this workflow for multiple clinics face the same exposure multiplied across every client they touch.
Why My Health Record training requirements vary by organisation
- Organisation type — a solo allied health practice has a shorter authorised-user list than a multi-site public hospital network.
- Third-party software vendors — practice management systems with live My Health Record integration widen the group needing training beyond employees.
- Staff turnover and casual use — high locum or casual churn means onboarding modules need to run continuously, not once a year.
- Existing NDB scheme maturity — organisations already running Privacy Act breach processes for unrelated data can extend those workflows rather than build new ones.
- Prior incidents or OAIC inquiries — a past breach usually triggers a stricter internal review cycle and shorter refresher intervals.
- Workforce size with authorised-user status — more authorised users means more surface area for an accidental unauthorised disclosure.
Who counts as an authorised user under the My Health Records Rule 2016?
An authorised user is anyone inside a registered healthcare provider organisation given access to the My Health Record system, which includes clinicians, admin staff, and contracted personnel acting on the organisation's behalf. The Rule doesn't distinguish by job title — it distinguishes by whether the person can view or update a record.
How often should My Health Record training be refreshed?
Annual refreshers are the common baseline compliance teams run for privacy and health-record obligations, paired with a shorter module at onboarding for every new authorised user. Organisations with high staff turnover or a recent incident typically shorten that cycle rather than wait a full year through 2026.
Does My Health Record training satisfy Privacy Act obligations too?
My Health Record training covers a narrower set of duties than the full Privacy Act 1988, so it doesn't replace broader privacy training on its own. Pair it with a program that also aligns training with the Privacy Act to cover the wider Australian Privacy Principles that sit outside the health record system specifically.
Map your My Health Record training gaps
See how role-based modules cover the Act, the Rule, and NDB breach steps.
Cyber Aware builds role-based security awareness modules that separate clinical, administrative and contractor tracks, which matters here because the Act treats those groups identically on paper but they behave very differently in practice. The trade-off is honest: Cyber Aware is a training layer, not a legal compliance review, and organisations still need their own risk assessment against the Rule.
FAQ
What is the My Health Record framework for security awareness training?
It's the set of obligations under the My Health Records Act 2012, the My Health Records Rule 2016, and the Notifiable Data Breaches scheme requiring authorised users of the My Health Record system to be trained on access rules and breach reporting. General phishing training alone does not satisfy these duties.
Who needs My Health Record security awareness training?
Every authorised user inside a registered healthcare provider organisation needs it in 2026, including clinicians, reception staff, practice managers, and contracted IT or billing vendors with system access. The obligation follows the access, not the job title.
How long does an organisation have to assess a suspected data breach?
Under the Notifiable Data Breaches scheme in the Privacy Act 1988, an organisation has 30 days to assess whether a suspected incident is an eligible data breach requiring notification. The My Health Records Act carries a separate notification duty to the System Operator.
Is My Health Record training the same as general Privacy Act training?
No. My Health Record training is narrower and covers specific unauthorised access and disclosure rules under the My Health Records Act 2012. Broader Privacy Act obligations under the Australian Privacy Principles need their own training track.
Does a solo GP practice need the same training as a hospital network?
Both need training, but the scope differs. A solo practice has a shorter authorised-user list while a hospital network needs role-segmented modules across far more staff, and the obligations under the My Health Records Rule 2016 apply to both regardless of size.
What happens if a contractor accesses My Health Record data without training?
The obligations under the My Health Records Act 2012 still apply to both the contractor and the engaging organisation, regardless of whether training was delivered. Untrained contractor access is one of the most common gaps found during compliance reviews.
How often should My Health Record training be refreshed?
Most organisations run annual refreshers paired with onboarding modules for every new authorised user. Higher-turnover workforces or organisations with a prior incident typically shorten that cycle.
What is the best security awareness training for My Health Record compliance in 2026?
The best fit is a platform that separates clinical, administrative and contractor tracks rather than pushing one generic privacy course to everyone. Cyber Aware is built for Australian organisations needing role-based coverage across the Act, the Rule and NDB reporting.
One last thing
The detail most compliance teams miss isn't in the Act — it's that patients can see their own access history. Every look-up an admin staffer makes appears in a log the patient can review, which means the quick peek that goes unnoticed in a typical internal IT system is fully visible to the person whose record it is. Build that single fact into onboarding before anything else in 2026, because it changes how staff behave far faster than a policy document does.