Key Takeaways
- From 1 July 2026, prescribed providers must upload written pathology and diagnostic imaging reports to My Health Record by default, unless one of four exceptions applies.
- Penalties bite: failing to register carries 250 penalty units ($82,500), failing to upload 30 penalty units ($9,900) per instance, and failing to keep exception records 10 penalty units ($3,300). The Commonwealth penalty unit is $330 and indexes on 1 July 2026, so dollar values rise slightly from that date.
- On top of civil penalties, the Commonwealth can recover the Medicare benefit paid for a non-compliant service as a debt owed by the provider.
- Four exceptions allow withholding a report (no My Health Record, patient request, clinical discretion, technical impossibility), but each must be documented and retained for 2 years or face the $3,300 penalty.
- Providers who cannot meet the deadline can apply for an extension; applications opened in March 2026, and you must have an in-progress or approved application in place by 1 July 2026 to avoid penalties.
- Phase 1 covers written reports authored by a pathologist or radiologist, not the underlying images. Patients can still ask for a specific result not to be uploaded.
- "Faster Access" is already live: since 13 October 2025 most pathology reports are viewable by patients immediately, so review how your practice communicates results before patients see them.
From 1 July 2026, prescribed healthcare providers must upload written pathology and diagnostic imaging reports to My Health Record by default under the Modernising My Health Record (Sharing by Default) Act 2025. Uploading is no longer optional: reports must be shared unless a documented exception applies, and non-compliance carries civil penalties and Medicare recovery. Here is what changes and what to do before the date.
What is changing on 1 July 2026?
Under the current model, uploading pathology and diagnostic imaging reports to My Health Record is voluntary. Around 75% of reports are already uploaded, but there is no legal obligation. That changes on 1 July 2026, when the Modernising My Health Record (Sharing by Default) Act 2025 flips the default: reports must be uploaded unless a specific exception applies, and every opt-out decision must be documented and retained for two years.
Phase 1 covers written pathology reports (blood tests, urine tests, anatomical pathology, cytopathology, genetic testing) and written diagnostic imaging reports (X-rays, CT, MRI, PET, mammograms, ultrasounds). The actual images are not included, only the written reports. The Australian Digital Health Agency's Better and Faster Access program page sets out the scope and the conformance work software vendors must complete. The government has flagged that expansion beyond pathology and imaging is being explored, but no additional document types have been confirmed.
Who must comply with sharing by default?
The mandatory upload obligation in Phase 1 applies directly to pathology laboratories and diagnostic imaging providers that are constitutional corporations, the organisations producing the reports, rather than the GP or specialist who ordered the test. If your practice operates its own pathology collection or imaging service, you may fall within scope.
General practices are still affected operationally even when not directly bound. Your patients will ask why results appear in their record, your clinical software needs to be configured correctly, and results will flow into patients' My Health Records faster than before. Referring providers also need to understand the exceptions framework, because patients have the right to request that specific results are not uploaded, and you may need to facilitate those conversations. The Digital Health Agency provides an interactive assessment tool to help providers determine whether their services fall under the upload requirements, which is worth working through if you are unsure.
What are the penalties for non-compliance?
This is not a framework without teeth. The Act introduces three tiers of civil penalty, expressed in penalty units. At the current Commonwealth penalty unit value of $330, the dollar amounts are:
| Breach | Penalty units | Current value | Notes |
|---|---|---|---|
| Failing to register with My Health Record when required | 250 units | $82,500 | One-off registration obligation |
| Failing to upload a report as required by the rules | 30 units | $9,900 | Per instance |
| Failing to keep records of an exception relied on | 10 units | $3,300 | Records retained for 2 years |
The penalty unit indexes on 1 July 2026 under the Crimes Act 1914 formula, so these dollar figures rise slightly from that date, although the unit counts (250, 30, 10) do not change. On top of civil penalties, if a report is not uploaded and no valid exception applies, the Commonwealth can pursue the Medicare benefit paid for that service as a debt owed by the provider. The patient's Medicare entitlement is not affected; the recovery comes from the provider. Enforcement begins once the Share by Default Rules commence, with an initial grace period whose exact length has not been publicly specified.
What are the four exceptions to mandatory upload?
Not every report must be uploaded. The Act provides four exceptions where a provider is not required to share a report.
The first is that the patient does not have a My Health Record. If a patient has cancelled their record or never had one, there is nothing to upload to. The second is patient preference: if a patient or their authorised representative requests that a specific report not be uploaded, the provider must honour that request. This is particularly relevant for sensitive results. Organisations like ASHM have raised concerns that mandatory upload of HIV, hepatitis B and C, and STI results makes them visible to all providers with record access, so clinicians in sexual health, mental health and other sensitive areas should proactively inform patients of their right to withhold. The third is clinical discretion: where a provider has a reasonable concern about the patient's health, safety or wellbeing (domestic violence is the obvious example), they may withhold the upload. The fourth is practical or technical impossibility, covering system outages or technical failures.
For every exception relied upon, the provider must retain a record with supporting evidence for two years from the date of service. If you rely on an exception and cannot produce evidence within that window, you face the separate $3,300 penalty. Build a consistent documentation process now.
What can patients still control?
Patients retain meaningful control under the new model, and your front desk should be ready to answer questions. Patients can request that a specific report not be uploaded before it is shared. Once a report is uploaded, patients can restrict access to specific documents, lock their entire record, hide individual documents, or remove documents entirely. They can also control which provider organisations can see their record, and they can cancel their My Health Record altogether, which permanently deletes all information including backups.
For post-upload concerns, such as wanting a document removed after it has been shared, the My Health Record Helpline on 1800 723 471 handles those requests. The Digital Health Agency publishes consumer fact sheets that practices can distribute, and the Office of the Australian Information Commissioner sets out patients' privacy rights over My Health Record information. Make sure clinical and reception staff understand these rights well enough to answer basic questions or direct patients to the right resource.
Is Faster Access already in effect?
Yes. While the mandatory upload obligation starts on 1 July 2026, the "Faster Access" component is already live. Since 13 October 2025, most pathology reports have been viewable by patients immediately upon upload, replacing the previous 7-day delay. As of 5 March 2026, diagnostic imaging reports for limb X-rays are also viewable immediately, while other imaging reports (CT, MRI, PET, mammograms, ultrasounds) now have a 5-day delay, down from seven.
This matters for clinical workflows. If your practice orders pathology or imaging, patients may see results before you have reviewed them and provided clinical context. Consider how your practice handles result communication, whether patients are warned that they may see results first, and how your recall and reminder system accounts for patients accessing results independently through My Health Record.
Who can apply for an extension and how?
Providers who cannot comply by 1 July 2026, typically because their software is not yet conformant, may be eligible to apply for an extension of time. Applications opened in March 2026 and are made to the Australian Digital Health Agency. The key compliance point is timing: if you are not complying from 1 July 2026 and do not have an in-progress or approved extension application in place, you may be subject to civil penalties and Medicare benefit recovery for services performed after that date. An in-progress application is your safe harbour, so lodge early rather than waiting.
When assessing an application, the Agency is required to consider the provider organisation's size and technological readiness, the potential disruption to the provision of healthcare, and any other matters it considers relevant. To prepare an application, confirm with your clinical or laboratory software vendor whether and when their My Health Record upload capability will be conformant, document the gap and your remediation timeline, and gather evidence of the disruption that immediate compliance would cause. The extensions process FAQ on the Digital Health Agency site sets out the current process, or contact the Agency on 1300 901 001. Even if you expect to be conformant, confirm the go-live date in writing so you are not caught by a slipped vendor timeline.
What should your practice do before 1 July 2026?
- Confirm your software is configured to upload. The major Australian clinical systems (Best Practice, Medical Director, Genie, Zedmed) have My Health Record integration, but it must be enabled and correctly configured. Confirm the status in writing with your vendor.
- Update your health records management policy to reflect Share by Default: how exceptions are documented, how patient withholding requests are recorded, and the two-year retention period for exception records.
- Update your privacy policy and patient-facing notices to state that pathology and imaging results are shared by default and that patients can request specific results be withheld.
- Train your staff. Front desk, nursing and clinical staff all need to understand what is uploaded, when patients can opt out, how to document an exception, and where to direct patient questions. Add it to your staff training processes.
- Lodge an extension application if you cannot meet the deadline. Make sure an in-progress application is in place before 1 July 2026.
- Review result-communication workflows so patients seeing results first does not create clinical risk.
This change shares its commencement date with several others. Our Medicare changes 1 July 2026 guide covers the full list landing the same day, including MBS indexation and the new assignment of benefit process.
How does sharing by default interact with the Privacy Act?
The Share by Default framework sits alongside your existing obligations under the Privacy Act 1988 and the My Health Records Act 2012; it does not replace them. Once information is uploaded to My Health Record, the My Health Records Act governs its use and disclosure within that system. But once information is downloaded from My Health Record into a local clinical system, the My Health Records Act no longer applies, and the Privacy Act and any applicable state or territory health information laws take over. Your practice's privacy obligations have not decreased; they have expanded.
If your practice suffers a data breach involving My Health Record information, you must notify both the OAIC and the Australian Digital Health Agency as soon as practicable, and the notifiable data breach obligations apply in full. Treat My Health Record data with the same security controls and breach-response discipline as the rest of your clinical information holdings.
Frequently Asked Questions
When does mandatory pathology and imaging upload start?
From 1 July 2026, prescribed providers must upload written pathology and diagnostic imaging reports to My Health Record by default under the Modernising My Health Record (Sharing by Default) Act 2025. Phase 1 covers written reports authored by a pathologist or radiologist, not the underlying images. Uploading is required unless one of four exceptions applies, and each exception must be documented and retained for two years.
Who must comply with sharing by default?
In Phase 1, the direct obligation falls on pathology laboratories and diagnostic imaging providers that are constitutional corporations, the organisations producing the written reports. GPs and specialists who order tests are affected operationally rather than directly: patients will ask about results, clinical software must be configured correctly, and referring providers must facilitate patient requests to withhold specific results. Practices that run their own pathology collection or imaging may fall directly within scope.
What are the penalties for not uploading to My Health Record?
Failing to register carries 250 penalty units ($82,500), failing to upload a required report carries 30 penalty units ($9,900) per instance, and failing to keep records of an exception carries 10 penalty units ($3,300). The Commonwealth penalty unit is $330 and indexes on 1 July 2026. Separately, the Commonwealth can recover the Medicare benefit paid for a non-compliant service as a debt owed by the provider.
Who can apply for an extension and how do I apply?
Providers unable to comply by 1 July 2026, usually because their software is not conformant, can apply to the Australian Digital Health Agency for an extension. Applications opened in March 2026. You must have an in-progress or approved application in place by 1 July 2026 to avoid penalties. The Agency considers your organisation's size, technological readiness and the potential disruption immediate compliance would cause. Lodge early rather than waiting.
Can patients still ask for a result not to be uploaded?
Yes. Patient request is one of the four exceptions: if a patient or their authorised representative asks that a specific report not be uploaded, the provider must honour it. This is particularly important for sensitive results such as sexual health, mental health and genetic testing. Patients can also restrict, hide or remove documents after upload, control which providers see their record, or cancel their My Health Record entirely.
What must I confirm with my clinical software vendor?
Confirm in writing whether your clinical or laboratory software can upload pathology and imaging reports to My Health Record, whether that capability is conformant with the Share by Default requirements, and the exact go-live date. If the capability will not be ready by 1 July 2026, that is the basis for an extension application. Do not assume the feature is enabled; configuration and conformance are separate from having the integration available.