The way pathology and diagnostic imaging results flow into My Health Record is about to change fundamentally. The Modernising My Health Record (Sharing by Default) Act 2025 received Royal Assent on 14 February 2025, and from 1 July 2026, prescribed healthcare providers will be legally required to upload pathology and diagnostic imaging reports to My Health Record by default. This is not optional. Providers who fail to comply face civil penalties, and in some cases, the Commonwealth can recover Medicare benefits paid for non-compliant services.
If your practice orders pathology or imaging, or if you operate a pathology lab or imaging centre, the new rules affect how your results are handled, how your patients are informed, and what documentation you need to keep. Here is what you need to know and what to do before the deadline.
What Is Changing
Under the current model, uploading pathology and diagnostic imaging reports to My Health Record is voluntary. Around 75% of reports are already being uploaded, but there is no legal obligation to do so. That changes on 1 July 2026.
The new Share by Default model flips the default position. Instead of providers choosing to upload, reports must be uploaded unless a specific exception applies. The burden shifts from opting in to actively opting out, and every opt-out decision must be documented and retained for two years.
Phase 1 covers written pathology reports (blood tests, urine tests, anatomical pathology, cytopathology, genetic testing) and written diagnostic imaging reports (X-rays, CT, MRI, PET, mammograms, ultrasounds). The actual images are not included, only the written reports. The government has flagged that expansion beyond pathology and imaging is being explored, but no additional document types have been confirmed yet.
Who Must Comply
The mandatory upload obligation in Phase 1 applies directly to pathology laboratories and diagnostic imaging providers that are constitutional corporations. These are the organisations producing the reports, not the GP or specialist who ordered the test.
That said, general practices are not off the hook. If your practice operates its own pathology collection or imaging services, you may fall within scope. More broadly, practices need to understand the changes because your patients will be asking questions, your clinical software needs to be configured correctly, and the results flowing into your patients' My Health Records will be visible faster than before. GPs and specialists who order tests should also be aware that the exceptions framework gives patients the right to request that specific results are not uploaded, and referring providers may need to facilitate those conversations.
The Australian Digital Health Agency has published an interactive assessment tool to help providers determine whether their services fall under the upload requirements. If you are unsure whether your practice is in scope, that tool is worth working through.
The Penalties Are Real
This is not a framework with aspirational guidelines and no teeth. The Act introduces three tiers of civil penalty for non-compliance.
Failing to register with My Health Record when required carries a penalty of 250 penalty units, which at the current rate of $330 per unit equates to $82,500. Failing to upload information as required by the Share by Default Rules carries a penalty of 30 penalty units, or $9,900 per instance. Failing to keep records of exceptions (more on that below) carries a penalty of 10 penalty units, or $3,300.
On top of civil penalties, if a report is not uploaded and no valid exception applies, the Commonwealth can pursue the Medicare benefit paid for that service as a debt owed by the provider. The patient's Medicare entitlement is not affected. The recovery comes from the provider's end.
Enforcement will begin once the Share by Default Rules formally commence, with an initial grace period. The exact length of that grace period has not been publicly specified, but the legislation is clear that this is a compliance obligation with financial consequences, not a suggestion.
The Exceptions Framework
Not every report must be uploaded. The Act provides four exceptions where a provider is not required to share a report to My Health Record.
The first is straightforward: the patient does not have a My Health Record. If a patient has cancelled their record or never had one created, there is nothing to upload to.
The second is patient preference. If a patient or their authorised representative requests that a specific report not be uploaded, the provider must honour that request. This is particularly relevant for sensitive health information. Organisations like ASHM (the Australian Society for HIV, Hepatitis and Sexual Health Medicine) have raised concerns that mandatory upload of results for HIV, hepatitis B and C, and STI testing means those results become visible to all healthcare providers with access to the patient's record, not just the treating specialist. Clinicians working in sexual health, mental health, and other sensitive areas should proactively discuss these changes with patients and inform them of their right to request that specific results be withheld.
The third exception is clinical discretion. If a provider has a reasonable concern about the patient's health, safety, or wellbeing, they may withhold the upload. Domestic violence situations are the obvious example, where making health information broadly accessible could put a patient at risk.
The fourth is practical or technical impossibility, covering situations like system outages or technical failures that prevent uploading.
For every exception relied upon, the provider must retain a record with evidence supporting the exception for two years from the date the service was provided. This is not a "tick a box and move on" requirement. If your practice relies on an exception and cannot produce evidence of it within that two-year window, you face a separate penalty of $3,300. Building a consistent process for documenting exceptions now will save significant headaches later.
What Patients Can Control
Patients retain meaningful control over their My Health Record under the new model, and your practice should be prepared to answer questions about these rights.
Patients can request that a specific pathology or imaging report not be uploaded before it is shared. Once a report has been uploaded, patients can restrict access to specific documents, lock their entire record, hide individual documents, or remove documents entirely. Patients can also control which healthcare provider organisations can see their record. If a patient wants to cancel their My Health Record altogether, that option remains available, and it results in permanent deletion of all information including backups.
For post-upload concerns, such as a patient wanting a document removed after it has already been shared, the My Health Record Helpline on 1800 723 471 handles those requests.
Your front desk and clinical staff should understand these patient rights well enough to answer basic questions or direct patients to the right resources. The Australian Digital Health Agency provides consumer fact sheets that practices can distribute.
Faster Access Is Already Live
While the mandatory upload obligation does not start until July 2026, the "Faster Access" component of the reforms is already in effect. Since 13 October 2025, most pathology reports have been viewable by patients immediately upon upload, replacing the previous 7-day delay. As of 5 March 2026, diagnostic imaging reports for limb X-rays are also viewable immediately, while other imaging reports (CT, MRI, PET, mammograms, ultrasounds) now have a 5-day delay, down from seven.
This matters for clinical workflows. If your practice orders pathology or imaging, your patients may see results before you have had a chance to review them and provide clinical context. Consider how your practice handles result communication and whether your current process accounts for patients accessing results independently through My Health Record.
What Your Practice Should Do Now
Even if your practice is not directly subject to the mandatory upload obligation in Phase 1, there are practical steps worth taking before July 2026.
First, confirm your clinical software is configured to upload to My Health Record. The major Australian clinical systems (Best Practice, Medical Director, Genie, Zedmed) all have My Health Record integration capability, but it needs to be enabled and correctly configured. Check with your software vendor if you are unsure.
Second, review your health records management policy to ensure it reflects the new Share by Default obligations. Your policy should address how exceptions are documented, how patient requests to withhold reports are recorded, and what your retention period is for exception records. If your practice does not have a health records management policy, now is the time to put one in place.
Third, update your privacy policy and patient-facing privacy notices to reflect that pathology and imaging results will be shared to My Health Record by default, and to inform patients of their right to request specific results be withheld.
Fourth, train your staff. Front desk, nursing, and clinical staff all need to understand the basics: what is being uploaded, when patients can opt out, how to document an exception, and where to direct patients with questions. Your staff training and orientation processes should include My Health Record obligations as a standing item.
Fifth, if your practice falls within scope and you are not confident you can meet the July 2026 deadline, extension applications are expected to open in March 2026. The Digital Health Agency will consider factors including organisation size, technological readiness, and potential healthcare disruption when assessing applications.
How This Connects to Your Existing Privacy Obligations
The Share by Default framework sits alongside your existing obligations under the Privacy Act 1988 and the My Health Records Act 2012. It does not replace them.
Once information is uploaded to My Health Record, the My Health Records Act governs its use and disclosure within that system. But once information is downloaded from My Health Record to a local clinical system, the My Health Records Act no longer applies. From that point, the Privacy Act and any applicable state or territory health information laws take over. Your practice's privacy obligations have not decreased; they have expanded.
If your practice suffers a data breach involving My Health Record information, you must notify both the OAIC and the Australian Digital Health Agency as soon as practicable. The mandatory data breach notification obligations apply in full.
Stay Ahead of the Deadline
The July 2026 deadline will arrive quickly, and the practices that prepare early will avoid the last-minute scramble that typically follows a new compliance obligation. Whether your practice is directly in scope for Phase 1 or preparing for future expansion of the Share by Default model, getting your policies, systems, and staff training aligned now is the practical approach.
ClinicComply helps Australian medical practices track compliance obligations across frameworks including the Privacy Act, RACGP Standards, and My Health Record requirements. Our template library includes ready-to-use policy documents for health records management, privacy, and staff training, all aligned to current Australian regulatory requirements. Start your free trial at cliniccomply.com.au and get your practice organised before the new rules take effect.