What's in this template?
This free Rule 42 policy template gives every registered My Health Record provider organisation the policy they are legally required to hold. It is built directly from the structure of the OAIC's official Rule 42 template and the Australian Digital Health Agency's published guidance, then tailored for use in an Australian medical practice or allied health service.
The template covers 14 sections plus a sign-off block:
- Purpose — links the policy to Rule 42 of the My Health Records Rule 2016 and section 73 of the My Health Records Act
- Scope — every worker, every system, every access pathway (clinical software, NASH PKI, mobile, remote)
- Legislative and regulatory framework — table of every Act, Rule and scheme that applies
- Roles and responsibilities — Responsible Officer, authorised users, all workers
- Authorising, reviewing and removing access — same-day removal when workers leave
- Identification, authentication and access controls — passwords, MFA, screen lock, NASH certificate handling
- Physical and technical security — server, workstation, paper, backup, audit logging
- Mobile devices and remote access — BYOD rules, lost device reporting
- Training and awareness — links to the Staff Training and Awareness Procedure
- Detecting, reporting and managing breaches — 1-hour reporting, System Operator and OAIC notification
- Audit, monitoring and oversight — quarterly audit log review and 2-yearly policy review
- Related documents — cross-references to your other compliance documents
- Definitions — HPI-O, HPI-I, IHI, NASH, Responsible Officer, System Operator
- Approval and review — formal sign-off table
Editable placeholder fields
{{practice_name}},{{abn}},{{hpi_o}},{{practice_address}},{{phone}},{{email}}{{responsible_officer}}— the person named to the Australian Digital Health Agency{{clinical_software}}— your conformant clinical system (Best Practice, Medical Director, etc.){{access_review_frequency}}— e.g., quarterly, every 6 months{{it_support_contact}},{{training_records_owner}}{{review_date}},{{next_review_date}}
Who needs a Rule 42 policy?
A documented Security and Access Policy is mandatory for every organisation registered to the My Health Record system, regardless of size. That includes:
- General practices of any size, including solo GPs
- Specialist medical practices registered to the system
- Allied health practices (physiotherapy, podiatry, psychology, etc.) connected via conformant software
- Pharmacies dispensing prescriptions through My Health Record
- Aboriginal Community Controlled Health Organisations
- Private hospitals and day surgeries registered to the system
- Pathology and diagnostic imaging providers uploading results
If you have a Healthcare Provider Identifier — Organisation (HPI-O) and a NASH PKI certificate, this policy applies to you.
Rule 42 at a glance
Rule 42 of the My Health Records Rule 2016 requires every registered provider organisation to have a written policy that addresses, at a minimum:
- How authorised users are nominated and managed
- How users are identified and authenticated when they access the system
- The physical, technical and procedural safeguards in place
- How the organisation trains and maintains the awareness of users
- How the organisation detects, reports and manages potential security breaches
- How access is suspended or removed
- How compliance with the policy is monitored
This template covers each of those requirements in the order an auditor will look for them, with editable placeholders so the policy reflects your specific practice rather than a generic stock document.
My Health Records Act requirement
The legal force behind Rule 42 comes from section 73 of the My Health Records Act 2012, which requires registered healthcare provider organisations to have, comply with, and enforce a policy of this kind. Failure to have a compliant policy is a breach of registration conditions and can result in:
- Suspension or cancellation of My Health Record system registration
- Civil penalties under the Act
- Reputational damage if a breach occurs without an adequate policy in place
The Australian Digital Health Agency, as System Operator, may at any time request a copy of your policy as part of compliance monitoring or in response to an incident. Practices that complete RACGP accreditation are also typically asked to evidence a Rule 42 policy under criterion C6.4 (Information security).
How to customise this template
- Download the Word document and replace every
{{placeholder}}with your details - Nominate your Responsible Officer — typically the practice principal, practice manager, or a senior clinician
- Confirm your HPI-O and NASH PKI certificate location with your practice manager or IT contact
- Tailor section 6 (Identification and authentication) to match how your conformant software actually works
- Set your access review cadence in section 5 — quarterly is good practice for most practices
- Have it approved by the Responsible Officer and signed in the approval table at the back
- Communicate it to all authorised users and require them to sign the Staff Training and Awareness Procedure acknowledgement
- Schedule the next review — at least every 2 years, or sooner if your software, processes or the legislation change
Related templates and tools
This policy is the foundation document. Pair it with the two procedures that bring it to life:
- My Health Record Staff Training and Awareness Procedure — the Rule 42(2)(a) training procedure with a built-in training register
- My Health Record Emergency Access Procedure — when and how clinicians may access a record under section 64 without consent
For broader information security obligations, see the Computer and Information Security Policy and the Privacy Policy in the RACGP library.
Frequently asked questions
Is a My Health Record Security and Access Policy mandatory?
Yes. Rule 42 of the My Health Records Rule 2016, made under section 73 of the My Health Records Act 2012, requires every registered healthcare provider organisation participating in the My Health Record system to have a documented security and access policy. This applies to solo practitioners as well as larger organisations. The Australian Digital Health Agency, as System Operator, may request a copy at any time.
What is Rule 42?
Rule 42 is the part of the My Health Records Rule 2016 that prescribes the minimum content of every registered provider's security and access policy. It covers user authorisation, authentication, training, physical and technical security, breach handling, and access removal. A policy that does not address every Rule 42 matter is not compliant.
Who is the Responsible Officer?
The Responsible Officer is the person nominated by the organisation to be the contact point for the Australian Digital Health Agency on My Health Record matters. They are accountable for approving the security and access policy, authorising users, ensuring training is delivered, and managing breaches. In a small general practice this is usually the practice principal or practice manager. The Responsible Officer is named at registration and updated through the Healthcare Identifiers Service.
What are the penalties for not having a Rule 42 policy?
The most common consequence is suspension or cancellation of My Health Record system registration. The Act also provides for civil penalties, and unauthorised access by a worker (which is more likely without a clear policy) can attract criminal penalties of up to 2 years' imprisonment under sections 59 to 62 of the Act. Practices undergoing accreditation may also fail evidence requirements under RACGP criterion C6.4.
How often does the policy need to be reviewed?
The Australian Digital Health Agency expects the policy to be reviewed at least every two years, and immediately whenever there is a material change — a new clinical software system, a change to the legislation or rule, a breach, or a change of Responsible Officer. The template includes a built-in review schedule.
Does this policy replace our broader privacy policy?
No. The Rule 42 policy is specific to the My Health Record system. You still need a general Privacy Policy covering the Australian Privacy Principles (APPs) and a Computer and Information Security Policy. The three documents reference each other and form your overall information governance set. ClinicComply provides templates for all three.
Is this policy enough on its own to comply with Rule 42?
The policy is the cornerstone, but Rule 42(2)(a) also requires a training procedure for authorised users. Most practices pair this Security and Access Policy with the Staff Training and Awareness Procedure (downloadable separately) so the training, knowledge check and refresher cadence are documented as well.
Can a sole-trader GP use this template?
Yes. The Australian Digital Health Agency's own sole-trader guidance is built on the same Rule 42 framework — only the scale of the safeguards changes. A solo practitioner is both the Responsible Officer and the only authorised user, so several sections collapse to single-person responsibilities, but every Rule 42 topic still has to be covered. This template is structured so you can simply remove sections that do not apply (e.g., reviews of multiple users) and keep the rest.