My Health Record in general practice

Consumer controls

Last revised: 18 Apr 2023

Consumer controls

Consumers can

  • cancel their My Health Record
  • add a nominated representative to help manage their My Health Record
  • ask healthcare providers to not add certain information to their My Health Record 
  • restrict access to their My Health Record, or specific documents within their record 
  • remove or hide certain documents from view
  • track how others have accessed and edited their My Health Record
  • choose to not share their My Health Record information for public health and research purposes.

Consumers cannot

  • alter the content of clinical documents in their My Health Record
  • restrict specific healthcare providers within a particular healthcare organisation from accessing their My Health Record information (consumers can only restrict access tof all providers within a particular healthcare organisation)
  • restrict access to specific documents within their My Health Record including Shared Health Summaries, Personal Health Summaries and/or advance care planning information. Consumers can, however, choose to remove all of these documents from view entirely.

Once a My Health Record is cancelled, it is permanently deleted. It can no longer be viewed or accessed by anyone and information that was held within the record cannot be recovered.

If a consumer who is a nominated representative for another My Health Record holder deletes their own record, some identifying information will be kept so that they can continue to exist on the record of the person that they are a representative for.

Healthcare providers are not notified when a My Health Record of a consumer they are providing care for is cancelled.

A nominated representative is a person invited by a consumer (or the consumer’s authorised representative) to access and help manage their record.

Nominated representatives can include a consumer’s family members, close friends or carer. No matter who the nominated representative is, they must act in accordance with the consumer’s preferences.

Nominated representatives can be removed from a record at any time and will no longer have access to the record.

A My Health Record may be managed by an authorised representative where a person is not able to manage their own record and make decisions for themselves. An authorised representative may be a parent, carer, family member, legal guardian or someone with enduring power of attorney. Most authorised representatives are parents who are managing a record for a child under 14.

Representatives can be added to a My Health Record via the ‘Privacy & Access’ tab. For more information on authorised representatives, visit the Australian Digital Health Agency’s Authorised representatives webpage. 

Under the My Health Records Act, healthcare provider organisations are authorised to upload information to the system. This means that, subject to the situations described below, there is no requirement for a healthcare provider to obtain consent prior to uploading clinical information. There is also no requirement for the consumer to review clinical information prior to it being uploaded.

It is considered good clinical practice to advise a patient that you will be uploading information to their record, particularly if this information might be considered sensitive. 

Consumers can ask a healthcare provider not to upload particular documents or information to their My Health Record and the healthcare provider must comply with the request. 

Consumers can set a 4-8-digit Record Access Code (RAC) to restrict access to their My Health Record. The consumer can then relay this code to specific healthcare providers of their choice, allowing them to access their record.

Consumers can also restrict access to specific documents contained within their record by setting a Limited Document Access Code (LDAC). Some documents in My Health Record cannot have restricted access, including Shared Health Summaries, Personal Health Summaries and advance care planning documents. 

RACs and LDACs can be set up by consumers in the ‘Privacy and access’ section of their My Health Record. 

Consumers can hide documents from view, meaning that they cannot be seen by any healthcare provider accessing their record. These documents can be reinstated at any time. 

Consumers also have the option to remove documents, which permanently deletes them from their My Health Record. 

Each time a consumer’s My Health Record is accessed or updated by a healthcare provider, nominated representative or authorised representative, their details and information on what they did in the record is added to the ‘Access history’ section of the My Health Record. 

Details displayed in the ‘Access history’ section include:

  • the time and date of access
  • which healthcare organisation or authorised person accessed the record
  • the action that was taken on the record (e.g., retrieve medicines information)
  • details of the consumer’s access to their own record. 

Consumers can choose to receive notifications by email or via SMS when:

  • their My Health Record is accessed
  • certain records are updated
  • their immunisation information changes
  • a new myGov account is linked to their record.

If consumers are concerned about something in their access history, they can contact the My Health Record help line on 1800 723 471. 

Consumers can choose to opt out of sharing their de-identified My Health Record data for research and public health purposes via the ‘Profile and settings’ section of their My Health Record.