My Health Record sharing by default: what changed for designers

9 July 2026

Patient portal & EHR Trust, Ethics & Safety Clinical vs Patient Interfaces

A 2025 law flips My Health Record from opt-in to opt-out sharing. The legal change is settled; what it means is that consent and notice now have to be carried by the interface, not by a one-time enrolment step.

Not legal advice This article describes a piece of legislation for design education. It is not legal advice. Compliance dates, exceptions and penalty amounts should be checked against the current law before being relied on.

The Health Legislation Amendment (Modernising My Health Record - Sharing by Default) Act 2025 received Royal Assent on 14 February 2025, and it changes the starting position of Australia's national health record system: instead of information being uploaded only when a provider or patient actively chooses to share it, key categories of health information are now uploaded by default, with patients retaining the right to opt out.

From opt-in workflow to opt-out design

Under the previous model, sharing was something a provider or patient had to actively choose, which put the consent decision at a single, visible moment. Under sharing by default, the decision point moves: the default action is now sharing, and the design burden moves with it, from a one-time enrolment screen to an ongoing, always-available way to say no. A system built around "ask once, then forget" no longer matches how the law works. Patients need to be able to find and act on an opt-out at any time, not only when a form happens to appear.

What is covered, and what is not

The Act names pathology and diagnostic imaging providers and services as the first category required to share by default, with other categories to be added over time by ministerial upload rules; in January 2026 the government flagged medicines information from online prescribing services as the next category expected to be added. Registered healthcare providers keep some discretion not to upload a specific item where there is a reasonable health, safety or wellbeing concern - which is itself a design problem, since a provider needs a clear, fast way to exercise that discretion in the moment, not a buried settings page.

The compliance mechanism

The Act gives the requirement real weight rather than leaving it as guidance. Where a provider fails to upload required information without a valid exception, the Commonwealth can pursue the Medicare benefit paid for that service as a debt. Separate civil penalties apply for related failures: up to 250 penalty units (about $82,500) for failing to register, 30 penalty units (about $9,900) for not complying with upload rules, and 10 penalty units (about $3,300) for failing to keep records of an exception used. Providers who are not participating are also required to display a notice saying so in a prominent location - a small but real interface requirement in its own right, whether that notice lives on a website, in a waiting room, or both.

What changed for patients, in practice

A related, earlier change gives a sense of what "by default" looks like once it reaches patients. From October 2025, most pathology reports uploaded to My Health Record became viewable by patients as soon as they were uploaded, replacing what had been a 7-day delay (a small number of categories, including anatomical pathology and genetic tests, kept a 5-day delay). The Australian Digital Health Agency reported that in the week after that change, consumer views of pathology and imaging reports on My Health Record rose 433 percent and provider uploads rose 105 percent - a large, fast shift in how much information reaches a patient's own screen, and how soon.

What this means for design teams

Design the opt-out as a persistent, findable action, not a one-time consent screen. Sharing by default means a patient can arrive at any point in their care already opted in without having made an active choice.
Give providers a fast, low-friction way to record a health/safety exception at the point of care, since the discretion not to upload only works for patients if it is realistic for staff to use it under time pressure.
Plan for a non-participation notice as a real interface element, not an afterthought, wherever a provider's own site or portal represents them.
Expect the scope to expand. The Act's category list is designed to grow (medicines information was already flagged as next); a product that assumes today's categories are final will need revisiting.

Funding, as a dated footnote The 2026-27 Federal Budget allocated $598.3 million over two years to My Health Record, including $47.5 million specifically to deliver further phases of Sharing by Default. This is cited here only as a dated marker of the reform's continued rollout, not as evidence of any particular design outcome.