Byteway helps Australian clinics keep their systems secure and compliant, and 2026 has given practice managers a fresh reason to check both. New “Share by Default” rules now require more health information to flow into My Health Record automatically. The change is real, but it is also widely misunderstood, and getting the scope right matters before you change anything in your practice.
From 1 July 2026, the Share by Default rules require pathology and diagnostic imaging reports to be uploaded to My Health Record by default, unless an exception applies. The direct legal obligation falls mainly on pathology and diagnostic imaging providers, not every GP. But all clinics are affected in practice, through workflows, patient questions, in-house diagnostics, and the security of more data moving between systems. It is a data-sharing reform with real compliance levers, not a licence to share everything.
What actually changed on 1 July 2026?
The Health Legislation Amendment (Modernising My Health Record — Sharing by Default) Act 2025 established a framework for key health information to be shared to My Health Record by default. <cite index=”22-1″>From 1 July 2026, pathology and imaging reports authored by, or on behalf of, a pathologist or radiologist must be uploaded to My Health Record, unless an exception applies.</cite>
This is phase one. It covers written pathology reports and written diagnostic imaging reports, not the actual images. The government has flagged that expansion to other information, such as medicines information from online prescribers, is being consulted on, but nothing beyond pathology and imaging is confirmed.
The change has teeth. <cite index=”24-1″>From 1 July 2026, pathology and imaging providers have been required to upload reports to My Health Record by default, backed by a real compliance lever: Medicare benefits can be withheld, and civil penalties can apply, for non-compliance.</cite>
Who does the obligation actually fall on?
This is where a lot of commentary overstates things. The direct upload obligation applies to pathology laboratories and diagnostic imaging providers that are constitutional corporations. For most GP clinics, the direct legal duty is limited, unless the practice runs its own in-house pathology collection or imaging service, which does fall squarely in scope.
What every clinic should do now?
Even where the direct obligation sits elsewhere, the practical effects reach every practice:
- Review your results and recall workflows. More results are now visible to patients, often immediately, so how and when you communicate them matters more.
- Brief reception and clinical staff. Patients will ask what is shared, who sees it, and how to opt a report out. Staff should be able to answer or direct them.
- Counsel patients on their rights. Patients can request a report not be uploaded, or have one removed after the fact via the My Health Record Helpline.
- Check any in-house diagnostics. If you run pathology collection or imaging, confirm your compliance directly.
- Secure the data flow. More information moving between your clinical software and My Health Record raises the stakes on system security and interoperability.
Why this is also a security question?
More health data flowing automatically between systems is good for patient care and raises the bar on security at the same time. Your clinical software needs to be conformant and current, your integrations need to work reliably, and the sensitive information passing through needs protecting.
This lands in the same year Australian healthcare suffered major breaches, a reminder that clinics are prime targets because of the data they hold. As a health service provider you are covered by the Privacy Act regardless of turnover, and APP 11 requires you to take reasonable steps to secure personal information. Sharing more data by default does not change that duty; it makes it more important. If a breach occurs, the Notifiable Data Breaches scheme applies.
Byteway Expert Insight
The clinics handling this well are not treating it as a box-tick. They are using it as a prompt to check the systems underneath: is the clinical software current and conformant, are the integrations secure, is access controlled, are backups tested, and is there a plan if something goes wrong. The reform pushes more sensitive data through your systems automatically, so the quality of those systems now matters more than it did last year. The compliance sits partly with your pathology and imaging providers. The security of your own practice sits entirely with you.
How Byteway helps
- We review your clinical systems for security, currency and safe integration with My Health Record.
- We apply the APP 11 security baseline: MFA, access control, encryption, tested backups, monitoring.
- We connect it to your broader managed IT and cyber security, so compliance is maintained, not one-off.
FAQs
What are the Share by Default rules?
Rules under the Modernising My Health Record (Sharing by Default) Act 2025 requiring pathology and diagnostic imaging reports to be uploaded to My Health Record by default from 1 July 2026, unless an exception applies.
Does this apply to all patient data?
No. Phase one covers written pathology and diagnostic imaging reports only, not images or all clinical records. Expansion is being consulted on but not confirmed.
Who has to comply?
Mainly pathology and diagnostic imaging providers that are constitutional corporations. GP clinics with in-house diagnostics are in scope; others are affected indirectly.
What happens for non-compliance?
Medicare benefits can be withheld for certain services where required information is not uploaded, and civil penalties can apply.
Can patients opt out?
Yes. A patient can request a report not be uploaded, or have one removed afterwards via the My Health Record Helpline. Opt-out decisions should be documented.
What should my clinic prioritise?
Update results and recall workflows, brief staff, counsel patients on their rights, confirm compliance for any in-house diagnostics, and secure the systems handling the data.
Key takeaways
- Share by Default started 1 July 2026, covering pathology and imaging reports to My Health Record.
- The direct obligation sits mainly with pathology and imaging providers, not every GP.
- All clinics are affected through workflows, patient questions and security.
- More data flowing automatically raises the stakes on system security and your APP 11 duty.
Get your clinic’s systems reviewed
Byteway helps Australian clinics keep their systems secure, current and compliant as more health data flows by default. Book a clinic data-security and compliance review. 👉 Book your review
