---
title: "Check a provider's My Health Record access and upload practice against the published rules"
url: "https://ailawframework.com/practice/health-and-medical-law/check-a-provider-s-my-health-record-access-and-upload-practice-against-t"
type: "task"
site: "AI Law Framework"
id: "A32-NE20261022-3"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Check a provider's My Health Record access and upload practice against the published rules

> From the organisation's written policy, a sample of uploads and the access log, mark who is authorised to use the system, whether the policy covers security and staff authorisation, and whether any upload was made…

Canonical page: https://ailawframework.com/practice/health-and-medical-law/check-a-provider-s-my-health-record-access-and-upload-practice-against-t  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the organisation's written policy, a sample of uploads and the access log, mark who is authorised to use the system, whether the policy covers security and staff authorisation, and whether any upload was made after the patient asked that the document not be uploaded. |
| What the lawyer must review | The lawyer decides whether the written policy meets the Rule, whether a particular upload was lawful, and what must be removed or corrected. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**My Health Record practice**

Test the written policy and the sample uploads against the OAIC's statement of the Rule.

- What the AI does: From the organisation's written policy, a sample of uploads and the access log, mark who is authorised to use the system, whether the policy covers security and staff authorisation, and whether any upload was made after the patient asked that the document not be uploaded.
- What the lawyer does: The lawyer decides whether the written policy meets the Rule, whether a particular upload was lawful, and what must be removed or corrected.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Confirm a written policy exists and that it covers authorisation and security, not only a privacy pamphlet.
2. If the patient asked that a document not be uploaded, record that the upload must not proceed.
3. For HIV, other notifiable conditions, cancer diagnoses and third-party history, open the Regulation before treating the upload as permitted. The OAIC page names those examples and sends the reader to the Regulation.
4. A correction is removal and replacement by the authoring organisation. The tool does not rewrite the clinical document.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: using the My Health Record system](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/health-service-providers/my-health-record/using-the-my-health-record-system) (checked 2026-10-22)
- [Australian Digital Health Agency: My Health Record for healthcare providers](https://www.digitalhealth.gov.au/healthcare-providers/initiatives-and-programs/my-health-record) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/health-and-medical-law/check-a-provider-s-my-health-record-access-and-upload-practice-against-t/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*