Just when we looked like getting clear of massive political and bureaucratic gravitational pull of the My Health Record we seem to be falling back into its mesmerising and dark attractions. Everyone will suffer if we can’t shake ourselves loose … and soon.
I gave up quite a few years ago writing about how badly the My Health Record had captured our politicians and bureaucrats in a centralised sharing model that, unfortunately, became obviously the wrong way to go on solving the sharing data problem not that long after we’d committed to and were spending big on it.
A lot of it was simply bad luck timing because there were a lot of good people working on the problem.
The NEHTA-led PCEHR (Personally Controlled Electronic Health Record) – the direct predecessor to today’s My Health Record – officially went live on 1 July 2012.
When Tim Kelsey arrived on our shores about 2014 and then became CEO of the Australian Digital Health Agency in 2016, the thing was a monster of sunk cost and political momentum.
Mr Kelsey was a talented digital health leader but we’d spent nearly $1.5 billion with nothing to show already on the project and whether he knew it or not, he wasn’t about to try to swim against a very strong current as the newly minted CEO. He doubled down and went for it big time with opt out.
And it failed reasonably badly, because the thing was simply unusable and inaccessible.
But in failure there ended up being a lot to work with: mainly that we managed to opt most of the population into being a part of it (not actually using it) and with that we had captured them in some pretty good legislation which would help us a lot in getting sharing going moving forward.
So at that point I stopped nagging and being so negative. The MHR had some good points and the government under Labor was promising to use those points and go wide, in the same way that the US had done, by mandating a single set of standards everyone needed to use to share data, and then using what was good about the MHR to help the whole process.
I’m going to say that at that point in time, I think I read this whole dynamic wrong.
So today I start whingeing again about the MHR and how we seem to be positioning it and using it much as we have in the past, as a sort of ongoing embarrassment we have to somehow never let anyone know about (hint: everyone knows about it now).
So far, our sharing by default legislation, has been piecemeal. First we mandated pathology company compulsory sharing, and last November we mandated an impending opt out on individual provider identifiers so we could in a manner make sure every provider had to update their data so we can find them in real time and extract data when we need to.
Both pieces of legislation are progress in one respect.
But a big problem finally seems to be showing itself. We are tying each bit to the My Health Record.
How did we go back in time this way? Sure, make things talk to the MHR, but don’t make it the centre of the universe of sharing anymore. It not only doesn’t need to be, but it’s also a very dumb way to tie yourself in knots and make all your local innovative software vendors go broke.
The US model of sharing has been fundamentally different, and though fraught with issues since it kicked off officially, we need to be asking why we are now not following what they did, learning from the mistakes of course, which I know our government already does understand.
In other words, make “sharing by default” speak to the phrase: share everything at every point with everyone who is authorised, especially patients.
Not, share it all to the MHR first and then we can make everyone talk to that, and then we can get going on sharing.
The original problem with the MHR architecture when we were already $1.5 billion down a rabbit hole was that it was sending all data to a centralised single silo, a concept which was redundant not long after global cloud infrastructure and cloud-based API data sharing became the norm.
This cloud and distributed sharing architecture technology starting ramping up in 2010 with Microsoft, AWS and Google commencing big infrastructure rollouts so by 2016, when we doubled down on the MHR with opt out, we should have known better.
The big hint for us then, that we entirely overlooked, was that the US, which was a ripe mess of a sharing system, and burning platform, knew all this in 2016 and put out its 21st Century Cures Act plan formally at that time.
The US model: one deadline, one standard, real money to get there
The United States’ approach was set out in the 21st Century Cures Act, passed in 2016, with the detailed rules following via the Office of the National Coordinator for Health Information Technology’s 2020 Final Rule.
The structure was blunt and comprehensive: all certified health IT vendors and providers would be required to expose patient data through standards-based FHIR APIs, on a clear, published timeline. Information blocking became enforceable from April 2021. Certified FHIR API access was mandatory from the end of 2022. Full patient data export capability was required by the end of 2023.
Did the US route this obligation through a single central government health record or even plan to at any point of time?
Nope. Why would they?
Patients can pull their own data directly from any provider or vendor system via an authorised app, without a government-run middle layer in between.
The government set the standard, set the deadline, and then largely got out of the way.
Oh, not actually out of the way entirely.
It acknowledged, repeatedly and publicly, that the transition would be expensive for developers, so they built comprehensive support in the form of education programs and crucially, significant funding, and extended compliance timeframes into the rollout to help smaller players get there.
The Australian model: sharing by default, but to one destination
Australia’s approach, which seemed to be evolving a few years back but now seems to have reverted to MHR centric, is still taking a different shape.
The Health Legislation Amendment (Modernising My Health Record – Sharing by Default) Act 2025 established a framework for mandatory data sharing, starting with pathology and diagnostic imaging reports.
Related
From 1 July 2026, pathology and imaging providers have been required to upload reports to My Health Record by default, backed by a real compliance lever: Medicare benefits can be withheld, and civil penalties can apply, for non-compliance.
Great work everyone, no really.
It’s working, by the government’s own measurement. The Australian Digital Health Agency reported that in the week after the reforms took effect, consumer views of pathology and imaging reports on My Health Record jumped 433%, with provider uploads up 105%. Those are strong numbers.
But the MHR first directive bears a little thinking about.
Rather than mandating one interoperability standard across the board on one timeline – the US approach – this move established Australia as doing its mandating data type by data type, obligation by obligation, with each tranche legislated nearly separately.
And rather than opening a direct channel between patient and provider, each tranche routes specifically through MHR.
Fun fact about pathology and a big problem for our grand MHR government ambitions.
Our pathology companies are among the smartest and most digitally literate in our healthcare ecosystem. Faced finally with a law that they had to share their data, which they hate doing because it threatens their channel model to market, they quickly worked out that they needed to capture all their patient customers directly.
So they set on a plan to share their data directly with patients in a way that captured them largely as their client first and the governments and MHR second.
You could look at this a couple of ways:
- Great work government, you forced the pathology companies to share directly with their providers and patients…and it sort of is, albeit I’m going to say an accident.
- Bad work government, you forced the pathology companies to move early and capture patients on their terms with a whole lot of data and engagement you’ve obviously now missed out on by not being part of that process, and which we know the pathology companies are using to consolidate their already vice-like grip on their market sector.
November 2025: another piece of the puzzle, this time on identifiers
The pathology mandate isn’t the only “sharing by default” reform Australia has legislated recently. The Regulatory Reform Omnibus Act 2025 passed parliament on 27 November 2025 and received assent on 4 December, with most provisions taking effect the following day.
Where the Modernising My Health Record Act deals with clinical documents, the RRO Act deals with the plumbing underneath: healthcare identifiers, the unique numbers that let systems match a record to the right patient or provider.
Its most significant change flips the default on how the Healthcare Provider Directory works – provider identifying and professional details can now be disclosed to other providers in the directory automatically, without needing consent first, moving from an opt-in to an opt-out model.
The Act also widens who can legitimately handle healthcare identifiers, adding health technology providers (wearables and monitoring apps, from February 2027), employers and insurers, subcontractors, and approved research institutes to the list.
And it hands the Health secretary new standing power, under a fresh Part 5AA of the Healthcare Identifiers Act, to set binding national data standards – covering data formatting, storage, disclosure and system interoperability – by administrative determination rather than further legislation.
Kicking our MHR addiction
This part of the Sharing by Default legislation pulls in two different directions, one offering hope of us kicking our addiction to the MHR.
The identifier and Directory changes don’t really touch the MHR-centricity question at all.
A more accurate, more current Provider Directory is foundational infrastructure – the “who is this provider” lookup that any interoperability model needs, whether Australia ends up MHR-centric or moves toward something closer to the US’s direct-exchange model.
It makes both architectures work better; it doesn’t argue for one over the other. It’s the kind of fix that seems unglamorous but is actually pretty cool and leaves open the idea that one day we can kick the MHR for all those times it simply won’t be useful in sharing.
Interestingly, the Part 5AA data standards power is about who gets to decide what a valid national data standard looks like.
Handing that authority to the Secretary by administrative determination, rather than through the open, industry-negotiated standards process Australia has traditionally relied on (HL7, the FHIR AU community), is, on the one hand, even more centralisation of government control, but on the other, not the same kind of centralisation as “everything goes through MHR.”
It’s centralisation of standard-setting authority, sitting alongside – not underneath – the MHR question.
Is there any indication government wants to use that power to go wider, beyond MHR, into a more broadly centralised architecture?
If you’d asked me a couple of years ago, I’d have said, yes.
Now I’m a bit confused by where we are but not confused about how much time we seem to be wasting on making sure we are never embarrassed by the MHR, even if we do get to a good distributed sharing model.
On the public record, no explicit statement to that effect exists that I can find, although I’ve had plenty of conversations with the DoHDA where it’s been said to me.
What is officially confirmed is worrying though: the 2026–27 Budget committed a further $47.5 million specifically to expand My Health Record’s Sharing by Default requirements to cover prescribed and dispensed medicines information and GP Chronic Condition Management plans – the next tranches in the same document-by-document pattern already established with pathology and imaging.
That’s more evidence for the “bit by bit, MHR first” approach continuing on its existing wasteful trajectory, not evidence of a pivot toward some broader use of the new standards power for distributed sharing to patients and providers.
Nothing in current government communications, budget papers or strategy documents points to that ambition now.
It’s a capability that now exists, sitting in reserve, rather than a stated plan. Worth watching, not yet worth alleging.
What’s the issue with shouting out loud what a good plan you seem to have and getting started on it now?
The case for pivoting to the distributed model
The MHR sits as an intermediary step, not the source of data sharing.
In the US model, a patient can get their result directly and immediately from the lab or provider that generated it, via a FHIR-based API, with no detour through a government platform first.
In Australia’s model, the record still has to land in MHR before most patients see it
There are some pretty cool exceptions now like what the major pathology labs have done, but there’s a big issue here because we are losing an ability for a patient to connect their own data. The path labs are never going to share their special relationship with other parts of the healthcare system, which is presumably what the government is aiming for.
We now should be asking that if that direct pathway already exists – the case of pathology and some other smart providers – or is achievable, shouldn’t we now pivot and make the legislated pathway run through every point of data sharing, not just a central government record, as it has occurred in the US?
The MHR’s own adoption story complicates the “sharing by default” case for centring everything on it.
The record has had a long and, by most honest accounts, underwhelming adoption history since its 2012 launch. The recent surge in consumer views is real, but it’s largely a direct, mechanical consequence of the pathology mandate itself, not evidence of an independent groundswell of patient engagement with the platform.
Yeah we all broke out the champagne and celebrated when those first pathology numbers, hitting the MHR, came in.
But we had the Yellow sparkling wine.
The pathology labs had broken out the Bollinger 1956 many months before because they captured all their customers directly without any government oversight and they aren’t sharing any of that vital data with anyone.
Also, if we had a scoreboard and on one side we had MHR pathology engagement with patients and on the other direct with the pathology labs, who do you think would be killing it?
As ever, none of this means MHR should ever be mothballed – it still has a useful, hard-to-replicate role. It’s the only place with legislated frameworks for delegated access (for carers, for example), for data patients can’t otherwise get in one place, and for longitudinal, cross-provider summaries no single vendor holds. The record has real utility.
The question is whether it needs to be the mandatory first stop for data types where direct provider-to-patient sharing is already technically available, rather than one option among several.
This approach is killing an innovative and vital local software sector
A final very important point about how we are doing this.
Australia’s MHR-centric rollout is placing an extraordinarily heavy, uneven compliance burden on local software vendors, without matching the US’s approach of directly funding and assisting key vendors through the transition.
Federal budget papers show the government has committed $598.3 million over two years from 2026-27 to MHR’s own operation and enhancement, and a further $13.3 million over two years to Sparked, the CSIRO-led national FHIR accelerator program. The Australian Digital Health Agency’s own annual budget runs to roughly $350-400 million.
So a billion on government or government assisting government, with no actual infrastructure being built versus in the same two years, maybe $5 million to the vendors?
That’s nuts.
Almost none of that flows directly to the vendors who actually have to rebuild their products to meet each new conformance requirement – some of it sound (security, privacy), some of it, by industry’s account, excessively granular for the practical benefit it delivers.
Emma Hossack, CEO of the Medical Software Industry Association (MSIA) – which represents around 140 companies making up roughly 90% of health software implementation across Australia’s public and private healthcare system –puts this oversight bluntly:
“We have a big problem with government giving money to government, giving money to government.”
Her core argument is that Australian vendors are just as capable of adopting a single, comprehensive standard as their US counterparts – the problem isn’t capability, it’s how the transition is funded and staged.
“We’re all very good at standards in health, because they’ve been doing it for decades and they know how to adopt them,” she says, pointing to electronic prescribing as proof.
“Our members are masterful at adopting standards. I’ve been through it with prescribing. We had, I think, four face-to-face meetings during that huge revolution to get that done.”
What frustrates her is that the standards-development infrastructure Australia has built – community programs, working groups, accreditation processes – often isn’t accessible to the smaller vendors who most need support to cross a compliance bridge.
“You can’t send your only staff member [interstate] for two days when they’re the only person doing it,” she says.
“Of course you can’t.”
The result, in her view, is a system that structurally favours larger, better-resourced vendors:
“It should be the whole purpose of this to make it equal for everyone… let the rich people get it all — that’s just not fair.”
Ms Hossack’s preferred model is close to the US approach but funded directly rather than through agency intermediaries: government pays vendors specifically for the implementation and change-management work of crossing a mandated compliance bridge, not for the underlying product development itself.
“It’s not development money — people are mainly happy to pay for that because it’s their IP,” she says.
“It’s the implementation, the change management, all that stuff. Pay them for that, and we can all get on with it. And stop paying government, paying government, paying government.”
Speaking on stage at the AIDH’s HIC26 conference last week, Ms Hossack made a related point about the sheer scale of what individual vendors are expected to absorb.
Mapping every applicable regulation, she told delegates, is “a hell of a task for a developer in a small company, maybe one- or two-man band, even for a really large company with a corporate kind of legal team”.
Her point wasn’t that the rules are wrong in substance – many, she said, were sound – but that the compliance burden compounded with each new instrument, and nobody had done the work of making it navigable for the vendors actually expected to comply.
Her broader ask of government isn’t more funding for its own sake.
“Our industry would love to get more funding, but they’re not looking for handouts. They’re looking for sustainable business practice,” Ms Hossack says.
Compare that to the US: the Cures Act rule explicitly built extended timeframes and compliance flexibility into the regulation because ONC recognised smaller developers might not have the resources to meet tight deadlines otherwise.
Australia’s approach, by contrast, has repeatedly asked vendors – many of them small, local companies – to absorb the cost of crossing each new regulatory bridge alone.
The one clear counterexample often cited is electronic prescribing, and it’s instructive precisely because of how it succeeded, not through agency-led infrastructure, but largely through funding paid directly to local vendors doing the implementation work, with money tied to outcomes rather than process.
Is there a cleaner way?
None of this is to say Australia’s data-sharing ambitions are wrong. Clinicians and patients plainly benefit when a pathology result reaches a GP or a patient faster.
But the “bit by bit, MHR first” architecture invites a harder question than whether the reforms are working.
It’s whether a single, comprehensive, FHIR-based mandate – announced early, applied uniformly, backed by direct transition funding for vendors, and built around direct provider-to-patient sharing rather than a mandatory central detour – might deliver the same outcome faster, cheaper, and with less strain on the local software industry that has to build all of it.