Digital health rules are tightening: what every practice needs to know

Australia is entering a new phase of healthcare regulation, especially in the digital realm. The rules that govern telehealth, My Health Record uploads, reporting mandates, and online prescribing are being significantly strengthened. Medical practices must adapt or risk falling behind, financially and reputationally.

The Veri view? Practices that get ahead now will build patient trust and competitive advantage.

The shifting regulatory landscape: more obligations, more oversight

Regulators are moving decisively to close the gaps that allowed fragmented data systems and low-touch telehealth models to flourish during the pandemic years.

What’s emerging is a more structured, interoperable, and transparent framework designed to make digital health safer for patients and more consistent across providers. For practices, however, that means new obligations, new reporting workflows, and less tolerance for shortcuts.

My Health Record “sharing by default” and upload mandates

In 2025, the Health Legislation Amendment (Modernising My Health Record – Sharing by Default) Act passed, establishing a legal basis for requiring certain healthcare providers to upload data to My Health Record by default.

From 13 October 2025, consumers should be able to see most pathology reports (like blood and urine tests) in My Health Record, or the ‘my health’ app, as soon as they are uploaded. Other results will be available after a 5-day delay, including:

• anatomical pathology
• cytopathology
• genetic testing.

From February 2026, consumers will be able to view X-ray reports for limbs (arms and legs) in My Health Record immediately after they are uploaded and see other

Importantly, the Act ties My Health Record compliance to Medicare benefits. Providers who don’t upload required data may need to repay Medicare payments or have benefits withheld once the new rules commence (expected to be around mid-2026). Exceptions exist for patients who have opted out or where there are serious safety concerns or technical barriers) but they must be legitimate and documented. 

The ultimate objective is to achieve stronger, more consistent data flow into the national record, reducing gaps, duplicates and information silos. 

Telehealth and prescribing rules: cracking down on “text-only” models

In October 2025, AHPRA and the National Boards released revised telehealth guidance emphasising that convenience cannot override safe clinical practice. 

They explicitly disallow prescribing or therapeutic recommendations based only on asynchronous questionnaires, email, or chat. A real-time interaction (video, phone or in-person) must precede a prescription or significant clinical decision. The change is triggered by concerns over fragmented telehealth models that prioritise volume over continuity and safety. 

The practical effect? Telehealth platforms that currently rely heavily on pre-filled questionnaires, automated chat logic, or purely digital interactions must update their workflows to ensure a live, clinician-led component.

Accreditation, safety standards, and audit expectations

Health service organisations (e.g. hospitals, clinics) are already expected to comply with NSQHS Standards Actions 1.17 & 1.18, which require systems to be able to provide clinical information into My Health Record, use national identifiers, maintain accuracy of uploaded data, and control workforce access. 

Under the My Health Records Act and the My Health Records Rules, breaches (such as incorrect uploads, improper disclosure, or failure to follow upload rules) may incur penalties or sanctions.

Practices will also be subject to incident reporting and notification obligations in the event of data breaches affecting My Health Record data.

What these changes mean – and why practices must act now

These reforms will determine who gets paid on time, who patients trust with their data, and which clinics are ready for the next decade of digital-first healthcare.

Risk of financial penalties and lost claims

There is real financial risk wrapped up in these new laws. If required information is not uploaded, eligible Medicare rebates may be withheld or must be repaid. Practices that delay adaptation risk revenue disruption.

Reputational exposure and patient trust

Patients expect digital competency, meaning that a practice seen as “offline” or non-compliant may lose trust. Complaints around telehealth practices already fuel regulatory scrutiny. Indeed, regulators are explicitly targeting models that appear too transactional or superficial.

Administrative overhead vs strategic investment

Compliance certainly has an upfront cost, including software upgrades, staff training, reworking workflows, data governance, and system audits.

But practices that treat these as investments, not burdens, can reap long-term benefits, including:

• better care coordination
• fewer duplicated tests
• safer prescribing
• alignment with future innovations (AI, decision support, population health analytics).

Practices that are fully compliant and can demonstrate seamless, integrated digital workflows will stand out. Patients will prefer clinics whose systems “just work,” maintaining continuity and avoiding fragmented care.

Strategy checklist: what your practice should do now

1. Conduct a systems audit

• Inventory your EHR, prescribing, imaging, pathology interfaces and confirm whether they support My Health Record upload and secure messaging.
• Engage vendors early — ensure your software has or will get the needed modules or API integrations.

2. Map document flows and upload rules

• Clarify exactly which documents you must upload (e.g. pathology reports, imaging results) and in what timeframe — once the Rules are finalised.
• Define exception workflows (opt-out patients, technical issues, safety concerns).

3. Redesign telehealth workflows

• Ensure telehealth consultations always include a real-time interaction (video or voice) before prescribing or major clinical decisions.
• Remove reliance on pure questionnaire-based prescribing.
• Document your telehealth protocols, scope, and audit trails.

4. Update policies & governance

• Revise your privacy, consent, and data handling policies to include My Health Record obligations.
• Assign roles for upload compliance, audit review, incident reporting, and staff access control.

5. Train your team

• Educate doctors, nurses, administrative staff about the new rules, the reasons behind them, and how to execute compliant workflows in practice.
• Use scenario-based training (e.g. handling a patient who opts out, tech failure, remote prescribing decision).

6. Communicate transparently with patients

• Advise patients what changes they’ll see (e.g. their lab/imaging results will be uploaded).
• Provide opt-out options and explain safeguards.
• Use this as an opportunity to reassure patients about your commitment to security and data-driven safety.

7. Monitor and audit continuously

• Periodically check that uploads are successful, correct, and timely.
• Track telehealth prescribing patterns and identify vulnerabilities or deviations from policy.
• Prepare for regulatory audits or inspection.

Veri’s view: digital rules are the building blocks of trust

Digital health regulations are not just red tape: they’re the architecture that enables clinical continuity, safety, scalability and future innovation. They are the underpinnings of a modern, accountable, data-driven healthcare system.

Practices that delay risk not just financial penalties but reputational erosion, inefficiency, and technological lag. In contrast, practices that jump early will win first-mover trust as patients increasingly expect seamless, digital-first care.

Which one will you be?