Who can see your My Health Record, and how to lock the doors

The most common question about My Health Record is not "what is in it". It is "who else can see it". That question is reasonable. Health information is intimate, commercially interesting, and useful to people who do not have your interests at heart. It is also, in a working health system, something treating clinicians need to see without performing a ritual dance every time you present with chest pain.

The design tries to hold both ideas at once. Treating providers can open the record. You can tighten the doors. Emergency staff can break the glass. Everything is meant to be logged. Whether that feels like control or like theatre depends on how the settings are explained — and they are often explained badly.

This is a map of the doors, not a promise that any particular setting will survive the next redesign of the consumer portal. It is also not personal medical or legal advice. If you have a safety concern, a family-violence situation, or a dispute about a child's record, talk to the official My Health Record support channels and, if needed, a lawyer who actually does this work.

Treating providers, not "any doctor with a login"

My Health Record is built for healthcare provider organisations that are involved in your care. The technical keys are healthcare identifiers: yours, the clinician's, and the organisation's. In ordinary use, a GP clinic, a hospital, a pharmacy or another registered provider organisation opens the record through clinical software because you are sitting in front of them, or because they are continuing treatment.

That is different from a random clinician browsing names. It is also different from the fantasy that the record is sealed unless you type a code every time. The default, for people who never touch the settings, is that treating providers can get in. That is the point of a shared national record.

A treating-provider login is not a licence to browse, and a consumer lock is not a delete key. The doors only work if you know which building they belong to.

"Involved in your care" is a phrase with some stretch in it. A hospital pharmacy, an after-hours locum, a pathology provider, a locum in your usual practice — all can have a legitimate reason. A curious neighbour who happens to be a nurse should not. Professional rules, the My Health Records Act, and the Australian Privacy Principles all sit over the top of the software. AHPRA-registered clinicians can get into serious trouble for snooping. That does not mean snooping never happens. It means it is a misconduct story, not a feature.

If you want the basic inventory of what those providers might actually find — medicines, immunisations, some results, the occasional discharge summary — start with My Health Record explained. There is no point locking an empty cupboard, and no point leaving a full one open because you thought it only held a flu shot.

Emergency access is a logged crowbar

Emergency access exists because people arrive unconscious, without a myGov login, and with a medicine list that would be useful to the team in resus. The system allows authorised users in participating organisations to open a record in an emergency even when consumer-set restrictions would otherwise block them.

That is a crowbar, not a spare key on a hook. It is meant to be used for urgent clinical need, and it is meant to be audited. If you have set a record access code or limited document access, emergency access is the path that can still get a clinician through.

Whether you find that reassuring or alarming is a values question. For most people, the risk of a missed anticoagulant in an emergency outweighs the risk of a logged break-glass event. For some people — public figures, people fleeing violence, people with highly stigmatised diagnoses — the calculation is different. The software cannot make that moral choice for you. It can only offer a control and a log.

If you use restrictions, decide in advance whether emergency access should still be possible. Then tell the people who would speak for you if you cannot. A nominated representative who does not know you locked the record is not a plan.

Nominated representatives and the family problem

A nominated representative is someone you (or the rules around children and impaired decision-making) appoint to help manage the record. Used cleanly, this is how an adult child helps a parent who does not do myGov, or how a parent manages a child's digital health consent until the young person takes control.

Used messily, it is how an old appointment survives a divorce, a friendship breakdown, or a change of carer. Digital access outlives kitchen-table arrangements. People forget to revoke it. People assume a password change is enough. People share logins because appointing a representative felt like paperwork.

Do the paperwork. Appoint people formally. Review the list after any change in relationship, diagnosis, or living arrangements. If you are helping an older relative, write down that you are the nominated representative and that they agreed. Informal access looks convenient until there is a dispute about who saw a pathology report.

Separated families deserve a special warning. Parental responsibility and My Health Record access are not always the same conversation as "who has the school pickup". If two people believe they should control a child's record, do not settle it by sharing a password and hoping. Get advice. The record is a poor venue for a custody fight, and a very effective way to make one worse.

The controls you actually have

The consumer portal offers several doors you can close. The names in the interface shift, but the ideas have been stable enough to describe.

Record access code

You can require a code before a provider organisation opens the record, with emergency access still available depending on how you set it. This is the blunt instrument. It stops casual treating-provider access. It also stops the useful kind, unless you remember to hand over the code.

If you set a code, put it somewhere a treating clinician can get it when you are conscious and willing. A code that lives only in your head is a code that will be bypassed in an emergency or will block a GP you wanted to brief.

Limited document access and hidden records

You can restrict particular documents, or hide them from general view. This is the scalpel. People use it for sexual health, mental health, an old admission they do not want every locum to open with, or a family situation they do not want advertised.

Hiding a document in the national record does not delete the clinical fact. The hospital still has the notes. The GP software may still have the letter. The laboratory still has the result. You are controlling a shared copy, not rewriting history. Anyone who promises you "the internet will forget this test" is selling comfort.

Removing representatives and checking access history

You can remove nominated representatives. You can look at who has opened the record. You should do both more often than you check your supermarket points balance, and less often than a person who is becoming frightened of their own file.

An access history that shows your usual GP, a hospital, and a pharmacy is ordinary. An access history that shows a provider you do not recognise is a reason to ask questions, not immediately a scandal. Locum arrangements, corporate practice brands, and hospital networks have names that do not match the sign on the building.

The practice file is a different animal

This is the distinction that saves people from magical thinking.

Your GP's clinical software is a local (or clinic-cloud) medical record. It holds consultation notes, inbox results, scanned letters, care plans, and the messy truth of a long relationship. Staff at that practice can see it according to the practice's own access rules. It is covered by the Privacy Act, the Australian Privacy Principles, professional standards, and whatever cybersecurity for small medical practices the clinic has actually implemented.

My Health Record is a national shared system. A document appears there if someone uploads it or a feed sends it. A restriction you apply there does not reach into Best Practice, MedicalDirector, a hospital EMR, or a pathology company's app.

So you can hide a discharge summary nationally and still have the same summary sitting in the GP inbox. You can refuse to upload a mental health letter and still have that letter in the psychiatrist's rooms. You can cancel your My Health Record entirely and still be thoroughly documented in half a dozen systems that do not care about your national opt-out.

If your real concern is a particular clinic, a particular staff member, or a particular document, say so and deal with that organisation. National settings will not fix a local gossip problem. Local settings will not hide a document you already sent to the national record.

A practical way to lock the doors

Most people do not need a fortress. They need a door that latches.

Start with the myGov account. Unique password, multi-factor authentication, a mobile number you still own. Revoke old devices. That is the consumer front door, and it is the one attackers actually try.

Then decide whether you are a default-open person or a restrictions person. Default-open makes sense if you want after-hours GPs and hospitals to see medicines and allergies without a scavenger hunt. Restrictions make sense if you have a document or a diagnosis that would cause you real harm if it were widely seen, and you are willing to carry the inconvenience.

If you choose restrictions:

• Set them on purpose, not because a Facebook post told you to lock everything.
• Keep emergency access available unless you have a specific reason not to.
• Give the code to clinicians you actually want involved.
• Review hidden documents when the acute reason has passed. An old STI result does not need to stay in the vault forever if the clinical risk of hiding it is now higher than the privacy risk of showing it.
• Write a one-line consumer note that you use access controls, so a confused registrar does not assume the record is empty.

If you are a clinician, do not treat a locked record as hostility. Treat it as information. Ask for the code. Use emergency access only when it is an emergency. Look at the audit trail in your own organisation. Shared logins and borrowed smartcards are how treating-provider access turns into a mess you cannot defend to the OAIC.

What the law is doing in the background

The My Health Records Act sits beside the Privacy Act and the Australian Privacy Principles. The Office of the Australian Information Commissioner is the privacy regulator people name when a health record goes walking. Healthcare identifiers have their own legislation. Provider organisations have extra duties when they handle My Health Record information.

None of that is a consumer settings screen. It is the reason a practice cannot shrug and say "the receptionist was curious". It is also the reason "I hid it in My Health Record" is not a complete privacy strategy. Most leaks still happen in email attachments, lost USB sticks, misdirected faxes that never quite died, and practice inboxes forwarded to the wrong John Smith.

Lock the national doors you care about. Then ask the more awkward question: who can see the same information in the systems that are not national at all.