Australia My Health Records Act 2012: every control, and what you already have

40 controls 24 frameworks share controls with it Australia verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

Australia My Health Records Act 2012 Evidence & Implementation Kit

40 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	27	measure it →
GDPR	27	measure it →
NIST SP 800-53 Rev 5	27	measure it →
SOC 2	27	measure it →
ISO 27001:2022	21	measure it →
ISO 27002:2022	21	measure it →
NIST Cybersecurity Framework 2.0	20	measure it →
FedRAMP High	18	measure it →
FedRAMP Moderate	18	measure it →
NIST SP 800-53 Rev 5 MODERATE	18	measure it →
NIST SP 800-53 Revision 5.1 HIGH	18	measure it →
APEC Cross-Border Privacy Rules (CBPR) System	17	measure it →

Every control

Code	Control	Also in
`MYHR-CUD-1`	Authorised collection, use and disclosure only	9
`MYHR-CUD-2`	Prohibition on unauthorised collection, use and disclosure	14
`MYHR-CUD-3`	Use limited to My Health Record purposes	9
`MYHR-CUD-4`	Records not held or taken outside Australia	17
`MYHR-CUD-5`	Interaction with the Privacy Act 1988	8
`MYHR-CUD-6`	Prohibition on use for a prohibited purpose	7
`MYHR-ENF-1`	Mandatory data breach notification	22
`MYHR-ENF-2`	Civil penalty compliance	9
`MYHR-ENF-3`	Criminal offences and sanctions	19
`MYHR-ENF-4`	Enforceable undertakings and injunctions	3
`MYHR-ENF-5`	Infringement notices	1
`MYHR-GOV-1`	System Operator functions and oversight	2
`MYHR-GOV-2`	Data Governance Board	2
`MYHR-GOV-3`	Annual reporting on the My Health Record system	2
`MYHR-GOV-4`	Review of decisions	3
`MYHR-GOV-5`	Retention, destruction and correction obligations of the System Operator	19
`MYHR-GOV-6`	The Register of participants	3
`MYHR-REG-1`	Registration as a participant	2
`MYHR-REG-10`	Notification when eligibility or registration conditions can no longer be met	1
`MYHR-REG-11`	Ensuring required information is given to the System Operator	14
`MYHR-REG-12`	Cancellation, suspension and variation of registration	0
`MYHR-REG-2`	Healthcare recipient registration and identity verification	15
`MYHR-REG-3`	Conditions of registration and participation	16
`MYHR-REG-4`	Contracted service provider oversight	20
`MYHR-REG-5`	Mandatory registration of prescribed healthcare provider organisations	0
`MYHR-REG-6`	Condition of registration relating to uploading records	0
`MYHR-REG-7`	Copyright conditions on handling old records for provider organisations	0
`MYHR-REG-8`	Copyright conditions on handling old records for operators and service providers	12
`MYHR-REG-9`	Non-discrimination in providing healthcare	1
`MYHR-SBD-1`	Share by default for prescribed key health information	3
`MYHR-SBD-2`	Approved periods where sharing or registration is not required	0
`MYHR-SBD-3`	Record keeping for sharing with the My Health Record system	14
`MYHR-SBD-4`	Notice where information is not being shared	3
`MYHR-SEC-1`	Written security and access policy	22
`MYHR-SEC-2`	Access controls and user account management	22
`MYHR-SEC-3`	Audit logging and access monitoring	22
`MYHR-SEC-4`	Training of authorised employees	20
`MYHR-SEC-5`	Security risk assessment	22
`MYHR-SEC-6`	Emergency access controls	19
`MYHR-SEC-7`	Consumer access controls and consent	18

Tell me when Australia My Health Records Act 2012 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Cloud governance framework
Cloud risk assessment
Provider due diligence
FedRAMP Authorization Boundary
SOC 2 Type II + ISO certifications
Security risk assessment of the system
pseudonymization procedure
key separation documentation
re-identification risk assessment
tokenization registry

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No risk assessment named by 4 frameworks
no risk assessment named by 3 frameworks
No access logging named by 3 frameworks
Logs not reviewed named by 3 frameworks

What this page is

A control-level reference for Australia My Health Records Act 2012, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition