It is a reasonable question, and one I get asked often: if the Australian government already gives me a free digital health record, why would I use an app as well?
The short version is that they are not the same kind of thing, and they are not really competing. My Health Record is a shared clinical record - the government runs it, your healthcare providers fill it in, and your healthcare providers can read it. A personal health record app is your own private copy - you fill it in, and nobody sees it unless you decide they should. Most people are better off with both, for the same reason you keep your own copies of your tax records even though the ATO has them too.
This article explains what each one actually is, who can see what, and where each falls short. Everything about My Health Record below is sourced to the Digital Health Agency, the Office of the Australian Information Commissioner, or the legislation, with links.
Disclosure
I founded exora, which is a personal health record app. So I have a stake in one half of this comparison, and you should read it accordingly.
What I have tried to do about that: describe My Health Record fairly and in detail, including the things it does better than any app can, and be specific about where a personal health record app - including mine - does not help. If you want a wider comparison of the apps themselves, I wrote one here.
The short answer
- My Health Record is a national system run by the Australian Digital Health Agency under the My Health Records Act 2012. It is filled in mainly by your healthcare providers. By default, any healthcare provider organisation involved in your care can read all of it. It is free, and you already have one unless you have opted out.
- A personal health record app is a private record you create and control. It is filled in by you - by uploading documents, or typing information in. Nobody has access to it, including your doctor, unless you actively share it.
- The practical difference: My Health Record is what the health system can see about you. A personal health record is what you can see about you. Those are different problems, and the second one is much less well served.
What My Health Record actually is
My Health Record is a national, government-operated summary of your health information. It is governed by the My Health Records Act 2012 and operated by the Australian Digital Health Agency. It costs nothing, and since the opt-out period closed in early 2019, you have one unless you chose not to, or have cancelled it since.
What goes into it comes overwhelmingly from your providers: shared health summaries from your GP, hospital discharge summaries, prescription and dispense records, immunisation history from the Australian Immunisation Register, Medicare and PBS claims data, and pathology and diagnostic imaging reports.
That last category changed substantially this year. Under the Modernising My Health Record (Sharing by Default) Act 2025, from 1 July 2026 most written pathology and diagnostic imaging reports authored by a pathologist or radiologist are uploaded by default rather than only when a provider chooses to. The written reports are included; the images themselves are not. (Source: the Australian Digital Health Agency.) If your mental model of My Health Record is “mostly empty”, it is worth another look - the system that exists in mid-2026 is meaningfully different from the one people formed opinions about in 2018.
You can add a few things yourself. There is a personal health notes section, a personal health summary for allergies and conditions you want providers to know about, emergency contact details, and advance care planning information. These are genuinely useful and underused.
What you cannot do is treat it as a document store. There is no way to drop in the eleven PDFs a specialist’s rooms emailed you, or a scan of a letter from 2011, or your records from three years living in London, and have the system absorb them. It receives structured clinical documents from connected providers. That is what it is built for.
When results actually appear
Worth knowing, because it catches people out. Since mid-October 2025, most pathology reports - blood and urine tests - are viewable as soon as they are uploaded. But anatomical pathology, cytopathology and genetic testing are held for five days first, down from the seven days that used to apply to everything. Imaging changed in February 2026: x-ray reports for limbs appear immediately, while CT, MRI, PET, ultrasound and other scans become viewable after five days.
If you run into one of those waits, it means nothing about your result. The Agency’s own consumer fact sheet is direct about it: “If access to a result is delayed this doesn’t mean there is anything wrong. Some results won’t be available for 5 days after they are uploaded, this is because of the type of test, not the result.” The delay is attached to the category of test before anyone has read your particular result. Your results still go straight to whoever ordered them, so ask them if you want to know sooner.
Who can see your My Health Record
This is the part most worth understanding, and the part where My Health Record differs most sharply from a private app. It is also the part where My Health Record is better designed than its reputation suggests.
The default is broad. The Office of the Australian Information Commissioner states it plainly: “If a patient does not set access controls, the default access controls apply and a healthcare provider organisation can view all clinical documents in their patient’s My Health Record, as well as upload documents to the patient’s My Health Record.”
That default is deliberate, and there is a good clinical argument for it. The value of a shared record is that the emergency department registrar at 3am does not have to ring your GP to find out what you are allergic to. But it does mean that if you have never touched your settings, the position is that provider organisations involved in your care can read the lot.
You can change it. The controls are real and they are free:
- A Record Access Code locks your whole record. A provider organisation cannot see anything without the code you give them. Note the mechanics: the code applies to the organisation rather than the individual clinician, and once an organisation has used it they are added to an access list and keep access without needing to re-enter it. You can remove organisations from that list whenever you like.
- A Limited Document Access Code works the same way but also unlocks documents you have marked as restricted, so you can give one trusted provider fuller access than the rest.
- You can hide or remove individual documents, or mark them restricted, so that a particular result is not part of the shared picture.
- You can see the access history - which provider organisations have looked at your record or uploaded to it. If you want the name of an individual who accessed it, the help line on 1800 723 471 will tell you.
There is one override worth knowing about, because people are sometimes alarmed to discover it after the fact rather than before. It is called emergency access, or informally “break glass”. A provider organisation can override your access controls where it reasonably believes access is necessary to lessen or prevent a serious threat to someone’s life, health or safety and getting your consent is unreasonable or impracticable, or to prevent a serious threat to public health or safety.
The OAIC’s guidance on the function sets out the limits, and they are tighter than the name suggests. Emergency access lasts five days, after which “all access to the patient’s My Health Record reverts to their access control settings”. It does not reveal everything: it cannot show “deleted information, hidden documents and personal health notes”. And the Agency monitors every use of it, and contacts organisations to review instances.
So: a broad default, real controls if you use them, a genuinely bounded emergency override, an audit trail you can read, and a regulator watching. That is a considered design. My criticism of My Health Record is not that it is careless with your information.
Is your data used for research?
People ask this, and the honest answer as at July 2026 is: not yet, and you can already say no.
A framework exists to govern secondary use of My Health Record data for research and public health purposes, but the data is not currently available to researchers. The Department of Health’s position is that it will only be released once governance arrangements are established, including a My Health Record Data Governance Board that would assess applications. You can set your participation now, in the Research and Public health section of your record, by choosing not to participate - and change your mind later. (Source: the Department of Health’s page on use of My Health Record data.)
It is a fair question to put to any personal health record app too, and you should ask it before uploading anything. Ours is on the security page: health data is never used to train AI models.
What a personal health record app is
”Personal health record” is an old term for a simple idea: a health record that belongs to the patient rather than to a provider or a government. The category ranges enormously, from a manual logbook that never leaves your phone to a cloud service that reads your documents for you.
What they share is the two properties that define the category. You fill it in - by uploading documents, connecting a device, or typing. And you control access completely - the default is that nobody else can see any of it, including a doctor treating you, until you choose to share.
That second property cuts both ways, and it is worth being clear-eyed about. Nobody reading your private app in an emergency is a privacy feature and a safety limitation at the same time. It is exactly why a personal health record is not a substitute for the shared clinical record.
Two questions are worth asking of any app in this category before you commit years of documents to it. Where does the data actually live, and under whose laws? And what happens to your record if you stop paying, or the company shuts down? A good answer to the second one is export, and it should not be hard to find.
The six differences that actually matter
1. Who fills it in
My Health Record is fed by your providers, automatically, and since 1 July 2026 that includes pathology and imaging reports by default. You do almost nothing. A personal health record is fed by you, which is more work and also the reason it can contain things the health system never digitised.
2. Who can see it
My Health Record: provider organisations involved in your care, broadly, by default, with controls available if you set them. A personal health record: nobody, until you share it. Neither of those is simply better - they are suited to different purposes.
3. Summaries versus source documents
My Health Record holds clinical documents that providers generate in standard formats. A personal health record can hold the actual artefact - the photographed letter, the pathology PDF, the scanned page from 2009 - and, in the case of apps that process documents, the information extracted from it.
4. How far back it goes
This is the biggest practical gap and it gets less attention than it deserves. My Health Record generally holds nothing from before the system reached you, nothing from a provider who does not participate, and nothing from overseas. If you were treated in Auckland in 2014, or by a specialist whose rooms still work on paper, that care is not in there and never will be. A personal health record has no such boundary, because the boundary is whatever you can lay hands on.
5. What you can do with it
My Health Record is designed to be read - by you, and by clinicians treating you. Personal health record apps vary, but the better ones let you search, trend a result over years across different labs, ask questions of your own history, and share a specific subset with a specific person for a specific period.
6. What happens if you leave
You can cancel My Health Record at any time. When you do, the information in it, including backups, is permanently deleted and cannot be recovered - a change introduced by amendments in 2018, replacing the earlier position under which cancelled records were retained for decades. Note what that does not cover: copies your providers hold in their own systems are theirs and stay. With a personal health record app, ask about export before you need it.
Two of those differences, in practice
Differences 2 and 5 are the ones people feel rather than read: how consent works, and how sharing works. Both follow from what each system was built to do, which means neither is a bug that either side is going to fix. Three situations make them concrete.
You are in a clinic in Bali and the doctor asks what you take
You can name the two you remember. The dose of the third, the one you started in March, the antibiotic that gave you a rash in 2019 - gone.
You do have an option here, and it is worth being fair about it: log in to myGov on your phone and hold up the screen. That works, and plenty of people do exactly that. But it depends on you having a connection and feeling well enough to navigate it, and it leaves the clinic with nothing - no copy for the file, nothing the doctor can look at again once you have left, nothing the pharmacy down the road can see. You cannot grant that doctor access, because within My Health Record there is nobody there to grant it to.
With a record of your own you send a link, choose to share your medications and allergies and nothing else, set it to expire in two days, and they open it in a browser without installing anything. When you get home, you revoke it.
A new specialist wants the relevant history, not your life story
You are perfectly happy for a cardiologist to see your medications, your conditions and your recent bloods. You would rather they did not read everything else, and that is a reasonable position to hold without having to explain yourself.
My Health Record does not work that way for someone you invite personally: a nominated representative gets your record at one of three access levels, for as long as the arrangement stands, and reaches it the way you do - through myGov. On the provider side the controls are organisation-level rather than person-level, so a Record Access Code lets a practice in, and everyone at that practice can see what it opens.
A personal health record shares by category, to one person, with an expiry, revocable from a single screen. Different granularity, for a different purpose.
You are unconscious in an emergency department in Melbourne
Here My Health Record is the right tool and nothing on your phone is any use whatsoever. Treating clinicians can reach your record without you doing a thing, which is precisely why the broad default exists - and a good argument for putting your allergies into your personal health summary tonight. No personal health record app solves this, including ours. A locked phone in a bag is not a health record.
Underneath those three situations sit two differences that are structural rather than fixable.
Consent runs in opposite directions. My Health Record tells you afterwards - access happens under the default settings, and the access history shows you who looked, once you go and read it. A personal health record asks first: access exists only because you created it, for the scope and the period you chose. Neither is simply better, and the reason is almost arithmetic. A record designed to be available in an emergency cannot stop to ask permission, and a record that asks permission first cannot be available in an emergency.
Sharing has a boundary in one and not the other. My Health Record shares within the Australian health system, and with representatives who log in through myGov. That covers a great deal of Australian healthcare and none of the rest of your life - the doctor in Bali, the specialist in Auckland, the physiotherapist whose practice never connected to the system.
And the counterweight, because it belongs right here rather than in a footnote: none of this makes My Health Record careless with your information. It is backed by an Act of Parliament, penalties for misuse, an emergency override that is bounded and monitored, and a regulator you can complain to. A young private company - mine included - cannot match that kind of institutional accountability, and you should weigh it accordingly. The difference between the two is purpose, not care.
So do you need both?
For most people, yes, and they are complementary rather than redundant.
Keep My Health Record for the emergency department. It is free, it fills itself in, and since July it collects your lab and imaging reports automatically. Set your access controls if the default does not suit you, add your allergies and conditions to your personal health summary, and then largely forget about it.
Keep your own record because of everything else. The years before the system reached you. The overseas care. The specialist who posts letters. The question “when did this actually start” that nobody can answer without reading twelve documents side by side. The appointment next week where you want to hand a specialist the whole picture rather than trying to recall it.
The two failure modes are equally common. People who rely only on My Health Record assume it is complete, and it is not. People who rely only on an app assume clinicians can see it, and they cannot.
Where exora fits
exora is a personal health record app, so everything said above about the category applies to it - including how it behaves in those three situations. What it adds is the processing: you upload documents and an AI pipeline reads them, extracts the clinical content, and assembles it into one searchable record with a timeline, so results from different labs land on the same trend line. Every fact links back to the exact page and text of the document it came from, so you can check it. Data is stored in Sydney under Australian jurisdiction, and it is free.
Honestly, where it does not help:
- No direct My Health Record connection yet. We are working with Services Australia on one. For now, you download your records from My Health Record and upload them - which works, and is a manual step.
- Your doctor cannot see it unless you share it. That is the category’s defining property, not a gap we can close. Keep My Health Record for the shared clinical view.
- It cannot get documents you do not have. You have a legal right to your records from any provider who has treated you - this explains how to ask - but the asking is yours to do.
- It is not medical advice. It organises and presents your information. It does not diagnose and it does not tell you what to do.
A reasonable starting point
If you want one concrete sequence: log in to My Health Record through myGov or the 1800MEDICARE app and see what is actually in there, which is probably more than you expect. Check your access settings and decide whether the default suits you. Add your allergies and conditions to your personal health summary. Then download what is in there, and start assembling the rest - the older records, the overseas ones, the paper - into a record of your own.
The government layer and your own layer answer different questions. It is worth having both.
Claims about My Health Record are sourced to the Australian Digital Health Agency, the Office of the Australian Information Commissioner, the Department of Health, and the My Health Records Act 2012, linked inline, and were checked on 30 July 2026. Government systems change; this page will be updated as they do. This article is general information about software and how these systems work, not medical or legal advice.
