My Health Record and child protection

This advice provides information on the My Health Record system, previously known as the personally controlled electronic health record system or eHealth, and how this relates to clients of child protection.
Document ID number 2430, version 3, 4 May 2020.

The My Health Record system is a Commonwealth initiative that moved to an opt-out model in February 2019 following a national rollout.

See My Health Record procedure for tasks that must be completed and ‘How Child Protection interacts with My Health Record’ for a quick summary guide to child protection’s authority.


  • Intake phase, investigation phase, protective intervention by agreement, interim accommodation order (IAO) to parent, IAO to suitable person and family preservation order – child protection has no access to the My Health Record.
  • Protective intervention phase when the child is out of parental care under an IAO (IAOs except an IAO to parent and IAO to a suitable person) – child protection can access the My Health Record.
  • Family reunification order, care by Secretary order, long-term care order, therapeutic treatment (placement) order – child protection can access the My Health Record.
  • Permanent care order – child protection cannot access the My Health Record.
  • Aboriginal children in Aboriginal care – child protection cannot access the My Health Record.
What is eHealth?

My Health Record, introduced in 2012, is an electronic summary of a person’s key health information, drawn from existing health records.

A My Health Record can be accessed by the individual to whom it relates and by healthcare providers involved in their care. A feature of the record allows a person to appoint a nominated representative(s), and for children under 14 years old and those incapable of managing their own My Health Record, an authorised representative(s).

A nominated or authorised representative(s) can access the content of the relevant person’s record, which may include information such as e-referrals, discharge summaries, medical history, pathology results and immunisations.

An authorised representative can view, edit, and delete documents. They can also cancel a My Health Record.

There are three access levels for nominated representatives: general access; restricted access, and full access.

For detailed information on the role and functions of authorised and nominated representatives see the My Health Record website.

What are the benefits of My Health Record?

  • Health information is stored in one place.
  • It can build responsibility in young people to manage their own record.
  • It can build health literacy in young people.
  • It can assist health providers dealing with the care of an individual.
  • It could provide a health history for young people leaving care.

What are the risks of My Health Record?

  • It may not include all health information for an individual.
  • Health practitioners treating an individual may not participate in the scheme and would therefore not be in a position to update health information. This places the responsibility on the record holder to update information.
  • Individuals, including parents, may have access to a child or young person’s record when this is no longer appropriate and this may pose a risk.
  • Young people who manage their own record may allow access to individuals considered inappropriate by child protection or other services or delete information best retained.
  • Individuals who control a My Health Record as an authorised representatives can delete a My Health Record. Information in a deleted record cannot be regained at a later stage.
The interface between My Health Record and child protection

As the system is based on an opt-out model, it is anticipated most child protection clients will have a record unless their parent opted them out by 31 January 2019 or cancelled the record since. A young person aged 14 years and above may also have cancelled their own record.

Therefore, it is important to enquire whether a child has a My Health Record as part of the health questions asked during child protection intervention, and to record this information on CRIS. Where appropriate, depending on the child’s legal status, the child protection practitioner should link themselves to the child’s My Health Record.

Should there be any change in the child’s circumstances, for example, if they are placed in care, and it is no longer appropriate for a particular individual already linked to the child’s My Health Record (including a parent) to have access to the record, timely action is required. See My Health Record procedure for tasks that must be undertaken.

Child protection access to a My Health Record

In some circumstances, child protection practitioners will have the authority to access a client’s My Health Record.

Child protection practitioners will have no access to a client’s My Health Record during intake or investigation phases, protective intervention by agreement and where the child is under an order to parental care.

Child protection can access the record during protective intervention when the child is subject to certain types of interim accommodation orders (IAOs) and when the child is subject to a protection order placing them in care (excluding permanent care order).

Child protection cannot access the My Health Record of a young person 14 years and older unless evidence can be provided to the Commonwealth that the young person is unable to manage their own record, for example, due to disability, or the young person agrees to link the child protection practitioner to their record. Child protection practitioners should encourage the young person not to provide an individual access to the record if they pose a risk to them.

Child protection can access the My Health Record of a child via an online database called the Children in Care portal. This portal was developed by the Commonwealth to facilitate access of state and territories child protection programs when accessing the My Health Record of clients.

Child protection practitioners in Victoria can access the portal via a link on CRIS in the health component of case practice. This link will only be accessible where practitioners have the appropriate delegation. Like CRIS, an audit is maintained of who has accessed the My Health Record and therefore practitioners must confirm they have the legal authority to access the record prior to doing so. See How Child Protection interacts with My Health Record.

Considerations for good practice

Child protection do not have the legal authority to take any action on a child’s My Health Record when parents retain exclusive parental responsibility and the child is not in care.

If there is a safety concern regarding one parent’s access to the child’s My Health Record, child protection practitioners should support the other parent to call the My Health Record helpline to request the record is restricted (and other parent removed from the record if applicable), for example, in circumstances of family violence.

If the child or young person is subject to a Children’s Court order where the Secretary has no parental responsibility or specific right of access to the child, such as an interim accommodation order to suitable person (i.e. kinship care) and there is a safety risk that requires the child’s record to be restricted or parental access removed, child protection practitioners must call the My Health Record helpline and request this occur.

Child protection practitioners should also consider if information on the record may be distressing for the child to see, for example detailed information about non-accidental injuries such as physical injuries, sexual abuse or mental health assessments. Practitioner should discuss this with the child prior to them seeing this when they access their My Health Record for the first time.

Where child protection practitioners have access to a child’s My Health Record, health information of relevance should be provided to the carer to inform their care of the child and recorded in CRIS.