Signing That Bulk-Billing Consent on a Screen? What Happens to Your Health Data in 2026

Millions of Australians are being handed a tablet or a paper slip at the front desk of their GP clinic this month, asked to sign off on a bulk-billed visit for the first time. From 1 July 2026, a change to the Medicare "assignment of benefit" rules means patients who are bulk billed are now asked to actively confirm consent so their doctor can be paid directly by Medicare, according to Services Australia. For most people the signature takes two seconds. The bigger question — the one few are asking at the counter — is what that digital tick actually authorises, and where your health information travels next.

What actually changed on 1 July

The reform is administrative, not clinical. Previously, bulk billing quietly assigned your Medicare benefit to the practice in the background. Now, when you are bulk billed for a GP visit, you may be asked to sign a digital or paper form, or confirm your consent another way, the Department of Health, Disability and Ageing states. After stakeholders raised concerns, the government added a 12-month transition period that also allows verbal assignment of benefit for all bulk billed patients in all settings.

That verbal option matters. It means you are not obligated to sign anything on a clinic tablet if you would rather not. But as clinics digitise their front desks, the default many practices are rolling out is an on-screen form — and that is where the data-privacy questions begin.

The consent form is not your health record — but it sits next to it

An IT security specialist will tell you to separate two things that feel like one at the counter. The bulk-billing consent is a payment authorisation: it confirms Medicare can pay your provider on your behalf. It is narrow. What worries privacy professionals is the wider ecosystem that same clinic software plugs into.

Under the Health Legislation Amendment (Modernising My Health Record – Sharing by Default) Act 2025, healthcare providers are now required by law to upload specific health information to My Health Record, starting with pathology and diagnostic imaging services. In January 2026, the government announced that medicines-related information from online prescribing services would be the next category shared by default, the Australian Digital Health Agency confirmed. In other words, more of your data is flowing into a central record automatically — whether or not you clicked anything at reception.

Who can see your data, and who controls it

Here is the reassuring part, and the part patients most often miss. Your My Health Record is private and can only be seen by you, your healthcare providers, and anyone else you choose to share it with. Consumers keep control and can manage privacy by setting access controls, according to the Office of the Australian Information Commissioner (OAIC), the independent regulator that oversees the system's privacy.

Those controls are real levers, not marketing. You can set a record access code so only providers you give the code to can open your record. You can restrict individual documents. You can switch on notifications that email or text you whenever a provider views or uploads to your record — a simple way to spot access you did not expect. Most Australians have never opened these settings. An IT professional would treat that as leaving your front door unlocked because you assume the street is quiet.

You can review the full framework and your rights on the OAIC's official My Health Record privacy page.

Why "sharing by default" changes the risk calculation

Registered providers must comply with security obligations set out in the My Health Records Act 2012 and the My Health Records Rules 2026 to keep their registration, the regulator notes. The system itself is government-owned and audited. The weaker links, security specialists warn, are usually at the edges: a clinic's own booking software, a third-party app you connected to your record, or a phishing email impersonating Medicare that harvests your myGov login.

Sharing-by-default means there is simply more information in one place, which raises the stakes if any of those edges is compromised. The 2026 rules tighten provider security, but they cannot patch a reused password or a fake "Medicare rebate" text. This is where the technology stops being the government's job and becomes yours.

What an expert would tell you to do this week

• Log in to My Health Record through myGov and read your access settings. Decide whether to add a record access code and switch on access notifications so you are alerted to every view.
• Turn on multi-factor authentication on your myGov account. It is the single biggest barrier between a leaked password and your full medical history.
• Treat unsolicited "Medicare" or "myGov" links with suspicion. Government agencies will not ask you to confirm your rebate through a link in an SMS. Type the address yourself.
• Ask at the desk which form you are signing. You are entitled to give verbal consent during the transition and to know that the bulk-billing tick is a payment authorisation, not a data-sharing agreement.
• Review connected apps. If you linked a health or fitness app to your record, confirm it still needs access and revoke what you no longer use.

None of this requires technical skill — but the interface can be confusing, especially for older patients or carers managing a record on someone else's behalf. If you are unsure how far your data reaches, or you suspect your myGov account has been accessed, an information-technology or cybersecurity consultant can walk you through locking down your account and auditing who has touched your record. For the payment and rights side of the new consent forms themselves, our guide on GP bulk-billing consent forms and your patient rights covers what you are actually agreeing to. For a wider look at how everyday apps handle Australian data, see our explainer on live-app data collection and your digital rights.

The 1 July change was designed to make bulk billing more transparent. Used well, that same transparency runs in your favour — but only if you open the settings the system already gives you.

This article is general information only and does not constitute medical, legal, or professional IT advice. For guidance specific to your situation, consult a qualified professional.