My Health Record (MHR) is a national public system for making health information about a healthcare recipient available for the purposes of providing healthcare to the recipient.

The Australian Digital Health Agency (ADHA) was established as a corporate Commonwealth entity in 2016, at which time it became MHR system operator.

There has been recent parliamentary interest in government procurement. Procurement of large public IT systems can raise risks relating to obsolescence, security and interoperability. This audit provides assurance to the Australian Parliament about whether ADHA has effectively managed MHR procurement.

Key findings:

• ADHA’s procurement and contract management of the My Health Record National Infrastructure Operator has been partly effective. Effectiveness has been diminished by poor procurement planning and failure to observe core elements of the Commonwealth Procurement Rules.
• ADHA’s governance framework for contract management and procurement is largely fit for purpose. There are policies and guidance for procurement and contract management, although probity guidance could be improved.
• ADHA’s management of the National Infrastructure Operator contract has been partly effective. The identification and assessment of commercial risk has been limited. The effectiveness of day-to-day administration of the contract is diminished by contract management planning that is not fully fit for purpose.