This report discusses the planning, developing and managing of security policies for the Commonwealth Government of Australia's 'My Health Record' system. It also analyzes the major risks in IT systems components, their consequences, inherent risks, and mitigation strategies. The report concludes with a risk register based on identified risks.