Introduction by Croakey:
As has been widely reported today (Wednesday), Federal Health Minister Greg Hunt has finally bowed to intense pressure over privacy concerns for the My Health Record, particularly on access to medical records by police and government agencies.
The Minister released a statement late on Tuesday after what were described by media as “crisis talks” with the Australian Medical Association and Royal Australian College of GPs.
In a statement that tried to shift as much blame as possible to Labor for its 2012 legislation, Hunt said he would introduce amendments to the legislation to ensure:
- no medical record can be released to police or government agencies, for any purpose, without a court order
- if someone wishes to cancel their record they will be able to do so permanently and it will be deleted from the system.
Hunt said he would look to implement and introduce these changes as soon as possible and the government would work with medical leaders “on additional communications to the public about the benefits and purpose of the My Health Record, so they can make an informed choice”.
He told media outlets today that he is “disposed” to agreeing to requests from the AMA and Royal Australian College of GPs to extend the My Health Record opt-out period, due to end on October 15, for another month, subject to talks this week with his state and territory colleagues at the COAG Health Council in Alice Springs.
Hunt’s shift has been widely welcomed, including by the AMA, the RACGP and the National Rural Health Alliance, which said the government had “moved to allay fears about the system, by making it more secure, and easier to leave if people don’t find it to their liking.”
“My Health Record always promised compelling health benefits, especially for people living in rural and remote areas. Now there are even more reasons to embrace the system,” Alliance CEO Mark Diamond said.
But, as Doctors Reform Society President Tim Woodruff outlines in the post below, that’s not remotely the end of the concerns about My Health Record. He says a key and enduring concern is that the opt out process assumes that all those who aren’t aware of the system or can’t understand it will be comfortable having a record generated. He writes:
This is a fundamental breach of the privacy of the doctor/patient or health professional/patient relationship. It is not informed consent. It is not about citizen engagement.
He says the Government should revert to the opt in process of enrolment, sort out the rules for secondary use of data and then improve its processes for encouraging people to enrol.
Others like the Australian Council of Social Service (ACOSS) want much broader consultation on the issues than just the two main medical groups. CEO Cassandra Goldie said:
The voices of the medical profession are important in this discussion, but it will also be critical that the input of community organisations and consumer representatives is sought and informs the legislation as it is drafted.”
Labor’s Health spokeswoman Catherine King has also signalled a continuing fight, saying Hunt’s response is “completely inadequate and will do little to allay community fears about privacy and security”.
King called for the government to “suspend the My Health Record rollout until this mess can be cleaned up” and raised continuing concerns that it might put at risk the safety of women fleeing abusive partners.
See also a selection of tweets below raising continuing issues for My Health Record, including this link to a ZDNet article tweeted by Ben Harris-Roxas (at @ben_hr) which reports:
The Office of the Australian Information Commissioner (OAIC) has released its first full quarterly update since the Notifiable Data Breach scheme (NDB) came into effect in February, and once again, private health continues to be the most breached sector.”
In response to Hunt’s claims that there have been no privacy breaches under the My Health Record to date, ABC news journalist Simon Elvery, tweeting at @drzax, linked to this report: https://www.oaic.gov.au/about-us/corporate-information/annual-reports/ehealth-and-hi-act-annual-reports/annual-report-of-the-australian-information-commissioner-s-activities-in-relation-to-digital-health-2016-17
Here are earlier stories on My Health Record published at Croakey if you’d like to catch up: https://croakey.org/?s=my+health+record.
Tim Woodruff writes:
The Federal Government has finally realised that there are major problems with its implementation of the My Health Record.
The glaring issue of the decrease in controls on accessing records for non medical purposes by police, security services, and welfare services has been exposed and legislation will now be passed to address this.
The fact that it took so long for the Government to accept there was a problem is a very concerning sign of either the lack of understanding of the Government and bureaucracy or a lack of concern for individuals’ rights or both.
But this is only one of the problems with My Health Record.
Opt in vs opt out: Informed vs uninformed consent
The opt out system requires those people who do not want such a record to go online by October 15 and follow the instructions to opt out or call a help line if needed.
That opt out period may now be extended for a month but that won’t necessarily address concerns.
For a person to opt out requires an awareness that a My Health Record system is in place, that the person is capable of going online or finding the Help number and understanding the instructions. If a person is not aware of My Health Record or can’t understand what is required then a record will automatically be created, whether on October 15 or November 15 2018.
The process assumes that all those who aren’t aware of the system or can’t understand it will be comfortable having a record generated.
This is a fundamental breach of the privacy of the doctor/patient or health professional/patient relationship. It is not informed consent. It is not about citizen engagement.
The opt out option was chosen because after five years of an opt in system the uptake was only about 6 million. Since its inception the My Health Record required patients or individuals to decide whether they wanted to have a record.
Usually that has been through their general practitioner asking them if they wanted to be a part of the system. It required advice and discussion about the pros and cons.
Because it wasn’t generating enough interest from doctors or patients, the decision was made to change from opt in to opt out. The failure of opt in was a failure of Government leadership in advocating to doctors and patients the value of the scheme. The easy way out has been taken.
Changing to opt out removes the responsibility for enrolment in My Health Record from the Government and doctors. It is a lazy solution. It indicates that Government, of itself and through doctors, have not been able to sell the advantages of the concept to enough of the public.
Instead in their commendable quest to get as many people enrolled as possible they have negated their responsibility for explaining to patients and the public, relying instead on the lack of awareness, of knowledge, and of understanding of the public about what is being foisted upon them.
On the ground, what does it mean?
Of five patients I asked yesterday about My Health Record, none had heard of it.
Of five patients I asked last week from a middle/upper class suburb, three had heard of it and some were happy to have a record because they said they had nothing in their records which would embarrass them.
Many however, will struggle to understand the positives or the negatives unless someone has the time to explain the details, and some will not appreciate how accessible their personal information will be or how to control it.
Secondary use of data
The second major area of concern is the secondary use of the data. The Federal Government has a framework to guide this secondary use. It states:
One of the functions of the System Operator under the MHR Act (section 15(ma)) is ‘to prepare and provide de-identified data for research or public health purposes’. This document also addresses the secondary use of identified MHR data, noting that the System Operator is authorised to collect, use and disclose an individual’s health care information (i.e. identifiable information) with the consent of the individual (section 66(2)).
The framework was completed in May 2018. The Federal Government is only now starting to implement that framework.
It is a guide. We don’t know yet what the rules will be. Yet the data will be gathered almost automatically after October 15, 2018.
This is back to front. Rules should be determined first so people can see them, then people can make decisions about their data. Once again, this is not about informed consent.
Benefits
The concept of My Health Record is excellent. It may save lives.
It certainly has the potential to make our health system more efficient with less duplication of tests, fewer phone calls to find data from different health care providers, less reliance on a patient’s memory of the drugs they are on and the tests and procedures they have had and the different doctors they have seen.
The benefits may be overstated to date. In terms of numbers of lives saved there is no figure and it would be hard to measure but is real. Efficiency gains would save time and money. Patients would benefit to some degree. The main beneficiaries of the efficiency gains are probably health care providers who don’t have to chase data.
Illegal use of data
The last concern however is that of illegal access to data. No data is safe. We can have world’s best practice security and still get hacked.
This risk has to be weighed against the benefits.
The very fact that it is intended to be such a comprehensive data base increases the risk of hacking far above the lack of security of a doctor’s individual record.
The fact that the Government has failed to appreciate the problems with legal use of data gives us little confidence that they do have world’s best practice security in place.
The Government should opt out
If this illegal use of data was the only concern, patients could then make an informed decision, and be understandably concerned about how competent the Government is in minimising that risk.
However, the current implementation process is deeply flawed. It is about uninformed consent. It is an attack on privacy.
The Government itself should opt out until it understands the issues. It should revert to the opt in process of enrolment, sort out the rules for secondary use of data and then improve its processes for encouraging people to enrol.
Tim Woodruff is an arthritis specialist and President of the Doctors Reform Society, an organisation dedicated to society where preventable causes of inequity are eliminated.
Via Twitter
