Introduction

1.1        The My Health Record (MHR) system is an electronic health record system that commenced operation in July 2012.[1] Although the system was originally designed on an opt-in basis, in May 2017 the government announced that the MHR system would transition to an opt-out system.[2] Members of the Australian public were originally given a three-month period to elect to opt-out. The deadline to opt-out was later extended to a four-month period concluding on 15 November 2018.[3]

1.2        In July and August 2018, concerns were raised in the media by medical commentators, general practitioners, IT professionals and journalists about the utility and security of the MHR system and whether members of the public should exercise their right to 'opt-out' of the new system.^[4]

1.3        In this inquiry, the Community Affairs References Committee (committee) has considered the views of a wide range of stakeholders to assess whether the MHR system is working and how it can be improved to make MHR a more effective tool to support patients and improve healthcare delivery.

What is MHR?

1.4        MHR is an online folder of summary documents relating to a healthcare recipient's health that can be controlled by the individual. MHR can be used to record information such as allergies, blood test results or medical conditions a person has been diagnosed with.^[5]

1.5        Some witnesses described MHR as being like a 'drop box' for health records: it provides a central place where copies of documents relating to a recipient's healthcare can be stored electronically, but the contents of and access to that box can be controlled by the healthcare recipient.[6]

Figure 1: How does MHR work?

Source: Department of Health (DOH) and Department of Human Services (DHS), Submission 22, p. 2.

1.6        When a healthcare recipient first accesses their MHR, it is likely to be blank. When the healthcare recipient first visits their general practitioner, nurse or pharmacist, two years' worth of Medicare information and Pharmaceutical Benefits Scheme data will be uploaded to the healthcare recipient's MHR, unless this function has been turned off by the healthcare recipient prior to the visit.[7]

1.7        Over time, other documents including a summary of the individual's health, hospital discharge summaries, medication information, referral letters and test results can also be uploaded to the central depository.[8]

1.8        Once the health care recipient has registered, they can access their MHR via the online portal or via a mobile phone application.[9]

1.9        A key feature of the MHR is that the individual can control who can access their health information. A healthcare recipient is able to set a Record Access Control, which will protect their entire record, or they are able to set a Document Access Control, which will restrict access to a particular document in their record.[10] Health care recipients can then provide the necessary codes to the doctors they would like to have access to their MHR.[11]

1.10      This facilitates the patient-centred flow of healthcare information whilst balancing the healthcare recipient's right to privacy.

What are the expected benefits of MHR?

1.11      Proponents of MHR point out that there are a multitude of potential benefits that may flow from having a personally controlled electronic health record.

1.12      The Australian Digital Health Agency (ADHA) advised the committee that 61 per cent of general practitioners and 79 per cent of pharmacists who have used MHR have already observed or experienced one or more actual benefits from use.[12] Some of these benefits are considered below.

Improved patient care, patient safety and medical communication

1.13      Submitters to the inquiry expect that MHR will lead to improved patient care, safety and medical communication.[13] Future Wise advised the committee that the lack of interoperability between hospitals and general practitioners is a common source of medical error.[14] MHR provides the ability for the hospital to attach discharge summaries, and event summaries and test results, such as pathology or diagnostic imaging, which may avoid these errors.[15] MHR allows for information to be consolidated in one place, which may be convenient for both consumers and clinicians.[16]

Improved continuity of care between providers

1.14      MHR may also improve continuity of care for health care recipients when visiting different health care professionals.[17]

1.15      The Australian Bureau of Statistics data indicated that in 2016 almost 4 million Australians saw more than three different health practitioners for the same condition.[18] People with Disabilities ACT Inc noted that research conducted by the Australian Institute of Health and Welfare found that 17 per cent of people with disabilities who saw three or more health professionals reported issues caused by a lack of communication between them.[19] MHR can allow an individual to share their health summary securely with each of their healthcare providers to support better continuity of care between providers.[20]

Reduced need to recite medical history

1.16      By having a consolidated electronic health record, there may be less need for patients, who could be quite unwell, to explain their medical history to multiple practitioners.

1.17      Submitters noted that a centralised health record would obviate the need for health care recipients with complex symptoms and medications, to explain all of their symptoms and history when they attend an emergency room or see a new doctor.[21] Similar benefits could also be gained by people with lower English language proficiency, people with intellectual disabilities or consumers who move between states or see practitioners in multiple locations.[22]

Empower health care recipients

1.18      MHR may assist to empower health care recipients to more fully participate in their own healthcare.

1.19      Currently, health recipients often do not get to see their own health records. Consumers Health Forum of Australia noted that there is already an information asymmetry that exists between health care recipients and health professionals. By allowing health care recipients to see their own health records and to control access to them, they may be empowered to play a more active part in their own health care.[23]

Reduce adverse drug events because of medication errors

1.20      Adverse drug events are common. Each year 230 000 adverse medication events lead to hospitalisation.[24] MHR has the capacity to reduce those errors by having available a list of medications that have been prescribed to the health care recipient and, if health summary has been uploaded, a more complete picture of the patient's health that may inform the medications pharmacists or doctors may prescribe.[25]

Public health research

1.21      Information from healthcare recipients who do not elect to 'Withdraw Participation' may have their de-identified data used for public health research purposes.[26] The data MHR contains, when aggregated, may provide researchers with ability to more comprehensively understand the use, cost and effectiveness of health services and the outcomes that healthcare recipients are achieving as a result of those services.[27] A healthcare recipient can nominate not to have their data used for secondary use purposes by selecting the 'withdraw participation' button in their MHR.[28]

Development of the MHR system

1.22      The MHR system has been in development for some time.

1.23      In 2009 the National Health and Hospitals Reform Commission recommended that 'by 2012 every Australian should be able to have a personal electronic health record that will at all times by owned and controlled by that person'.[29]

1.24      To enable individuals to have a personal electronic health record, a system was required to assign all Australians with an identifying number that would be unique to them to ensure that the correct health information was assigned to the correct person. In 2010, the Healthcare Identifiers Act 2010 was passed for that purpose.[30]

1.25      In 2011, the Personally Controlled Electronic Health Records Bill 2011 (PCEHR Bill) was introduced to establish the legal framework for a national electronic health records system. The PCEHR Bill was referred to the Senate Community Affairs Legislation Committee (Legislation Committee) for inquiry and report.[31] In that report, the Legislation Committee made three recommendations:

• that the review of the Act explicitly consider whether the Secretary of the Department of Health was the appropriate person to be the system operator;
• that the review of the Act consider the opt-in design and consider the feasibility of transitioning to an opt-out system; and
• that the Bill be passed.[32]

1.26      The then Government made a number of amendments in response to concerns raised during the committee's inquiry and the Bill was passed by the Parliament.[33]

1.27      In 2013 a review of the Personal Electronic Health Record system was conducted by Mr Richard Royle, Dr Steve Hambleton and Mr Andrew Walduck (Royle Review).[34] The Royle Review made 38 recommendations including renaming the system MHR and transitioning to an opt-out system.[35] Legislation was introduced to give effect to the change of name in 2015.[36]

2016 MHR participation trials

1.28      In 2016 DOH commissioned four trial sites: two opt-in sites—covering a number of general practices in Perth, Western Australia, and at the Ballarat Hospital in Victoria—and two opt-out trial sites in the North Queensland and the Nepean Blue Mountains Primary Health Network areas.[37]

1.29      The evaluation of those trials found that there was evidence to support 'the stakeholder consensus that opt-out should be the participation model into the future'.[38] It found that there were statistically significant increases in: individual awareness of the MHR, individual and healthcare provider recall of communication about the MHR; individual registration and use of the MHR system; healthcare provider organisations registered to use the MHR system, health provider document uploads to and viewings of MHRs.[39]

1.30      Two other findings from the trials are notable. First, once the benefits of MHR were explained, focus group participants 'said that their concerns about security and privacy, or about the fact that a My Health Record had been created, disappeared'.[40] The second is that the focus group participants strongly suggested that a 'bigger emphasis on awareness and education' would be required for a national change.[41]

1.31      These trials and their evaluation have guided some aspects of the national rollout of MHR, such as the communication strategy.[42]

Opt-out model

1.32      In 2015, Parliament provided an option for the Minister for Health to make rules to provide for a national opt-out model after consulting with the relevant Ministerial Council comprising representatives of the state and territory governments.[43]

1.33      In May 2017, the Australian Government announced that it would transition to an opt-out model as part of the 2017–18 Budget.[44] The rule giving legal effect to that announcement was made on 30 November 2017.[45]

1.34      The period to allow individuals to opt-out of the MHR system commenced on 16 July 2018 and it will conclude on 15 November 2018.[46]

Opting out

1.35      There are a number of ways an individual can elect to opt-out.

1.36      To opt out, an individual needs to verify their identity by producing their Medicare Card or Department of Veteran's Affairs (DVA) card and either their driver licence, passport or ImmiCard.

1.37      Under the current system there is the ability to request cancellation of their registration in the MHR system.[47]

1.38      The Parliament is currently considering the My Health Records Amendment (Strengthening Privacy) Bill 2018 (Bill). This Bill would allow for a person to request deletion of records that are held about them in the MHRs system.[48]

Current participation in the system

1.39      The Chief Executive of the ADHA, Mr Tim Kelsey, told the committee that, as at 12 September 2018, approximately 900 000 people have opted out, and that the opt-out rate is three percent.[49] The committee heard that it was not possible to provide accurate data as there are a number of channels available to people to opt-out of the system: internet, telephone and on paper. Ms Caroline Edwards from DOH explained that the paper returns will not be processed until after the opt-out period.[50] Mr Kelsey advised the committee:

Maybe the salient figures would be 6.1 million currently have a My Health Record. Since the start of opt out 181,000 have opted in. So we've had roughly 900,000 opting out, your correct, but at the same time 181,000 people have opted in to the system, since opt out, obviously wanting to take advantage of the benefits ahead of opt out being realised later this year. What we're saying is that the total number of 6.1 million incorporates those who have opted in since the start of opt out.[51]

1.40      Mr Kelsey also advised the committee that the ADHA had anticipated significantly higher levels of opt out than it was currently seeing and that the opt-in rates are very much higher than the rates seen over the previous six years.[52]

What structures are currently in place to guard against misuse?

1.41      There are a number of structures and penalties in place to guard against misuse of data contained in a MHR.

1.42      Under the My Health Records Act 2012, there are heavy penalties for the unauthorised use, collection or disclosure of health information. The criminal penalty is up to two years imprisonment and/or $25 200 for an individual or $126 000 for bodies corporate. The civil penalty is up to $126 000 for an individual or $630 000 for a body corporate.[53]

1.43      Knowingly breaching restricted data may lead to a criminal penalty under the Criminal Code Act 1995.[54]

1.44      The Office of the Australian Information Commissioner is empowered under the My Health Records Act 2012 and the My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 to investigate breaches to the My Health Records Act and to address them through conciliation, education or enforcement actions, including enforceable undertakings, injunctions or civil penalties.[55]

1.45      There are also a number of information technology measures that protect the MHR system from unauthorised access. These are considered in greater detail in the next chapter.

Structure of the report

1.46      This report is organised into five chapters.

1.47      Chapter 2 considers concerns about the privacy and security of the MHR.

1.48      Chapter 3 considers concerns that have been raised by submitters about using the MHR system.

1.49      Chapter 4 will consider the reasons the opt-out model was adopted, why some groups are advocating for a return to opt-in and concerns people have raised about their experiences trying to opt-out.

1.50      Chapter 5 will contain the committee's conclusions and recommendations.

Conduct of the inquiry

1.51      The Senate referred the MHR system inquiry to the committee on 15 August 2018 for inquiry and report by 8 October 2018.[56] On 19 September 2018, the Senate agreed to extend the time for reporting to 12 October 2018.[57] The committee received further extensions on 12 October and 17 October 2018 to finalise its report.[58] The committee reported to the Senate on 18 October 2018.

1.52      While the committee was conducting this inquiry, the Legislation Committee was conducting an inquiry into the My Health Records Amendment (Strengthening Privacy) Bill 2018. On 28 August 2018 the committee and the Legislation Committee agreed to share evidence relevant to each inquiry. A statement was placed on each committee's website to that effect.[59]

1.53      In accordance with its usual practice, the committee advertised the inquiry on its website and wrote to 57 individuals and organisations inviting submissions by 14 September 2018. The committee continued to accept submissions after that date.

1.54      The committee received 118 submissions from individuals and organisations. A list of submissions received by the committee is available at Appendix 1 and copies of public submissions can be accessed via the committee's website.

1.55      The committee held three public hearings in Canberra on 11 September, 17 September and 20 September 2018. A list of the witnesses who appeared at each hearing is available at Appendix 2.

1.56      The committee thanks all the individuals and organisations who submitted to the inquiry and appeared as witnesses.

Notes on references

1.57      References in this report are to Committee Hansard are to proof transcripts. Page numbers may vary between the proof and official transcripts.

Navigation: Previous Page | Contents | Next Page