The My Health Record (MHR) system is an electronic health record system
that commenced operation in July 2012. Although the system was originally designed on an opt-in basis, in May 2017 the
government announced that the MHR system would transition to an opt-out system. Members of the Australian public were originally given a three-month period to
elect to opt-out. The deadline to opt-out was later extended to a four-month
period concluding on 15 November 2018.
In July and August 2018, concerns were raised in the media by medical
commentators, general practitioners, IT professionals and journalists about the
utility and security of the MHR system and whether members of the public should
exercise their right to 'opt-out' of the new system.
In this inquiry, the Community Affairs References Committee (committee) has
considered the views of a wide range of stakeholders to assess whether the MHR
system is working and how it can be improved to make MHR a more effective tool
to support patients and improve healthcare delivery.
What is MHR?
MHR is an online folder of summary documents relating to a healthcare
recipient's health that can be controlled by the individual. MHR can be used to
record information such as allergies, blood test results or medical conditions
a person has been diagnosed with.
Some witnesses described MHR as being like a 'drop box' for health
records: it provides a central place where copies of documents relating to a recipient's
healthcare can be stored electronically, but the contents of and access to that
box can be controlled by the healthcare recipient.
Figure 1: How does MHR work?
Source: Department of Health
(DOH) and Department of Human Services (DHS), Submission 22, p. 2.
When a healthcare recipient first accesses their MHR, it is likely to be
blank. When the healthcare recipient first visits their general practitioner,
nurse or pharmacist, two years' worth of Medicare information and Pharmaceutical
Benefits Scheme data will be uploaded to the healthcare recipient's MHR, unless
this function has been turned off by the healthcare recipient prior to the
Over time, other documents including a summary of the individual's
health, hospital discharge summaries, medication information, referral letters
and test results can also be uploaded to the central depository.
Once the health care recipient has registered, they can access their MHR
via the online portal or via a mobile phone application.
A key feature of the MHR is that the individual can control who can
access their health information. A healthcare recipient is able to set a Record
Access Control, which will protect their entire record, or they are able to set
a Document Access Control, which will restrict access to a particular document
in their record. Health care recipients can then provide the necessary codes to the doctors they
would like to have access to their MHR.
This facilitates the patient-centred flow of healthcare information
whilst balancing the healthcare recipient's right to privacy.
What are the expected benefits of MHR?
Proponents of MHR point out that there are a multitude of potential
benefits that may flow from having a personally controlled electronic health
The Australian Digital Health Agency (ADHA) advised the committee that
61 per cent of general practitioners and 79 per cent of pharmacists who have
used MHR have already observed or experienced one or more actual benefits from
use. Some of these benefits are considered below.
Improved patient care, patient
safety and medical communication
Submitters to the inquiry expect that MHR will lead to improved patient
care, safety and medical communication. Future Wise advised the committee that the lack of interoperability between
hospitals and general practitioners is a common source of medical error. MHR provides the ability for the hospital to attach discharge summaries, and event
summaries and test results, such as pathology or diagnostic imaging, which may
avoid these errors. MHR allows for information to be consolidated in one place, which may be convenient
for both consumers and clinicians.
Improved continuity of care between
MHR may also improve continuity of care for health care recipients when
visiting different health care professionals.
The Australian Bureau of Statistics data indicated that in 2016 almost 4 million
Australians saw more than three different health practitioners for the same
condition. People with Disabilities ACT Inc noted that research conducted by the
Australian Institute of Health and Welfare found that 17 per cent of people
with disabilities who saw three or more health professionals reported issues
caused by a lack of communication between them. MHR can allow an individual to share their health summary securely with each of
their healthcare providers to support better continuity of care between
Reduced need to recite medical
By having a consolidated electronic health record, there may be less
need for patients, who could be quite unwell, to explain their medical history
to multiple practitioners.
Submitters noted that a centralised health record would obviate the need
for health care recipients with complex symptoms and medications, to explain all
of their symptoms and history when they attend an emergency room or see a new
doctor. Similar benefits could also be gained by people with lower English language
proficiency, people with intellectual disabilities or consumers who move
between states or see practitioners in multiple locations.
Empower health care recipients
MHR may assist to empower health care recipients to more fully
participate in their own healthcare.
Currently, health recipients often do not get to see their own health
records. Consumers Health Forum of Australia noted that there is already an
information asymmetry that exists between health care recipients and health
professionals. By allowing health care recipients to see their own health
records and to control access to them, they may be empowered to play a more
active part in their own health care.
Reduce adverse drug events because
of medication errors
Adverse drug events are common. Each year 230 000 adverse medication
events lead to hospitalisation. MHR has the capacity to reduce those errors by having available a list of
medications that have been prescribed to the health care recipient and, if
health summary has been uploaded, a more complete picture of the patient's
health that may inform the medications pharmacists or doctors may prescribe.
Public health research
Information from healthcare recipients who do not elect to 'Withdraw
Participation' may have their de-identified data used for public health
research purposes. The data MHR contains, when aggregated, may provide researchers with ability to
more comprehensively understand the use, cost and effectiveness of health
services and the outcomes that healthcare recipients are achieving as a result
of those services. A healthcare recipient can nominate not to have their data used for secondary
use purposes by selecting the 'withdraw participation' button in their MHR.
Development of the MHR system
The MHR system has been in development for some time.
In 2009 the National Health and Hospitals Reform Commission recommended
that 'by 2012 every Australian should be able to have a personal electronic
health record that will at all times by owned and controlled by that person'.
To enable individuals to have a personal electronic health record, a
system was required to assign all Australians with an identifying number that
would be unique to them to ensure that the correct health information was
assigned to the correct person. In 2010, the Healthcare Identifiers Act 2010 was passed for that purpose.
In 2011, the Personally Controlled Electronic Health Records Bill 2011
(PCEHR Bill) was introduced to establish the legal framework for a national
electronic health records system. The PCEHR Bill was referred to the Senate
Community Affairs Legislation Committee (Legislation Committee) for inquiry and
report. In that report, the Legislation Committee made three recommendations:
- that the review of the Act explicitly consider whether the
Secretary of the Department of Health was the appropriate person to be the
- that the review of the Act consider the opt-in design and
consider the feasibility of transitioning to an opt-out system; and
that the Bill be passed.
The then Government made a number of amendments in response to concerns
raised during the committee's inquiry and the Bill was passed by the Parliament.
In 2013 a review of the Personal Electronic Health Record system was
conducted by Mr Richard Royle, Dr Steve Hambleton and Mr Andrew Walduck (Royle
Review). The Royle Review made 38 recommendations including renaming the system MHR and
transitioning to an opt-out system. Legislation was introduced to give effect to the change of name in 2015.
2016 MHR participation trials
In 2016 DOH commissioned four trial sites: two opt-in sites—covering a
number of general practices in Perth, Western Australia, and at the Ballarat
Hospital in Victoria—and two opt-out trial sites in the North Queensland and
the Nepean Blue Mountains Primary Health Network areas.
The evaluation of those trials found that there was evidence to support
'the stakeholder consensus that opt-out should be the participation model into
the future'. It found that there were statistically significant increases in: individual
awareness of the MHR, individual and healthcare provider recall of
communication about the MHR; individual registration and use of the MHR system;
healthcare provider organisations registered to use the MHR system, health
provider document uploads to and viewings of MHRs.
Two other findings from the trials are notable. First, once the benefits
of MHR were explained, focus group participants 'said that their concerns about
security and privacy, or about the fact that a My Health Record had been
created, disappeared'. The second is that the focus group participants strongly suggested that a
'bigger emphasis on awareness and education' would be required for a national
These trials and their evaluation have guided some aspects of the
national rollout of MHR, such as the communication strategy.
In 2015, Parliament provided an option for the Minister for Health to
make rules to provide for a national opt-out model after consulting with the
relevant Ministerial Council comprising representatives of the state and territory
In May 2017, the Australian Government announced that it would
transition to an opt-out model as part of the 2017–18 Budget. The rule giving legal effect to that announcement was made on 30 November
The period to allow individuals to opt-out of the MHR system commenced
on 16 July 2018 and it will conclude on 15 November 2018.
There are a number of ways an individual can elect to opt-out.
To opt out, an individual needs to verify their identity by producing
their Medicare Card or Department of Veteran's Affairs (DVA) card and either
their driver licence, passport or ImmiCard.
Under the current system there is the ability to request cancellation of
their registration in the MHR system.
The Parliament is currently considering the My Health Records Amendment
(Strengthening Privacy) Bill 2018 (Bill). This Bill would allow for a person to
request deletion of records that are held about them in the MHRs system.
Current participation in the system
The Chief Executive of the ADHA, Mr Tim Kelsey, told the committee that,
as at 12 September 2018, approximately 900 000 people have opted out, and that
the opt-out rate is three percent. The committee heard that it was not possible to provide accurate data as there
are a number of channels available to people to opt-out of the system:
internet, telephone and on paper. Ms Caroline Edwards from DOH explained that
the paper returns will not be processed until after the opt-out period. Mr Kelsey advised the committee:
Maybe the salient figures would be 6.1 million currently have
a My Health Record. Since the start of opt out 181,000 have opted in. So we've
had roughly 900,000 opting out, your correct, but at the same time 181,000
people have opted in to the system, since opt out, obviously wanting to take
advantage of the benefits ahead of opt out being realised later this year. What
we're saying is that the total number of 6.1 million incorporates those who
have opted in since the start of opt out.
Mr Kelsey also advised the committee that the ADHA had anticipated
significantly higher levels of opt out than it was currently seeing and that
the opt-in rates are very much higher than the rates seen over the previous six
What structures are currently in place to guard against misuse?
There are a number of structures and penalties in place to guard against
misuse of data contained in a MHR.
Under the My Health Records Act 2012, there are heavy penalties
for the unauthorised use, collection or disclosure of health information. The
criminal penalty is up to two years imprisonment and/or $25 200 for an
individual or $126 000 for bodies corporate. The civil penalty is up to
$126 000 for an individual or $630 000 for a body corporate.
Knowingly breaching restricted data may lead to a criminal penalty under
the Criminal Code Act 1995.
The Office of the Australian Information Commissioner is empowered under
the My Health Records Act 2012 and the My Health Records (Information
Commissioner Enforcement Powers) Guidelines 2016 to investigate breaches to the
My Health Records Act and to address them through conciliation, education or
enforcement actions, including enforceable undertakings, injunctions or civil
There are also a number of information technology measures that protect
the MHR system from unauthorised access. These are considered in greater detail
in the next chapter.
Structure of the report
This report is organised into five chapters.
1.47 Chapter 2 considers concerns about the privacy and security of
1.48 Chapter 3 considers concerns that have been raised by submitters
about using the MHR system.
1.49 Chapter 4 will consider the reasons the opt-out model was
adopted, why some groups are advocating for a return to opt-in and concerns
people have raised about their experiences trying to opt-out.
1.50 Chapter 5 will contain the committee's conclusions and
Conduct of the inquiry
The Senate referred the MHR system inquiry to the committee on 15 August
2018 for inquiry and report by 8 October 2018. On 19 September 2018, the Senate agreed to extend the time for reporting to 12 October
2018. The committee received further extensions on 12 October and 17 October 2018 to
finalise its report. The committee reported to the Senate on 18 October 2018.
While the committee was conducting this inquiry, the Legislation
Committee was conducting an inquiry into the My Health Records Amendment
(Strengthening Privacy) Bill 2018. On 28 August 2018 the committee and the Legislation
Committee agreed to share evidence relevant to each inquiry. A statement was
placed on each committee's website to that effect.
In accordance with its usual practice, the committee advertised the
inquiry on its website and wrote to 57 individuals and organisations inviting
submissions by 14 September 2018. The committee continued to accept
submissions after that date.
The committee received 118 submissions from individuals and
organisations. A list of submissions received by the committee is available at
Appendix 1 and copies of public submissions can be accessed via the committee's
The committee held three public hearings in Canberra on 11 September, 17
September and 20 September 2018. A list of the witnesses who appeared at each
hearing is available at Appendix 2.
The committee thanks all the individuals and organisations who submitted
to the inquiry and appeared as witnesses.
Notes on references
References in this report are to Committee Hansard are to proof
transcripts. Page numbers may vary between the proof and official transcripts.
Navigation: Previous Page | Contents | Next Page