Chapter 2

Is My Health Record secure?

2.1        Throughout this inquiry, submitters have raised concerns about the security of the My Health Record system (MHR). This chapter will consider the design of the system and the protections it includes, what individuals can do to enhance the privacy of their own records and whether those protections are sufficient to protect vulnerable members of the community. The chapter will then examine whether the record can be legitimately accessed by employer nominated doctors or law enforcement agencies and what secondary or tertiary purposes MHR data could be used for.

Is the design of the system secure?

2.2        Submitters and witnesses to the inquiry expressed concerns about the risks of unauthorised access to MHR data. Submitters who raised these concerns commonly referred to the way the system was designed.

Centralised database

2.3        There are two broad ways of designing a data management system: the first is a distributed or federated model where data is stored in decentralised repositories.[1] The second model is a centralised repository or database. MHR is a form of centralised database.[2]

2.4        Mr Grahame Grieve from Health Intersections explained the difference between a centralised database like MHR and a distributed system:

In a centralised database, all the information flows up to the central repository and then out of it. It's like a hub-and-spoke model with public transport: everyone goes to the city to get anywhere. Whereas a distributed system means you go directly to the source of the information and hold it there.[3]

2.5        Mr Grieve explained to the committee that there is a balance that needs to be managed between utility and privacy when considering which model should be adopted:

As you build a single repository, you have the benefits of scale and the problems of broad access. That's why there's space for multiple scales of repository to choose the optimal point for a particular context. For some people there is an issue that we want everybody's medications to be available for drug-to-drug interaction testing. On the other hand, making everyone's medications available for that has privacy concerns...[4]

2.6        As an example of the clinical benefits that can come from having a centralised database with lower privacy restrictions, Mr Kelsey from the Australian Digital Health Agency (ADHA) explained that the Northern Territory's experience with its e-health record indicated that having no privacy restrictions meant that clinicians could obtain the information that they needed at the time it was needed and that citizens could obtain the clinical benefits of having an electronic health record without needing to engage with it.[5]

Risk of external unauthorised access

2.7        Some submitters raised concerns that having broad access to a centralised database makes it hard to secure. The Centre for Digital Business described the design of MHR as 'a centralised database with widespread access at the edge'.[6] That means that the data for MHR is held in a centralised database but that a large number of healthcare providers are granted access to records in the database. Most submitters considered that there would be approximately 900 000 health practitioners who would have access to the central repository.[7]

2.8        The Centre for Digital Business explained that having so many potential access points was a potential source of vulnerability for the system if those access points could not be properly secured:

A system is only as resilient as its weakest link. Even if "military grade" security applies to the centralised database... securing access at the edge involving some 900,000 individuals in a great variety of environments, is a far greater almost impossible challenge.[8]

2.9        A number of other submitters and witnesses, such as information technology specialists Dr Robert Merkel and Mr Paul Power, were also concerned that keeping the log-in mechanisms and passwords of 900 000 health practitioners secure may be a challenge.[9]

2.10      This concern is particularly acute in health professions where existing practices can be lax.[10] The Information and Privacy Commission of New South Wales told the committee that poor information practices, such as passwords being kept next to access terminals, keeping systems logged in for faster access, failing to limit access to only essential staff and using generic logins, were becoming more common.[11]

2.11      Against that backdrop, the Centre for Digital Business considered that the security challenge facing MHR was 'practically unresolvable'.[12]

2.12      The ADHA advised the committee that healthcare organisations must connect to the network through conformant software with a secure and encrypted connection that requires two-factor identification in addition to any local authentication process.[13]

2.13      Concerns that the system may not be able to be secured at the health practitioners' point of access was given greater prominence because a centralised database is also potentially a more substantial target for cyber-criminals because it contains a large amount of valuable data.[14]

2.14      Medical data is considered to be valuable to health recipients and to clinicians,[15] but it is also potentially valuable for commercial and identity fraud purposes.[16] Some witnesses described the aggregation of valuable data in one database as a 'honey pot' that may attract criminals.[17]

2.15      Dr Merkel told the committee that he believed that the number of people with legitimate access increased the possibility of a successful attack by criminals because it was inevitable that not all of the health practitioners will be able to keep their accounts secure:

...if you have that many people with legitimate access, the odds of somebody electronically impersonating that person by stealing their passwords and gaining access to their account—the other things you need to get on the system—it's inevitable that criminals will find ample people who, for whatever reason, have not kept their accounts secure. This is what hackers do. They're very skilled at it.[18]

2.16      Dr Merkel said that it may also be reasonable to assume that some of the groups who may seek to attack a central database will have sophisticated operations:

Some of those individuals and organisations are extremely well resourced, skilled and determined, so the data in My Health Record needs to be extremely well protected. And, while the core system may well indeed be well protected, my understanding is that hundreds of thousands of health practitioners will have access to My Health Record information, and the log-in mechanisms for some of the ways you can get in and access that data are considerably less hacker-resistant than they should be.[19]

2.17      Some submitters considered that if the central database is breached, the attacker is likely to obtain broad access to the database.[20]

2.18      For this reason, some submitters favoured a federalised or decentralised model.[21] One of the benefits of a decentralised model is that less information is contained in each system, making the risk of disruption or unauthorised access smaller.[22]

2.19      However, the committee heard that when the MHR system was first designed, a federated model was not really possible and the system that exists is limited by those initial design choices:

The design of the system and the standards it is based on were state of the art in 2007. Although a more distributed design was initially planned, it is now, unfortunately, a centralised national database of static summary documents. This was an inevitable consequence of the technical standards used at the time...[23]

2.20      Professor Chris Bain, a digital health expert, told the committee that whilst a distributed model might be preferable from a technical perspective, it is not the model that currently exists and it would be a substantial investment to change it:

Some people have put forward technical architectures where the information isn't actually held all in one place. You might have demographic data held in one repository, general practice data held in another repository and hospital data held in another repository and you bring it together in a virtual view, if you like, but it never actually sits in one large database. There are arguments for that, but we don't have that in front of us at the minute.[24]

Protecting the system

2.21      The ADHA accepts that the system needs to be able to protect Australia's health information for the system to have legitimacy:

The Agency understands that healthcare information is some of the most private information people have, and that the success of Australia's digital health program is reliant on secure digital operations and respecting people's rights to privacy.[25]

2.22      The ADHA advised the committee that it is aware that certain safeguards are vulnerable and so it has developed a security design called 'defence in depth'.[26] This security design employs a range of security measures that operate simultaneously to protect the data that has been entrusted to it. This includes comprehensive security monitoring, process and technology security controls, security assurances and a dedicated security operations management team.[27]

2.23      The ADHA informed the committee that the system has been certified and accredited under the Australian Government Information Security Manual and the Protecting Security Policy Framework by an independent assessor.[28]

2.24      The ADHA also notes that there are stringent penalties and criminal penalties attached to the misuse of MHR information.[29]

2.25      Future Wise noted that this is an important area to get right because medical privacy, once breached, cannot be restored:

Privacy of medical confidentiality is a one-way door; penalties and sanctions may serve as deterrents, or as compensation for the loss of privacy, but neither give individuals their privacy back if it is breached.[30]

Is MHR less secure than the existing system?

2.26      In determining how much weight to afford to the above concerns, some submitters stressed that they should be considered against the status quo that exists for the current circulation of medical information.

2.27      A lack of interoperability between clinical systems means that Australian health practitioners still largely rely on transmitting documents by fax.[31] Dr Chris Moy from the Australian Medical Association explained that fax is not a very private or effective method of communicating important health information:

...I get a call in the middle of a consultation, I have other patients in front of me, I try to rustle together a few bits of information and I fax it away. This isn't particularly private, because I don't know whether it ends up where it is [needed], and it's absolutely no use if I'm not there after hours.[32]

2.28      Dr Moy told the committee that he believed it was important for the discussion about privacy to start from an understanding of the vulnerabilities in the current system:

The problem is that the current debate so far has not been an apple versus apple situation. Really, we've had a debate about My Health Record versus this sort of mythical utopia of perfect privacy: it's not been a debate about My Health Record versus the sad reality of this fax land and all the harm that goes with it.[33]

2.29      The current system is vulnerable to unauthorised access. One submitter noted that:

In 2018 there has been well-publicised disciplinary action against healthcare workers in South Australia and Western Australia for inappropriately accessing individual records to which they had no clinical need to access, highlighting the importance of the "insider threat" to privacy.[34]

2.30      With the current procedures for handling medical records, healthcare recipients have no way of knowing who has viewed, accessed or shared components of their health information.[35]

2.31      Proponents of MHR note that the new system will have an electronic audit trail that means that the healthcare recipient can see who has accessed their information. The ADHA noted that these audit logs are updated in real time and that healthcare recipients can elect to be notified when someone accesses their record:

Every access to every health record is logged in an audit trail and immediately visible to the consumer. A consumer can elect to get a text message or email when a new healthcare provider accesses the record or when certain things happen to the record such as a new shared health summary being uploaded, or when someone 'breaks the glass' to access their record.[36]

2.32      Professor Chris Bain noted that where people have inappropriately accessed records, an electronic audit trail means that the offenders can be caught and punished:

it's very clear and visible to the patient, most importantly, who's accessing it. Patients, unless they go through a whole lot of rigmarole...will struggle to know who in any given hospital has looked at their records and whether it was just the treating team or others who sniffed around. We've had examples in South Australia of people who were caught out because they sniffed around. That's only because there's an electronic system and an audit trail.[37]

2.33      However, some submitters, such as the Office of the Australian Information Commissioner noted that these audit logs only show access at the organisational level.[38] This means that if a healthcare recipient wants to know who within the organisation access their record they need to contact the organisation concerned.[39]

2.34      Separate arrangements apply for the System Operator which, in most cases, can track access at the individual practitioner level.[40] Some submitters noted that it would be desirable for consumers to be able to have access logs at an individual level.[41]

Committee view

2.35      The committee understands that there are potential security vulnerabilities associated with having a centralised database with broad access. The committee acknowledges that having a system that is able to be accessed by such a large number of health practitioners provides opportunities for external unauthorised access by actors who may wish to take advantage of the data for their own purposes.

2.36      However, the committee also acknowledges that there are some clinical benefits to the model that has been adopted. A centralised database provides clinicians with the ability to access information as it is required, unless the healthcare recipient has activated one or more of the privacy settings.

2.37      While a federated model may have been preferable if the system was to be designed today. The committee acknowledges that a substantial investment has been made in the current system and that fundamentally redesigning the system would involve additional investment.

2.38      The committee notes that the ADHA has undertaken considerable work to secure the information held within the MHR system. However, the committee notes that the system may become a more substantial target as the number of records held within the system increases.

Additional security protections for individuals

2.39      MHR was designed to be a system that could be controlled by the healthcare recipient. To add to the security of their records, healthcare recipients can apply a number of privacy settings to their MHR.

2.40      These privacy controls include a record access control, which protects the entire record, a document access code, to restrict access to a particular document, or a healthcare recipient could set up an email alert when a new organisation first accesses the healthcare recipient's record.[42] The Health Workers Union told the committee that restricted controls only appear to apply to organisations, and that individual health providers are 'exempt' from those settings.[43]

2.41      Applying a record access code would mean that the code would have to be provided every time the MHR was accessed.[44] Similarly, the document access code would need to be provided each time the document was accessed.[45]

Security and vulnerable groups

2.42      For some groups there are serious security concerns that do not appear to be able to be addressed by the current privacy settings. These apply especially to young people and women and children who have experienced family violence.

Young people aged 14–17 years

2.43      Until a person is 18 years old, a person with parental responsibility can be an Authorised Representative.[46] The Authorised Representative is empowered under the My Health Records Act 2012 to do anything that the healthcare recipient would be able to do.[47] This includes seeing all of the young person's clinical information except from their Medicare Benefits Schedule (MBS) and Pharmaceutical Benefits Scheme (PBS) data.[48] A person ceases to have an authorised representative when they turn 18 or they satisfy the System Operator that they want to manage their own MHR and can demonstrate that they are able to do so. Under ADHA policy, this requires the young person to obtain a letter from a health professional or a court.[49]

2.44      Some submitters expressed concern that these settings may restrict the ability of young people aged 14 to 17 to confidentially access healthcare.

2.45      Dr Robert Walker, a general practitioner from the Lindisfarne Clinic who runs a clinic at a high school in Tasmania, told the committee that he no longer believed that he could guarantee the absolute confidentiality of clinical work.[50] In his submission, Dr Walker explained that many students are unaware they may have a MHR or that their parents may be able to see parts of their record, such as pathology tests or pharmacy dispensing records, unless they had taken control of their own record.[51]

2.46      Dr Walker noted that while most parents are supportive, disclosure of certain information could be detrimental to the student if the parent is not supportive:

Most parents are supportive but not always. There are risks of poor outcomes if confidential data appears on a teenager's MyHR for others to view. Students will be frightened and may not seek help in times of crisis. Imagine the risks they face when their sexuality or their mental health issues are exposed to unforgiving parents or religious orders! Some may be injured or become homeless and self-harm is a constant concern.[52]

2.47      One 17 year old told the committee that they were unaware that a record had been created for them and that their parents were able to see the information that was added to it:

I live away from home because my mother and I don't get along. I didn't know I needed to take control of My Health Record to stop her from seeing and controlling all of my personal information in My Health Record and talking to my doctor.[53]

2.48      A number of submitters and witnesses noted that there may be legitimate reasons to seek medical advice, such as obtaining mental health or sexual health information that a young person may prefer their parent did not know about.[54]

2.49      To ensure that young people in this age group are aware of the MHR and what it means for them, a number of submitters recommended that the ADHA specifically tailor communications to target this demographic.[55]

2.50      The ADHA advised the committee that specific material has been developed to communicate information about MHR to young people and their parents which had been reviewed by young people in coordination with Orygen Youth Health.[56] The ADHA also noted that it had engaged heavily with social media, reaching 127 million social media accounts with over 127 000 pieces of content in accordance with feedback received during the 2016 participation trials.[57]

2.51      Orygen, The National Centre of Excellence in Youth Mental Health (Orygen) explained that, as an organisation, it facilitated feedback on two draft information sheets but that some of its other concerns have not been addressed to its satisfaction.[58] In particular, Orygen was not satisfied that timely and age-appropriate information has been provided about opting out during the opt-out period.[59]

2.52      The Australian Privacy Commissioner, Ms Angelene Falk, advised the committee that she has asked the ADHA and the Department of Health (DOH) to conduct additional consultation with a view to striking the right balance between utility of the record and the privacy of people in the affected age group:

There have also been issues raised regarding the access by parents to younger people's My Health Record parents after age 14 and concerns relating to individuals at risk from family violence. I've asked the agency and the department to give further consideration to these issues during the opt-out period and to consult with affected stakeholders as to whether these settings continue to strike the right balance between the utility of the record and the protection of privacy. Strategies to address issues affecting vulnerable people may include further education and engagement. Consideration may also be given to whether further adjustments are required to these default settings.[60]

Women and children in family violence situations

2.53      Submitters raised serious concerns that the system may be vulnerable to unauthorised access, including by individuals who might have parental responsibility for a child and may have been perpetrators of family violence.[61]

2.54      The Law Council of Australia (LCA) explained that it may be possible for a person's former partner to become an Authorised Representative on a child's MHR because the broad definition of parental responsibility in family law legislation includes:

...a person who merely has an order that a child spend time with that person. Frequently, a parent may retain parental responsibility for a child whilst simultaneously being subject to an interim or final parenting order made under the Family Law Act 1975 or the law of a state or territory.[62]

2.55      As noted above, an Authorised Representative can see all of the clinical information except for MBS and PBS data.

2.56      In particular, submitters were concerned that an individual may use the right of access they may have as the parent of a child to obtain access to data that may disclose or narrow down the possible residential address of their former partner and child.[63]

2.57      Submitters noted that potentially identifying information may range from the name of a pharmacy or doctor that the child attended to letters from specialists or other document that are uploaded to the MHR may include the actual residential address of the former partner and child.[64]

2.58      One submitter who had left a violent partner explained to the committee that her child's MHR may disclose their location. The submitter noted that the shared health summary includes an address field and that the activity log reveals that the name of the only medical centre in suburb and the name of the doctor that opened the record.[65] The submitter's experiences of the navigating the system are set out in the case study below. 

Case Study—Escaping family violence

I am a separated parent, who has escaped family violence. As far as I am aware, my ex-partner does not know where I currently live. However, that may now have been compromised by the establishment of a My Health Record for my son, because under the current legislation, my ex-partner will be permitted to access all information in my son's record, including documents that reveal our location – even if I try to remove them from the system...

I was shocked to learn that my son's My Health Record includes information that identifies our location. Specifically:

-          The activity log reveals which medical centre established the record. There is only one medical centre in our small suburb. It is across the road from my son's school, just a few blocks from our house. This effectively gives away our location.

-          A shared health summary names the practitioner who authored it (and whom google reveals is working in that same medical centre). This information remained even when I tried to permanently remove that shared health summary from the record.

-          The same shared health summary included a form field detailing our home address. Fortunately for me, it was an outdated address. However, it does raise the question of why an address has been included at all.

Currently, the only way to restrict his access to the record is to get an order for sole parental responsibility. However, this process could take months or even years, and going to court is not guaranteed to result in such an order...

Without an order naming the child, the maximum period the digital health agency can suspend my son's record is one month. This is patently inadequate time to secure an order for sole parental responsibility, or to add a child to a family violence order should the defendant choose to challenge it. So, this offers very little protection to victims of Family Violence. Furthermore, even though I have been told that my son's record is currently suspended, I am still able to access it.[66]

2.59      Submitters with experience of domestic violence noted that many perpetrators of domestic violence are controlling and may have access to all of their partner's passwords and constantly monitor where they go and what information they access.[67]

2.60      Women's Legal Service Queensland told the committee that these tendencies meant that the system could inadvertently place women and their children in danger:

We believe the "opt-out" requirement is particularly dangerous if victims are unaware they have active My Health Records, the types of information contained on these records, and the potential for perpetrators to access this information. It is not uncommon for highly dangerous perpetrators to constantly monitor women's lives including who she communicates with, where she goes and her access to information. Perpetrators often have access to (and in fact demand) access to all such accounts including her passwords, controlling every aspect of her life. The media and controversy around the roll out has not only alerted victims to potential safety concerns but will also inadvertently alert perpetrators to a new possible way to enhance control over their victims and children.[68]

2.61      They noted that some of the information in a MHR could potentially be used to escalate physical or verbal abuse toward the victim.[69]

2.62      To ensure that all members of the community remain safe, many submitters called for a greater level of education to be provided to the community.[70]

2.63      The LCA suggested that one way to fix the problem might be to amend the definition of 'parental responsibility' in the My Health Records Act 2012 to read that 'the child is to spend unsupervised time with the person'.[71] According to the LCA, this amendment would have the effect that a person who was subject to a restraining order or personal protection order that prevented them from spending time with the child would not be considered to have 'parental responsibility'.[72]

2.64      The DOH considered that the concern had been addressed by the privacy settings that are already in the MHR system:

That's why there are all sorts of mechanisms for people to go in and change the access environment in their records. But we are very interested in what the Law Council and others have to say and we are always interested in hearing these things and we are continually reviewing those settings and so on.[73]

2.65      The ADHA also explained that it had processes in place to suspend the account of a child if there were concerns about family violence:

Practically speaking, the agency has operational processes in place to respond to those situations so that a consumer—potentially a mother fleeing a violent situation—could contact us and raise concern about safety for herself or the child. The ex-partner would not be able to see the mother's record but could see the child's. We would immediately suspend that record in terms of stopping the authorised representatives from accessing it. We do that immediately and then we undertake an investigation to ensure that any sort of access is not putting the child at risk and those records can remain suspended while there's any risk of that occurring.[74]

2.66      However, as the above case study demonstrates, those restrictions appear to apply for a period of 30 days, which may not be enough time to find a more permanent solution.

Committee view

2.67      The committee is concerned by the possibility that the MHR system may jeopardise the ability of young people and women to confidentially seek medical advice without posing further risks to their physical or emotional wellbeing.

2.68      The committee notes that young people aged between 14 and 17 years may have legitimate reasons to seek medical advice and may prefer that their parents did not know about it.

2.69      The committee notes that the Australian Information Commissioner and Privacy Commissioner and others have called on the ADHA to revise its strategy for engaging with young people and how the default settings are currently configured.

2.70      The committee is deeply concerned about the prospect that perpetrators of domestic violence may be able to legitimately gain access to the records of their children and potentially exploit that access to the potential detriment of their former partner and their children. The committee is not satisfied that women and children are adequately protected and believes that further work is required to ensure that MHR is not used by perpetrators to gain access to records. The committee notes the recommendation of the LCA as one way this issue may be addressed. The committee understands that the ADHA is conducting work to improve its response in this area. The committee urges them to continue with that work and to engage more fully with providers of domestic violence services.  

Who else could find out what is in MHR?

Employer nominated doctors

2.71      Some submitters raised concerns that an employer nominated health practitioner could obtain access to the healthcare recipient's MHR and potentially disclose information that the healthcare recipient would prefer was kept confidential in the context of a pre-employment medical or workers compensation claim.[75]

2.72      While this might seem like a remote possibility, Ms Leigh Svendsen from the Health Services Union advised the committee that the union was aware of cases where health information has been passed on to an employer by a health practitioner.[76]

2.73      The concern raised by unions and others was that the way the My Health Records Act is drafted may make it entirely permissible for that information to be passed to an employer.

2.74      The unions' concern is that access to information in the MHR is dependent upon the provision of 'health care' which is broadly defined in the Privacy Act 1988 to include 'assessing, maintaining, improving or managing the individual's health'.[77] Mr Christopher Watts from the Australian Council of Trade Unions noted that it was his interpretation that such a broad definition could include examinations of the individual for medical relating to a person's employment.[78]

2.75      The DOH advised the committee that the information could not be used in that way because subsection 14(2) of the Healthcare Identifiers Act 2010 prohibits a healthcare provider from disclosing a healthcare identifier as part of employing the healthcare recipient or examining the healthcare recipient in connection with a contract of insurance.[79]

2.76      The joint submission from the DOH and the Department of Human Services (DHS) stated that it was not possible to access a MHR without collecting, using or disclosing a healthcare identifier.[80]

2.77      However, some witnesses disagreed with the departments' assessment. Mr Thomas Ballantyne, a principal at Maurice Blackburn Lawyers told the committee that if the MHR could be accessed using the individual's Department of Veterans' Affairs file number or their Medicare number, then the restriction in the Healthcare Identifiers Act did not apply:

I think the key thing is effectively whether you need to use the healthcare identifier to access the My Health Record of a particular patient. I went again on the digital health portal—the training for providers—this morning, and it's clear that you can access a patient's My Health Record with their healthcare identifier or a Medicare number or a DVA number.

I think that, on plain reading of section 14 of the Healthcare Identifiers Act, it has to be the most likely outcome that, unless you use that particular number, the offence doesn't apply—the exclusion doesn't apply.[81]

2.78      Other submitters, such as the Public Health Association of Australia and Unions NSW noted that employers may ask employees to consent to the release of information in their MHR.[82] Under section 66 of the My Health Records Act, a participant may disclose for any purpose health information included in the MHR with consent of the healthcare recipient.

2.79      DOH and the ADHA have made clear that it was certainly not intended that the legislation would facilitate access to information contained in a MHR for any purpose other than the provision of health care to the recipient.[83]

2.80      A number of submitters, including Maurice Blackburn Lawyers, have recommended that a provision similar to section 14(2) of the Healthcare Identifiers Act 2010 be added to the My Health Records Act to clarify the position.[84]

Law enforcement

2.81      Some submitters raised concerns about whether information in a MHR could be used for law enforcement purposes.

2.82      Section 70 of the My Health Records Act currently provides that information may be disclosed for the purposes of law enforcement or the protection of revenue.

2.83      Whilst the committee was conducting this inquiry, the Community Affairs Legislation Committee (Legislation Committee) was conducting an inquiry into the My Health Records Amendment (Strengthening Privacy) Bill 2018 (Bill).

2.84      That Bill will, if passed, remove section 70 from the My Health Records Act and replace it with a requirement that a 'designated entity' may apply to a judicial officer for a warrant to obtain information in a MHR from the System Operator, other than 'healthcare recipient-only notes'.[85]

2.85      Submitters to this inquiry endorsed the measures in the Bill directed at strengthening privacy provisions.[86]

Committee view

2.86      The committee considers that the MHR system should only be used to provide access to information for the purpose of providing healthcare to the healthcare recipient. The committee considers that where there is doubt about whether information contained within the system may be used for that purpose, the legislation should be clarified to ensure that the integrity of the system is maintained.

2.87      The committee notes the recommendation proposed by the unions and Maurice Blackburn Lawyers that to avoid doubt, a provision similar to section 14(2) of the Healthcare Identifiers Act 2010 should be inserted into the My Health Records Act. 

How else could information in the MHR system be used?

Secondary use

2.88      In addition to the provision of healthcare, MHR has the potential to provide information that could be used in public health research. This is known as secondary use.

2.89      Submitters broadly acknowledged that MHR data has the potential to have significant public health research benefits, including improving insights into population health issues and how people use the health system.[87]

2.90      The default setting is that all people consent to the use of their information for secondary use. However, they may withdraw this consent by selecting the 'Withdraw Participation' button in their MHR.[88]

2.91      Some submitters noted that this default setting was originally conceived of in the context of an opt-in model. On that basis, it was reasonable to assume that people who provided information made an informed choice when they consented to their information being placed in the MHR system and that it may include the secondary use of that data.

2.92      That informed consent is not necessarily true in an opt-out model. Some submitters considered that healthcare recipients should be asked to provide explicit consent to the secondary use of their data.[89] 

2.93      The LCA explained that the secondary use of data was at odds with privacy laws because the healthcare recipient had not provided consent for their data to be used in that way. Therefore, the LCA recommended that explicit consent should be obtained:

The secondary use of their data is at odds with the underlying principles in both Commonwealth and state privacy laws. These principles provide that a health entity that holds information about a patient can only use or disclose the information for the particular purpose for which it was collected, unless the patient has explicitly consented to secondary use or disclosure. The Law Council therefore recommends the patient must provide explicit consent if their health information is obtained for a secondary purpose or disclosure.[90]

2.94      Whilst it is not currently possible, the Framework to guide the secondary use of My Health Record system data (Secondary Use Framework) notes that in time a dynamic consent model will be explored to allow consumers to decide whether to participate in a research project on a case-by-case basis.[91]

2.95      Whether healthcare recipients would be prepared to provide consent may depend on the nature of the research projects under consideration.

2.96      Consumers Health Forum of Australia told the committee that its research has found that consumers are more likely to give permission to projects if they understand how their data is going to be used and what benefits might flow from its use:

we believe there is a place for secondary use of de-identified—that's a key word—My Health Record data. On the whole, so do consumers. Our research shows that Australians want ownership and control of their own health data and want to give consent when it is used by governments, private companies and researchers. The same research also found that consumers are more likely to give permission if they understand how their data will be used and the benefits that will come from its use. There is a level of comfort among the majority of consumers in data being used to support health providers to improve care or make better policy. But consumers are significantly less willing to share their data if it's to be used for commercial gain.[92]

2.97      To ensure social license for the use of secondary data there is a need to make sure that the data is used in a manner that the community would feel comfortable with.[93]

2.98      To ensure that secondary data is used appropriately, the DOH has developed the Secondary Use Framework which sets out the guiding principles for the use of secondary data from the MHR system. The principles detail the governance model, consumer control of data, applications and access to secondary data, the process for requesting and accessing data, linkage privacy protection, making data available, assurance processes and risk mitigation.[94] 

2.99      The Secondary Use Framework was developed after public consultation and was supported by submitters to the inquiry.[95] In particular, submitters were supportive of the principles that prohibited insurance agencies from applying for data and that prohibited the release of data for 'solely commercial purposes'.[96]

2.100         DOH and DHS advised the committee that two examples that would be prohibited were access to data for direct marketing to consumers or for the assessment of insurance premiums or claims.[97]

2.101         Some submitters raised concerns that secondary data, if it was released, may be re-identified.[98]

2.102         Whilst the DOH understood the concern, it noted that the linkage and data custodian arrangements administered by the Australian Institute of Health and Welfare are stringent and different from a previous case where Medicare data was re-identified by some Melbourne based researchers.

2.103         The researchers who conducted the re-identification, Dr Chris Culnane, Associate Professor Benjamin Rubinstein and Dr Vanessa Teague told the committee that, while they welcomed the approach to not publish MHR data as open data, they did not consider that would be sufficient to prevent re-identification of datasets.[99]

2.104         These researchers told the committee that they believed that the technical difficulty of finding patients was low and that 'the presence of the identifiable MBS-PBS data for 10% of the population is now a resource that an attacker could leverage in My Health Record identification'.[100]  

2.105         The Privacy Commissioner told the committee that valuable lessons had been learned from the previous experience and that the Secondary Use Framework has been drafted to take account of those lessons:

Only to note that that matter was the subject of an investigation by my office, and we did find that there was a breach of the Privacy Act. What it brings to light, of course, is that with de-identified information there needs to be very strict safeguards around that information. In that case, it was around making information publicly available. That's not what is envisaged by the secondary use framework as I understand it.[101]

Third party access

2.106         Some submitters were concerned at the prospect that MHR data could be made available, either now or in the future, to insurers or other commercial parties.[102] 

2.107         These submitters raised concerns that while the Secondary Use Framework currently prohibited access by third parties, the Secondary Use Framework would only be in place in the short term, noting that health insurer access may be prioritised in the first review.[103]

2.108         Some submitters considered that a legislative amendment may be required to ensure that insurers would not be able to access the data and to ensure that their data is permanently protected from such interests.[104]

Committee view

2.109         The committee considers that there is great potential for data in the MHR system to be used for population health research purposes, however, the committee also recognises concerns that personal data be used for commercial purposes.

2.110         The committee notes that the current Secondary Use Framework does not permit secondary data to be used for 'solely commercial purposes'. The committee considers that this prohibition is appropriate but notes that there is public interest in a more permanent solution being found to ensure that a healthcare recipient's MHR data is only used for the purposes for which it was originally intended. 

Navigation: Previous Page | Contents | Next Page