On 16 July 2018 the Australian Minister for Health and Liberal MP for Flinders, Gregory Andrew 'Greg' Hunt, characterised My Health Record as a "secure summary" of an individual's key health information.
The Office of the Australian Information Commissioner (OAIC) tells a rather different story.
One where at least 242 individual My Health Records have been part of mandatory data breach reports in 2015-16 to 2016-17, with nine of the 51 reported breach events involving "the unauthorised access of a healthcare
recipient’s My Health Record by a third party".
A story which also involves at least 96 instances of Medicare uploading data to the wrong digital health records and also uploading claim information to another 123 My Health Records apparently without the knowledge or consent of the persons in whose names these My Health Records had been created.
There were other instances where MyGov
accounts held by healthcare recipients were incorrectly linked to the My
Health Records of other healthcare recipients.
Prior to the database name change and system change from opt-in to opt-out there had been another 9 data breaches of an unspecified nature reported, involving an unknown number of what are now called My Health Records.
More instances are now being aired in mainstream and social media where My Health Records were created by DHS Medicare Repository Services or other agents/agencies without the knowledge or consent of the individual in whose name the record had been created.
Prior to the database name change and system change from opt-in to opt-out there had been another 9 data breaches of an unspecified nature reported, involving an unknown number of what are now called My Health Records.
More instances are now being aired in mainstream and social media where My Health Records were created by DHS Medicare Repository Services or other agents/agencies without the knowledge or consent of the individual in whose name the record had been created.
 |
| Healthcare IT News 16 July 2018 |
If this is how the national e-health database was officially functioning malfunctioning by 30 June 2017, how on earth is the system going to cope when it attempts to create millions of new My Health Records after 15 October 2018?
On the first day of the 60 day opt-out period about 20,000 people refused to have a My Health Record automatically created for them and at least one Liberal MP has also opted out, the Member for Goldstein and member of the House of Representatives Standing Committee on Health, Aged Care and Sport Tim Wilson.
Prime Minister Malcolm Bligh Turnbull has stated his view that mass withdrawals will not kill the national digital health records system - perhaps because he and his government are possibly contemplating adopting the following three coercive recommendations found amongst the thirty-one recommendations included in the Siggins Miller November 2016 Evaluation of the Participation Trials for the My Health Record: Final Report:
NOTES
OAIC annual reports:
On the first day of the 60 day opt-out period about 20,000 people refused to have a My Health Record automatically created for them and at least one Liberal MP has also opted out, the Member for Goldstein and member of the House of Representatives Standing Committee on Health, Aged Care and Sport Tim Wilson.
Prime Minister Malcolm Bligh Turnbull has stated his view that mass withdrawals will not kill the national digital health records system - perhaps because he and his government are possibly contemplating adopting the following three coercive recommendations found amongst the thirty-one recommendations included in the Siggins Miller November 2016 Evaluation of the Participation Trials for the My Health Record: Final Report:
20. Use all mechanisms
available in commissioning and funding health services as vehicles to require
the use of the My Health Record to obtain funds where practical.
21. Consider ways to
require the use of the My Health Record system by all healthcare providers and
how to best use the Government’s purchasing power directly (e.g. in the aged
care sector), via new initiatives as they arise (such the Health Care Home
initiative) or via PHNs commissioning clinical services (e.g. require use of
the My Health Record system in all clinical and aged care services that receive
Commonwealth funds). Such requirements should have a timeframe within which
healthcare providers need to become compliant.
22. Explore with health
insurers how they could encourage preferred suppliers and clients to use the My
Health Record system as part of their push for preventive care and cost
containment.
That the My Health Record is not about improving health service delivery for individual patients is indicated by the fact that a My Health Record is retained by the National Repositories Service for between 30 and up to 130 years after death and, even during an individual's lifetime can be accessed by the courts, police, other government agencies and private corporations listed as research organisations requiring medical/lifestyle information for what is essentially commercial gain, at the discretion of the Secretary of the Department of Health or the Digital Health Agency Systems Operator. See: My Health Records Act 2012 (20 September 2017), Subdivision B - s63 to s70
To put it bluntly, this national database will allow federal government to monitor the personal lives of Australian citizens more closely, enforce civil & criminal law, monetise collated data for its own benefit and, weaponize the personal information collected anytime it feels threatened by dissenting opinion.
NOTES
OAIC annual reports:
The Guardian, 22 July 2018:
Australia’s impending My
Health Record system is “identical” to a failed
system in England that was cancelled after it was found to be selling
patient data to drug and insurance companies, a British privacy expert has
said.
My Health Record is a
digital medical record that stores
medical data and shares it between medical providers. In the UK, a similar
system called care.data was announced in 2014, but cancelled in 2016 after an
investigation found that drug and insurance companies were able to buy
information on patients’ mental health conditions, diseases and smoking habits.
The man in charge of
implementing My Health Record
in Australia, Tim Kelsey, was also in charge of setting up care.data.
Phil Booth, the
coordinator of British privacy group Medconfidential, said the similarities
were “extraordinary” and he expected the same privacy breaches to occur.
“The parallels are
incredible,” he said. “It looks like it is repeating itself, almost like a
rewind or a replay. The context has changed but what is plainly obvious to us
from the other side of the planet, is that this system seems to be the 2018
replica of the 2014 care.data.” [my yellow highlighting]
North Coast
Voices , 22 July 2018, Former
Murdoch journalist in charge of MyHealth records –what could possibly go wrong?
UPDATE
Australian
Parliamentary Library, Flagpost,
23 July 2018:
Section 70 of the My Health Records Act
2012 enables the System Operator (ADHA) to ‘use or disclose
health information’ contained in an individual’s My Health Record if the ADHA
‘reasonably believes that the use or disclosure is reasonably necessary’ to,
among other things, prevent, detect, investigate or prosecute any criminal
offence, breaches of a law imposing a penalty or sanction or breaches of a
prescribed law; protect the public revenue; or prevent, detect, investigate or
remedy ‘seriously improper conduct’. Although ‘protection of the public
revenue’ is not explained, it is reasonable to assume that this might include
investigations into potential fraud and other financial offences involving
agencies such as Centrelink, Medicare, or the Australian Tax Office. The
general wording of section 70 is a fairly standard formulation common to
various legislation—such as the Telecommunications
Act 1997—which appears to provide broad access to a wide range of agencies
for a wide range of purposes.
While this should mean
that requests for data by police, Home Affairs and other authorities will be
individually assessed, and that any disclosure will be limited to the minimum
necessary to satisfy the request, it represents a significant reduction in the
legal threshold for the release of private medical information to law
enforcement. Currently, unless a patient consents to the release of their
medical records, or disclosure is required to meet a doctor’s mandatory
reporting obligations (e.g. in cases of suspected child sexual abuse), law
enforcement agencies can only access a person’s records (via their doctor) with
a warrant, subpoena or court order....
It seems unlikely that
this level of protection and obligation afforded to medical records by the
doctor-patient relationship will be maintained, or that a doctor’s judgement
will be accommodated, once a patient’s medical record is uploaded to My Health
Record and subject to section 70 of the My Health Records Act 2012. The
AMA’s Guide
to Medical Practitioners on the use of the Personally Controlled Electronic
Health Record System (from 2012) does not clarify the situation.
Although it has
been reported that
the ADHA’s ‘operating policy is to release information only where the request
is subject to judicial oversight’, the My Health Records Act 2012 does
not mandate this and it does not appear that the ADHA’s operating policy is
supported by any rule or regulation. As legislation would normally take
precedence over an agency’s ‘operating policy’, this means that unless the ADHA
has deemed a request unreasonable, it cannot routinely require a law
enforcement body to get a warrant, and its operating policy can be ignored or
changed at any time.
The Health
Minister’s assertions that no one’s data can be used to ‘criminalise’
them and that ‘the Digital Health Agency has again reaffirmed today that
material … can only be accessed with a court order’ seem at odds with the
legislation which only requires a reasonable belief that disclosure of a
person’s data is reasonably necessary to prevent, detect, investigate or
prosecute a criminal offence…..
Although the disclosure
provisions of different agencies may be more or less strict than those of the
ADHA and the My Health Records Act 2012, the problem with the MHR system
is the nature of the data itself. As the Law Council of Australia notes,
‘the information held on a healthcare recipient’s My Health Record is regarded
by many individuals as highly sensitive and intimate’. The National Association
of People with HIV Australia has
suggested that ‘the department needs to ensure that an individual’s My
Health Record is bound to similar privacy protections as existing laws relating
to the privacy of health records’. Arguably, therefore, an alternative to the
approach of the current scheme would be for medical records registered in the
MHR system to be legally protected from access by law enforcement agencies to
at least the same degree as records held by a doctor.
No comments:
Post a Comment