Sue Dunlevy, National Health Reporter, News Corp Australia Network
28 July, 2018
EXCLUSIVE
IN the wake of a growing public backlash and increasing scrutiny of the My Health Record, key health lobby groups backing it are declaring themselves to be on the payroll of the agency rolling it out.
We can reveal the Australian Digital Health Agency has spent millions of dollars of taxpayers money trying to co-opt the support of leading health and consumer groups for the government’s online My Health Record.
A News Corp investigation of government tender documents has found
* The Consumers Health Forum has received over $105,000;
* The Royal Australian College of General Practitioners nearly $2 million;
* The Australian Health and Hospitals Association $1.2 million;
* The Pharmacy Guild $194,000;
* Australian Council Of Social Service $32 500.
The Australian Medical Association and the Royal Australian College of General Practitioners both signed contracts with the government to promote the record to doctors in return for a $910 million increase in Medicare rebates.
In most cases the money was for educating their members or consumers about the record, mailing out letters and setting up a secure messaging system between doctors.
All the groups say they had in principle support for an electronic health record before they received the money, that the money did not change their view and some have been critical of aspects of the My Health record after receiving the money.
Every Australian will get an online My Health Record that will reveal if they have had an abortion, a mental illness, a sexually transmitted disease or a drug addiction unless they opt out by October 15.
Former AMA president Professor Kerryn Phelps says any individual or group that has received money from the ADHA needs to declare it.
“I have a very strong and unequivocal view that advocacy organisations like the AMA and other groups should not do deals with government in exchange for supporting programs,” she said.
“They need to be presenting a completely unbiased view on behalf of their members, we are not an arm of the government.”
The Australian Digital Health Agency has taken forthright approach in the last week.
Professor Phelps revealed after she spoke out about privacy problems with the record she received a phone call from Australian Digital Health Agency boss Tim Kelsey.
“What he tried to do was reassure me on privacy and security and I said I would have to proceed with my concerns,” she said.
“It was unusual to get a phone call like that,” she said.
Earlier this week a Parliamentary Library paper critical of privacy aspects of the My Health Record was removed from the library’s website and later a more anodyne version replaced it.
Queensland MP Bob Katter who shares privacy concerns has suggested the record is Orwellian.
“I read George Orwell’s 1984 and it scares me still. Big Brother is watching,” he said in a media release on his constituents concerns about the record.
The agency said it was collaborating with a wide range of clinical and consumer leaders and had 17 agreements with peak consumer organisations and informal agreements with another 15 organisations — to undertake collaborative communications activity around My Health Record.
“No stakeholder has been asked, as part of any contractual arrangements, to present a particular view point on having a My Health Record. Additionally, organisations are open and free to have their own views on My Health Record,” the agency said.
“These organisations are committed to the system and are encouraging healthcare providers to adopt use of the My Health Record system into daily practice,” the agency said.
Sue Dunlevy has been doing a sterling job letting Newscorp subscribers (sadly it is behind a paywall) know just what is going on with the myHR and the current opt-out process.
Most who have been watching all this closely have been rather surprised with the rather one-eyed support for the program being offered by the organisations listed and have always assumed this was due to funding from the ADHA having an influence. It is nice to see some specific numbers around the amounts spent. (Note the CHF does understand the myHR contending issues quite well as indicated from this blog post here:
and so it is even harder to follow the why they are not more balanced in their media releases.)
It is clear that, at least to some degree, ‘money talks’!
I will note, in passing, that Prof Phelps is by no means the only one to have had phone calls from Tim Kelsey (or his chief of staff) to try and have their views changed. Just so you know there is a fair bit of it going on behind the scenes, according to some very trustworthy sources.
Interim Head, Department of General Practice, University of Melbourne
As the opt-out period for the My Health Record continues, so too does the debate surrounding issues of confidentiality. While possible data breaches have generated widespread concern, for one group – teenagers – it may not just be hackers they want to keep out. It may be their parents.
Consider this scenario:
Katy is 16 years old and, after a couple of months of dating another 16-year-old, Tom, they start having sex. Katy’s regular GP has looked after her asthma since she was six but she feels awkward seeing him. Katy visits a GP that her school friend recommends to ask about contraception and to get a pregnancy test. The GP offers and does a chlamydia test, as recommended by the Australian guidelines for STI testing. She really doesn’t want to discuss this with her mother just yet.
There are options for 14 to 18-year-olds like Katy to keep their medical records private under the My Health Record scheme, but teens must be proactive and change their settings or ask their health providers not to upload this data.
Remind me, what is a My Health Record?
My Health Record stores and manages each individual’s health information – such as blood tests, prescriptions, diagnoses, vaccinations and allergies – online. Every Australian will have a My Health Record generated unless they choose to opt out before October 15.
Parents may opt out their children, and those aged over 14 are able to opt out themselves.
Some information will be automatically uploaded as soon as a My Health Record is created. This includes Medicare claims for things like GP visits, and Pharmaceutical Benefits Scheme (PBS) claims for subsidised medications.
Other My Health Record information such as what is recorded by a GP when you see them, or letters from specialists to your GP, could be uploaded by them. Any test results and X-ray reports might get uploaded by the laboratories and X-ray centres directly, rather than through your GP.
Medicare and PBS claim information will not be visible on the record to parents of teenagers aged 14 and over, even if they are on the family Medicare card. It has long been the case in Australia that parents cannot see Medicare information for children aged 14 and over, and this recognises the rights of young people to confidentiality as they become more independent.
But this is not currently the case with other information on the My Health Record. Parents or legal guardians act as authorised representatives of their under-18 child’s record.
The parent can see other documents such as the health summary, medications prescribed, any test results, and specialist’s letters. At 18, parents’ access to the young person’s record is cancelled.
However, if you are between 14 and 18 years old you can choose to take control of your own My Health Record.
How teens can protect their confidentiality
Teenagers can have control over what is uploaded onto their My Health Record. They can ask their doctor and any other health professional they see not to upload the information about their health visit they wish to keep confidential.
Teens can also ask the doctor to tick the “MHR opt out” box on pathology requests and prescriptions so these are not uploaded. Or they can ask the pharmacist not to upload medication dispensing information.
Doctors, pharmacists and other health professionals should also remember to ask all young people whether they want their test results, prescriptions or health summaries uploaded or not.
If either party doesn’t request an opt-out, pathology tests and prescriptions will be automatically uploaded.
Problems with this system
Young Australians have the legal right to confidential health care. This means they can visit a health professional on their own, and the information shared must be kept confidential unless there is a risk of suicide or if the young person is under 16 and being abused.
Confidentiality has been shown to improve young people’s willingness to seek help early and thereby prevent unwanted consequences of behaviours or mental health issues. Katy, for example, has obtained an STI test and contraception which will help prevent unwanted sexual health issues.
This current system for protecting the confidentiality of teenagers’ information on their My Health Record has obvious flaws. It relies on busy health professionals – some of whom may not be experienced in the My Health Record – remembering to ask every teenager whether they want information uploaded or not.
It also places the onus on teenagers, who in many cases may not be fully versed in the health care system. It relies on them to remember, and have the confidence, to ask for information not to be uploaded.
Let’s go back to Katy again. In Katy’s situation, the information she shares with her friend’s GP must legally be kept confidential. Because Katy is under 18, the doctor must decide whether she is mature enough to consent to treatment, such as contraception, on her own.
Katy had a My Health Record created for her when she was 13 and didn’t take much notice of the laws around this at the time. She doesn’t know that she can take control of her own record and even if she did, she would be worried about offending her mother. Katy doesn’t ask this GP not to upload today’s visit information and the GP, who isn’t her usual GP, doesn’t remember to ask her.
The My Health Record default settings won’t permit her mother to access her Medicare and Pharmaceutical Benefits Scheme data, so the record of her pregnancy test and visit to the GP isn’t visible to her mother. But the doctor’s summary that mentions a prescription for contraception and an STI screen is. If Katy’s mother decides to check her My Health Record, Katy’s confidentiality will be breached.
Teen-friendly My Health Records
The overwhelming concern is that young people will forgo important and timely health care because of concerns about confidentiality. We should be progressing the confidence of young people to take charge of their health, not driving them back.
At the same time, young people may not have the benefits that accrue with an electronic health record if they continuously choose not to have health events uploaded for fear that others will find out.
The Australian Digital Health Agency must urgently redesign the My Health Record program to respect young people’s right to autonomy and confidential health care.
The My Health Record must be automatically shifted to the control of the young person once they turn 14, with no obligation for parental access.
The uploading of pathology tests and prescriptions should be opt-in, not opt-out. This would mean health care providers must ask each time whether information gets uploaded.
An official communication campaign is needed for young people aged 14 to 18 to explain what the My Health Record will mean for them and how they can have the benefits of a record, without losing their rights to confidential health care. Communications must be targeted at young people and designed in collaboration with young people.
These important steps will enable young people to feel secure in managing their own health care and their My Health Record.
When a teenager turns 14 they must typically give consent for parents to access their Medicare information, but now parents can register their child for a My Health Record and potentially view and administer it until age 18.
The Australian Association for Adolescent Health (AAAH) has called for the Government to automatically seek consent from young people aged 14 to 17 years before granting access to any part of their My Health Record to parents or legal guardians.
"Those people are vulnerable to having to, unwittingly perhaps, or not so unwittingly, share [health information] with people who they may not wish it to be shared with," AAAH president Melissa Kang said.
In line with Department of Human Services policy, Medicare data stops flowing into My Health Record once a teen turns 14.
But advocates are concerned that other information such as health status summaries or medication lists uploaded by doctors could remain visible to a carer, potentially exposing sensitive issues such as mental and sexual health.
Once they turn 14, teenagers can also take control of their record, delete documents, administer Medicare data and turn on access settings, but this does not occur automatically.
"Should a child be concerned about the confidentiality of their record, they can take control at 14 in which case their authorised representatives will be removed from the record," an Australian Digital Health Agency (ADHA) spokesperson said.
"A child who takes control can also appoint their parents as a Nominated Representative if they wish to have their parents help in managing their record and health care."
Teens need medical privacy: social workers
Until October 15, parents can opt children under 18 out of My Health Record, otherwise one will be automatically created.
Children aged 14 and over can also opt themselves out online using their Medicare number, according to the ADHA.
All I can say is that some good souls have worked hard to make it all clear and the more I read the more certain I am that the ADHA have totally failed with education. This should have all been worked through and discussed before the opt-out period.
Now we see that flexibility is possible, how about we get a full competent strategic review of the myHR with review by the Auditor General, a proper review (evidence-based) of what is actually needed in a National EHR System (if anything), and a proper business case and privacy impact statement of any final design.
We have wasted $2 Billion doing this with evidence free dogma - time for a change! Isn't it funny to see all those organisations who said the myHR was wonderful as it, was welcoming change!
Note: I have excluded any commentary taking significant funding from the Agency or the Department of Health on all this to avoid what amounts to paid propaganda. (e.g. CHF, RACGP, AMA, National Rural Health Alliance etc. where they were simply putting the ADHA line – viz. that the myHR is a wonderfully useful clinical development that will save huge numbers of lives at no risk to anyone – which is plainly untrue)
It’s often been said, the Australian My Health Record is not a finished project. It is evolving and has, indeed, lots of potential to improve and streamline patient care. Sadly, the privacy issues that have haunted the project for years still seem to be unresolved. And when it comes to secondary use of patient data, there’s more to come from a different direction.
Back in 2013 I wrote this in a blog post about the My Health Record, then called the Personally Controlled Electronic Health Record or PCEHR:
“The PCEHR Act 2012 states that the data in the PCEHR can be used for law enforcement purposes, indemnity insurance purposes for health care providers, research, public health purposes and ‘other purposes authorised by law’. This is far from reassuring. There are many grey areas and unanswered questions. There are too many agendas. The PCEHR should first be a useful clinical tool to improve patient care.”
Five years later and there are still ambiguities about when, how and for what reason law enforcement agencies and other non-medical parties can access the national My Health Record system. This should have been crystal clear by now. Here’s is what I posted in 2015:
“(…) at the moment the information in the PCEHR may be used by the Government for data mining, law enforcement purposes and ‘other purposes authorised by law’, for up to 130 years, even after a patient or provider has opted out. (…) The legal framework should be reviewed, and any changes must be agreed upon by consumers and clinicians.”
Privacy. Everyone’s talking about it. Not just the people who are desperate to keep their secrets under wraps (I’m looking at you, Ashley Madison users). And not just the nerds running around rabidly trying to convince everyone that "they" are trying to control us all (that’s us, fellow George Orwell readers).
No, privacy isn’t just for people at weird extremes any more. It’s becoming a conversation topic for "normal" people. It comes up with my barista. I’ve overheard people discussing it on trams. I even brought it up with some strangers, quite emphatically, at a party - and wasn’t even judged (that much).
One of the things I like most about talking about privacy is that, in the right circumstances, people feel something about it. It can be emotional. And when things are emotional, they are way more interesting.
You've no doubt filled out countless patient information sheets in the waiting rooms of hospitals or medical centres.
Usually, they ask you for an emergency contact — and for many people, that's a blood relative.
In most cases, that next-of-kin data is never looked at again, unless an emergency happens. But what if you could link people together based on who they listed as their blood relative?
As the government rolls out its My Health Record database, a major hack of a similar system in Singapore has highlighted the vulnerabilities of high-tech record sharing. By Lizzie O’Shea and Justin Warren.
The positives and perils of My Health Record
Last week, Singapore’s ministry of health admitted information from 1.5 million citizens had been copied in “a deliberate, targeted, and well-planned cyber attack” by hackers who were specifically going after the personal data of the country’s prime minister, Lee Hsien Loong. It took authorities a week to detect the breach, which, to be fair, is relatively fast given the average organisation takes more than six months.
The story came at an awkward time for the Australian government, at the end of the first week of the opt-out period for the My Health Record system; a week dogged by controversy.
My Health Record is a centralised database designed for sharing health information. In its ideal form, the system would mean any health-care professional around the country could access some of your medical records with just a click. Despite its origins in 2012 as an opt-in program, the Turnbull government changed the system to opt-out in 2016 – a move former Labor health minister Nicola Roxon had warned would be “a serious mistake” back in 2011. Australians have until October 15 to opt out. Everyone who does not opt out will have a record created for them automatically.
My Health Record: lawyers warn of system abuse and call for privacy protection in law
28th Jul 2018
My Health Record will have undoubted medical benefits but the Australian Lawyers Alliance (ALA) is concerned that access to the data will be abused and says legislation changes are needed now.
“Our concerns are more about system abuse than a mass data breach,” said Andrew Stone SC, NSW President, ALA. “My Health Record will be beneficial but we need to think about the ways in which it will be abused and misused, and address these issues now so the benefits can be delivered.”
According to the ALA, legislation is needed to protect against access to My Health Record data by anyone aside from health providers and to guard against access in which authorisation is coerced.
A political firestorm erupted last week over the Australian government’s move to create a shareable national electronic health record for all 24.7 million of its citizens by December of this year. Unless an individual opts out of having a My Health Record by 15 October 2018, the government will create one for them that will be kept for 30 years after the person dies, or for 130 years after a person’s birth if their death date is unknown.
The government and many health care associations such as the Royal College of Australian General Practitioners, the Pharmacy Guild of Australia, and the Australian Healthcare and Hospital Association (AHHA) have been touting the benefits of the system. The AHHA states such an e-health record will lead to “better coordination of care among multiple health care providers, better informed decisions on health care that involve both the patient and the health care provider, reduced duplication of diagnostic tests, fewer adverse drug events and reduced hospital admissions.” All have been pleading with the 6 million Australians [PDF] currently with a My Health Record not to opt out, and for everyone else to allow one to be created for them.
Interim Head, Department of General Practice, University of Melbourne
As the opt-out period for the My Health Record continues, so too does the debate surrounding issues of confidentiality. While possible data breaches have generated widespread concern, for one group – teenagers – it may not just be hackers they want to keep out. It may be their parents.
Consider this scenario:
Katy is 16 years old and, after a couple of months of dating another 16-year-old, Tom, they start having sex. Katy’s regular GP has looked after her asthma since she was six but she feels awkward seeing him. Katy visits a GP that her school friend recommends to ask about contraception and to get a pregnancy test. The GP offers and does a chlamydia test, as recommended by the Australian guidelines for STI testing. She really doesn’t want to discuss this with her mother just yet.
There are options for 14 to 18-year-olds like Katy to keep their medical records private under the My Health Record scheme, but teens must be proactive and change their settings or ask their health providers not to upload this data.
My Health Records laws need to be scrapped and rewritten, warn experts
By Dana McCauley
27 July 2018 — 6:36pm
Privacy experts have rejected the federal government's reassurances that My Health Record patient data will not be accessed by third parties without a warrant, demanding that it redraft laws giving authorities broad powers of access.
Pressure is mounting for Health Minister Greg Hunt to tear up the legislation after he promised to clear up any "ambiguity" about patient privacy under the system, which will enrol all Australians with a Medicare card if they do not opt-out by October 15.
University of Technology, Sydney law lecturer Geoff Holland told Fairfax Media the Privacy Act would offer no protection for Australians enrolled in My Health Record if police sought to access their private information, as the wording of the legislation would override its safeguards - contradicting the government's position.
I am thinking about opting out of My Health admits Kristina Keneally
The Australian
10:46AM July 27, 2018
Rachel Baxendale
Labor senator Kristina Keneally says she is thinking about opting out of the My Health Record scheme, despite being NSW premier when COAG resolved to digitise health records.
Senator Keneally’s comments come after Health Minister Greg Hunt will yesterday conceded he would consider strengthening privacy provisions for the My Health Record scheme at the urging of medical practitioners.
My Health Record is a system which people may or may not choose to use, but the fear is that it could be used against them, argues Deakin University researcher Joshua Badge.
The Australian Digital Health Agency, the bureau responsible for My Health Record, maintains that law enforcement agencies can only gain access to the e-health system with a warrant, subpoena or court order. Health Minister Greg Hunt has backed this assertion but several sources have disputed the claim.
Earlier this week, the Parliamentary Library contradicted the minister, suggesting that enforcement bodies including the Australian Federal Police, the Department of Home Affairs and all the state and territory police forces would have access to the system. The Parliamentary Library decided to temporarily take down the post after the Health Department filed a complaint. It has since been republished with minor amendments (here is the original).
They took out: the conclusion My Health Record significantly reduces the threshold for access; the conclusion that cops can get it without a warrant; the bit where they said Greg Hunt’s statements “seem at odds” with the legislation. #auspol#MyHealthRecord
Public trust in the My Health Record may be lost without swift action from the Government, the Department of Health and the Australian Digital Health Agency (ADHA) to fix significant legal and privacy issues, according to the Australian Healthcare and Hospitals Association.
The issues centre on possible access by enforcement bodies to information stored in My Health Record.
A Parliamentary Library briefing released last week warned that the law governing My Health Record did not require a warrant or court order in order for the operator of the system (the ADHA) to provide medical records to police or other enforcement agencies.
CHF supports stronger protection for patient records
MEDIA RELEASE FRIDAY, 27 JULY 2018
The Consumers Health Forum welcomes the statement by the Prime Minister and Minister Hunt that the Government will move to address concerns about protection of privacy under the My Health Record.
“The success of MHR relies very much on people’s trust that their medical information will be protected,” the CEO of the Consumers Health Forum, Leanne Wells said.
“Mr Turnbull says if refinements are needed, they would be made. We believe Section 70 of the My Health Records Act 2012 needs to be tightened so that access to medical records for non-healthcare reasons is governed by law and judicial oversight and not left to be subject to agency policy.
The chief of Australia’s peak body representing more than 60,000 police officers in all jurisdictions, has called on the Turnbull government to urgently legislate to outlaw investigators from accessing the My Health Record system without a warrant.
Malcolm Turnbull yesterday flagged further “refinements and reassurances” to the controversial e-record scheme to help ensure it did not undermine patient privacy.
The Royal Australian College of General Practitioners said those refinements were essential if public health was not to be put at risk through people being reluctant to discuss certain conditions with their doctors.
Professor of Practice in Digital Health, Monash University
Australians have just under three months to decide whether they want a My Health Record, which would allow the various health professionals who look after them to access and share their health information. From October 15, those who haven’t opted in or out will have a record automatically generated.
In emergency situations, access to information from My Health Records about allergies, medicines and health conditions can save lives. Day to day, it will provide benefits such as reminding us when we last had a tetanus shot, or allowing a back-up GP to access the results of a recent blood test so we don’t need another.
