First day deluge for My Health Record opt-out

Australians trying to opt out of the My Health Record have been confronted with issues using the dedicated opt-out portal, forcing many to spend hours waiting to speak with a call centre operator.

The first day problems began as the opt-out window for the e-health record system began on Monday, with many individuals wasting no time attempting to withdraw their consent.

Many trying to opt-out took to social media to vent their frustration with the portal, including its ability to verify identity credential.

Call operator Laura answers. Pleasantly & politely tells me she can help. Uses my Medicare number to locate my record. But can’t change alter my record as system down. She apologizes, guesses this is why I’m having trouble online and suggests I try again later. #MyHealthRecord https://t.co/BqLTRqYLxF

— Dr Leslie Cannold (@LeslieCannold) July 15, 2018

Well, opting out of @MyHealthRec is going well so far. #MyHealthRecord pic.twitter.com/Bw8vL3zAsA

— W (@WarWraith) July 15, 2018

It also emerged that call centre operators were forced to use the public facing portal after their own back-end systems apparently collapsed.

On hold with @MyHealthRec for over 1.5 HOURS to opt out without providing my drivers license/passport number. Turns out their entire backed system has crashed and they are telling support staff to just punch peoples details into the website. Confidence inspiring! #MyHealthRecord

— T0py (@InfoSecFriends) July 16, 2018

Entire server processing opt out from my health record has crashed. People trying to call centrelink are waiting in excess of 2 hours. Not even day 1 yet #auspol

— fred sparrow (@HailMarxism) July 16, 2018

A spokesperson from the Australian Digital Health Agency wouldn’t comment on whether any degradation of service to the portal had occurred during the day after “great interest in the My Health Record”.

But there was some acknowledgement of the higher than anticipated call waiting times.

“The Agency anticipated higher call volumes today, and as a result had more staff on standby to respond to enquiries,” the spokesperson said.

“If consumers were not about to get through today, they can opt out over the next three months till 15 October 2018.”

reCAPTCHA capturing data?

IT consultant and analyst Justin Warren also pointed out that Google’s reCAPTCHA widget was embedded in the portal, which could lead to some data used to opt out being offshored.

Right, so ADHA have embedded Google's reCAPTCHA on the My Health Record opt-out page, which has its own Privacy and Terms of Use. https://t.co/TeAJ3JVz7K

— Justin Warren (@jpwarren) July 15, 2018

The portal requires individuals to enter either a passport or drivers licence number, combined with either a Medicare card or DVA card number. 

reCAPTCHA, which is used to verify individuals as human when a query is performed, uses cookies to understand a user.

When presented with this information, the ADHA declined to comment.

However the My Health Record's legislation requires any record data, including information collected during the process of the opt-out, to remain on-shore.

Update Tuesday 17 July 9:00am : ADHA later advised on Twitter that no reCAPTCHA data was being shared.

FAQ: reCaptcha use in opt-out

reCaptcha is used in the opt-out process to ensure the transaction is made by a person and not a computer. This is important in preventing automated attacks which may impact service availability. There is no sharing of data with third parties.

— My Health Record (@MyHealthRec) July 16, 2018

Update Tuesday 17 July 2:00pm: Prime Minister Malcolm Turnbull confirmed a glitch in the opt-out system took place on Monday, but that 20,000 people were still able to opt-out.