My Health Record inquiry backs away from return to opt-in

Australia’s grinding, decade-long and always controversial journey towards national adoption of electronic health and medical records is set to maintain its current ‘opt-out’ stance after a key parliamentary committee backed away from a return to voluntary adoption.

The Senate’s Community Affairs References Committee on Thursday delivered its final report into the My Health Record system, recommending a slew of improvements but pulling up short of flipping the roll-out back to the previous opt-in model.

The report represents a crucial truce in the ongoing political and social debate surrounding privacy and access elements of the troubled scheme because it stipulates far tougher default access controls over the presumption that citizens should only get an eHealth record if they proactively ask for one.

Medical and care sector stakeholders had feared that recommendations to flip the national eHealth scheme back to opt-in would again derail the potential for vital critical mass to be garnered to make the system feasible at a mainstream level.

In the end, despite philosophical differences, the notion that centralised electronic health data was of more public benefit than privacy detriment appears to have won out.

Even so, the committee was sharply critical of the rollout, punching out 14 recommendations that it believes place necessary limits on how highly sensitive personal health and medical information can be accessed.

Where the recommendations (and for that matter the government of the day) ultimately land is debatable, but the list of suggested improvements looks roughly like this:

• Current laws be amended “to protect the privacy of children aged 14 to 17 years unless they expressly request that a parent be a nominated representative.”
• Access codes should be applied to each My Health Record by default and that individuals should be required to choose to remove the code. The ability to override access codes in the case of an emergency should only be available to registered healthcare providers for use in extraordinary and urgent situations.
• Existing laws be amended “to extend the period for which a My Health Record can be suspended in the case of serious risk to the healthcare recipient, such as in a domestic violence incident.”
• Explicit individual consent be required for “data which is likely to be identifiable from an individual's My Health Record” if it is to be “made available for secondary use”.
• Current prohibition on secondary access to My Health Record data for commercial purposes be strengthened “to ensure that My Health Record data cannot be used for commercial purposes.”
• No third-party access to an individual's My Health Record be permissible, without the explicit permission of the patient, except to maintain accurate contact information.
• Current laws be amended so that “it is clear that an individual's My Health Record cannot be accessed for employment or insurance purposes.”
• Access to My Health Records for the purposes of data matching between government departments “be explicitly limited only to a person's name, address, date of birth and contact information, and that no other information contained in a person's My Health Record be made available.”
• Legislation be amended “to make explicit that a request for record deletion is to be interpreted as a right to be unlisted, and as such, that every record is protected from third-party access even after it is deleted, and that no cached or back-up version of a record can be accessed after a patient has requested its destruction.”
• The Australian Digital Health Agency (ADHA) “revise its media strategy to provide more targeted comprehensive education about My Health Record.”
• The ADHA “identify, engage with and provide additional support to vulnerable groups to ensure that they have the means to decide whether to opt out, whether to adjust the access controls within their My Health Record and how to do this.”
• More funding to communicate what the MHR entails to “vulnerable and hard to reach communities.”
• The opt-out period be extended for another year.
• Regular oversight report to Parliament be required.

The full report can be found here.