30 July 2018

Police can access medical data MHR or not

MBS TheHill

An examination of the legislation underpinning Medicare Australia has revealed that the precedent for the police accessing MyHealthRecord without a warrant was set a long time ago.

Medicare Australia is legally allowed to share linked PBS and MBS data with law enforcement without a court order, so long as the disclosure is “reasonably necessary” to enforce criminal law, a law imposing a pecuniary penalty, or the protection of the public revenue.

Once linked, PBS and MBS data can tell a very detailed story about an individual’s medical history. 

It was possible to infer from item numbers and prescription codes whether a patient had a mental health condition, an STI or had undergone an abortion, said Dr Chris Culnane, a cybersecurity expert at The University of Melbourne. 

“So, releasing that information is very similar to releasing someone’s medical records, which is obviously not something that should occur without appropriate oversight,” he said.

Two legal experts contacted by The Medical Republic confirmed that Medicare Australia could legally pass health information onto law enforcement without judicial oversight under the National Health Act 1953.

Medicare Australia was contacted for comment but did not provide a response prior to going to press.

The revelation came as fear and confusion mounted in response to reports that the Australian Digital Health Agency (ADHA) could disclose MyHealthRecord documents to police, Centrelink, Medicare, or the Australian Tax Office without a court order. 

Currently, the police cannot access medical data held privately in a GP clinic without a warrant or a subpoena. 

But under Section 70 of the My Health Records Act 2012, the ADHA can share health information if it reasonably believes it is necessary for, among other things, the prevention, detection, investigation, prosecution or punishment of criminal offences, or the protection of the public revenue. 

“You could drive a reasonably large truck through those provisions and not hit the side,” said Peter Clarke, a barrister at Isaacs Chambers in Melbourne. “They are drafted in such broad and vague terms that it is easy to justify access. It is a big gift to the police.”

Lowering privacy protections could put vulnerable patients at risk if, for instance, their Centrelink payments depended on their health status, or they were technically breaking the law by undergoing an abortion in Queensland, said Professor Kerryn Phelps, a GP and past president of the AMA.

“Who in their right mind puts the ADHA in charge of deciding whether this precious information is handed over to a third party?” she said. 

Assistant Professor Bruce Baer Arnold from the School of Law at the University of Canberra said the drafting of the legislation was a “deliberate privacy creep” and that bureaucratic convenience had trumped the rights of citizens.

The ADHA said it would never release documents without a court order, and had not done so in six years of operation.

But legal experts said requests for private health information should be subject to judicial review.

“It is a big deal in our society, and it has been for about 400 years, to be able to enter someone’s private domain,” said Mr Clarke. 

By not embedding judicial oversight in the legislation, the government was effectively asking the public to trust every individual in every agency that might have control over MyHealthRecord information in the future. 

This was a flawed approach because “people are inherently fallible and subject to various temptations and various biases,” said Jonathan Crowe, a professor of law at Bond University.

References:

National Health Act 1953 – Privacy Guidelines for the Medicare Benefits and Pharmaceutical Benefits Programs (Guideline 3: Linkage of claims information by Medicare Australia)

Health Insurance Act 1973 (124Z Minister may authorise disclosure of information about a serious offence)

‘Medicare and pharmaceutical benefits’ (The Office of the Australian Information Commissioner)

Something to say?

Leave a Reply

5 Comments on "Police can access medical data MHR or not"

Notify of
avatar

Sort by:   newest | oldest | most voted
Lou Lewis
Guest
Lou Lewis
1 month 19 days ago
It has just been announced tonight that the honourable (and I use that word loosely) health Minister is going to make changes to the MHR act that will enable government authorities and other institutions access to the MHR of patients only by a court order. He also said that if the government creates a MHR for you and after a while you no longer want it the government will actually delete this record for all eternity!! If you believe that yo must believe that pigs fly!! By the way why was such a flawed ,insecure, no guarantee of privacy system,… Read more »
Steve Hambleton
Guest
1 month 20 days ago

The ADHA said it would never release documents without a court order, and had not done so in six years of operation.

But legal experts said requests for private health information should be subject to judicial review.

So the two statements above say the same thing…..
The ADHA has a board with a consumer on it and a consumer advisory panel to advise the board and it’s policy is that it would never release documents without a court order.

Lou Lewis
Guest
Lou Lewis
1 month 19 days ago
There are so many secret deals done with government and their agencies by both the AMA and the RACGP that I have trouble believing anything becomes from the mouth of any former president of the AMA. Sorry if I sound mistrustful of secret compacts with governments without the knowledge of the general members of the union, and sorry if I do not trust secret units within the health apartment running experiments on general practitioners, and sorry if I don’t trust the word of any government subcommittee, but I would be even more sorry if I trusted the word of these… Read more »
Trevor
Guest
Trevor
1 month 20 days ago
Seems to me what’s happening in the controversy around MyHR is another good example of how the people are being served by the State. That is, it’s another topic jostling at the interplay of Nation vs State. I take “Nation” to be the sum of actual individuals (living, dead and to-be) and “State” to be the apparatus elected to serve the necessary functions required by (a democratic, progressive) Nation. The State is able to, and has the tools, to go to extraordinary lengths to validate members of the Nation. A pretty good example is the identification of soldiers from fragments… Read more »
Chris Atkins
Guest
Chris Atkins
1 month 20 days ago

I suspect the risk of inappropriate release of info is low but do agree more formal oversight of requests is the way to go.

wpDiscuz