Why is concern over access to My Health Record data not mirrored by worries over police requests for confidential PBS and MBS records?
While public outrage over access to My Health Record (MHR) data has forced a legislative change in favour of greater privacy, the police have been quietly dipping into another honeypot of health data: PBS and MBS records.
An investigation by The Medical Republic has revealed state, territory and federal police forces have sent around 2,600 requests a year for this sensitive health data to the Department of Human Services over the past two years. The department can legally disclose private health records to the police without a court order.
The department would not reveal how many of these requests were granted, but said the number of disclosures per year had remained stable over the past decade.
Once linked, Pharmaceutical Benefits Scheme (PBS) and Medicare Benefits Schedule (MBS) data, can paint a very detailed picture about a person’s medical history.
PBS data includes every rebatable medication purchased at a chemist. MBS records show which Medicare item numbers were billed for during each consultation, and what tests were ordered.
This information is as sensitive as MHR data, although it lacks the granularity of laboratory test results or GP notes, which can be included in a MHR. In November, the federal parliament passed legislation requiring police to produce a court order to access MHR data.
“This begs the question as to why similar protections are not being enacted in the MBS and PBS legislation,” Malcolm Crompton, a former privacy commissioner of Australia and founder and lead privacy advisor of Information Integrity Solutions, told The Medical Republic.
The legislative inconsistency was an “undeniable oddity” especially because most of the content of a MHR would, at least initially, simply be MBS and PBS data, he said.
Data sharing between the Department of Human Services and the police is shrouded in secrecy, with decisions being made behind closed doors by unnamed officials using an undisclosed set of public interest guidelines, which were issued by the secretary of the Department of Health in 2003.
The human services department has refused to make its 18-page privacy guidelines public under FOI laws, citing concerns that agencies might use their knowledge of the guidelines to trick the department.
“Specifically, with the benefit of having reviewed the document, requestors may construct their requests in a manner that undermines the department’s procedures (e.g. by misleading the delegate) in order to secure the disclosure of the requested information,” an FOI decision maker said.
Bernard Robertson-Dunn, PhD, the chair of the health committee at the Australian Privacy Foundation, said that argument was flawed and that the guidelines should be published.
“It could be argued that such secrecy and the implied suggestion that the police cannot be relied upon to do the ‘right thing’ is further undermining trust in public sector organisations,” he said.
“Is the department seriously suggesting that the police do not always act in the public interests?”
The department eventually provided a single case study for police use of private health data, four months after initially being asked about the purpose of disclosing this data, and only after The Medical Republic’s investigation exposed the scale of police requests.
The case study describes a scenario where the police are making an enquiry about a missing person whose safety is in question, and are using MBS and PBS claims information to determine whether the missing person had seen a doctor, obtained medications or updated their contact details.
The Medical Republic contacted each state, territory and federal police force for this investigation, but only the NT Police confirmed how many times the department had provided patient information.
The NT Police, Fire and Emergency Services made an average of 26 requests per year for private health data, including current contact details, next of kin, MBS or PBS records.
All of these requests were successful, and all were made without a court order. “Requests are not made under court order but rather must satisfy certain criteria,” Detective Acting Superintendent Peter Kennon said.
“That is it must be for a missing person or in relation to an offence with a penalty of two years or more imprisonment or 44 penalty units (about $6,000), and be in the public interest.”
The department is obliged to report the number of times it has disclosed linked PBS and MBS data to law enforcement authorities on an annual basis to the Office of Australian Information Commissioner (OAIC).
The Medical Republic obtained a copy of the OAIC reports, which showed that the DHS gave linked MBS and PBS data to police five times in 2016-17, but did not disclose data given to police in the previous three years.
“Most of the public interest disclosures the department makes to law enforcement agencies do not need to be included in our annual reports to the Privacy Commissioner,” a department spokesperson said.
The department only has to report the disclosure of “linked” MBS and PBS data to police. The word “linked” is not defined in the legislative instrument, so in practice, the department appears able to apply a definition that minimises its reporting obligations.
MBS and PBS data was only “linked” if the information was “combined, joined or merged”, a department spokesperson said. “The mere extraction of an individual’s MBS and PBS claims information into separate documents does not constitute linking for the purposes of the guidelines, even if those documents are sent to the same email address,” the spokesperson said.
“The department seems to be playing with semantics in order to avoid complying with the intention of the guidelines,” Dr Robertson-Dunn said.
Clearly, the government could do more to improve governance and transparency around data sharing without compromising security, Mr Crompton said.
“What is the oversight? If it is just an unaudited report to the OAIC who is not independently scrutinising each decision then perhaps oversight needs to be upgraded,” he said.
“If this involves additional work by an extremely cash-strapped regulator like the OAIC, then necessary funding should be provided.”
