Senate MHR report echoes doctors’ concerns

The senate committee's report recommends a 12-month rollout freeze for the MHR, but the minister says he's not budging

---

A Senate committee has called for the My Health Record roll-out to be put on ice for 12 months to fix security concerns, tighten access controls and ensure patients properly understand their options.

The Senate Community Affairs References Committee’s report criticised the Australian Digital Health Agency’s information strategy, saying it had failed to give people enough information to make informed choices about the planned opt-out system.

The committee’s recommendations chime with many doctors’ concerns over the current MHR design regarding security and patient awareness.

RACGP President Dr Harry Nespolon said the problems had arisen due to the shift from an opt-in system to opt-out without adequate attention to safeguards.

“It’s clear that the privacy provisions in the current legislation are not sufficient. As it is now, we cannot support it,” Dr Nespolon told The Medical Republic.

“Whether the politicians take 12 months to sort it out, or 24 months, or six months, we would prefer they sort it out sooner rather than later.”

Coalition senators on the committee issued a dissenting report opposing the 12-month freeze and the adoption of default access codes. They argued that the use of access codes would impede clinicians and only pose more security risks if, for example, people were sent PINs by post or email.

Health Minister Greg Hunt, who earlier called the senate inquiry a “stunt”, rejected the call for a 12-month suspension.

But Labor’s health spokeswoman, Catherine King, said the My Health Record should not proceed until public confidence was restored.

She agreed with the report’s contention that “an unreasonable compromise may have been struck between ensuring the utility of the system and safeguarding the privacy and safety of healthcare recipients”.

In its report, released late on Thursday, the committee acknowledged that the opt-in participation model had not been able to deliver the critical mass necessary for the MHR system to get traction quickly.

But the current model had “swung too far in favour of ease of access” and not focused enough on the importance of helping the public make an informed choice about whether to participate and the level of security they might require.

Specifically, it recommended that access codes be applied to each My Health Record as a default and that individuals should be required to choose to remove the code.

The ability for health professionals to override access codes should be limited to “extraordinary and urgent situations”.

AMA President Dr Tony Bartone said the AMA supported many of the committee’s recommendations but not the addition of pre-set access controls that would effectively make the My Health Record an opt-in system.

However, he said the minister should give the MHR roll-out more time past the mid-November cut-off for opt-out.

“We think it’s reasonable to extend the opt-out period.  I’ve always said we needed to give everyone the assurance  about what they were signing up for.

“It makes no sense to close the opt-out period before legislative amendments are finalised.  It needs to be extended pending the legislation, at least a month or two after the legislation is passed.”

Dr Bartone also emphasised the need for more education of the public in view of the changes to how their health information would be managed and stored.

The Senate report called for an amendment to ensure there was no doubt that MHR data, including de-identified data, could be used for commercial purposes. It noted that the current Secondary Use Framework prohibited the use of data for “solely commercial purposes”.

It also urged legislative provisions to ensure that employers and insurers could not access patients’ MHR data, and said no third-party access should be allowed without the patient’s explicit permission, except to maintain contact details.

The committee demanded an amendment to allow at-risk patients, such as families fleeing domestic violence, to suspend their records for a longer period, and changes to ensure greater privacy for 14 to 17-year-olds.

The report emphasised concerns that the ADHA’s communications campaign had not communicated a clear understanding of the MHR system and the significance of the shift to an opt-out model.

The opt-out system made it “more important than ever” to ensure that individuals understood the benefits of the system, the privacy and security implications, and the degree of control they could exercise over access to their MHR before they decided whether or not to opt-out.

A lack of awareness meant many of the MHR’s important security features would be rendered redundant, the report by the Greens and Labor-dominated committee said.

It urged the ADHA to do more to support “hard-to-reach” patient groups, including indigenous people, non-English speakers, the disabled and those without computer skills, and asked the government to devote extra funding for that purpose.

In other recommendations, it said legislation should be amended to ensure no cached or back-up version of a record could be accessed after a patient has asked for it to be deleted, and said the system operator should report “regularly and comprehensively” to parliament on the management of the My Health Record system.