My Health Record: A Further Erosion of Civil Liberties

The Turnbull government oversaw the 2015 implementation of a system that allows 21 government agencies warrantless access to all citizens’ metadata, while last year, it announced a national facial recognition system that will allow all citizens’ ID photos to be matched with CCTV footage images.

The government is currently in the process of rolling out a national health data scheme that will automatically link all citizens’ private health information – which will potentially include genomic data – to a centralised system unless individuals opt-out by 31 January 2019.

My Health Record is being spruiked as a system that will allow doctors convenient access to a patient’s medical history. However, privacy advocates and health professionals are warning of the security and privacy threats posed by the scheme, which allows for the secondary use of data.

Police access

Former Australian Medical Association president Kerryn Phelps said in a recent article that she was “cautiously enthusiastic” about a centralised health record, especially due to the benefits it could have for older people with complex medical histories, until she took a closer look at the legislation.

Professor Phelps pointed out that section 70 of the My Health Records Act 2012 currently allows police and government agencies warrantless access to this information in order to investigate or prosecute a crime, counter “seriously improper conduct,” or to protect public revenue.

A hidden agenda?

“The sales pitch is that this is all about people’s health, but if that was the case then these other things, like third party access and delegations to unknown people, would not need to be there,” Professor Phelps told Sydney Criminal Lawyers®.

The professor stressed that police and agencies don’t “have any business accessing that information, and certainly not without a warrant.” While health minister Greg Hunt stated last week that the Act would be amended to require a warrant, “we haven’t seen the results of that yet.”

“We don’t know what other agenda might be operating or why the government feels third party access is needed,” Professor Phelps said. She added that the fact the legislation allows access for the preparation for proceedings before any court or tribunal as “quite a significant concern.”

At present, My Health Record is being operated by the Australian Digital Health Agency (ADHA). But, Professor Phelps warns that if the scheme is privatised in the future, as happened with land title registries, there would be no accounting for where the information could end up.

A failed model

Operating since 2012, My Health Record has six million Australians already on the system. And as the coordinator of British privacy group Medconfidential Phil Booth has pointed out, it’s disturbingly similar to a UK system called care.data, which was cancelled in 2016 after a damning review.

“My Health Record does indeed share a number of characteristics with care.data, most notably that it appears to be more about providing a conduit for the exploitation of patients’ data for secondary uses than genuine, properly-evidenced clinical use,” Mr Booth said via email.

The British privacy advocate explained that the system in this country is even being run by the same man who was in charge of the British scheme. ADHA chief executive Tim Kelsey is the former head of the controversial care.data program.

Worthless guarantees

Mr Booth outlined that safeguards for the secondary use of My Health Record system data are “pretty much identical” to those made around care.data, which leaves open the potential for this sensitive information to end up in the hands of commercial entities.

According to Booth, instances where a commercial company has a contract with an Australian healthcare service make the promise that information will not be used “solely for commercial” purposes redundant.

A recent ABC investigation revealed that HealthEngine – Australia’s largest online doctor appointment booking service – was passing on information to law firms that were seeking clients for personal injury claims. And this company has a data sharing arrangement with My Health Record.

Booth also explained that while the government has guaranteed information that’s released for “research, policy and planning purposes” will be de-identified, the details within that data still “make a person uniquely identifiable.”

Impacting marginalised groups

The ability that Australian authorities have in accessing this confidential information – whether that be with or without a warrant – has the potential to impact certain groups whose activities may breach the law, such as sex workers, people who use drugs and woman who have an abortion.

Professor Phelps said the most concerning effect this aspect could have is that people may refrain from seeking medical assistance. “If somebody doesn’t feel they can go to the doctor and say they have a problem with cocaine use, then we’re not able to help them.”

“The only way that doctors can do their job is if there is strict confidentiality and privacy around those conversations,” Professor Phelps continued, “and that the conversations are had for the purpose of helping that person with their health.”

Due to concerns regarding criminalisation and stigmatisation a Sex Workers Outreach Project briefing paper suggests people living with HIV, sex workers who live in jurisdictions where sex work is criminalised and people who inject drugs should all opt-out of the scheme.

Opting out

As Professor Phelps explained, the original iteration of My Health Record allowed an individual to personally control their data. And the scheme was opt-in, until the Turnbull government passed legislation late last year making it compulsory for all those who don’t opt-out.

The opt-out model is “a problem because there are a lot of people that I’m speaking to that don’t know that they are able to opt-out,” Professor Phelps explained. Although, she added that people are gradually “starting to get the message.”

Mr Booth described the scheme as being run by “powerful people with a bunch of their own agendas, who aren’t medically competent, and who clearly aren’t telling you everything.” And he posed the question, “Who wouldn’t be a bit concerned?”

People should be “at least concerned enough to check it out for themselves and opt-out if they’re not satisfied that proper answers are being given,” he advised. “If it turns out down the line that everything works perfectly, they can always opt-in later.”

For those of you who do want to opt-out of My Health Record, you can do so here. It’s a two minute process that requires your Medicare card, as well as your drivers licence, or another form of identification.