The arguments for and against having a My Health Record

After insisting there would be no further extension, Health Minister Greg Hunt took to Twitter on Wednesday to extend the deadline for Australians to opt out of the government’s My Health Record project.

The opt-out period was meant to end on October 15. But community concerns about privacy – and lobbying by the Australian Medical Association (AMA) for certain amendments – saw the period extended to 3am on November 16. Thursday morning.

Parliament is currently debating proposed amendments meant to address security and privacy concerns.

Mr Hunt’s announcement came after the My Health website appeared to crash – and after the Senate voted to extend the opt-out period to January 31.

Labor is pushing for the rollout to be suspended for 12 months – by which time it will presumably be in government, and will further refine the system.

Today the Government worked with the Senate crossbench to extend the opt-out period for #MyHealthRecord.

The opt-out period will be extended until January 31, 2019, however, it’s important to note that people can opt-out at any time.

— Greg Hunt (@GregHuntMP) 14 November 2018

What’s the fuss about?

In 2017, the government announced that in 2018, every person with a Medicare or Department of Veterans’ Affairs (DVA) card who has not already registered for a My Health Record would automatically have one created for them, unless they choose to opt out of the system.

My Health Record (MHR) is Australia’s national eHealth record system – a repository for healthcare information that is accessed online by healthcare providers and healthcare consumers.

One in five Australians are reportedly enrolled at My Health’s forerunner, the Personally Controlled Electronic Health Record (PCEHR) system that was launched in 2012.

The Australian Digital Health Agency estimates that almost six million Australians currently have a MHR.

My Health is basically the PCEHR re-badged with a friendlier name.

The PCEHR, plagued by technical issues and a blown budget, was originally launched as an opt-in system, but failed to lodge in the public mind and had a relatively small uptake.

That Australians are automatically given a MHR and have to otherwise opt out has been the system’s most effective publicity strategy – and a highly contentious one.

Why would I opt to stay in?

Jim Gillespie is deputy director at Menzies Centre for Health Policy, and badociate professor in health policy at the University of Sydney. He initially made his argument at The Conversation and it has since been picked up by news media as the standard bearer for opting in.

The MHR system gives health care professionals access to information about your medications and allergies, immunisation records, summaries of hospital and GP care, investigation reports, and advance care plans.

This information, Professor Gillespie said, could save lives in emergencies.

He also noted better continuity in the management of this information would help reduce the 27 per cent of clinical incidents in Australian hospitals currently caused by medication (mis)management.

He argued MHR was a small step towards empowering patients with greater knowledge about their health.

“Pressures to present records in terms that are comprehensible to consumers may even take us towards interactive ‘learning communities’ – the basis of a more people-centred health system,” Professor Gillespie said.

“Better-informed patients can enable more effective communication and mutual learning from health professionals.”

He acknowledged the privacy issue, but noted My Health’s forerunner, the PCEHR, had not been breached in its five years of operation.

The National Rural Health Alliance, Australia’s peak body for rural and remote health, has implored country people not to opt out of MHR.

In a statement from CEO Mark Diamond, the alliance claimed MHR will save lives.

“If you live outside a major city, you have less access to health services, and are more likely to delay getting medical treatment. That means you’re more likely to end up being hospitalised,” Mr Diamond said.

“A My Health Record means that all your important health information is at the fingertips of your doctor, nurse or surgeon.”

Why opt out then?

Katharine Kemp is co-leader, ‘Data as a Source of Market Power’ Research Stream of The Allens Hub for Technology, Law and Innovation, at UNSW. Bruce Baer Arnold is an badistant professor at the University of Canberra’s School of Law. David Vaile is leader of the Data Protection and Surveillance stream of the Allens Hub for Technology Law and Innovation, at the UNSW Faculty of Law, UNSW.

They made the opt-out case for The Conversation, which has since been widely cited.

They argue that My Health “can’t be relied upon as a clinical record”. They quote the Office of the Australian Information Commissioner, which said: “The My Health Record system contains an online summary of a patient’s key health information; not a complete record of their clinical history.”

They pointed to a small June poll (of 200 practitioners) on the Australian Medical Association’s doctors portal that suggested 76 per cent of respondents think the MHR will not improve patient outcomes, while 12 per cent think it will.

Their main concern is that MHR poses a security risk. They cited the Australian Digital Health Agency’s caution that there are risks from the online transmission and storage of our personal information in this system.

They argue health data is prized by hackers, and that “storing records digitally with online access greatly increases their accessibility for criminals, hackers and snoopers”.

Health records are valuable as a means of identity theft due to the wealth of personal information they contain.

“They are a huge prize for hackers, fetching a high price on the Dark Web,” the piece said.

You won’t know who has seen your record

Dr Kemp and company say that it won’t just be your doctor who has access to this centralised digital record of your personal health information.

“The default position is that numerous people will have access – doctors, pharmacists, physiotherapists, nurses and unidentified staff of various organisations,” the article stated.

MHR’s access-logging system does not track which individuals are accessing records, only institutions, which means you won’t be able to tell who has seen it.

“Even without a technical hack, that will make it almost impossible to keep your information secure in this system,” the authors noted.

They also noted that My Health permits external health apps to access your records. According to the legislation, this should only be done with your consent.

“Unfortunately, and predictably, health apps are already securing consent; through obscure, standard-form contracts so you might not be aware the app owner could sell your sensitive medical information to others.”