They Just Don't Get It - Personal Privacy does Matter

All in all it has been a very bad week for NSW Health IT. Both the major daily papers, The Sydney Morning Herald and The Australian have been running stories pointing out how a number of years of careful policy work related to the privacy of Shared Electronic Health Records has been swept aside - basically to meet a political time line for implementation of a trial EHR system - termed Health-E-Link.

It seems the NSW Minister for Health was persuaded that every one in the target population (citizens over 65 years living in the Hunter Region who visited local outpatient facilities) would love to to have their details available for sharing with any authorised practitioner on a compulsory basis. Later it was decided that once the details were collected the citizen would have 30 days to "opt-out" of record sharing. However the records are not deleted - merely made unavailable.

Even worse the clients of the system have no say in what will be captured - so the only way to avoid having a record established is not to attend the public services in the area.

Not surprisingly, many advocacy groups and other interested parties (dismissed as "privacy zealots" by the Minister, are less than impressed with this outcome, saying to a group we don't mind records but we want a strong say in who accesses these records and under what circumstances. They are also annoyed that the regulations to allow this information capture were slipped through quietly with no public consultation or announcement.

Just the other day a powerful coalition of privacy advocates enumerated what is required in the way of privacy for records to be made available for sharing between health practitioners.

The key points they itemised were put in the following terms:-

"We urge you to build a foundation for medical information technology that is based on the following longstanding ethical and privacy principles and protections:

• Restore the patient's right of consent
• Give patients the right to opt-out of having their records in any national or regional electronic health system
• Give patients the right to segregate their most sensitive medical records
• Require audit trails of all disclosures
• Deny employers access to medical records
• Require that patients be notified of all suspected or actual privacy breaches
• Preserve stronger privacy protections in state laws
• Enact meaningful enforcement and penalties for privacy violators"

All this is utterly reasonable and practical - and is what should be done - to ensure citizens are comfortable with shared records and these recommendation accord closely with what has been developed both in the UK and indeed for the Commonwealth under the HealthConnect banner.

Frankly NSW is a rogue state that will put the cause of health information sharing in Australia back decades unless a major policy about-face occurs. Those responsible for this should recognise they have made a grievous mistake and suspend the trial until proper reasonable controls can be put in place.

David