Sunday, October 08, 2017
This Is The Second Time The Government Has Tried To Grab Largely Unfettered Access To The Information In The myHR. Why Did The First Attempt Fail I Wonder?
I first alerted the reader to proposals around the Secondary Use Of The myHR Data here:
This was late August 2016 – and after a bit it all went quiet!
This appeared a few days ago as the project ramped up – and was mentioned in the blog last week:
De-identified My Health Record data could potentially be used by researchers
06 October, 2017 07:00
A public consultation has begun on potential uses of de-identified data drawn from Australia’s national e-health record system.
The government in its May budget set aside $374.2 million for the expansion of the My Health Record system as it shifts to an ‘opt-out’ model. Under the new model, a health record will be created for every Australian citizen unless they request otherwise. (Once a record is created it can’t be deleted, just rendered inaccessible.)
Some 5 million Australians already have records.
Specialist consultancy HealthConsult has been retained by the Department of Health to develop a framework “for the secondary use of data held in the My Health Record system for research, policy, system use, quality improvement and evaluation activities”.
Secondary use is any use of the system for purposes other than providing healthcare to an individual; for example, research, policy analysis and work on improving health services.
Under My Health Records Act 2012 one of the duties the operator of the eHealth record system — the Australian Digital Health Agency — is “to prepare and provide de‑identified data for research or public health purposes”.
The government also faced questions about its management of Medicare data after a service offering the Medicare number of any individual was unearthed.
HealthConsult is accepting submissions until 17 November. The consultation paper is available online.
Usefully HealthConsult have provided a summary of the issues they plan to consult on and address:
A ‘plain English’ guide to the Public Consultation Paper
The Australian Government is consulting with the public about how data in the My Health Record system may be used in future. This is your chance to have your say. The Department of Health is leading the public consultation and has prepared this guide to the Public Consultation Paper – Development of the framework for the secondary use of My Health Record system data (‘the Consultation Paper’).
The My Health Record system allows you to share your important health information (like your medical conditions, treatments, allergies, and details about medicines) securely online with registered healthcare providers – from anywhere, at any time. It can include information from Medicare (like the last time you went to see your doctor), prescription data (what medicines you take) and test results (like blood tests or x-ray reports). It can also hold other documents uploaded by your GP (like letters to specialists) and hospitals can upload discharge summaries and follow-up care information.
‘Secondary use of data’ is when information is used for a purpose other than that for which it was originally collected. The primary purpose of My Health Record is to assist your doctors and healthcare providers with their clinical decision-making – so all your doctors and healthcare providers can look at the same information about your health. This way, everyone can work together in one secure digital environment to better coordinate your care, even when you can’t speak, like in a medical emergency. For the purposes of these public consultations, ‘secondary use’ is defined as “using the information in the My Health Record system for purposes other than the provision of direct healthcare to the individual person, which is considered to be the primary use.”
Over 5 million Australians now have a My Health Record. Most doctors and hospitals in Australia are connected to the My Health Record system, which currently holds over 3 million clinical records and 12 million prescription and dispense documents. As the volume of information in My Health Record grows and more Australians get a My Health Record, it may become one of Australia’s most comprehensive health data resources. The Framework will build upon existing privacy laws to enable secondary use of health data for the public good and the use of data solely for commercial and non-health related purposes is considered out of scope.
There are many existing public and government health datasets being used for secondary purposes. It is envisaged that the Framework will address overlap between commercial and health related uses of data. For example, use of data for development of pharmaceuticals could be considered both a health related and commercial purpose.
Currently, data in the My Health Record system is not used for research, policy and planning purposes, although legislation is in place to enable it. Under the My Health Records Act 2012, one of the functions of the Australian Digital Health Agency as the system operator for the My Health Record is “to prepare and provide de-identified data for research and public health purposes.” In addition, the legislation states that health information in the My Health Record system may be collected, used and disclosed “for any purpose” with the consent of the healthcare recipient.
The Privacy Act 1988 also applies to the My Health Record in respect of consumers’ health information, for example, the Australian Privacy Principles Guidelines explicitly states that in order for you to give consent for anything, you must be adequately informed beforehand, you must give it voluntarily, your consent must be current and specific, and you must have the capacity to understand and communicate it. Consent is defined as “express or implied consent.”
In 2018, all Australians will have a My Health Record created for them unless they choose not to have one. This means that people can exercise a choice to opt out of the My Health Record system. If a person does not opt-out, their consent is implied.
Before My Health Record data can be used for secondary purposes, a Framework is required that incorporates such existing rules. The Framework must reflect the expectations of all Australians about how the health information held in the system should, or could, be used. The release of the Consultation Paper marks the start of a consultation process for the government to find out what Australians want the Framework to say. It gives people the opportunity to provide input about who should be able to access My Health Record data, for what purposes and what the oversight arrangements should be.
In the future, the secondary use of My Health Record data is very likely to provide important insights into the effectiveness and safety of medical treatments and clinical care across Australia’s health system.
The folate story
A good example of evidence-based policy-making as a result of secondary data use occurred in 1989 when Western Australian researchers linked health data from different registries. The researchers determined that the inclusion of folic acid in expectant mothers’ diets prevents neural tube defects in their babies. This finding was followed by education campaigns to encourage women to eat more folate enriched foods or take folate supplements during pregnancy. In 2007, all Australian governments (Commonwealth, State and Territory) agreed to introduce the compulsory enrichment of bread‑making flour with folate, which reduces incidents of spina bifida and other neural tube defects in children. Since this measure was introduced there has been a significant (14.4%) overall decrease in the rate of neural tube defects in Australia. The rate of neural tube defects decreased by almost 55% among teenagers and by 74% for Aboriginal and Torres Strait Islander women.
Other likely benefits
Secondary use of My Health Record data could also occur when new treatments, like new drugs, are offered to Australians for diseases like diabetes or cancer. Identifiable information in My Health Record may be securely linked to quickly locate people who may want to be part of clinical trials.
Researchers involved in clinical trials may also request permission to link My Health Record data to other databases to help investigations into subsequent hospitalisations, diseases and death.
My Health Record has operated successfully, securely and with millions of participants for almost five years. The system has security similar to that of a bank and is built on proven technology. It has controls in place to detect and mitigate denial of service attacks and hacking attempts.
Typically in Australia, agencies that hold and manage data and information, like the Australian Institute of Health and Welfare and the Australian Bureau of Statistics, play a central role in privacy protection and use of data for monitoring and research. Their duties include undertaking activities to maximise the value of the data they hold, while minimising risks to security and privacy. The Framework will be developed with a view to defining a role for a single accountable authority to be responsible for secondary uses of My Health Record data.
In 2016, new participation arrangements for My Health Record were trialled in several parts of Australia. Residents in these communities had a My Health Record created for them unless they chose not to have one. As part of these trials, an independent evaluator found that once the majority of participants understood the My Health Record system, they agreed that the benefits of having a record “far outweigh the possibility of risks to privacy, confidentiality and security.”
This paper and more detailed information are available from this link:
Besides making the obvious points that the ‘Folate Story’ was nailed without the myHR almost 30 years ago and that the myHR has already had breaches as reported by the OAIC a month or so ago this is a useful summary.
Writing a year ago or so I commented:
“There are a range of issues I see that need to be resolved here:
First, given the myHR is presently a large pile of documents (many .pdfs) just how is the data to be extracted and made useable? (an example I know of is that many of the PBS records use trade names rather than standardised names for comparability)
Second how certain can we be the records will be properly anonymised and not be re-linkable?
Third what will be the involvement of properly constituted ethics committees and data anonymization experts in allowing this data access?
Fourth will citizens be told if their data is being utilised and have the right to see the data before it is used so they can deny access if they are concerned.
Fifth, given NEHTA’s and DoH’s track record of ‘pseudo consultation’ where pretty much all input is just ignored what confidence can we all have what is done will be in accord with sensible requests.
To me the threshold question will be ‘Just who does this access and research ultimately benefit?’ If the answer is the patients or citizens there may be a case for this – otherwise I, for one, will be pretty sceptical!”
I see no reason to change those comments and with comments related to unconsented and commercial use of the data I think we need to move carefully and cautiously rather than have a blow up and totally destroy any remaining confidence in the myHR.
This is a complex topic and I am interested in what readers think and if I think I can say something useful I will plan to develop a submission.
Comments more than welcome!
Posted by Dr David G More MB PhD at Sunday, October 08, 2017