This long article reminded me just how real the issue is:
‘Damaging our trust’: why My Health Record lets down sexual and gender minorities
It is critical that people—especially people from gender and sexual minorities and people living with HIV—are made aware of the potential risks of the My Health Record system.
My Health Record is a well intentioned policy but its execution discourages marginalised groups from confidently accessing healthcare.
It stokes fears of the forced disclosure of confidential health information—such as the results of sexual health tests and HIV status—which undermine public health outcomes and the individual wellbeing of people in the LGBTI community.
The Australian Digital Health Agency (ADHA) was created in 2016 to improve health outcomes for Australians using digital systems.
The cornerstone project of the Agency is a national digital health system, and so every Australian will have a My Health Record account by the end of 2018. The online account is a summary of your health information.
According to the ADHA website, its purpose is to deliver ‘safer, better quality healthcare’ and the initiative has many advantages.
Centralisation reduces the hassle of transferring documents between medical institutions and provides immediate access to information (e.g. allergies and prescribed medications) for efficient emergency treatment.
However, the problem is two fold. Firstly, once uploaded your confidential records are retained for 30 years after your death, or if that date is unknown, 130 years after your birth.
Secondly, and more pressingly, law enforcement agencies can access your confidential health information without oversight: the approval of a court or tribunal is not required [see: s. 17 and s. 70].
Health Department officials may release information included in a My Health Record if they believe it is ‘reasonably necessary’ to prevent, detect, or investigate ‘improper conduct’ or to prosecute criminal offences.
Additionally, your enrolment in the system is automatic so if you do not opt-out your consent to these details is presumed.
Privacy concerns are well founded. A My Health Record includes information such as discharge and event summaries, pathology and imaging reports, prescription documents, and specialist letters.
Medical data of this kind is highly sensitive, especially for people from gender and sexual minorities.
Things that are recorded could include a trip to A&E to obtain PEP, summaries of consultations with trans and gender diverse health specialists, notes from consultations with psychologists, the frequency of sexual health testing and the results of the tests, and prescriptions for such things as PrEP and HIV medication.
The Australian Privacy Foundation previously pointed out that the ATO and ABS have expressed an interest in accessing health data, and further warned that such information could be matched with your metadata. Indeed, one of the purposes of the system is to ‘provide de-identified data’ for research purposes.
Last year academics from Melbourne University demonstrated that it is already possible to identify people from supposedly de-identified health data from the Australian Medicare Benefits Scheme (MBS) and the Pharmaceutical Benefits Scheme (PBS).
Lots more here:
While this article focusses on the LGBTI community very similar issues arise with the mentally ill, those with other potentially stigmatising problems and so on. While the system has been opt-in it has been a relatively simple matter to avoid the myHR but with the opt-out plans rolling on this becomes less easy and straight forward.
I wonder where the research is on the potential downsides for such groups and the mitigation strategies that are needed. In a society as complex as ours it is never ok to assume that if something is alright for 95% of the population that the potential downsides for some do not demand consideration and mitigation.
Remember we were promised a voluntary system – have now been lumped with the opt-out process, still not fully clarified and defined as far as I know – and seem not to have any solid research or evidence on just what all the risks for the minorities are and how they are to be managed.
It really is not good enough for something as important as you private health information, especially in the era of massive data leaks from the likes of CBA and Equifax and information abuse from the likes of Facebook.
Can anyone who has such evidence and research let us all know?
David.
Not research but submissions to Health
ReplyDeleteSubmissions from the Royal Australian and New Zealand College of Psychiatrists.
Review of the Personally Controlled Electronic Health Record
26 August 2014
https://www.ranzcp.org/Files/Resources/Submissions/Archive/3695-President-to-Minister-Dutton-re-PCEHR-27-Augu.aspx
"The RANZCP does, however, have a number of ongoing concerns regarding the implications for patients with mental illness, where issues of privacy, access and consent can be complex"
Electronic Health Records and Healthcare Identifiers: Legislation Discussion Paper
24 June 2015
https://www.ranzcp.org/Files/Resources/Submissions/Archive/4139-President-to-M-Bowles-re-Ehealth-submission-2.aspx
"... the RANZCP has concerns regarding how the Personally Controlled Electronic Health Record (PCEHR) system will work in practice – especially around issues of privacy and access to sensitive health information, which are especially relevant to patients with mental illness."
Like so many submissions that did not agree with Health's ideology, they got ignored.
BTW, a lot of information that used to be available on Health's, NEHTA's and myhealthrecord.gov.au is gradually disappearing. Almost looks as though ADHA is trying to hide stuff, or at least make it harder to find.
People should be able to decide if they want to opt out from having a record through being informed transparently about how the system is designed in terms of controlling access. If a consumer is anxious about something sensitive in their record, then they should be informed exactly how the access controls have been designed and work. For example they might need to know:
ReplyDelete1) you can't block access to your record by an organisation until that organisation has already accessed your record. This may be too late if you have something sensitive that you wish to keep confidential.
2) access is not controlled at the level of a clinician, but at the level of an organisation. An organisation may be as large a 'Queensland Health'. Thus if you don't want a particular clinician or health service to see your record, then you would need to block everyone from Queensland Health. If you are happy not to block access, then you should know that it is possible for any health care worker within Queensland Health to see your record. That includes your next door neighbour who happens to work as a physiotherapist at the local hospital, and your aunt who works in a distant hospital at the other end of the state. Your access history will simply show 'Queensland Health'.
3) if you get a prescription filled (don't we all at some point?), then your local pharmacist and her dispensing technicians will all be able to see everything in your record. If this pharmacy is part of a larger group of pharmacies, then it is possible that all of the staff in the broader group will also be able to see your record.
4) If you/your child is under 18, then one or both of the parents may be able to access your record and find out where you and your family are living/receiving care and what sort of health care you are receiving, along with any other representatives that may have been granted access by the parents to your record.
For most people, this will all be fine, and they may benefit from having a record. But if you have something that you need to be confidential - only shared with those that need to know - then you may not want to take the risk that is inherent in the current design. Perhaps wait for version 2.
Remember - there are no access controls over what the government can see.
ReplyDeleteI bet Timmy won't tell that to the press club next week.
I bet Timmy is not eligible for a MyHR. Unless he is a que jumper. We have no shortage of skills able to run a small Agency in Australia so I don’t think any special visa would be justified.
ReplyDeleteThe whole Govhr project can be summed up as a nice but dim idea much like care.data
There is a simply to to valid if you can do an indervidual or just an organisation and at what level of organisation it goes down to
ReplyDeleteOpen a ticket or 9 asking for screenshot based instructions. Either that will clear up the matter or you will not get an answer, which would open up a whole new set of questions
What happens when the parents are splitting up due to domestic violence and one of them needs their access blocked to the MyHR records of the children? If a mother and the children are relocated to a new address for safety (AVO) then you don't want the father accessing records in the MyHR that may help to locate them.
ReplyDeleteThat is not the concern of the health minister, that would fall to another minister. Simply send a request to the MyHR help desk and see if you get a response. Let us know the outcome
ReplyDeleteYou raise a very valid question