Quote Of The Year

Timeless Quotes - Sadly The Late Paul Shetler - "Its not Your Health Record it's a Government Record Of Your Health Information"

or

H. L. Mencken - "For every complex problem there is an answer that is clear, simple, and wrong."

Monday, July 17, 2017

Weekly Australian Health IT Links – 17th July, 2017.

Here are a few I have come across the last week or so.
Note: Each link is followed by a title and a few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.

General Comment

A quiet week with the big news being the Government recognising it needs to make access to Medicare numbers more secure while not imposing too much red tape.
Otherwise the ADHA has been out and about on disposing of faxes and so on. Time will tell how that goes.
Enjoy the browse!
-----

Government announces Medicare security review after darknet sale revealed

Former public service head Peter Shergold will lead the review into how 200,000 health professionals access Medicare
In 2016, the system allowing access to Medicare card details was accessed 3,929,685 times. Photograph: Tracey Nearmy/AAP
The Turnbull government has announced a review the security of the online Medicare system and how doctors are able to access Medicare numbers after a darknet trader was discovered illegally selling patient details on request.
The former public service head Peter Shergold will lead the review, putting on notice thousands of doctors and other providers who have access to Medicare numbers via an online portal.
Guardian Australia revealed last week a darknet trader was offering the Medicare patient details of anyone for sale by “exploiting a vulnerability” in a government system, raising concerns that a health agency may be seriously compromised.
-----

Federal government announces review of health provider online access of Medicare data

July 10, 20179:36am
Staff writers News Corp Australia Network
A MAJOR review of the security of Medicare card details being made available online to private health providers has been announced by the Federal Government.
Human Services Minister Alan Tudge and Health Minister Greg Hunt have issued a joint statement saying the review follows revelations of a possible breach of Medicare records.
The federal government has been forced to contact “dozens” of Australians whose Medicare card numbers were illegally sold on the dark web.
-----

Medicare’s 45,000 daily hits under scrutiny

  • The Australian
  • 12:00AM July 10, 2017

David Crowe

The federal government will launch a high-powered inquiry into Medicare security to review the way doctors check up to 45,000 records every day, after a damaging privacy breach sparked fears about the sale of personal data to criminals.
The government will today name former public service chief Peter Shergold to lead the review into the online system, vowing to make “security risks and controls” a key part of a report to be done within three months.
The move puts doctors and other providers on notice that their access to Medicare numbers could be overhauled to tighten personal privacy in the wake of revelations last week that an online trader had sold 75 personal card details and was offering more for sale.
-----

Medicare 'dark web' scam could mean more red tape for GPs

Antony Scholefield | 10 July, 2017 |
Practices may face tougher security measures when looking up patients' Medicare details following claims hackers are selling patient Medicare numbers on the dark web.
The Federal Government has announced it will review the Medicare number lookup system, which GPs have used since 2009, after it emerged patients' Medicare numbers have been selling for about $30 each.
An initial concern was that cyber criminals had hacked into the Department of Human Services computer system to access the data.
-----

Australian Digital Health Agency MOU Biannual Report 2016-2017 for the period ending 31 December 2016

Mr Tim Kelsey
Chief Executive Officer
Australian Digital Health Agency
Level 25, 56 Pitt Street
Sydney NSW 2000
Dear Mr Kelsey
I am pleased to provide you with the biannual report for the period ending 31 December 2016, in accordance with section 3.3 of Schedule 1, section 3.3 of Schedule 2 and section 10.1 of the Memorandum of Understanding between the Office of the Australian Information Commissioner and the Australian Digital Health Agency, in relation to the provision of dedicated privacy-related services under the Privacy Act 1988, the My Health Records Act 2012 and the Healthcare Identifiers Act 2010.
If you have any queries relating to the report, please contact Melanie Drayton on [contact details removed].
Yours sincerely
Angelene Falk
Deputy Commissioner
21 March 2017
-----

Breach leads to review of access to Medicare card data system

An independent review of security and access to Health Professionals Online Services will report by the end of September.
By Chris Duckett | July 10, 2017 -- 00:05 GMT (10:05 AEST) | Topic: Security
The Australian government has commissioned a review into Health Professionals Online Services (HPOS), which will focus on security and access to the system.
HPOS is currently used 45,000 times daily, and allows medical practitioners and health providers to look up Medicare details when a person does not have a Medicare card on them, the federal government said in a statement released on Monday morning.
"The system has had, and continues to have, the strong support of the AMA [Australian Medical Association] and GPs due to its convenience and ability to provide immediate patient care," the government said. "It provides an alternative avenue to the existing telephone network for a health professional to identify a patient's eligibility for Medicare benefits."
-----

Fact Check: Security of My Health Record

Created on Friday, 14 July 2017

What is My Health Record?

My Health Record is a secure online summary of your health information. An individual can control what goes into it, and who is allowed access. Individuals can choose to share their health information with their doctors, hospitals and other healthcare providers.

Why is there a need for a digital record system?

One in three General Practitioners (GPs) will see a patient for whom they have little or no health information. Many patient records are created as paper files. They are regularly transmitted between healthcare providers using unsecure email, fax machines and by post. The My Health Record offers health professionals secure digital access to a patient’s record at the point of care, wherever that may be.
There are significant benefits of My Health Record for all Australians. These include avoided hospital admissions, fewer adverse drug events, reduced duplication in diagnostic tests, better coordination of care for people seeing multiple healthcare providers, and better informed treatment decisions.
-----

Queensland Health's Dr Richard Ashby outlines vision, tech play

Lessons learned from payroll disaster - and previous clinician and clinical administrator roles - to help direct the ship
Jennifer O'Brien (CIO) 13 July, 2017 16:00
Queensland's Health's CEO and CIO Dr Richard Ashby wasn't around in 2013 when a payroll system implementation disaster led to a Commission of Inquiry. But he has taken one lesson learned during this debacle to heart and he applies it to all current and future tech projects at the organisation.
“One thing we have learned is that having the applications and the hosting and the managed services undertaken by one organisation is proving to be very beneficial. I won’t pick on payroll, in particular, but some of those sorts of examples where things haven’t gone well, you end up with large multinational companies pointing at each other, and pointing at government.”
Certainly, as the chief executive of eHealth Queensland and CIO of Queensland Health, Ashby has a big remit. In his combined role, he said he is focused on the business outcomes and the transformation of care for individual patients and for groups of patients for hospitals, and for the system.
-----

The key to making therapeutic robotics more efficient: a human touch

Andrew Masterson
Published: July 12 2017 - 11:45PM
Mechanical and robotic exoskeletons hold considerable promise, both as aids to the disabled and machines to increase the lifting power of worked in heavy industry, but so far the reality has lagged considerably behind the dream.
One of the principle obstacles faced by designers in the need for frequent recalibration of exoskeleton settings. Each system, of course, has to be tweaked to suit its individual user, but it must also be adjusted to accommodate changes in movement styles or speed as the user becomes tired or switches from one function to another. Although technically possible, such alterations, done in downtime by a technician, are costly and tedious.
Scientists at the College of Engineering at Carnegie Mellon University in the US, however, have developed an exoskeleton system that incorporates feedback mechanisms powered by the person using it, allowing it to self-adjust to changing mechanical demands in real time.
-----
10 July 2017

Finally, GPs can track My Aged Care referrals

Posted by Julie Lambert
In a welcome move, GPs will no longer be left in the dark after referring patients to the federal government’s My Aged Care system.
Under changes adopted on July 3, referring doctors can keep track of their patients’ progress, including which organisation is doing an assessment, their contact details, and the services that have been referred or commenced.
With a patient’s consent, a GP can also provide information to streamline the referral to an assessor via a webform, fax, or over the phone. A patient does not have to be present when a doctor makes a referral by phone, but the doctor must have their consent.
If the referral information is complete, it will be sent directly to an assessment organisation without the My Aged Care contact centre needing to call the patient.
-----

Streamlined My Aged Care improves consumer support and access

New policies and processes have been implemented to make life easier for all consumers, particularly older people with diverse needs, and health professionals who use My Aged Care.
Page last updated: 11 July 2017
11 July 2017
New policies and processes have been implemented to make life easier for all consumers, particularly older people with diverse needs, and health professionals who use My Aged Care.
My Aged Care is the Australian Government’s one-stop shop for aged care support.
Aged Care Minister Ken Wyatt said one of the most important changes to My Aged Care was clarification of who can speak on a consumer’s behalf, and under what circumstances.
-----

Malcolm Thatcher reveals ‘insider’ perspective about IT failures

‘Whether in the private or public sector, we don’t do big IT implementations well.’
Jennifer O'Brien (CIO) 12 July, 2017 09:41
The biggest failing of the IT industry is the fact there’s not enough focus on “people and business change,” according to former interim CIO/CEO of eHealth Queensland, Dr Malcolm Thatcher.
That’s one of the lessons learned by the former Queensland health executive, who’s now on the other side of the fence and able to reveal insights and key learnings about his time in government and industry.
Thatcher has been in IT for 35 years, with a range of roles including chief health information officer for Queensland Health; interim CEO and CIO; as well as executive director, information and infrastructure and CIO for Mater Health Services.
Since leaving Queensland Health in February 2017, Thatcher has focused on completing a book, based on his PHD research and industry knowledge, titled Digital Governance Handbook for CEOs and Governing Boards.”
-----

E-health record a smart tool but needs to be safe

15th Jul 2017 9:54 AM
A NATIONAL shared electronic health record has the potential to be an important tool in improving health outcomes, according to the Australian College of Nursing.
But there must be assurances that patients' confidential medical information is secure and protected.
"A national shared electronic health record means that as people move between health care providers - or even move between states - clinical professionals have a single trusted source of information, information that could be vital such as a person's allergies or medications, they can quickly and easily access,” ACN CEO Adjunct Professor Kylie Ward said.
-----

Fax machines on the way out for Australian healthcare

Created on Friday, 14 July 2017
Fax-free healthcare is one step closer today, as the Australian Digital Health Agency (the Agency) and clinical information systems vendors work together to progress secure electronic messaging between healthcare providers.
This technology will enable health data to flow securely from one healthcare provider to another – irrespective of the software they are using, the organisation they work for, or with whom they are communicating.
Dr Nathan Pinskier, Chair of the RACGP Expert Committee on eHealth and Practice Systems, said the technology will have a big impact on the sector, where confidential patient records are regularly transmitted by dated systems such as facsimile and post.
"The number one issue to be resolved in health care communications is the ability for healthcare providers to electronically communicate with each other directly, seamlessly and securely," Dr Pinskier said.
-----

Online doctors shouldn't replace in-person care: AMA

Posted yesterday at 6:29pm
The nation's peak medical body is warning patients to choose comprehensive health care over convenience as more online doctor services become available across Australia.
Websites offering prescription repeats, medical certificates and consultations for a range of common illnesses have caused concern among medical professionals.
The online services, which are not bulk-billed, offer consultation over video link from a patient's home instead of a brick-and-mortar clinic and can cost between $20 and $50.
But the online services compromise patient care for the sake of convenience, according to the vice-president of the Australian Medical Association, Tony Bartone.
-----

Taking a patient’s family medical history and privacy breaches

Members can rest assured that they can collect a patient’s family history without breaching the Act.
14 Jul 2017
For doctors, taking a patient’s family history of things like heart disease is a fundamental part of good clinical management.
However, in the absence of legal protection, it would could be a problem from a privacy perspective. It entails taking certain details from your patient about another person’s health (usually a relative), and not informing the person. It is technically a breach of privacy in relation to the person whose details are recorded.
In response to these concerns, the AMA has for some years held a ‘Public Interest Determination’ (PID) from the Privacy Commissioner to protect medical practitioners taking a patient’s family history from being in breach of the Privacy Act 1988 (Cth) (‘the Act’). This covered all medical practitioners providing a health service covered by the Act.
-----

Explainer: Is it possible for the government to decrypt criminal messages without a back door?

Tim Biggs
Published: July 14 2017 - 2:38PM
When is a government back door into your social media account a back door and when is it "access to communications"?
That is the question experts are struggling to figure out after the government on Friday further detailed legislation, to be introduced this year, that will oblige tech companies and telcos to assist law enforcement in accessing encrypted information.
"What we seek to do with other leading economies in the world is to ensure that [tech companies] assist the law, to enable our law enforcement agencies to have access to these communications so that they can keep us safe", Prime Minister Malcolm Turnbull said at a press conference.
-----

Data Governance Australia (DGA) draft code of practice

19 Jun 2017
CREATORS
Data Governance Australia is developing a Code of Practice as part of an on-going effort to set leading industry standards, promote a culture of best practice, and to drive innovation by increasing consumer confidence and trust in the data practices of organisations.
Keyword(s): 
Geographic Coverage: 
------

Politics podcast: Graeme Samuel on data governance

July 13, 2017 11.34am AEST

Author

  1. Michelle Grattan
Professorial Fellow, University of Canberra

Interviewed

  1. Graeme Samuel
Vice-Chancellor's Professorial Fellow, Monash University
Many Australians are worried about the proliferation of data businesses and the government knowing too much about them.
Data Governance Australia chairman Graeme Samuel hopes that a self-regulatory code of conduct will raise the standards among data-driven organisations. Despite the pervasiveness of data in our daily lives, he argues most people don’t understand the extent to which organisations use it.
As a former regulator, Samuel regards government regulation of data as “second-best” and is “there to step in when there is market failure”. In drafting the code, he has consulted closely with businesses and the public to try to “anticipate community concerns into the foreseeable future”.
On the government’s My Health Record – which has been rolled out very slowly – he argues the benefits of a centralised system outweigh privacy concerns, although every effort needs to be made to protect the privacy of health records.
-----

DGA chair pushes back against ‘joint ownership’ model for data

Former ACCC chair pushes for industry self-regulation of data handling
Rohan Pearce (Computerworld) 12 July, 2017 15:01
The chair of Data Governance Australia, Graeme Samuel, has argued against a Productivity Commission recommendation that would see consumers given greater control over data about them held by businesses.
The former chair of the Australian Competition and Consumer Commission today used an address at the National Press Club to argue that any move to take too much control of data away from businesses would stifle innovation.
The Productivity Commission’s final report on Data Availability and Use recommended that individuals and small and medium businesses be given “a new Comprehensive Right to the use of their digital data.”
-----

Bupa employee steals data for 108,000 global customers

By Staff Writer on Jul 14, 2017 6:56AM

Personal details exposed.

An employee "copied and removed" the personal information of more than 100,000 international health insurance plan customers from the systems of health insurer Bupa.
The data included names, dates of birth, nationalities, some contact and administrative information. No medical or financial data is at risk.
The now ex-staffer is believed to have made the information they have available to "other parties" too, according to a letter sent to the 108,000 international health insurance policy holders from Sheldon Kenton, managing director of Bupa Global, the firm's international health insurance division.
-----

We need to streamline reminders when a GP is absent

10 July 2017

PRACTICE SOFTWARE 

A 'buddy system' might be the way to prevent holiday mishaps, writes Dr Oliver Frank. 
THE ISSUE
GPs frequently have to check incoming test results and correspondence for colleagues who are away. In the rush of daily consulting, it can be difficult to remember to do this. Currently GPs use workarounds, including adding reminder notes to their lists of appointments or other types of manually-created prompts.
PROPOSED SOLUTION
Clinical software should provide a redirection facility that sends copies of incoming test results, correspondence and other messages for an absent GP to one or more other specified buddy GPs in the practice, on specified days, for the anticipated duration of the GP’s absence. The forwarded results need to be listed separately from the buddy GP’s own results. Results that need no action during the recipient GP’s absence can disappear from the buddy GP’s list once so marked, while any results that the buddy needs to follow up while the recipient GP is away should stay visible until the issue has been dealt with or the recipient GP has returned. On their return, the absent GP will see the results that arrived and the annotations made by the buddy GP(s).
-----

Meet the worm-bot

10 July 2017
Although the prospect of a worm robot inching its way through your colon may be a touch disconcerting, it could actually be a safer and more comfortable alternative to traditional colonoscopies.
Scientists from the University of Colorado in the US have created a worm-like device that can cleverly navigate the human colon, collecting images along the way.
The latest in the field of robotic aides, the 13cm-long ‘worm’ is made up of three flexible sections and nine shape-memory alloy springs, which convulse in a peristaltic motion mimicking that of the gut.
-----

AFL goes for lifesaving goal as organ donors sign up in record time

The Australian Government has unveiled a new online organ donor registration process which will save lives.
Page last updated: 13 July 2017

Joint Media Release

The Hon Ken Wyatt AM, MP
Minister for Aged Care
Minister for Indigenous Health
The Hon Greg Hunt MP
Minister for Sport
13 July 2017
The Turnbull Government has today unveiled a new online organ donor registration process which will save lives.
Almost instantly, you can now register to become a donor, using a mobile phone, tablet or computer.
Aged Care Minister and Indigenous health Minister Ken Wyatt also announced today a new partnership with the Australian Football League (AFL) to help lift the national organ donor rates.
-----

Global database matches patients to clinical trials

By Australian Hospital + Healthcare Bulletin Staff
Monday, 10 July, 2017
New life-saving and pain medications could reach the market up to four years faster thanks to an Australian initiative to fast-track the clinical trial approval process.
Currently, clinical trials can be delayed up to eight years because drug companies do not have easy access to suitable patients. To help resolve this dilemma, Australian company Neoclinical has created Australia’s largest voluntary ‘matching database’ between patients and the 40,000 clinical trials that occur worldwide at any one time.
The registration service allows patients who want to be part of a clinical trial to find one that might be suitable for them.
“Every great medical advance in modern history has involved a clinical trial to prove a drug’s benefits before regulators allow patients access to it,” Neoclinical Managing Director and Oncology Specialist Registered Nurse Megan Guy said.
-----

Healthshare partners with the Australian Health Service Alliance (AHSA) to help increase Specialist cost transparency for over 2 million Australian Patients

For Immediate Release  12th July 2017
Healthshare partners with the Australian Health Service Alliance (AHSA) to help increase Specialist cost transparency for over 2 million Australian Patients Healthshare, Australia's leading digital health platform, has today announced a major partnership with the Australian Health Service Alliance (AHSA), an organisation representing 27 Australian private health funds. The innovative partnership will help members of the AHSA-affiliated funds  quickly and easily find a medical specialist who participates in their fund's No Gap or Known Gap scheme, via Healthshare's specialist directory.
The directory is available to General Practitioners (GPs) via their clinical software. As a result, patients likely to have surgery can discuss with their GPs upfront about being referred to a  specialist with no out-of-pocket costs at the location of their choice. Utilising Healthshare's  market-leading practitioner referrals platform, the GP can then automatically populate a referral  through their clinical software including patient and specialist details.
-----

NBN Co reaches halfway mark early, thanks to shrinking target

Lucy Battersby
Published: July 10 2017 - 12:15AM
NBN Co has reached the halfway mark of its network roll-out early, thanks to a reduction in the total number of premises that will be connected by 2020. 
The government-owned company is celebrating the halfway milestone on Monday after rolling its infrastructure past 5.7 million premises, with about 2.2 million of those premises actively using the network. 
By 2020 NBN Co expects to connect a total of 11.2 million premises, down from an earlier estimate of 11.9 million premises. Both these estimates are down from a 2011 expectation that NBN Co would connect 13 million premises. 
-----

NBN: the download lowdown

  • The Australian
  • 12:00AM July 13, 2017

Anthony Klan

Eight years since its inception, the $49 billion National Broadband Network reached its halfway point this week with one in two Australians now able to connect.
But a major technical shift in direction by the Coalition federal government — which it claims will see up to $30bn slashed from the ultimate bill — is expected to see more problems emerge with many users already finding they are achieving speeds slower than before they had the NBN but are paying more for the service.
The Kevin Rudd ALP government in 2009 launched its grand plan for a nationwide internet network, underpinned by the philosophy that fibre cabling was the key to the online future.
“Do it once, Do it right. Do it with fibre” was Labor’s mantra at the time. The ALP declared 93 per cent of homes would be connected directly with fibre — known as fibre to the premises or FTTP — with the remaining 7 per cent in remote areas to access the NBN via satellite.
-----
Enjoy!
David.

Sunday, July 16, 2017

Has The ADHA Not Kept The Right And Left Hand In Synch – It Rather Looks Like It.

We had this appear yesterday from the ADHA.

Fact Check: Security of My Health Record

Created on Friday, 14 July 2017

What is My Health Record?

My Health Record is a secure online summary of your health information. An individual can control what goes into it, and who is allowed access. Individuals can choose to share their health information with their doctors, hospitals and other healthcare providers.

Why is there a need for a digital record system?

One in three General Practitioners (GPs) will see a patient for whom they have little or no health information. Many patient records are created as paper files. They are regularly transmitted between healthcare providers using unsecure email, fax machines and by post. The My Health Record offers health professionals secure digital access to a patient’s record at the point of care, wherever that may be.
There are significant benefits of My Health Record for all Australians. These include avoided hospital admissions, fewer adverse drug events, reduced duplication in diagnostic tests, better coordination of care for people seeing multiple healthcare providers, and better informed treatment decisions.
Following unanimous support by all State and Territory governments, the Government will expand My Health Record and create a record for every Australian, unless they prefer not to have one.
The Health Sector Supports My Health Record
‘We all want the My Health Record to work. It has the potential to support much better patient care, particularly when your patients see another doctor or health care provider.’
  • The Royal Australian College of General Practitioners (RACGP) includes helpful case studies on their website on the benefits of My Health Record for GPs:
‘The RACGP has been an advocate for a national shared electronic health record system and understands the clinical benefits of healthcare providers accessing healthcare information not available via normal communications channels.’
‘Community pharmacy, as the most accessible community health care destination, has always been at the forefront of digital innovation and an opt-out model for the operation of My Health Record will enable community pharmacies to enhance their patient care.’

How does My Health Record system protect people’s health information?

My Health Record legislation provides protections for privacy of medical information in the system. The Agency, as the system operator, is responsible for the security of the My Health Record system.
The Agency have in place a comprehensive set of people, process, and technology controls to protect health records from a cyber-attack. The system has bank strength security which ensures information is stored and accessed by only trusted connected health systems.
The system complies with the Australian Government requirements for storing and processing protected information, and is regularly tested and audited to confirm that these requirements are met.
The Agency’s Cyber Security Centre continually monitors the system for evidence of unauthorised access. This includes utilising specialist security real-time monitoring tools that are configured and tuned to automatically detect events of interest or notable events. Examples of this include:
  • Overseas access by Consumers and Healthcare Providers
  • Multiple failed logins from the same computer
  • Multiple logins within a short period of time
  • Logins to the same record from multiple computers at the same time
  • High transaction rate for a given Healthcare Provider
  • Certain instances of after business hours access and all instances of emergency access.
The Cyber Security Centre regularly reviews the events of interest based on its knowledge of the likely threats to the My Health Record and updates them accordingly.

How do healthcare providers protect your health information?

Every time a healthcare provider accesses a My Health Record, a log is automatically created. This allows an individual to monitor every access to their My Health Record in real time, with complete transparency.
An individual’s Medicare card number does not allow My Health Record information to be accessed, additional information is required to authenticate consumers and health care providers.
Healthcare organisations can only access an individual’s My Health Record if they:
  • are directly involved in the individual’s care;
  • have a healthcare provider certificate installed (either with NASH HPI-I or HPI-O certificate) on the device that they are using to access the record;
  • a valid username and password, and;
  • have the Record Access Code (RAC), if an individual has enable restrictions.
Any software that connects to the system undergoes automated checks to ensure that it conforms to the system requirements and has authority to access the information. Write access to My Health Record is only available to healthcare provider organisations via approved clinical software.
If a person were to deliberately access an individual’s My Health Record without authorisation, criminal penalties may apply. These may include up to two years in jail and up to $126,000 in fines.

What controls do individuals have?

A person can arrange to be notified by email or SMS when a healthcare provider organisation accesses their record for the first time. The individual can also view a real time log of every access to their My Health Record by a provider organisation.
Individuals can control what information is in their My Health Record, and which healthcare provider organisations can access their record. A range of privacy controls are available including:
  • Setting a Record Access Code (RAC) which the individual can give to their healthcare provider organisation to allow access to their record, and prevent other healthcare providers from access unless in an emergency
  • Flagging specific documents in their record as ‘limited access’, and controlling who can view
  • Removing documents from view within their record
  • Asking healthcare providers not to upload information and, under the My Health Records Act 2012, healthcare providers must comply with this request.
For more information on managing access, privacy and security of your My Health Record visit www.myhealthrecord.gov.au or call 1800 723 471.

Download 'Factsheet: Security of My Health Record'

Here is the link:
Clearly the message that is intended is that we have it all utterly in hand an – to quote a now dead politician – ‘Don’t you worry about that!’
But then we have this that appeared also last week:

Australian Digital Health Agency MOU Biannual Report 2016-2017 for the period ending 31 December 2016

Mr Tim Kelsey
Chief Executive Officer
Australian Digital Health Agency
Level 25, 56 Pitt Street
Sydney NSW 2000
Dear Mr Kelsey
I am pleased to provide you with the biannual report for the period ending 31 December 2016, in accordance with section 3.3 of Schedule 1, section 3.3 of Schedule 2 and section 10.1 of the Memorandum of Understanding between the Office of the Australian Information Commissioner and the Australian Digital Health Agency, in relation to the provision of dedicated privacy-related services under the Privacy Act 1988, the My Health Records Act 2012 and the Healthcare Identifiers Act 2010.
If you have any queries relating to the report, please contact Melanie Drayton on [contact details removed].
Yours sincerely
Angelene Falk
Deputy Commissioner
21 March 2017
Here is the link to the total report:
Here we discover (about ½ way down the full report) the following:

Details of mandatory data breach notifications relating to the My Health Record system

Mandatory data breach notifications received during the reporting period

The OAIC received two mandatory data breach notifications from the System Operator during the reporting period, in September 2016 and December 2016. It involved the unauthorised access of a healthcare recipient’s My Health Record by a third party. The review of these notifications was ongoing as at 31 December 2016.
The OAIC also received eighteen mandatory data breach notifications from DHS during the reporting period.
  • Eleven notifications resulted from findings under the Medicare compliance program that certain Medicare claims in the name of a healthcare recipient but not made by that healthcare recipient were uploaded to their My Health Record. These notifications totalled 92 breaches, each of which affected a separate healthcare recipient. Seven of these data breach notifications have been closed, totalling 67 breaches, and the review of the other four notifications, totalling 25 breaches, was ongoing as at 31 December 2016.
  • A further seven notifications, affecting fourteen healthcare recipients, eight with a My Health Record and six without, relate to healthcare recipients with similar demographic information having their Medicare records intertwined. As a result, Medicare claims belonging to another healthcare recipient were made available in the My Health Record of the record owner. Review of these notifications was ongoing as at 31 December 2016.

Mandatory data breach notifications closed during the reporting period

The OAIC completed its enquiries into ten data breach notifications received from DHS between April 2016 and October 2016. These data breach notifications relate to the findings under the Medicare compliance program discussed above.
The OAIC requested further information from DHS regarding the data breaches. Following consideration of the additional material and response provided by DHS, the OAIC considers that DHS has acted appropriately in assessing those incidents, sought to cancel the relevant My Health Records and sought to contact affected individuals.

Mandatory Data breach notifications received in previous reporting periods and still open

Two of the data breach notifications received by the OAIC prior to 1 July 2016 were still open at 31 December 2016. These data breach notifications relate to intertwined Medicare records and affected four healthcare recipients and two My Health Records.
-----  End extract.
So not only do we have breaches of the myHR but they don’t seem to be rapidly investigated and resolved.
Go figure – but it is hardly bolstering the confidence of those who have also been a little disquieted by the Medicare Number leaks of last week.
Not very professional as far as I can see, and just what was the point of discussing how many entities love the myHR in the same document?
David.

AusHealthIT Poll Number 379 – Results – 16th July, 2017.

Here are the results of the poll.

Has The Medicare Number Leak Increased Concern Regarding The Security Of Personal Data Held In The myHR?

Yes 76% (120)

Maybe 20% (31)

No 3% (5)

I Have No Idea 1% (2)

Total votes: 158

The numbers speak for themselves. The vast majority are now rather less comfortable with myHR security.

A really great turnout of votes!

Again, many, many thanks to all those that voted!

David.