My Health Record (MHR) online security concerns: to opt in or to opt out

My Health Record (MHR) online security concerns: to opt in or to opt out

The My Health Record phoneline was in meltdown today as people who wanted to opt-out of the controversial scheme scrambled to make their choice known.

The Senate has just voted in favour of an amendment, proposed by One Nation leader Pauline Hanson, to extend the deadline for opting out from tomorrow to January 31.

Ms Hanson’s motion was carried on the voices. The government did not try to oppose it.

It is welcome news for many Australians who were unable to opt out this morning.

Today the Government worked with the Senate crossbench to extend the opt-out period for #MyHealthRecord.



The opt-out period will be extended until January 31, 2019, however, it’s important to note that people can opt-out at any time. — Greg Hunt (@GregHuntMP) November 14, 2018

Labor’s plan to delay and derail the roll out of the My Health Record was blocked today.



We thank the crossbench for not delaying this important policy change as Labor tried so desperately to do. — Greg Hunt (@GregHuntMP) November 14, 2018

In comparison, the Govt’s focus is on strengthening the safety and privacy of health information in the My Health Record system.



The Parliament is now considering further amendments to Labor’s original My Health Record legislation. My Health Record will protect and save lives — Greg Hunt (@GregHuntMP) November 14, 2018

Adelaide father-of-two, who wished to be known only as Ben, said he and his wife had been trying to get through on the phoneline for days.

“My wife has been on hold for an hour and it has just dropped out,” he told news.com.au.

“I’ve been on hold a couple times and it has dropped out, including this morning. I was on hold for 15-20 minutes before it dropped out.”

Others complained that the phone doesn’t even ring before a message is heard that “your call cannot be completed at this time” and advising people to hang up and try again later.

But a spokesman for the Australian Digital Health Agency said reports that the system was not operational were incorrect.

“The opt-out website and the My Health Record Help Line are both operational. We are experiencing high demand, which has slowed the system down, and some people have experienced difficulties opting out this morning. These issues have now been resolved,” he said.

“The Agency anticipated higher call volumes and has increased the number of Help line operators available to support callers

“A call back feature has been enabled allowing people to leave their details for a customer service representative to return their call and process their request to opt out.

“If a person leaves their details for a call back, the Help line will return the call over the coming days to opt the person out. No record will be created for individuals in this circumstance.”

Ben said he had tried opting out on the website first and was successful completing the process for his own record and one of his sons.

But his wife and other son kept getting an error when they tried to opt out online.

“We’ve been trying for a couple of weeks (to get through on the phone line) but particularly in the last few days,” he said. “It’s obviously very frustrating.”

Ben was not the only one who experienced problems. Other readers also complained about getting error messages when trying to opt out online, and there have been complaints on social media about issues with the phone line.

Sydney resident Anton Francis told news.com.au he had tried calling the number seven times since 10.08am this morning.

Another reader, Elena, said she attempted to opt out a few days ago without success. She tried again “quite a few times” this morning, via the website and on the phone, but it “just did not work”.

“It is unbelievable how disorganised this process is,” she said.

“The online system does not work and when you try to phone, it just hangs up on you. There is no automated message or any sort of system in place that can cope with the demand.

“I’m really against my records being on the system and I am unable to opt out. This is just ridiculous, and makes me feel angry and helpless and not in control of my information.”

I've just tried calling the 1800 number and it doesn't even ring. — Jon (@Jon00073511) November 13, 2018

Both 'Opt Out' options do not work.

Website won't recognise correct information provided and suggests the phone number which won't answer.



Tells me everything I need to know. https://t.co/loOIMIpcF9 — Dave G Byrne (@davegbyrne3) November 13, 2018

@MyHealthRec This is a shambles. I can't opt out and the phone lines are crashing long before being able to speak to anyone. pic.twitter.com/scWEnlhc4L — Daniel Bevan (@DanielCBevan) November 13, 2018

Ben said he just wanted to wait until after legislation passed that would improve privacy and security for patients before opting in.

Australians did have until tomorrow, November 15, to opt out of the My Health Record scheme, or else a record would have automatically been created for them.

Complicating the situation, legislation that would improve privacy and security for patients, allowing them to permanently delete their record, had yet to pass through the Senate, and still hasn’t.

Labor made a last-ditch push for the deadline to be extended by 12 months, but that motion was defeated 32-30 before Ms Hanson’s more modest extension was approved.

“The Morrison government has been dragged kicking and screaming into accepting an extension to the My Health Record opt-out period,” Shadow Health Minister Catherine King said.

For months, Labor has been calling for an extension in order to get this important reform right. For months, the Liberals have been insisting there was no need for an extension.”

About 1.147 million Australians, or 4 per cent of the population, have opted out of the electronic health record system so far, while more than 300,000 have opted in. Seventeen million or so will be automatically enrolled when the deadline passes.

There were expectations the final opt-out figure would more than double to 10 per cent.

Health Minister Greg Hunt had already delayed the deadline by a month — it was supposed to hit in October.

“It’s arguably the safest system in the world, but most importantly, it’s about giving people for the first time their own medical records when they need them,” he told the Nine Network last week.

“It’s a modern part of any health management system.”

Labor says the My Health Record scheme “promises huge benefits” to Australians, but the government’s “botched rollout”, including the switch from an opt-in to and opt-out model, has “seriously undermined public trust” in it.

Ms King wants the government to ask for a review from the Privacy Commissioner to address lingering concerns about patients’ safety and privacy.

She is also calling for a new public information campaign to better inform the public about the “benefits of a properly implemented” scheme.

The legislation amending the system has the support of Labor, the Australian Medical Association and, notably, incoming independent MP Kerryn Phelps.

It includes harsher penalties for people found guilty of improperly using the system, and better protections for victims of domestic violence.

Once it passes the Senate, it will need to be approved by the House as well.

You still have time to opt out, should you wish. The easiest way is to go to www.myhealthrecord.gov.au, or to call 1800 723 471.

If you’re unsure what to do, here are the important things you should consider, courtesy of our reporter Charis Chang.

PROTECTIONS HAVEN’T PASSED PARLIAMENT YET

Legislation that would ensure a patient’s right to permanently delete their record and that police can only access someone’s medical history with a court order have not yet been passed. It won’t be done before the November 15 deadline.

YOU SHOULD BE ABLE TO DELETE IT

The government has promised to change the scheme so anyone who wants to delete their My Health Record at any time after November 15 can do so. The record will be deleted forever. Originally data would have been kept until 30 years after someone died, although organisations would not have been allowed to access it.

NOT ALL DATA IS AUTOMATICALLY UPLOADED

Two years of data from the Medicare Benefits Schedule, Pharmaceutical Benefits Scheme, Australian Immunisation Register and Australian Organ Donor Register will be automatically updated the first time your doctor looks at your record, unless you get in first and ask for it not to be downloaded.

Otherwise it’s up to your doctor to upload the information and they will decide what records to put on your file.

You can also ask them not to upload sensitive data such as information on sexually transmitted diseases, abortion, mental illness or cosmetic surgery.

IT’S NOT JUST YOUR DOCTOR WHO CAN SEE YOUR DATA

Any registered health provider like your doctor, pharmacist, physiotherapist, nurse, diagnostic imaging and pathology practice, and other unidentified staff will be able to see your record.

It could also include your chiropractor, optometrist, osteopath, dentist, psychologist and Chinese medical practitioner because anyone registered with the Australian Health Practitioner Regulation Agency can access your information. As long as you’re a patient and they have the right software downloaded on their computer, they can look at your records.

But if you don’t want your dentist poking around in your data, you can ensure this doesn’t happen by placing restrictions on it.

You can go online and set a Record Access Code to only give certain healthcare professionals access and you can also restrict access to certain documents by setting a Limited Document Access Code.

However, these controls can be overridden in an emergency.

You can see who has looked at your data online by checking its access history. It won’t show the individual doctor who looked at it but it will show the organisation, what date they looked at it and if documents were added or changed etc.

If you really want to find out who accessed your record, you can make a request to find out through the Australian Digital Health Agency (ADHA).

You can also set up an email or SMS alert to let you know when an organisation looks at your record for the first time.

Law enforcement agencies can only access a person’s My Health Record with a warrant or court order (changes passed in Lower House).

The privacy commissioner recommends checking regularly for unexpected or unauthorised access. You can call the Australian Digital Health Agency (ADHA) on 1800 723 471 if you think something is wrong.

THE REALITY OF HACKING

Any online record is susceptible to hacking no matter how sophisticated the security system.

There will be regular security audits of My Health Record but any documents downloaded or created by a doctor could also be stored on their local IT system and the security of this will depend on their system.

YOUR DATA COULD BE USED FOR RESEARCH

The use of your data in a de-identified form (which means you’ll be anonymous) for research will be allowed and is known as “secondary use”.

You can tick a box to opt out if you don’t want your data used this way.

Organisations including pharmaceutical companies in Australia and some overseas in certain circumstances will be able to apply to access the data.

Some people may also have their data used in an identified form but only if they agree first.

PRIVATE HEALTH FUNDS WON’T BE ABLE TO SEE IT

Proposed legislation will also stop private health insurers or other insurers from seeing the system’s data for research or public health purposes, even when it has been de-identified.

COULD YOU BE IDENTIFIED?

Even when data is de-identified, there’s still a chance you could be linked to the record.

There was already one case in 2016 when the Government released data on de-identified patients and Melbourne University IT researchers demonstrated it was possible to re-identify these people.

YOUR BOSS CAN’T REQUEST YOUR RECORDS

Proposed legislation will ensure your employer won’t be able to ask to see your My Health Record and can’t ask you to share information with them either.

PROTECTIONS FOR YOUNG PEOPLE

Currently a young person aged 14 and over can take control of their My Health Record at any time by removing their parents’ access to their record.

But the Government will conduct a review looking into whether it is appropriate that parents have default access to the records of those aged 14 to 17.

PROTECTIONS FOR ABUSE VICTIMS

Proposed legislation will stop abusive former partners from accessing their child’s record in cases of domestic violence.

PENALTIES TO BE INCREASED

Proposed legislation will increase penalties for people found guilty of improper use of My Health Record. They will face up to five years in jail, instead of two, and the maximum fine would more than double to $315,000.

THE BENEFITS OF MY HEALTH RECORD

Giving doctors access to your medical records could be lifesaving especially in emergency situations. It should also prevent unnecessary duplication of blood and other tests.

It will give doctors more complete information about your medical history and help them to better diagnose and provide treatment.

HOW TO OPT IN OR OUT

If you are happy to have a health record created, you don’t need to do anything as one will be automatically created. Or you can go online and opt in to the system and create any restrictions you want on your record.

It’s also possible to opt out now if you want to wait for parliament to pass the proposed changes first and then opt in at a later date if you wish.

Continue the conversation @SamClench | samuel.clench@news.com.au

@CharisChang2 | charis.chang@news.com.au