"Australians rightly are asking questions around the security and privacy of that information and this is a very important opportunity for there to be that debate and certainly I welcome it," Ms Falk said, adding that there had not been a security breach of the system in the six years of its operation which was covered by rules specific to the My Health Record system. "With the move to opt-out, there has been heightened community awareness of the My Health Record system and the personal information that’s included. “I acknowledge that there have been a number of issues that have been raised by the community and I have been in discussions with the Minister for Health [Greg Hunt] ... [and] the Australian Digital Health [Agency] in terms of those issues." Australians rightly are asking questions around the security and privacy. Australia's Acting Privacy Commissioner Angelene Falk The commissioner added that it was her “expectation that” security requirements for the My Health Record System would "continue to be reviewed and enhanced, as they should be”.

Asked whether the Turnbull government had struck the right privacy and security balance with My Health Record, Ms Falk said: "I think what the debate has done is bring that balance to the forefront and we know that Australians — certainly at the moment — have a very heightened awareness of how their personal information and data is being handled." Tim Kelsey (centre), head the Australian Digital Health Agency, which is rolling out My Health Record. Credit:ADHA Ms Falk said she supported Prime Minister Malcolm Turnbull's comments from Friday, in which he told ABC's AM radio program "we are obviously going to do everything we can to reassure concerns". "I have welcomed the comments by the Prime Minister that these matters are getting serious concern by government and I am in active discussions in relation to the matter," Ms Falk said. Malcolm Turnbull will not be opting out from the My Health Record data collection, despite security concerns from IT experts. Credit:Daniel Pockett

Ms Falk's comments came as a new report from her office, the Office of the Australian Information Commissioner (OAIC), revealed that the private healthcare sector had the highest number of reportable data breaches, with 25 per cent of all reported breaches involving health information. The OAIC received 242 notifications under the Notifiable Data Breaches (NDB) scheme in the period April 1 until June 30, according to the second quarterly statistical report, released on Tuesday. Since the scheme started on February 22, the OAIC has received 305 notifications in total. Loading The private healthcare industry was the top sector for reporting data breaches under the NDB scheme, with 49 notifications in the quarter, followed by the finance sector with 36 notifications. The OAIC said the healthcare notifications did "not relate to the My Health Records system". The report said the main causes of data breaches were malicious or criminal attacks (142 notifications or 59 per cent), followed by human error (88 notifications or 36 per cent). The majority of malicious or criminal breaches reported were the result of compromised credentials, and the most common human error was sending emails containing personal information to the wrong recipient.

But Anna Johnston, director of privacy consultancy Salinger Privacy and a former NSW deputy privacy commissioner, said the report did not paint a full picture of the Australian data breach landscape, as public state-based hospitals and state-based law-enforcement agencies are not covered by the NDB scheme as they are exempt from the federal Privacy Act. Loading "That the healthcare sector is the number one sector reporting data breaches that are likely to result in serious harm is bad enough, but when you consider that this is only half of the story, then the state of data protection compliance is presumably a lot worse in the healthcare sector than this report suggests," Ms Johnston said. To get a true picture of the state of data protection compliance across Australia, Johnston said Australia "would need either harmonised privacy laws, or at least a harmonised breach reporting scheme".

This was a point the commissioner acknowledged. "[The report] paints an accurate picture of the organisations who have an obligation under law to report [a breach] to the OAIC," Ms Falk said. But not a picture of the entire nation, Fairfax inquired. "That’s right," Ms Falk said.

Name and shame Loading Another criticism of the Notifiable Data Breaches scheme by privacy advocates is that the OAIC has chosen not to name companies who report breaches to it. Former Privacy Commissioner Timothy Pilgrim told Fairfax Media in February that he had deliberately decided not to "name and shame". "For the first 12 months, we will be providing statistical information on the number of breaches," he said at the time. "We won't be publishing every breach at this stage." But Ms Falk said this could change after a review is held next year.

"I certainly haven’t ruled it out and I have said that we will review that as time goes by," Ms Falk said, adding that she wanted to ensure Australia was in step with international laws "because ... publication in [one] country for a global entity is going to be publication to the world at large". "I ... will be looking to see the developments that are happening in the EU and the timing of when, and if, the EU decides to publish names of their data breach reporting scheme," Ms Falk said. "I want to be satisfied that our scheme has had an opportunity to develop and for the maturity of organisations to develop." Federal Health Minister Greg Hunt has defended the My Health Record scheme. Credit:AAP Johnston said it was still too early to assess the effectiveness of the mandatory data breach reporting scheme in terms of whether a name and shame approach should be taken up.