Under pressure, Health Minister Greg Hunt today extended the opt-opt period for the My Health system until January 31, 2019.

The Senate voted to delay the deadline, and although the amendment needed to return to the House of Representatives to be formally adopted, Mr Hunt endorsed the extension on Twitter.

If you don't make a choice by the new cut-off date, you'll be among the estimated 17 million Australians for whom a record will be automatically created in the Government's online database of health information.

The opt-out period to date has been tumultuous. Since July, software analysts, unions and family violence charities have raised privacy and security concerns about the system, while health groups have talked about its clinical benefits.

If you're confused, that's understandable. Some people were shocked to find they already had a record, and the opt-out deadline was originally pushed back one month. There was also a swift Senate committee inquiry and the Government has proposed two sets of legislative changes.

Read on for a guide to what may change about My Health Record, and what's still leaving some people concerned.

What's about to change

After questions were raised about the ability of law enforcement agencies to access individual My Health Records without a court order, the Government introduced a bill making two key changes to the My Health Record legislation:

Requiring law enforcement to have a court order to access My Health Record.

Requiring law enforcement to have a court order to access My Health Record. If someone cancels their record, the Australian Digital Health Agency (ADHA) must "destroy" it, rather than holding it for 30 years after their death.

The amendment is being debated in the Senate today, but some experts still question when deleted is truly "deleted".

Without knowing the technical details of the system's software, Robert Merkel, a software engineering lecturer at Monash University, said it would be important to understand how the ADHA is implementing the "permanent" deletion of records.

He wants to know whether it means deleting them off the live system and ensuring backups are destroyed, or simply making it illegal to access a cancelled record.

The ADHA said that, after the legislation is passed, the record and any backups will be "permanently deleted" if someone cancels their record.

Individuals who have previously requested their records be cancelled will also have them permanently deleted.

Sorry, this video has expired Greg Hunt explains first round of changes to My Health Record.

What the Government says will change

A Senate inquiry into the function of My Health Record made several recommendations aimed at improving the security of the system, as well as advocating the opt-out period be extended for 12 months.

Last week, Mr Hunt announced additional changes to the legislation:

The penalties for improper use of My Health Record will be increased.

The penalties for improper use of My Health Record will be increased. To protect those in family violence situations, a person will not be allowed to be the authorised representative of a minor if they have restricted access to the child, or may pose a risk to the child, or a person associated with the child.

To protect those in family violence situations, a person will not be allowed to be the authorised representative of a minor if they have restricted access to the child, or may pose a risk to the child, or a person associated with the child. Employers will be prohibited from asking for or using an employee's My Health Record information.

Employers will be prohibited from asking for or using an employee's My Health Record information. Insurers will be excluded from accessing health information or deidentified health data for research.

Insurers will be excluded from accessing health information or deidentified health data for research. The ADHA won't be able to delegate functions of the system to any authority other than the Department of Health and the chief executive of Medicare.

Dr Bruce Baer Arnold, a law and health expert at the University of Canberra, said the changes were "a band-aid on the My Health Record train wreck".

"Many critics of My Health Record, such as myself, are passionate about public health," he wrote in an email.

"We perceive benefits from a … well designed and well maintained national electronic health system.

"We are concerned however about proper management of risk."

This week the Labor Party renewed calls to extend the opt-out period for 12 months until the new amendments are debated and passed. For now, the Senate agreed to a three-month extension.



What some people still want changed

While the proposed changes have been broadly welcomed, some groups have lingering concerns.

Will the medical privacy of teenagers still be undermined?

When a teenager turns 14, they must typically give consent for parents to access their Medicare information. Using My Health Record, parents can register their child and view and administer their information until the child turns 18, potentially undermining their medical privacy.

Once they turn 14, teenagers can take control of their record, but this does not occur automatically.

For now, the Government has announced it will conduct a review of the situation for 14- to 17-year-olds.

This article contains content that is not yet available here.

A lot of work has been done to ensure adolescents can access confidential health care, which the current scheme puts at risk, according to University of Melbourne associate professor Lena Sanci and member of the Australian Association for Adolescent Health.

"We want it to work, but it has to be designed in a way that it will work best for young people," she said.

Is the system design insecure?

The fundamental design of the My Health Record system raises concerns the Government has not yet addressed, according to Anna Johnston, director of Salinger Privacy.

As a centralised database, she argued it gives more people than ever before the ability to access a health record — but with clinical benefits, come risks.

"That garden variety risk will come from the 900,000 [people] who will eventually have access to the system as an authorised user, working somewhere within the healthcare system," Ms Johnston said.

While only healthcare professionals involved in a patient's care are meant to access a record, Ms Johnston suggested a step up in penalties, as proposed by the Health Minister, is unlikely to act as a deterrent.

Some healthcare workers have also pointed to a tradition of lax security in some Australian hospitals, which could, they argued, affect My Health Record.

Supporters of My Health Record argue it will support care during an emergency. ( ABC News: Margaret Burin )

Will Australians opt in to privacy controls?

Critics argue the nature of an opt-out system means that many Australians will have a My Health Record created, but never take control of it or even know it's there.

Currently, users of My Health Record can apply an access code to the record or certain documents, so only someone who has the code can get access.

But they must opt in to these privacy controls, and it appears relatively few do so.

As of Wednesday October 31, the ADHA said 18,288 record access codes and 3,991 limited document access codes had been created. More than 6 million Australians already have a record.

The Senate committee report recommended that record access codes should be applied to each My Health Record by default, and Ms Johnston said this would go some way towards addressing the issue.

The Government has not indicated it will take up the committee's suggestion.