Wednesday, 22 August 2018
My Health Records Amendment (Strengthening Privacy) Bill 2018; Second Reading
On 24 March 2017 the COAG Health Council agreed to a national opt-out model for long-term participation arrangements in the My Health system. This support was reaffirmed this month, in Alice Springs, only a few weeks ago.
In May 2017 the government announced national implementation of opt-out as part of the 2017-18 budget.
On 30 November 2017 I made the My Health Records (National Application) Rules 2017 to apply the opt-out model of registration to all consumers in Australia, and to specify the period in which consumers could opt out. The opt-out period commenced on 16 July 2018 and will end on 15 November 2018.
As part of the 2017-18 budget, this government announced that, in order to achieve the benefits sooner, the My Health Record system would transition to an opt-out system whereby every Australian will receive a My Health Record by the end of this year, unless they've opted out.
The opt-out period started on 16 July this year, and the Australian Digital Health Agency, together with many partner organisations, has been working closely with the healthcare sector to inform consumers about the purpose and benefits of My Health Record, the privacy settings for restricting access and the right to opt out.
Soon after the opt-out period concerns were raised by some groups—specifically, that My Health Record information could be disclosed for law enforcement purposes, and that health information would continue to be retained in the system after a consumer has cancelled their My Health Record.
The system has operated for six years and no material has been released for law enforcement purposes, I am advised. In any event, the policy has been that there would be no release of information without a court order.
I think it's important to be very clear about this—the My Health Record system has its own dedicated privacy controls which are stronger in some cases than the protections afforded by the Commonwealth Privacy Act, on the advice I have. The operation and design of the My Health Record system was developed after consultation with consumers, privacy advocates and experts, health sector representatives, health software providers, medical indemnity insurers, and Commonwealth, state and territory government agencies. Further, the system has been operating without incident since July 2012.
Nonetheless, this government has listened to the recent concerns and, in order to provide additional reassurance, is moving quickly to address them through this bill. I appreciate the constructive consultations with the Australian Medical Association and the Royal Australian College of General Practitioners and I welcome the recently reaffirmed support from all state and territory governments for this important health reform, for the opt-out process and for the strengthened privacy provisions at the recent COAG Health Council meeting.
The bill will remove the ability of the system operator—that is, the Australian Digital Health Agency—to disclose health information to law enforcement agencies and other government bodies without a court order or the consumer's express consent. This is consistent with the system operator's current policy position, expressed clear and absolute, which has remained unchanged and has resulted in no My Health Records being disclosed in such circumstances.
The bill will also require the system operator to permanently delete health information it holds for any consumer who has cancelled their My Health Record. This makes it clear that the government will not retain any health information if a person chooses to cancel at any time. The record will be deleted forever.
In addition to these amendments, I have already extended the opt-out period by a further month, to end on 15 November. This will provide more time for consumers to make up their own mind about opting out of My Health Record. Even after this period a consumer can choose not to participate at any time and cancel their My Health Record. Their record will then be cancelled and permanently deleted.
These legislative changes reinforce the existing privacy controls that the system already gives each individual over their My Health Record. Once they have a My Health Record, individuals can set a range of access controls. For example, they can set up an access code so that only those organisations they elect can access their record, and they can be notified when their record is accessed. They can also elect if they don't want their Medicare or other information included in their My Health Record.
The My Health Record system has provided and will continue to provide significant health, social and economic benefits for all Australians through avoided hospital admissions, fewer adverse drug events, reduced duplication of tests, better coordination of care for people seeing multiple healthcare providers, and better informed treatment decisions.
The Australian government is committed to the My Health Record system because it is changing health care in Australia for the better. The Australian government is equally committed to the privacy of individual's health information. These measures are specifically designed and intended, through consultation with the AMA and the College of General Practitioners, amongst others, to strengthen the privacy protections and demonstrate this commitment.
I commend the bill to the House.