Nigel Scullion (NT, Country Liberal Party, Minister for Indigenous Affairs) Share this | Hansard source

I thank Senator Bernardi for the invitation to make a contribution on these amendments. There are two amendments. The first is to remove the ability of the system operator—that's actually the Australian Digital Health Agency—to disclose information to law enforcement agencies and other government bodies without a court order or the consumer's express consent. This is actually consistent with the Australian Digital Health Agency's current policy position, which has remained unchanged and has resulted in no My Health Records being disclosed under such circumstances. We did deal, a moment ago, with the Centre Alliance amendment. Whilst it wasn't supported, they intended to delete the new sections 69A and 69B, which deal with very narrow confines under which a court order can be made.

The second element of those amendments is going to require the Australian Digital Health Agency to permanently delete health information it holds for any consumer who has cancelled their My Health Record. This makes it clear that, if a person chooses to cancel at any time, their record will be deleted completely and forever. The new amendments are as follows. Particular concerns have been raised regarding the potential for domestic violence to occur. As a result of that, for example, a parent may be able to access a child's My Health Record and get access to information on where the mum has moved to with the child. The government recognise that this is a serious matter, so we've put in a range of safeguards. There are a series of safeguards already in place in the system. These amendments will apply if a person has parental responsibility or if a person's access to the child is subject to supervision. This isn't intended if the court decides that you have access to 60:40 periods of time. It's only when there are particular supervision circumstances, so they only get access to the child in supervised circumstances. This would be taken into consideration. It also applies if the Australian Digital Health Agency considers that they may pose a risk, so there may be other circumstances where access to this information may pose a risk. This is ensuring that that person can't get access to the child's My Health Record.

The amendments will also provide greater clarity that My Health Records cannot be used for insurance or employment purposes. We've had a lot of discussion about that. This just provides some clarification. It will prohibit an employer from requesting or using health information in an individual's My Health Record, protecting employees and potential employees from any discriminatory use or use of their My Health Record. Information can be obtained from a My Health Record by healthcare providers and individuals. These amendments will also ensure that information derived from the My Health Record system cannot be used for insurance or employment purposes, regardless of where it is being viewed or stored. This will be one of the prohibited uses. This prohibition will apply to any activity for insurance or employment purposes, regardless of whether it is considered to be for the purposes of providing health care. For example, a healthcare provider undertaking a health assessment of an individual for employment purposes, which sometimes happens, would be expressly prohibited from using the individual's My Health Record or from using information that has been derived from that.

Through these amendments we'll also be increasing the maximum penalty levels for breaches of key privacy protections. This was an expressed recommendation of the Senate Community Affairs Legislation Committee. The maximum penalty level is just under double: in broad terms, I think for a corporation it is up to $1.5 million and five years imprisonment and for an individual it is $315,000. In any event, we have reflected the recommendations of the Senate inquiry. These penalty levels are now the maximum penalty levels for breaches of key privacy protections. They will be associated with any misuse of a person's health information obtained by unauthorised access to the My Health Record system or taking My Health Record information outside of Australia. Effectively, for example, if you downloaded something, printed a hard copy, took it outside of Australia and sold it outside of Australia, you wouldn't be subject to Australia's laws in that regard, so that prohibition about taking information outside of Australia ensures that you cannot take those My Health Records out of Australia. But if you were in London, for example, and went to a doctor or practitioner, you could still get access to the benefits of your My Health Record.

This will result in much stronger penalties for persons who collect, use or disclose health information if they are not authorised to do so. An individual who knowingly misuses a person's health information contained in their My Health Record will now face up to five years in jail and a maximum penalty of $315,000. Without going into too much detail, secondary use—if you tell someone something and they use it—is exactly the same; there is not a diminished penalty. The penalty remains at the maximum for the secondary person who obtains information from a prohibited act; they are subject to the same penalties. These increases in penalties acknowledge that as the system grows it will contain a larger volume of health information that needs to have the appropriate level of security. We think these safeguards are appropriate. The amendments also make clear that if a person chooses to cancel their My Health Record at any time it will be deleted permanently, including any backups, saved copies or the like.

In May this year the minister released the framework for the secondary use of the My Health system data, and now these amendments, as I indicated earlier, provide a legislative basis to support another tier of the appropriate use of My Health data for research and public health purposes. The amendments also remove the ability of the Australian Digital Health Agency to provide identified or de-identified information to the private health insurers and other types of insurers for research or for public health purposes. For the purposes of clarity: we're removing the ability that currently exists in de-identified form, to ensure that any of the data cannot be provided to insurers for research and public health purposes. They'll also provide that the minister's rule-making power will include the ability to specify requirements that apply to entities handling information for research and public health purposes, and set out processes for seeking to use or deciding to disclose this de-identified information. The amendments will also remove the ability of the Australian Digital Health Agency to delegate its functions and powers to an entity other than the Department of Health and the chief executive, Medicare. Such functions are delegated as appropriate to ensure the effective management of the system.

Finally, the government remains committed to the My Health Record system being government owned and operated. There was some talk about what would happen if we sold it. Are these same processes going to be in place? We are committed to this being government owned and operated as a national health asset, and the legislation clearly and unequivocally reflects this position. As a package, these amendments comprehensively address the concerns that have been raised by the public and in the Senate inquiries, and enhance the safety and privacy protections in the My Health Record system. The My Health record system will provide significant health and economic benefits for all Australians through avoided hospital admissions, fewer adverse drug events, reduced duplication of tests, better coordination of care for people seeing multiple healthcare providers and better informed treatment decisions. We're committed to this system because it is changing health care in Australia for the better, and we're equally committed to the privacy of the individual's health information. These measures strengthen the privacy protections and demonstrate this commitment.

I thank all senators who have made a significant contribution through the Senate inquiry and through this process. I commend the amendments to the house.