Australians who have never heard of "My Health Record" are discovering that some of their private medical information has been uploaded to an online government health record.
From Monday this week until the middle of October, Australians will have to let the government know if they don't want a My Health Record account set up for them, otherwise they will be automatically enrolled in the system later this year.
Over the past six years the government has invested over $2 billion in creating a digital health record system to store patient information such as allergies, medical history and medications. But getting patients and doctors to sign up has been a slow task.
Six million people have so far signed up for a record under a system that required people to opt in. But the government has now changed the rules so that unless people opt out, a record will be created for them later this year.
In the wake of CensusFail and other examples of governments mishandling data, there is widespread concern over who will access the data and in what context, leading people to opt out.
Among some of the concerns, for example: police can access the data without a warrant; and access to the records is allowed in cases where the government needs to "protect public revenue".
Other groups such as those representing people with mental illnesses and/or HIV, or sex workers, are concerned about who might have access to the information stored in medical files.
Prime minister Malcolm Turnbull said on Tuesday that around 20,000 people had opted out of having a record created on the first day alone.
But BuzzFeed News has spoken to some people who have discovered, when trying to opt out of having a record created for them, that health records have already been set up, and some have extensive medical history in them.
Simon Stanton from Tasmania told BuzzFeed News that a health summary was created for him.
"My initial reaction was disbelief," he said. "I can see a lot of records ranging from a Shared Health Summary through to prescriptions, specialist and GP visits. The summary refers to conditions from the present back to the 1990s."
As part of the system, patients can limit who has access to records, who can create records, and alerts for when records are accessed. Stanton said he had since limited the access for the healthcare provider who had created the record without his knowledge.
Stanton said that he spoke to the person who created his summary who was "very apologetic" but he remains concerned that the record will still stay there.
Another user, Jamie in Sydney, who asked for her surname not to be published, told BuzzFeed News that her record was listed as being created in 2015 by herself, but had data dating back to 2011.
"My best guess is that when I created a MyGov account and started linking in associated services, that it prompted me to get a My Health Record," she said.
"It may have happened when I connected Medicare. So either it happened without me realising or I opted in without understanding the consequences of doing so.
"My record had prescription data, a hospital discharge and a whole bunch of Medicare data."
Shannon Molloy from Sydney told BuzzFeed News that when he went to opt out, he found he already had a record.
"I have no idea how or why," he said. "I logged in and saw that I do indeed have one, but the only information contained in it is that I'm a registered organ donor from a form I filled out in 2010. I spent a good 10 minutes on the site trying to figure out a way to remove it, without any luck."
The people BuzzFeed News spoke to had not yet called the Australian Digital Health Agency, the government agency tasked with overseeing the health record. There are reports that some people are waiting hours to get through.
BuzzFeed News sought comment from the Australian Digital Health Agency on the number of people opting out, and the average call wait times, but did not hear back prior to publication.
A spokesperson told technology website ZDNet that wait times as of Wednesday morning were three minutes for standard enquiries and 39 minutes for "complex enquiries".
The agency has also downplayed concerns about the privacy and security of the system, saying in a statement on Monday that individuals set the controls on their record.
"For sensitive information such as a person’s HIV status, a pathology service will not upload a report to the My Health Record where existing state or territory registration prohibits disclosure of sensitive information without the expressed consent of the individual," the agency said.
Information identifying individuals is only made available to third parties with the consent of the patient, ADHA said, and use of the data for insurance purposes is specifically ruled out in the guiding framework for the health record.