Police and other government agencies can access a person’s My Health Record without first obtaining a warrant or court order, the Australian Parliamentary Library has confirmed.
Last week, the federal government opened a three-month window for people to opt out of having a My Health Record created for them.
Over the past six years the government has invested over $2 billion in creating a digital health record system to store patient information such as allergies, medical history, and medications. But getting patients and doctors to sign up has been a slow task, so the government flipped it from an opt in system to an opt out system.
One of the major concerns cited by people choosing to opt out is who can access the health record and in what circumstances. While patients have a certain amount of control over which health care professionals can access and modify files, there has also been concern that police and other agencies might be able to access them for law enforcement.
Health minister Greg Hunt claimed last week that it wasn’t possible for the records to be accessed without a court order.
“The Digital Health Agency has again reaffirmed today that material, which is the case for every medical record in the country, can only be accessed with a court order,” he told the ABC. “And that applies to the situation of every medical record which is currently available.
“So, the security of the online is far greater than the fact that all of these existing medical records already exist. Whether it’s within a GP’s practice, in a hospital system, within a pharmacy. So simply giving people the choice if they wish to have that together.”
But a report released by the Australian Parliamentary Library yesterday contradicted the minister. Buried in the My Health Records Act 2012, is Section 70, which provides access to the records in some circumstances without a court order.
The Australian Digital Health Agency (ADHA) can disclose health information on a record if the agency “reasonably believes that the use or disclosure is reasonably necessary to, among other things, prevent, detect, investigate or prosecute any criminal offence; breaches of a law imposing a penalty or sanction or breaches of a prescribed law; protect the public revenue; or prevent, detect, investigate or remedy ‘seriously improper conduct’”.
The protection of public revenue, according to the parliamentary library, would likely include investigations into fraud involving Centrelink, Medicare, or the Australian Taxation Office.
“While this should mean that requests for data by police, Home Affairs and other authorities will be individually assessed, and that any disclosure will be limited to the minimum necessary to satisfy the request, it represents a significant reduction in the legal threshold for the release of private medical information to law enforcement,” report author Nigel Brew said.
“Currently, unless a patient consents to the release of their medical records, or disclosure is required to meet a doctor’s mandatory reporting obligations (e.g. in cases of suspected child sexual abuse), law enforcement agencies can only access a person’s records (via their doctor) with a warrant, subpoena or court order.”
Brew said that Hunt’s comments “seem at odds with the legislation which only requires a reasonable belief that disclosure of a person’s data is reasonably necessary to prevent, detect, investigate or prosecute a criminal offence”.
In a press conference on Wednesday, Hunt claimed that his original statement was accurate, stating that people were confused about how ADHA would "apply" the 2012 legislation.
"They cannot, and will not release without a court order," he said.
But this point was addressed by Brew. He said the legislation "does not mandate this and it does not appear that the ADHA’s operating policy is supported by any rule or regulation".
"As legislation would normally take precedence over an agency’s ‘operating policy’, this means that unless the ADHA has deemed a request unreasonable, it cannot routinely require a law enforcement body to get a warrant, and its operating policy can be ignored or changed at any time," he said.
Over 20,000 people opted out on Monday morning last week, but the ADHA continues to refuse to provide a running tally on the number of people opting out of the system.
Hunt said on Tuesday that on the current trajectory, the government was on the way to having over 90% of the population signed up for a record.
“Look, we’re expecting that, we were expecting up to 90% would be enrolled and looks like it will be more than that now,” he told 2GB radio. “So it’s actually tracking ahead of our positive expectations.”
Liberal MP Tim Wilson has already confirmed he has opted out of the record, and Labor MP Ed Husic on Wednesday morning said he would opt out if the government didn’t make improvements to the system.
Ed Husic: I will certainly opt-out of the government’s My Health Record if the government has been unable to provide evidence that they’ve improved the system. MORE: https://t.co/OM6CRSGXO0 #amagenda https://t.co/Q6nd9Qv2KQ
Labor is backing the Coalition's system, introduced under the Gillard Labor government, but has said that the opt out window should be extended.