Oz government offers privacy concessions on MyHealth Record

Australia's peak medical bodies have won some concessions over the privacy of the country's MyHealth Record, and the government says it will extend the opt-out period to mid-November, but it's unlikely to end the hostile debate over the initiative.

Overnight, Health Minister Greg Hunt announced that the government would amend the MyHealth Record legislation to remove its warrantless law enforcement access to the records.

That aspect of the e-health system was so contentious that when the Parliamentary Library published an opinion that the legislation did, in fact, provide warrantless access to the records, the piece was briefly unpublished before being replaced with a version that was less confronting to the government.

After meeting with doctors' lobbies yesterday – the Australian Medical Association, and the Royal Australian College of General Practitioners – Hunt published an after-hours media release announcing the change.

“Labor’s 2012 My Health Record legislation will be strengthened to match the existing ADHA policy”, the media release states (as they say on Twitter, don't @ me, that's what it says!).

Hunt also announced that “delete” will mean what it says: if someone wants their MyHealth Record expunged, it will be, rather than being retained until 30 years after they're dead.

Again, this will be in the form of an amendment to “Labor’s 2012 legislation”.

And – Vulture South is certain you'll be thrilled to hear this – the release also trumpets that the government will work with medical leaders on some kind of spin strategy, or as the release puts it, “additional communications to the public about the benefits and purpose of the My Health Record”.

Today, Hunt told ABC radio he would ask his state counterparts to agree to extend the opt-out period to mid-November, but Labor's health spokesperson Catherine King said the entire opt-out should be suspended until public concerns have been addressed.

King added that there remain real concerns that the record could be abused by parents in custody disputes, for example.

Privacy bods, who weren't consulted in the change, aren't satisfied, saying the government's only addressed two factors among many.

Trent Yarwood, an infectious diseases specialist and member of tech advocacy group FutureWise, told The Register there's no detail beyond “there will be changes”.

“We'd like to see what the policy says, and make sure that the changes properly protect access to information”, Yarwood added.

The problem with the AMA and RACGP conducting the discussions is that they represent doctors and aren't health privacy experts, he added.

The MyHealth Record debate is likely to overlap with Australia's proposed government data sharing regime, for which an issues paper* was published in early July.

“That's a very broad-based release regime that will override various protections like the Privacy Act”, Yarwood said.

“Concern over law enforcement access was only a small part of the MyHealth Record privacy concerns”.

Yarwood also highlighted that even with law enforcement access dealt with, there will still be nearly a million health sector workers able to access MyHealth Record.

There's also a concern about Section 98 of the MyHealth Record Act to be addressed.

That section gives the Australian Digital Health Agency the power to delegate any of its functions to other bureaucrats – and that would include its powers to disclose information.

Even with a court order, Yarwood said, the delegation power and the data release regime represents a profound change to how health data is handled.

Today, he explained, a doctor is likely to be at least consulted if there's a demand for a patient's information; under the MyHealth Record structure, the decision to release “can fall to a bureaucrat”, and the doctor won't necessarily be in the loop. ®

*Bootnote: The author erroniously called the issues paper "draft legislation" in the first version of this article.