Australia’s digital health strategy gets the nod without data interoperability controls
My Health Record, the Australian government’s e-health record system, has been officially given the green light from the Council of Australian Governments Health Council to automatically sign citizens up to the service, allowing them to opt-out if they choose.
By 2018, all Australians will have a My Health Record and by 2022, all healthcare providers will be able to contribute to and use health information in My Health Record on behalf of their patients. They will also be able to communicate with other healthcare providers on the clinical status of joint patients via the digital platform.
According to the strategy, Safe, seamless, and secure: Evolving health and care to meet the needs of modern Australia, the interoperability of clinical data is essential to high-quality, sustainable healthcare, with My Health Record allowing the collection of citizen’s data to share in real-time between providers. However, there is currently no overarching standard in place to govern the sharing of data, with a public consultation on draft interoperability standards to determine an agreed vision and roadmap for implementation of interoperability slated to occur “by the end of 2018”.
“Base-level requirements for using digital technology when providing care in Australia will be agreed, with improvements in data quality and interoperability delivered through adoption of clinical terminologies, unique identifiers, and data standards,” the strategy explains.
“By 2022, the first regions in Australia will showcase comprehensive interoperability across health service provision.”
In the strategy [PDF], the Australian Digital Health Agency (ADHA) said Australians want a health system that puts people first and offers more choice, control, and transparency. Most importantly, Australians want their health information to be confidential and secure, protected from cyber criminals and from any unauthorised access.
Healthcare providers have a similar desire, ADHA said, wanting secure digital services that provide instant access to a patient’s information — especially in an emergency.
“Digital information is the bedrock of high quality healthcare … digital health can help save and improve lives,” the report’s foreword reads.
In July, it was reported that Medicare card information had become available on the dark web. Minister for Human Services Alan Tudge said at the time the only information available was a Medicare card number, and that it was not sufficient to access any personal health record.
Speaking with ZDNet, Trent Yarwood, a member of the leadership team at Australian advisory firm Future Wise, said it is not necessarily this individual breach that’s the issue.
“It’s the fact that it’s putting another piece of information about people out there that can then be combined with all these other sources and potentially used to either commit identity fraud or to get more specific personal information about people,” Yarwood said. He also noted the revelation from last year that parts of the Medicare Benefits Schedule and Pharmaceutical Benefits Scheme were not encrypted properly.
“For people like Alan Tudge to say there is no data security issue is obviously incorrect and I think reflects a very poor understanding of what the power of these sorts of linked datasets is.”
During the 2015-16 financial year, the Office of the Australian Information Commissioner (OAIC) received 16 mandatory data breach notifications, which recorded 94 separate breaches that affected a total of 103 healthcare recipients, 98 of whom had a My Health Record at the time of breach.
The OAIC received three data breach notifications from the system operator, with the first of the notifications relating to MyGov accounts held by healthcare recipients being incorrectly linked to the My Health Records of other healthcare recipients. The second and third notifications related to unauthorised My Health Record access by a third party.
