Tim Kelsey, Chief Executive of the Australian Digital Health Agency, addressed a handful of security and privacy concerns the health record raises in front of the National Press Club (professional organization for journalists) on May 24, 2018.
Mr. Kelsey emphasized the measures implemented in recent months to better protect patients’ personal data, including the establishment in 2017 of the Australian Cyber Security Centre (ACSC) to monitor and assess the cyber threat.
The new My Health Record framework for action will be published in July 2018.
A cybersecurity center to ensure constant monitoring
« My Health Record operates to the highest cybersecurity standards in Australia and is independently audited on that basis by a number of organizations (…), » said Mr. Kelsey (source: Zdnet.com). « The [Australian Digital Health Agency] has set up a national cybersecurity center to ensure constant, multi-layer surveillance of My Health Record, » while adding that since MyHR was launched in 2012, « there has been no breach. »
An access code on the individual’s MHR
Another security measure is the necessity to have an access code or PIN on the individual’s My Health Record so that users are the only individuals to be able to see their personal health data.
An SMS alert when the record is being accessed by a third party
In addition, users will be able to consult a real-time audit log indicating who has accessed their record. They can also set up an SMS alert that notifies them when their account is open.
Individuals can also withhold a document from the view of their clinician.
« All instances of access by a clinician are attributable directly to that person and recorded in real-time, » Tim Kelsey said, adding that unauthorized use of the data will be punishable via a custodial prison sentence of up to two years.
Guidelines on the third party use of MHR data
The third party use of My Health Record information is one of the primary concerns related to the device.
In May, the government published guidelines on the use by a third party of data generated by the national health record.
Direct access to and release of My Health Record data is only to an Australian entity, the guidelines state, and data released for secondary use is to be stored in a facility within Australia.
The framework limits access to de-identified data, noting that it cannot be used solely for commercial and non-health-related purposes. This means that insurance companies cannot use this information to set premiums for example, Tim Kelsey said.
MHR: Australians can opt out from July to October 2018
Currently, more than 5.7 million Australians (out of more than 24 million inhabitants) have a My Health record. All citizens will have an account automatically created by the end of the year: those who don’t want one will have from July 16 to October 15, 2018, to opt out.
Mr. Kelsey said that when a My Health Record has been canceled, the contents of the record is dumped as per government data removal procedure, and becomes unavailable for secondary use.
The legal framework of My Health Record to be revised and published in July 2018
The goal of the Australian Digital Health Agency for 2019 is to provide every registered clinician with a secure means of communicating digitally with their colleagues without « resorting to paper or the dreaded fax machine ».
By 2022, the first selected regions in Australia will have connected all their care services so that clinicians have cross-organization access to information, Tim Kelsey added.
The new framework for action of My Health Record will be published in July. It will outline the road map for delivering of the three key principals of the Digital Health Agency and the online record. Touching on the three principals, Mr. Kelsey said they will be centered on participation, empowering people to take more control of their health and care; collaboration, which will require the co-design of services; and innovation.