My health record system

Introduction

Senate Standing Committee on Community Affairs References Committee

Health information is some of the most intensely personal information that will ever be recorded about an individual. For that reason, there is a strong community expectation that personal health information will remain private and secure, and that individuals will have control over who has access to their records. Currently, the vast majority of Australians do have a significant degree of control over who has access to their personal health information.

There are specific considerations regarding children and young people with disability which should be taken into account in relation to the My Health Record system. Privacy at a broad level is typically experienced very differently by children and young people with disability. At a personal level children and young people with disability often have more people, services and supports in their lives compared to their peers who don’t live with disability. Some children with disability are also frequently and intensely monitored which also impinges on personal space and in turn privacy.

Children with disability also usually have increased contact with the health system through: early childhood early intervention; processes of diagnosis; assessments requested or required to access services and supports; allied health intervention throughout childhood which responds to developmental difference and functional impairment; and in other situations.  A great deal of personal information, which is classified as heath information, regarding children and young people with disability is therefore created and available.

The My Health Record system represents yet another government agency who will have access to the personal health information of children and young people with disability. This is not to mention the potential secondary use of My Health Record data.  It is vital that careful consideration is given to how the system’s implementation and operation will specifically impact on children and young people with disability.

Children and Young People with Disability Australia

Children and Young People with Disability Australia (CYDA) is the national representative organisation for children and young people with disability, aged 0 to 25 years. The organisation is primarily funded through the Department of Social Services and is a not for profit organisation. CYDA has a national membership of 5300 and a growing social media presence with 22 500 followers across the three major platforms of Facebook, Twitter and LinkedIn. 

CYDA provides a link between the direct experiences of children and young people with disability to federal government and other key stakeholders. This link is essential for the creation of a true appreciation of the experiences and challenges faced by children and young people with disability.

CYDA’s vision is that children and young people with disability living in Australia are afforded every opportunity to thrive, achieve their potential and that their rights and interests as individuals, members of a family and their community are met.

CYDA’s purpose is to advocate systemically at the national level for the rights and interests of all children and young people with disability living in Australia and it undertakes the following to achieve its purpose:

Listen and respond to the voices and experiences of children and young people with disability;

Advocate for children and young people with disability for equal opportunities, participation and inclusion in the Australian community;

Educate national public policy makers and the broader community about the experiences of children and young people with disability;

Inform children and young people with disability, their families and care givers about their citizenship rights and entitlements; and

Celebrate the successes and achievements of children and young people with disability.

Human rights context

The right to privacy is a central and fundamental obligation enshrined in international human rights.  As a State Party to the International Covenant on Civil and Political Rights 1966[1] (ICCPR), the Convention on the Rights of Persons with Disabilities 2006[2] (CRPD) and the Convention on the Rights of the Child 1989[3], Australia has an obligation to ensure the right to privacy is upheld for people with disability, including children and young people. 

Article 17 of the ICCPR sets out the fundamental human right to privacy, stating:

‘No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation’[4].

General Comment No. 16: Article 17 (Right to Privacy), the Right to Respect of Privacy, Family, Home and Correspondence, and Protection of Honour and Reputation, clarifies that even lawful interference of privacy should be in accordance with the provisions, aims and objectives of the Covenant[5]. In addition, State Parties must ensure that personal information gathered and held on computers, data bases and other devices, does not reach the hands of persons not authorised to receive it and that information is never used for purposes incompatible with the Covenant[6].

Article 22 of the CRPD enshrines the equal right to privacy for people with disability, including in relation to health information:

‘States Parties shall protect the privacy of personal, health and rehabilitation information of persons with disabilities on an equal basis with others’[7].

Australia also has an obligation to uphold a child’s right to privacy. Article 16 of the CRC states:

‘No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation’[8].

Australia thus has a clear obligation to ensure rights to privacy are upheld for children and young people with disability in relation to the My Health Record system.

General comment

CYDA has a number of concerns regarding the My Health Record system and its potential implications for children and young people with disability.

In particular, CYDA is concerned that many of the systems and processes currently used by My Health Record have the potential to undermine and further limit the right to privacy of children and young people with disability. The lack of clarity regarding the interaction of the National Disability Insurance Scheme (NDIS) and the My Health Record system is also of particular concern, as there may be additional implications for children and young people with disability who are participants of the Scheme. 

It is CYDA’s view that these issues currently outweigh any potential benefits of the My Health Record system. Until these issues are resolved, CYDA is not confident that the rights, safety and wellbeing of children and young people with disability will be adequately protected by the My Health Record system.

Responses to the inquiry terms of reference

1. a) the expected benefits of the My Health Record system

Children and young people with disability typically have frequent and more complex interactions with the health services. Consequently the My Health Record system has a number of potential benefits for children and young people with disability including:

Avoiding the duplication of health assessments;

Improving access to vital information in the event of an emergency;

Facilitating better quality of care;

Ensuring health services have a comprehensive understanding of the needs of the child or young person;

Providing a more convenient and efficient way of creating a health history and storing and locating health information;

Affording greater control over health information by providing a location where health documents can be stored and managed; and

Ensuring important health documents are not lost and are available when needed.

1. b) the decision to shift from opt-in to opt-out

CYDA’s concerns regarding My Health Record are compounded by the transition from an opt-in to an opt-out system. An opt-out system does not offer a meaningful opportunity to weigh the potential costs and benefits of participation, before a record is created.

From 15 November 2018, a My Health Record will be automatically created for all Australians who do not actively opt-out of the system. The automatic creation of records does not provide for informed consent, as it does not require individuals to actively make a decision to participate.

Available data indicates that there are low levels of health literacy in Australia, including among young people[9]. This is reflected in feedback provided to CYDA by young people with disability and families of children and young people with disability. Health literacy relates to the ‘knowledge and skills required to understand and use information relating to health issues’[10]. It is CYDA’s view that these low levels of health literacy, in addition to an opt-out system, further diminishes the capacity of the My Health Record system to provide for informed consent.

As discussed previously, children and young people with disability already experience a significant limiting of their right to privacy as a result of systemic and societal issues. An opt-out system further limits the control which exists regarding the personal information of children and young people with disability.

Secondary use of data

CYDA’s concerns regarding the use of an opt-out system extend to the secondary use of data. Currently, individuals need to opt-out to ensure their personal health information is not used for research purposes. CYDA is concerned about the ethical implications of using health information without informed consent. It is CYDA’s view that the potential disclosure of identifiable data for secondary purposes is particularly problematic given the lack of information around consent processes.

It is critical that the rights of children and young people with disability are upheld in the secondary use of health information. It is CYDA’s view that this can best be achieved by transitioning the secondary use of data to an opt-in system. 

Privacy and security

Vulnerability to unauthorised access

There are numerous publicly reported examples of government systems and data bases that have been subject to unauthorised access. Unfortunately CYDA’s constituency has direct experience of the vulnerability of government systems through the NDIS where it was recently revealed a flaw in the online NDIS ICT system allowed access to the private information of people with disability. Allied health professionals have also reported to CYDA that they have received health information through the NDIA on people who are not known to them.

A further example is the cyber-attacks directed at the Census website in 2016 which caused significant disruption and raised serious concerns about the security of personal data.

The NDIS experience, and other similar examples of government privacy breaches and system vulnerability diminish trust in the government collection and storage of data and underlines the importance of strong privacy and security protections.

It is therefore critical that the My Health Record system maximises the security of personal health information and works to earn the trust of users, including children and young people with disability.

Third party access

CYDA is of the view that further clarification is required regarding the legal authority to disclose My Health Record information to third parties[11]. CYDA acknowledges that the My Health Records Amendment (Strengthening Privacy) Bill[12] makes a number of changes to the operation and application of relevant sections of the My Health Record Act[13]. In particular, CYDA welcomes changes which would remove the ability of the System Operator to disclose My Health Record information to law enforcement and government agencies without an order from a judicial officer[14].

There has been a broad public discussion about the implications of the Act in relation to law enforcement and government agencies such as the Australian Taxation Office. However, CYDA believes there remains a lack of clarity regarding implications for NDIS participants and their interactions with the National Disability Insurance Agency (NDIA), directly or indirectly through courts and tribunal processes or Quality and Safeguards Commission investigations.

The NDIS has the capacity to collect a substantial amount of personal information about participants. For example, when applying for the Scheme, prospective participants are presently  asked to sign a specific agreement consenting to the NDIA to access information, including from Centrelink and Medicare, for the purposes of determining whether someone meets the eligibility requirements for the NDIS and to help development or implement a participant’s NDIS plan. CYDA has serious concerns and questions about the implications of the NDIA’s broad authority to access and use personal information for the My Health Record system. This includes whether the abovementioned agreement will constitute consent for the purposes of disclosing My Health Record information to third parties. 

In addition, feedback received by CYDA indicates that the NDIA’s interaction with participants during court and tribunal processes has raised further concerns about the potential use of My Health Record information. It is CYDA’s view that the degree to which My Health Record information will be indirectly accessible through legal action remains unclear. For example, will a tribunal hearing a matter between the NDIA and an NDIS participant be able to gain indirect access to My Health Records through subpoena?

The potential ability of the NDIA to indirectly access the personal information of participants, as detailed above, has serious implications for children and young people with disability, both in relation to their interactions with the NDIS and the privacy of their My Health Record. Therefore, CYDA maintains that these matters should be examined and clarified as a matter of urgency.

Authorised and nominated representatives

CYDA is concerned the processes relating to the appointment of authorised and nominated representatives are not robust enough to ensure appropriate protections to people who people who require support and assistance to participate in the My Health Record system.

Children and young people with disability experience a high vulnerability to abuse. International research demonstrates that children and young people with disability are three times more vulnerable to abuse than their peers without disability[15]. CYDA is concerned that current processes for appointing authorised and nominated representatives could potentially be exploited to access and manage health information as a direct form of abuse or to hide historical evidence of abuse on a person’s record.

Currently, an individual can become an authorised representative under s 6 of the My Health Record Act as an ‘otherwise appropriate person’. This process involves demonstrating to the System Operator that the healthcare recipient is ‘not capable of making decisions for himself or herself’[16] and providing a statutory declaration setting out their relationship to the health recipient and that to the best of their knowledge there is no one with parental or legal authority[17]. 

The evidentiary requirements in this section are limited and differ significantly from the requirements to be appointed an authorised representative through parental responsibility or legal authority which require evidence such as a birth certificate or guardianship order[18]. CYDA is unaware of any processes or guidelines in place to check the veracity of statutory declarations or ensure the System Operator assess any risk of abuse associated with these appointments.

A similar situation arises with the process for appointing a nominated representative. A nominated representative can be appointed online by a healthcare recipient by logging in to My Health Record through MyGov and changing access settings[19]. CYDA understands that there is no requirement to actively show, outside of having someone’s MyGov login information, that the healthcare recipient has given their consent to the appointment of a nominated representative. 

In addition, CYDA is concerned about the scope of persons who could potentially be appointed as an authorised or nominated representative. For example, would s.6 extend to disability services providers or other individuals such as a service provider?

It is imperative that My Health Record system processes, procedures and legislation are robust enough to ensure the protection of rights, safety and wellbeing is afforded to children and young people with disability. CYDA maintains that the existing processes for appointing authorised and nominated representatives do not meet that benchmark, and must be reviewed.

Finally, CYDA is of the view that the description of a person being ‘not capable of making decisions for himself or herself’[20] in s. 6 of the Act should be amended.  All people are capable of making decisions. Some people with disability may require support to make decisions and may not understand the implications of the My Health system or the Act under consideration. It is offensive, demeaning and disempowering to label people as not capable of making decisions. Therefore, it is CYDA’s view that this section of the Act should be amended to reflect this and state; ‘not capable of making decision in relation to My Health Record’ .

The government’s administration of the my health record system roll-out

Public information campaign

Access to detailed and comprehensive information is fundamental to ensuring individuals know how to use My Health Record and have the information necessary to decide whether or not to participate in the system.

It is therefore critical that the Australian Digital Health Agency develops and implements a communication and education strategy which is inclusive of people with disability, including children and young people with disability and families.

In addition, CYDA welcomes the ongoing consultation undertaken by the Australian Digital Health Agency, including the Consumer Participation Program. However, CYDA maintains that this process could be strengthened by directly engaging children and young people with disability and families.

A public information campaign that is informed by and meets the needs of young people with disability and families of children and young people with disability has multiple benefits including facilitating informed consent, improving user knowledge of the My Health Record participants and increasing trust in the system.

1. g) any other matters

My health record and the National Disability Insurance Scheme

The NDIS has fundamentally altered how services are provided to people with disability in Australia.  Commonwealth, State and Territory roles have changed to incorporate individualised funding and a market approach to the provision of specialist disability services. In addition, the NDIS is aimed at creating new and innovative opportunities for people with disability to engage with and utilise mainstream services. 

The NDIS has not yet reached full scheme. Consequently, a number of operational issues remain unresolved and the provision of services to people with disability continued to evolve. In addition, the NDIS has been beset by a number of concerning implementation issues. This includes a lack of clarity regarding the interface of NDIS and mainstream systems, resulting in service gaps where neither system takes responsibility for the provision and funding of services.  A primary area of concern is the interface between the NDIS and mainstream health services. Delineated responsibilities in relation to the provision and funding of services provided to people with disability under these two systems remains unclear, particularly given the often interconnected and overlapping nature of disability and health services. 

The My Health Record system is problematic in these circumstances due to a lack of clarity regarding how it interacts with the NDIS now and in the future.

In addition to the concerns set out above in relation to the third party access by the NDIA, CYDA is concerned about the lack of clarity regarding the current and future capture of NDIS information by the My Health Record system.

While CYDA has been informed that My Health Record does not currently capture NDIS information, at the operational level matters are more complex. For example, current and prospective NDIS participants will regularly request specialist disability service providers and mainstream health services, who have access to My Health Record, to prepare documents for use by the NDIA. This may include reports about the functional impact of disability or Assistive Technology Assessments. It remains unclear whether such documents will be captured by the My Health Record system. Further, given the evolving nature of the disability services sector, it remains unclear which service providers will have access to the system. For example, while some service providers will be registered with the Healthcare Identifier service and have access to the system through conformant software or read only access through the National Provider Portal, others will not.

Clarifying these two issues is critical to ensuring young people with disability and families of children and young people with disability can participate in the My Health Record system and interact with service providers from an informed position.

CYDA also understands that the future capture of NDIS information by the My Health Record system is being considered under the National Digital Health Strategy: Framework for Action. It is acknowledged that this is still in the early stages of consideration. CYDA maintains that the progression of this issue must be informed by the direct experience of children and young people with disability and families.

Medicare and PBS discrepancy

It is CYDA’s understanding that a discrepancy exists between authorised and nominated representatives in relation to the ability to view Medicare Benefits Schedule (MBS) and Pharmaceutical Benefits Scheme (PBS) data once a child turns 14. If the child takes control of their record and consents to the inclusion of MBS and PBS information, an appointed nominated representative will be able to view that information[21]. This also applies to a person over the age of 18 who appoints a nominated representative. However, once a child turns 14 and has an authorised representative, this information will no longer be included in an individual’s health record[22]. For people with disability who have an authorised representative long term, this appears to have the practical effect that no one can access MBS and PBS information on their behalf.

Much of the messaging around the My Health Record system has emphasised the benefits of individuals being able to view and control their health information. This discrepancy seems to effectively undermine those benefits for people with disability who require an authorised representative.   

CYDA acknowledges that this issue is outside the control of the System Operator, however it is nevertheless an inconsistency which should be resolved.

Conclusion

The My Health Record system has unique and substantial implications for children and young people with disability. It is critical that lived experience of children and young people with disability and families informs the My Health Record System. This includes the unique experience of the right to privacy and the implications of the My Health Record system interaction with the NDIS. 

The matters raised in this submission must be addressed to ensure that children and young people with disability can access the benefits of My Health Record under a system that is robust enough to ensure their rights, safety and wellbeing are protected.

CYDA thanks the Committee for the opportunity to provide feedback on the My Health Record system. CYDA can be contacted to discuss any of the matters raised in this submission.

Contact

Stephanie Gotlib
Chief Executive Officer
20 Derby Street, Collingwood VIC Australia 3066
03 9417 1025 or 0425 724 230
This email address is being protected from spambots. You need JavaScript enabled to view it.
www.cyda.org.au 

[1] United Nations General Assembly 1966, International Covenant on Civil and Political Rights, https://bit.ly/2Mrt9ke

[2] United Nations General Assembly 2006, Convention on the Rights of Persons with Disabilities, https://bit.ly/1qmcT8Z.

[3] United Nations General Assembly 1989, Convention on the Rights of the Child, https://bit.ly/2JJh9O1.

[4] United Nations General Assembly 1966, International Covenant on Civil and Political Rights, Article 17(1), https://bit.ly/2Mrt9ke

[5] UN Human Rights Committee 1988, CCPR General Comment No. 16: Article 17 (Right to Privacy), The Right to Respect of Privacy, Family, Home and Correspondence, and Protection of Honour and Reputation, Para. 4, https://bit.ly/1maYWIk.

[6] Ibid, Para. 10.

[7] United Nations General Assembly 2006, Convention on the Rights of Persons with Disabilities, Article 22(2), https://bit.ly/1qmcT8Z.

[8] United Nations General Assembly 1989, Convention on the Rights of the Child, Article 16(1), https://bit.ly/2JJh9O1.

[9] Australian Bureau of Statistics 2008, Health Literacy, Australia 2006: Summary of Findings, Australian Bureau of Statistics, Canberra, viewed 18 September 2018, https://bit.ly/2PLtqjx.

[10] Ibid.

[11] My Health Record 2012 (Cth), s. 65, s. 69 and s. 70.

[12] My Health Records Amendment (Strengthening Privacy) Bill 2018 (Cth)

[13] My Health Record Act 2012 (Cth), s. 65, s. 69 and s. 70.

[14] House of Representatives 2018, My Health Records Amendment (Strengthening Privacy) Bill 2018: Explanatory Memorandum, Parliament of the Commonwealth of Australia, Canberra, p. 1.

[15] Sullivan et al. 2000, Maltreatment and disabilities: A population-based epidemiological study, p. 1257.

[16] My Health Record Act 2012 (Cth), s. 6(4)(b)i.

[17] Australian Digital Health Agency 2018, Act on someone’s behalf as an authorised representative, My Health Record Website, viewed 10 September 2018, https://bit.ly/2OhwfrV

[18] Ibid.

[19] Ibid.

[20] Ibid, s. 6(4).

[21] Office of the Australian Information Commissioner 2018, Young People and the My Health Record System, Office of the Australian Information Commissioner, Canberra, viewed 14 September 2018, https://bit.ly/2roGLmQ.

[22] Ibid.