What an excellent idea. I have multiple chronic diseases and I’m getting on a bit, I was hoping the health record would solve the problem of getting info where its needed in an emergency but it seems to me your idea is more useful. Though there are health apps on my iPhone which would serve the purpose, I could just have the relevant info to put into the phone to unlock it instead of all my medical info. FYI I am unimpressed by Apple Health though its getting better, its more aimed at healthy people than sick ones.
3 Likes
I was undecided about staying in or opting out until reading about partnering with HealthEngine(HE).
Now HE may not have done anything illegal but certainly demonstrated they put money before their ethics, morals and reputation by both trading client information to third parties and editing negative reviews from clients to make them look positive.
The issue I have is in a project like MyHealth Record there should have been a standard set for any partner in terms of ethics/practice/business values and they should have been investigated for compliance. So either there is no standard or the lead group did not vet HE and discover the way they operate. Further, the lead group’s failure to terminate the relationship upon HE’s behaviour becoming public, I have to conclude it is likely there are more instances of problems at this level.
5 Likes
That’s interesting.
Two questions it raises for me are:
-
What if I’m unaware or have forgotten any details about my family? I guess theres some things hard to deny, but the more subtle ones would be easy, and
-
Do I need my family members permission to disclose their history? whether they are specifically identified or not? Anyone with access to government registries can work out my parents and siblings, etc and there are plenty of online ‘services’ that can be used to stalk out such information.
I’m sure there are more questions.
Sad thing is, your reply rings a bell with me and I wouldn’t be surprised if I’ve unthinkingly given out such information years ago when I was less questioning about companies that randomly drift-net information out of customers/etc.
4 Likes
Good question. As far as the Dark Web is concerned, your most substantial risk is probably identity theft.
The MyHealthRecord database will contain enough information to assume the identity of any individual who has a record. That’s millions of potential targets. The database will be a honeypot, attracting every nasty that’s capable of exploiting the information.
We’re in for interesting times.
8 Likes
Quite apart from the sensitive nature of health records (did you really want your employer to know that you once had an abortion? etc. etc. etc.), there is enough basic information for vanilla identity theft (name, address, etc.).
I have bought or sold real estate using a medicare card, so it seems that the importance of keeping your medicare card number secure is increasing. (This is an ongoing government problem, as with the drivers licence. The more it is used as a de facto identity card, and yet the more different parties have a copy of it, the less useful it is as an identity card - and all the while being a complete abuse of the card’s actual intended purpose!)
5 Likes
It is my understanding that one has a chose what information is stored on MyHealth Record. If one say has a medical procedure one does not want to share with anyone (such as one that goes against religious, cultural or personal/family beliefs), then one can ask a provider not to up load the data/record to MyHealth.
It is however worth noting that the individual service provider will retain records of the consultation, treatment and outcomes on their own information storage system, which is also likely to be electronic and also subject to the same (possibly higher) security risks of that with MyHealth.
If the procedure/treatment has a medicare claim number, then the information of the treatment will still be recorded through the medicare system, unless one choses to have the procedure outside the medicare system (that being, at full cost to the patient).
I also imagine that basic information stored by MyHealth is no different to that stored in the whitepages or by any other institution one deals with. I hope that if one is concerned about identity theft from MyHealth, one also removes their name from Sensis Whitepages and also every other institution/company one deals with as the same risks apply. Unfortunately in today’s day and age, this is impracticable and a risk one needs to deal with when engaging services from anyone from a private contractor to the government. We need to provide some hope and faith that they also look after and don’t share the information they have collected either in person through to apps one may use for services.
Couldn’t agree more. Information stored by medicare, including banking details for refunds as well as information used to prove identity for new card holders is information which would be far more of interest for hackers who want to commit identity theft.
3 Likes
Hackers go for the easiest, softest, and most potentially lucrative targets first. Why hack into the local clinic for a few hund or thousand possible ‘hits’ when you can get Australia for your effort, whether through MyHealthRecord, Medicare, Centrelink, an insurance company, a bank, or [ fill one in ].
5 Likes
No you don’t have a choice about what is stored, it is all stored once it is created. What they allow you to do is “control” who accesses what on your record. However in a number of circumstances all details can be made available to a large number of interested parties.
6 Likes
At the time of consultation one can ask the provider not to store the information on MyHealth. The provider would have to honour such wishes otherwise they would be in breach of contract.
Once the information has been stored on MyHealth, then it becomes part of the record history which will be retained for a very long time, including up to 30 years past one’s death.
4 Likes
This document is for pharmacists, but could be enlightening.
3 Likes
Confirmation of this is outlined here:
See: Situations where documents should not be uploaded
It is also worth noting that the Pharmacy Information Sheet linked about by @PhilT is silent on this which is a concern as pharmacies would also be required to meet the legislative obligations of a healthcare customer. Namely requests that pharmacy records are not uploaded as per the information on MyHealth website.
The above is very important for those who chose to use MyHealth Records but may have records from time to time that they wish not to be recorded for some reason. An example maybe if a creatable record is due to a indiscretion through their own lifestyle choice.
3 Likes
It does reference refusal by the client and allows for non uploading, but as I previously held once a record is created it is not removed but can be hidden (unless it was a incorrect person’s data uploaded to your record).
"Q If the patient does not consent to having their dispense information uploaded to their My Health Record, what do I need to do to ensure it is not uploaded?
The default setting is generally “Upload”. In the dispensing software there is a pre-populated checkbox confirming that the patient consents to having the dispense information uploaded to their My Health Record. If the patient does not consent, you must untick the box.
The pharmacist can advise the individual to either change the settings (through the consumer portal) so that no PBS information flows to the My Health Record or, alternatively, they may contact the My Health Record Helpline to disable to flow of information on their behalf."
The pharmacies do not need to advise they upload, they do not need your explicit consent, but you may explicitly refuse to allow uploading which should stop the uploading.
However the DHS record of the dispensing will still be created on your record but takes longer to happen and is not as detailed as the pharmacy upload.
5 Likes
Missed that bit.
Agree that the DHS record will still be created as the information will still be captured by medicare (which falls under DHS)…one does not have a choice to opt-out/in of medicare record capture unless one chooses not to use medicare system and subsidies for dispensing (pay full cost and have dispensing like a non-medicare holder).
4 Likes
By opting out of MyHealth the Medicare data will not be populated on that system, so in a way you avoid the shared access by anybody unless they have a warrant to examine your Medicare record. I know the data is still stored but the ability to access this data on MyHealth is a much easier process with less “authority” needed than to access your Medicare record, eg Emergency Access which is granted for 5 days at a time does not exist in Medicare.
4 Likes
Agree, that the medicare data stored by DHS will be separate to that stored on MyHealth. They must be running two discreet/separate servers/data storage systems which can talk to each other when instructed (through the MyHealth record settings).
4 Likes
That is my understanding too. However if you don’t even know that you have a My Health Record - and the government doesn’t seem to plan to tell people - then you won’t be requiring the health care provider not to upload.
3 Likes
I can see the move to get rid of Medicare as a system and that the Govt at some point will say you must have a MyHealth record as they will fold them all into one stating “cost savings”. I think this will occur sooner rather than later as the numbers of registered MyHealth users increases to above some percentage mark. This is more perhaps why they chose Opt Out rather than the old Opt In so they could raise the number to that magic point by using people’s own lethargy, inability, unawareness to act to Opt Out.
The LNP Govt dislike/loathe Medicare as it was a Labor Govt Act of Law that created it, Death by a thousand cuts perhaps as they have tried to do in the past?!
7 Likes
That is an interesting concept. It is often quite difficult to get two probably disparate systems talking, especially under two disparate managements. It could be another opportunity to introduce ‘debacle class’ problems.
A scenario I hope is well past its time, but I could imagine one of the tech savvy (choke, gag) officials mandating reliability be assured by: System ‘A’ outputs all requests from the week on Hollerith cards on it’s well maintained ‘classic’ punch. System ‘B’ has a well maintained ‘classic’ card reader so it batches the requests and puts the requested records on tape, probably all fixed format so any change would be a monumental change, and posts the tape back to System ‘A’ where it is read and processed to update their database (or collection of pdf files as the case may be). Security is maintained because the tape is returned to the shelf for reuse and the cards all got bent in the reader.
My doors are now locked because the whistleblower police may be headed my way, 'cross pond 
6 Likes
Any communication between systems opens up security holes.
On reflection, I’m more than a little concerned by the apparent reliance on Adobe systems in general and “Adobe Experience Cloud” in particular.
3 Likes
