This already exists,. If one has children, one knows the centralised children immunisation register/database The same could easily be extended to include COVID vaccinations.
2 Likes
The harm is the breach. Any unauthorized access to private information is harm.
There may be additional harm if the hacker etc. then uses that private information in bad ways e.g. extortion, blackmail, public shaming, identity theft, stalking, …
By that spin then we would suppress details of lots of convictions for crimes - whether by politicians, police officers, religious officeholders, … - because it ‘erodes trust’ in the containing institution.
This is so typical ‘government’ that the solution to a problem is perceived as ensuring that the problem is kept secret.
Yeah, nah. If you don’t want trust to be eroded then avoid situations that erode trust, in this case - correctly control access to data. Unfortunately MHR wasn’t designed with good control front and centre.
4 Likes
Yes, the AIR is indeed the national repository for vaccination information and COVID vaccination details will be uploaded to this repository. Work is currently underway to rollout new software to those providers who don’t already have this ability so that all COVID vaccinations may be captured.
To @person’s point “The harm is the breach” - absolutely. But what about a failed attempted breach. And what about a false positive, i.e. there wasn’t actually even an attempt. It seems to me the arguments of both sides have merit to some degree. Why should we tie up our public servants and tax dollars in notifications of non-breaches? But there is certainly merit in holding systems such as the My Health Record system to a higher standard than others due to the sheer number of health professionals who legitimately have access. So I have sympathy with some aspects of ADHA’s request but feel that they ask for too much.
1 Like
Not strictly MyHealthRecord, but related:
What could possibly go wrong?
Oh.
Next stop?
2 Likes
I am a decade out of date, but one of the prime failures of the federal procurement system was that those assessing tenders were duty bound to accept the company could deliver on all claims made. Everyone knew that was farcical yet the government was supposed to be a model, compliant customer working with the winner so as not to unnecessarily reduces their profits, not just working to achieve an outcome at best value. References could be hit or miss as how many federal procurement officers would admit ‘I made a mistake’? One learned their euphemisms and tried to work accordingly.
Having a bad history was rarely a block to winning the next one although there was at least one company that was banned for a year or two for continuously lowballing to win and renegotiating upwards after every phone call, email, and meeting.
1 Like
The proof of My Health Record is in the use. Apparently not much. Yet another piece of ill advised expensive ‘tech’ that has gone nowhere regardless of the reason(s).
1 Like
Yeah, I enabled My Health Record for my parents and myself as my parents have a lot of health issues and jump between a lot of doctors and specialists so thought that having My Health Record would be handy. But a lot of diagnostic stuff and summaries and discharge summaries from hospitals and GPs don’t get updated.
Wonder if part of it for GPs if they worry losing their patients to other doctors if they make it easier to switch GPs with detailed records? Or just GPs don’t have the time to do it?
1 Like
I don’t see that the rate of access by patients tells us very much, I have no reason to do so, the access by the medical profession is another matter.
It seems the records are incomplete in many cases because doctors don’t update them when they perform relevant actions. Other doctors don’t refer to the system because they know it is not up to date, so the original doctors feel justified in not doing updates because there is no point if so few refer to it …
Are all the doctors too busy? Do they need to be paid more to do it? Is there no goodwill to invest in helping others, when under pressure just help yourself? Do senior people not lead from the front and encourage juniors to do the right thing? Maybe somebody needs to find out.
1 Like
I don’t know who has access to MHR. I checked my husband’s and he had blood tests, etc. When I went back this year to check some pathology to see how long his condition had been extant, all was gone, replaced by a GP’s summary which said very little.
On mine I have only the last two years’ immunisations and a couple of prescriptions; no pathology, imaging, conditions, discharge etc. All disappeared. Not much use, except for proving COVID status.
All of the above. Aren’t paid to do it. Don’t have time. Plus confidentiality and liability issues. There are lots of reasons why doctors won’t use it. None of them is a secret.
My hard-ass solution: Legislate that all patient records stored by a practice must be stored on computers and must be stored in a mandated open, standard format. Then legislate that if a patient indicates that the patient is using My Health Record then anything that gets stored by the practice must also automatically be uploaded to My Health Record. (This ensures that zero time and effort is required by doctors.)
This guarantees patient portability between practices (in and of itself a problem, long before My Health Record) but also guarantees that My Health Record will be complete for those patients using it (or at least as complete as the practice’s own records).
Take the opportunity also to legislate about where records are stored, how they are stored, how information is to be protected, etc. e.g. only want cloud storage if it’s client-side encrypted (no matter which country the storage is located in but obviously overseas is harder to control than local). That includes any backups that are made - and backups should be being made.
There is a relatively small set of software packages being used across almost all practices. So getting those software vendors on board will cover a large percentage of practices.
However this highlights another challenge - this could make it easier for a practice to defect from one package to another package i.e. portability of a practice between packages, which is obviously something that a software vendor does not want.
There is no quick fix. Developing an industry standard would no doubt result in heel-dragging by all the stakeholders unless there is a government stick available to wield.
Finally, government must legislate to deny itself gratuitous access i.e. limit the use of the data to one purpose and one purpose alone - the health care of the individual patient - unless the patient specifically on a case-by-case basis consents. No law enforcement. No court orders. No employers. No insurers. No trawling by researchers.
And notwithstanding all that, there is no way I want my records on My Health Record. I will remain opted out no matter how well it works, for as long as I have that choice. From the sounds of it, I don’t have to worry about not having that choice any time soon.
2 Likes
But they will be in the record management system of who ever one chooses to use as a local health provider. Possibly also on more than one Practice Management System for those who have used more than one Practice over time, where the Practice has changed packages (ours did), or one has attended a hospital in recent years (emergency, in-patient, private/public).
Are any of the large multinational providers of the Practice Management Systems/Packages any less likely to be selling access to their collected knowledge in some form, or permitting access to governments?
1 Like
OK, while the government is about it, make that illegal too, except with specific consent of the patient on a case-by-case basis.
I’d suggest anyone who had made an online booking (HotDoc being one) and filled out the forms online or in paper form at the practice, hospital etc has consented to what ever the T&Cs provide for.
I had a need to present at emergency at the hospital 2 yrs prior (not Covid) and needed to provide a full history using many reams of paper to satisfy their system needs. No way to offer them a personalised digital version from my records, as well as a GP and other references. I’m now on their - QLD Health system in full. When I had need again 12 months following it was a 30 second process. Of course I’d already twice shared the same in recent years to 2 other private hospital businesses (Ramsay Health being one). They all use the same keys of dob, full name and Medicare number.
Regardless of any other suggestion, they all ask you to do the work of filling out their forms on line, as only that will suffice. I assume one option is to provide name rank and serial number only, oops - Medicare number.
In respect of use of the data maintained.
If it was required to be kept in a single common central registry under Govt Regulation, would that allow one or Govt to make that place the primary source? IE The regulated central record IP takes precedence over any copies retained and or used by a Practice, hospital or private providers. None of the last mentioned would have any other rights of use other than in the treatment of the named patient.
P.S.
It’s reasonable for all of us to question how our personal medical records and content are maintained and kept confidential. OTH I’ve also been on the difficult end of an insurer-super provider wanting to know not only key details of my medical history but that of my parents etc, both living at the time. The fine print on the form suggested any errors or omissions could affect any future payout! Whether any of us know reliably full details of parents or siblings health issues, and whether one should dare share that with a third party, there is only one answer. My greater concern is not what information is available, but how it might be misused.
1 Like
That is one possible solution but obviously it requires you to have great faith in the government as far as honesty and competence goes. Also, that solution is in essence taking away the choice to opt out. It wouldn’t be ideal during a network or server outage, although some medical providers that you deal with regularly e.g. your GP’s practice could act as caches of the primary content. I think it becomes harder to control who has access to what.
With what I was proposing, the primary source would remain the medical provider who has created the content, and the government is essentially providing the backup or secondary source (when you consent) - and that secondary source would be the means by which another needed medical provider, with your consent, would get a view of other parts of your medical history.
Indeed. Hence why it is really important to keep the government focused on: one purpose and one purpose alone - the health care of the individual patient
and to make all other uses illegal. Otherwise it’s a honeypot that too many other parties will find irresistible.
How do you know this?
IP addresses are virtual, nothing is stopping an attacker from using an Australian IP to launch attacks.
Key recovery is a tractable problem but often requires trust.
That said if the goal is to actually have a private eHealth record, we’ve had technology for decades that would enable an ehealth record where the custodians of the data need-not be trusted with the confidentiality of the data as encryption can be used as the enforcement of confidentiality rather than access control.
Encryption of data in transit and at rest is a great anti-hacking measure. However, it isn’t relevant when considering legitimate access to the data, or illegitimate use of those legitimate channels. That is to say if Doctor A has been given access to one’s record but their receptionist uses their computer, then it is quite conceivable that one has to rely on trust that the receptionist doesn’t access one’s record. The My Health Record system at least provides consumers with a full audit record of accesses so one can see which provider has accessed the record, but in an electronic environment it is impossible to be sure whether that was really that provider or not, even though the whole system is protected by client certificates and encryption. It is worth noting, however, that the receptionist would certainly have access to my paper based record at the practice with likely no traceability whatsoever, so the electronic version might be said to be more secure.
It would be unusual for most of us to find we have a paper record any more. The practices/specialists we have attended in recent years and hospitals are all digital. Our GP’s transitioned some time past. Each made a choice of which product to use for practice/patient management system/software. The practice/hospital may or may not enforce access recording. There is an assumption all changes are logged and all access is uniquely authorised.
As a patient you are excluded from access to those systems. Most of us would expect a record of medical treatments to be printable on request. Obtaining a report on who has accessed your records might prove more difficult.
