Ms Catherine King (Ballarat, Australian Labor Party, Shadow Minister for Health and Medicare) Share this | Hansard source

This is a government that is always there for the shiny, exciting headline-grabbing announcements when it comes to digital projects but that goes missing when it comes to the implementation. After those announcements, it goes missing. We've seen that with the National Disability Insurance Scheme and the way in which it has completely mucked up the implementation. We've seen it with the census fail and we've seen it with the National Broadband Network. This is a government that cannot deliver services and cannot deliver digital projects.

Two years go, this government announced it was going to 'rescue' Labor's electronic health record system. This is, of course, after coming to government and doing nothing at all for 12 months. Suddenly it had to rescue a system that was on a trajectory of actually getting more and more people signed up. Never mind that Labor's opt-in scheme didn't need rescuing. It was a scheme that already had a million people signed up and was growing steadily as public awareness of its benefits spread. Nonetheless, they decided to go to an opt-out model. The opt-in model relied on the informed consent of patients actively choosing to take part; the opt-out model relies on presumed consent. It is a fundamental shift in thinking about the electronic health record.

Despite this, the government somehow didn't go back and tighten the legislation or look at whether the enabling framework legislation that underpinned our personally controlled health record was suitable. So right from the start they dropped the ball on implementation. They did nothing for ages, they then axed the Medicare Locals that were charged with getting informed consent for the personally controlled electronic health records and then they decided that they would trial opt-out.

After the announcement of the trials we didn't hear much about it—although there were some problems with the opt-out trial sites—until a few months ago when the government announced that the three-month opt-out period would start. From the beginning, we were pretty wary. We recognise that, if implemented by a competent government, e-health could deliver tangible healthcare improvements and save the health system up to $7 billion a year through fewer diagnosis, treatment and prescription errors. That's the very reason that we began delivering this important reform when we were in government—building that architecture. But given that this is the same mob that, as I said, gave us census fail, stuffed up robo-debt, botched the NBN and the NDIS, and allowed Australians' Medicare data to be sold on the dark web, we had real concerns about their ability to pull this off, Unfortunately, our worst fears have been realised.

The Liberal government made the decision to transition to an opt-out system, but made no real effort to explain this fundamental change to the community and to bring the community with them. They made no effort to reassure people that their privacy would be protected and that their data would remain secure. In short, they didn't seek to bring the public along with them. If anything, they sought to conceal these changes from the Australian public. There was no public information campaign—we were assured by the Australian Digital Health Agency that there would be. There was no TV advertising and no leadership from the Minister for Health. They gave every impression that they were trying to sneak through the opt-out process so that Australians wouldn't even notice that it was happening and so wouldn't exercise their right to opt out.

It was this approach that of course fuelled the firestorm of public suspicion and distrust that was to follow. The first month of the opt-out period, frankly, has been an absolute disaster. The media, doctors, unions, privacy advocates and opposition have all exposed a string of privacy and security concerns that the government seemed not to have even considered, nor could it actually explain them. Two weeks into the fiasco, the minister announced some welcome changes: amendments to require law enforcement agencies to get a warrant or a court order to access records, an extension to the opt-out period and the ability to delete permanently unwanted records. The minister also finally conceded the need for a comprehensive public information campaign. We're still waiting on the details of what this will look like and whether it will be adequate. We're also deeply sceptical that any truly comprehensive campaign can be produced and rolled out in the three months between now and the end of the extended opt-out period.

But whatever the case, these changes do not go far enough to address the concerns swirling around the Australian community. That's why Labor has maintained its call for the rollout of the scheme to be suspended until these issues can be addressed. And that's why Labor has today called for a comprehensive Senate inquiry into the scheme, not just into the government's proposed legislative amendments but into the whole system underpinning the My Health Record system. We want this inquiry to look at all of the legislation, regulations and rules that underpin the scheme—a complete stocktake of the My Health Record system. There are some serious unaddressed issues involving domestic violence and workers compensation, and the potential that commercial actors like health insurers will get access.

Family law experts have warned that the system could become a new battleground in disputes between warring exes and risk the safety of women fleeing abusive former partners. They point to a loophole that allows a parent who does not have primary custody to create a My Health Record on their child's behalf without the knowledge or consent of the former partner. An abusive ex-partner could then gain access to details, including the location of medical practitioners and pharmacies attended by the child with their primary caregiver, putting people at risk.

There is also uncertainty about the potential for employers to gain access to the private health data of workers. Unions are urging tens of thousands of their members to opt out, because they fear that under the new system employer doctors used for pre-employment health checks for insurance purposes could get access to and pass on a worker's entire medical history.

Labor wants this reform to succeed, but we can well understand why unions are urging their members to opt out. With this kind of uncertainty swirling around, why wouldn't they? This is what the government has done. There was a 10-year pathway to an excellent healthcare reform, and because of the government's failure to address some of these fundamental questions we've got unions telling people to opt out, doctors telling people to opt out, GPs saying they have opted out and specialists saying the same thing. Even politicians: there are many members of this place who have told me that they have opted out. This is not the sort of system that gives us and the public a great deal of confidence that the government has got it right. The government claims none of these are actually issues—forgive my scepticism. It also said there was no issue around law enforcement access but was then forced into a humiliating backdown when it agreed to amend the legislation.

Let's have a proper look at these issues. Let's consider some other proposals, too. Should there be a second factor for authentication beyond username and password for healthcare professionals? Should there be better default access restrictions so that healthcare professionals other than your immediate treating doctor don't see things like your STI history, for example? Should we make it opt in for your data to be used for research purposes or opt in for each individual piece of health data to be uploaded? Should we revoke third-party apps' access to the data?

We're deeply concerned also about the secondary use of data. Under the current framework, My Health Record data cannot be used for solely commercial and non-health related purposes such as direct marketing to consumers. But what's to stop a future government, particularly one that has control of the Senate, changing that framework to give insurance companies, for example, access to that data? We know the big health insurers want access. They're very keen for that. Labor wants to make sure that that does not happen—no matter what—but we don't trust this government to honour its assurances. We want an ironclad legislated guarantee that this won't happen.

Given all of this continued uncertainty, we urge the Greens and crossbenchers to join with us in the Senate to make this inquiry a reality. We know that the legislation the government is proposing will go to a Senate inquiry. We understand that is going to be the case, and it is certainly what we would be recommending, but it needs a much broader inquiry where people who have expertise in cybersecurity and in privacy law can actually have these matters heard. Nothing less than a comprehensive inquiry will satisfy concerned stakeholders and a concerned public.

This is a system that is an important health reform, but the government has absolutely jeopardised the reform because of its failure to get the implementation right. It has underestimated people's concerns about their privacy and people's concern and understanding of what is now happening with their data. We are in a different world from what we were in back 2012 when we had an opt-in, informed-consent system. The government has failed with My Health Record. We need to look at this further.

See this speech in context