Gai Brodtmann (Canberra, Australian Labor Party, Shadow Assistant Minister for Cyber Security and Defence) Share this | Link to this | Hansard source

The government's implementation of the My Health Record system has been nothing shy of inadequate and nothing short of woeful. In August, the government announced rollout phase 2 of My Health Record, which meant that every Australian's private health information would be stored online unless they chose to opt out. This is not the way the system was originally designed. This was not the way the system was originally intended. Labor's opt-in model was a model based on informed consent. The Australian public had the ability to learn about My Health Record and then choose whether they wanted to be part of the system. This was intended to be a system based on trust, Mr Speaker. As of this morning, My Health Record has lost the trust of nearly 1 million Australians who have opted out. This is significant given that there are still two months left in the opt-out period—although not surprising, given 20,000 opted out on day one.

My Health Record has the potential to be a safe, helpful and trusted tool, but this government has significantly and severely damaged this potential with its woeful implementation and rollout of this system. The rollout of this system has been inadequate. As the shadow assistant minister for cyber security and defence, my concerns about My Health Record immediately turn to the cybersecurity of the data which the system will be holding. My concerns stem from the complete and utter disregard for cybersecurity that the Turnbull-Abbott-Morrison government has shown. This is the government that brought us cyberfails such as the 2016 census, repeated crashes of the Australian Taxation Office website—more than 12 over 12 months—and, who can forget, robo-debt.

Australian government agencies are expected to comply with mandated Australian Signals Directorate top 4 mitigated cybersecurity standards. These are: application whitelisting, patch applications, configuring of Microsoft Office macro settings and user application hardening. In 2014, an audit of seven government agencies found that not one met this criteria. Not one met mandated cybersecurity standards that are mandated by the Australian Signals Directorate for government agencies. Seven government agencies were audited and not one was found to be considered cyber-resilient. How did the coalition government respond? With a very stern letter from the then Minister Assisting the Prime Minister for Cyber Security asking agency and department heads to take cybersecurity very seriously. It was a letter that was sent to these department heads and these agency heads. They were mandated government agency and ASD endorsed standards on cybersecurity, yet the government's response when these agencies weren't complying was to send them a very stern letter asking them to take cybersecurity very seriously.

Despite assurances to the Joint Committee of Public Accounts and Audit that they would be compliant by 2016, the latest Australian National Audit Office report revealed that two out of the three agencies audited again still had insufficient protections against cyberattacks from external sources. In the latest report, a total of 14 government entities were reviewed and just four were found to comply with those mandated top four cybersecurity standards by the Australian Signals Directorate. They were the Department of Human Services, Treasury, AUSTRAC and the Department of Agriculture and Water Resources. The government entities that have not complied with these mandated standards include the Australian Federal Police, the former Department of Immigration and Border Protection, the Australian Bureau of Statistics, the Australian Taxation Office, the Australian Financial Security Authority and the Department of Foreign Affairs and Trade.

At a time when significant data breaches and cyberattacks are an almost daily occurrence, the revelation that our own government entities continue to fail to meet mandatory cybersecurity standards should be a cause for great and immediate concern. But the response from the government was to send a letter saying,' Please take this very seriously.' These are the government entities that collect and store the information of Australians. They protect our borders. They run our national security operations. Continuing to overlook this lack of compliance is continuing to put this data at risk with potentially significant consequences for Australians, and this includes our digital health data.

The Department of Health was responsible for the 2017 Medicare data breach, which allowed a darknet vendor to sell Medicare card details using the Australian Department of Human Services logo. At the time, Nigel Phair, former AFP investigator into high-tech crime, described the coalition government's response to this breach as 'disappointing, confusing and often contemptible'. It is alleged the Department of Health and the Digital Health Agency have been independently audited, but this is yet to be confirmed by the government and the results of this audit have not been released. Although I am heartened to know that the Digital Health Agency has a cybersecurity centre, I still have a number of concerns, particularly about their cybersecurity compliance.

In August, I raised my concerns in parliament. I asked the then Turnbull government: 'Is the Department of Health cyber resilient? Is the Australian Digital Health Agency cyber resilient? Does the Department of Health comply with ASD's mandated top four mitigation strategies? Does the Australian Digital Health Agency comply with those mandated mitigation strategies? Do they comply with the essential eight mitigation strategies, which are mandated? What about access to data? What about the computers in every health professional surgery, clinic and centre across Australia? Are they cyber-secure? Do we know? What audits have been undertaken? What standards have been used?' There are so many questions on this front, and it appears that no-one on the other side of the chamber is taking this seriously. This is serious. This is highly sensitive data and this is serious.

The history of government agency noncompliance with mandated Australian Signals Directorate cybersecurity standards—the fact that we have a track record of that—does not fill this side of the chamber with great confidence that the Digital Health Agency and the Department of Health are cyber-secure, are implementing these mandated standards and are applying some cybersecurity standard to the health professionals to which they engage. I am yet to receive answers from those opposite on my many questions.

A report from the Office of the Australian Information Commissioner in July revealed that Australia's health sector is the worst industry affected by data breaches, which is why I am so concerned, and why this side of the chamber is so concerned. It is not only the fact that government agencies aren't complying with mandated standards and not only the fact that this government has an appalling track record with its agencies in terms of cyber breaches—as I said, census fail, 12 ATO breaches over the past 12 months and the robodebt issue, as well as the Medicare issue. Not only am I concerned about past performance but I'm also concerned about the fact that the Office of the Australian Information Commissioner found that across Australia the health sector is the worst industry in terms of data breaches.

Why haven't we seen the results of the independent audit? The Australian Digital Health Agency maintains that it has been independently audited. Well, if so, let us see the results. Release the results. And who also conducted the independent audit? Was it multiple agencies? Was it external agencies? Who actually conducted the independent audit? When was it conducted? And what standards were used as the measure in that independent audit? If the Australian Digital Health Agency is compliant with the ASD's top four mandated mitigation standards, then show us the information; show us the confirmation in order to provide assurance to the Australian public about the safety of their data. I think that's the least we can do, given the fact that the agency has said that it has been independently audited. Well, show us the results. Show us that you are compliant with those standards. Show us that you are cybersecure. Show us that you are cyber-resilient. Show us that you actually have the systems in place for a cyber-recovery.

The reason I'm concerned about that, the reason this side of the chamber is so concerned, is that we are talking about the personal data of every Australian, unless they choose to opt out. And we're not just talking about a cough or a broken bone; this information is highly sensitive. We're talking about pregnancy terminations, we're talking about injuries from assault, we're talking about miscarriages and we're talking about workers compensation injuries. It is highly sensitive data that needs to be protected from falling into the wrong hands, and the Australian people need to be reassured that the cybersecurity arrangements are in place to provide us with some sense of comfort that this agency and the Department of Health and this highly sensitive personal health information is actually cybersecure and cyber-resilient.

Online criminals are not the only ones we should be worried about here. The Office of the Australian Information Commissioner report also revealed that human error accounted for almost 60 per cent of data breaches within the health sector, which is absolutely significant. The insider threat is significant on so many fronts, not just in the health sector but in other sectors as well. Is the government planning on educating the health sector about basic cyberhygiene? If not, why not? This government's past track record in educating the broader community on cybersecurity makes you wonder whether it's actually going to happen in relation to those health professionals. Yesterday in question time the government were talking about their fabulous track record in educating senior Australians on cybersecurity, and the minister went into some rant about border protection. But where is the education program to prove that you've actually done this? Where is the education program to prove that you've done this education and that you've raised awareness about basic cyberhygiene practices amongst health professionals? Where's the universal education program right across Australia that is targeting seniors to improve their cyberhygiene practices?

This government's all talk when it comes to cybersecurity—all talk. It's got this dazzling, huge strategy but no deadlines, no key performance indicators and no targets—just a whole list of activities, and everyone's running around doing those activities and we don't know any outcomes from that strategy, a strategy that has significant funding. One of the key components missing from that strategy is an education program for the broader Australian community, for these people in the health sector, for senior Australians, for small business.

Health data is an increasing target for cybercriminals. Last year in the UK, the healthcare sector suffered more than half of all cyberattacks, and in 2016 a Californian hospital paid US$17,000 in bitcoin as ransom to a hacker who had seized control of its computer systems. A cyberattack on a Singapore health database earlier this year stole details of 1.5 million people, including the Prime Minister, and last year's WannaCry attack proved that the networks that aren't cybersecure, down the supply chain, are the biggest vulnerability of our systems.

Australia is not immune here. If we do not get this right, we will become part of these statistics. Again, I've been calling on the government to actually get some rigour on the cybersecurity front and get some ballast in the critical infrastructure space. There was an act that was passed a few months ago, and it addressed only a few sectors in critical infrastructure, and it failed to even mention the word 'cybersecurity', which is breathtaking in 2018.

In closing, I just want to share some of the feedback I've had from Canberrans about My Health Record. A local medical practitioner wrote to me not long after the opt-out period began. He said, 'It's now been 50 minutes, and I still can't get through to a resolution of my request to opt out—trying to opt out online only to finally get the message, "Unable to process your request." How can the My Health Record system be trusted if they can't manage to deal with a simple online process?' Labor are not the only ones questioning the government's implementation of My Health Record. We've got Canberrans and health professionals doing it too. We must reassure Australians that the Digital Health Agency is cyber-resilient. We must reassure Australians that the networks that access this data comply with minimum cybersecurity standards. The government must reassure Australians that their personal data stored on My Health Record is secure and prove that the Department of Health and the agency are cyber-resilient. Only then can millions of Australians be assured their personal information will be safe.

Tim Watts (Gellibrand, Australian Labor Party) Share this | Link to this | Hansard source

Data governance and security is now one of the most talked about issues in our society. Most Australians are now used to receiving emails from companies or organisations informing them that their private information has been exposed in a data breach. Have I Been Pwned, a website maintained by Australian Troy Hunt, a Microsoft security expert, has logged nearly 5½ billion pwned user accounts across hundreds of confirmed data breaches. In fact, a US organisation that tracks data breaches found that, in 2018 alone, almost 800 data breaches have been confirmed, exposing over 27 million records. Since 2005, they've found almost 10,000 breaches, exposing one billion records.

It's hardly surprising, then, that the public are increasingly anxious about protecting their personal data when stored online. This was the context for the rollout of Australia's My Health Record, an online summary of Australia's key health information intended to give doctors access to patients' critical health information, like prescriptions, allergy tests and scan results. My Health Record has been a long time coming. It is a project with obvious potential benefits for individuals and our broader healthcare system. It has the potential to save lives, to improve a person's experience and to save money throughout the healthcare system. Given these potential benefits, it's unsurprising that this policy has been pursued across multiple governments on both sides of politics. But a project of this nature also has major risks.

Given the legitimate sensitivities associated with maintaining the confidentiality of private medical information, maintaining public confidence in this system was always going to be a major challenge and a major priority for the rollout of the My Health Record. But, when the current government decided to change the rollout of My Health Record—from something where Australians had to choose to opt in and provide informed consent to participate, to a system that people had to make a decision to opt out of and could become a part of without their informed consent or even their knowledge—the government dramatically underestimated the increased sensitivity that this would create and the public's anxiety with data security issues associated with it. It required a first-principles re-evaluation of the data governance for the project and an extensive public consultation and communications program to bring the public along with these changes. This has manifestly not occurred. The result has been a barrage of anger and confusion that has completely undermined the public's trust in the security and confidentiality of My Health Record.

This bill, the My Health Records Amendment (Strengthening Privacy) Bill 2018, which Labor supports, is a reaction to the public's anger to this bungled rollout. Before this bill, law enforcement bodies could access My Health Record information for certain purposes, such as the investigation of a criminal offence. Now this bill makes clear that such release of information to police or other law enforcement authorities can only be done with consent or a court order. This bill also responds to the public's anxieties over the storage of the information in My Health Record after they opt out. The My Health Record originally required the information to be retained 30 years after a person's death. This bill requires that an individual's My Health Record be deleted permanently if that person decides to cancel their record. But this bill doesn't go far enough. These are good measures, but we need to go further.

Unlike the government, Labor intend to move carefully here. As a result, we've referred this bill to a Senate inquiry with a view to the introduction of further amendments that could improve public confidence in the My Health Record. Labor are particularly concerned with two aspects of this bill. Firstly, we are worried that My Health Records could facilitate family violence. That's because the act may allow a non-custodial parent to create a My Health Record on their child's behalf without the knowledge of their former partner. That record may contain information about the location of recent doctor or pharmacy visits and may then be used by an abusive ex-partner to track a mother and child. Although the issue has been repeatedly raised by advocates against family violence, the government has refused to act. The second problem, this time raised by the trade union movement, is that employers could again access to the My Health Records and use those records to discriminate against workers on the basis of their content. The act is ambiguous at best about whether information from workers' compensation health checks can be passed on to employers. This bill needs to do more to protect women fleeing domestic violence and workers' information in the workplace.

Beyond our concerns with this bill, the Labor Party have received support from the Senate for a separate, broader inquiry that will review all laws, regulations and rules that underpin the My Health Record. We strongly believe that this inquiry is needed to exert greater scrutiny on the data governance structure prevailing in this shift to an opt-out system. The Minister for Health in response to the rising public anger about concerns to do with the security and confidentiality of this information repeatedly insisted in public that the My Health Record had 'military grade security' and was impenetrable. This frankly does nothing to answer the question as to whether this system has the ability to protect sensitive personal information. In fact, from my perspective, it merely undermines any confidence in his competence or that the government even understands the basic principles of data governance and security.

In response to the growing community uproar about the My Health Record, the minister issued a press release stating that the My Health Record is protected by:

… defence level encryption, secure gateways and firewalls, authentication mechanisms, and malicious content filtering.

He said that it would be monitored by the Australian Digital Health Agency's Cyber Security Centre for unusual activity. But what he failed to communicate and, more worryingly, to understand is that effective security online isn't about technology; it is about having a risk management system. The best military-grade technology—whatever that means—is worthless without an accompanying system built to manage a suite of other non-technology risks associated with the storage of sensitive data of this kind.

My Health Record has the potential to be the largest data honey pot ever created in Australia. The idea that hostile or criminal actors would seek access to this information is not a hypothetical concern. Hackers stole personal data about 1.5 million people from the Singapore government healthcare database in what the Singapore government described as a 'deliberate, targeted and well-planned attack'. Their system was breached because one computer belonging to SingHealth, one of the two major government healthcare groups in Singapore, was infected with malware through which hackers gained access to the non-medical personal data of 1.5 million healthcare patients, including the Singapore Prime Minister. Similarly in the United States hackers managed to steal records of around 21.5 million people from the US Office of Personnel Management. Large-scale data breaches like those in Singapore and the United States and breaches of a similar scale in Germany and the United Kingdom are equally possible in Australia, too. We shouldn't kid ourselves: we are a target as well.

To be confident in a risk management system for protecting data like this, all forms of information risks must be identified and appropriate risk management policies put in place. My Health Record has many forms of risks. In fact, you could consider it having hundreds of thousands of risks. That's in the form of every employee working in every clinic and every hospital in Australia who has access to these records, the so-called insider risk. It us naive ignorance at best and wilful neglect at worst for the minister to believe that technology alone would prevent incursions into government data systems. In fact, during the three months between March to June 2018 alone, the Office of the Australian Information Commissioner received 242 notifications of data breaches under the Notifiable Data Breaches scheme. Twenty per cent of these breaches came from healthcare providers, the largest single source of data breaches. This figure understates the data security risk in the health sector because public hospitals and community health centres are exempt from reporting data breaches under the Notifiable Data Breaches scheme.

There are almost 700 public hospitals in Australia that provide two-thirds of all hospital beds in the country and employ over 300,000 staff. Each and every one of those employees is a potential risk that a data governance system would need to manage. They are a risk because human error accounted for 60 per cent of data breaches by health providers. It was not malicious attacks from hackers, from state based actors or from cybercriminals; it was just human errors. The risk was not in the hardware or in the software but in the wetware. No military-grade technology can prevent information being given out by mistake because a clinic hasn't trained its staff.

Instead of only talking about the technology, the government needs to ensure that health providers around the country have good security practices. As the member for Canberra pointed out so presciently in her previous speech, we need basic cyber hygiene training for everyone touching this system. Health providers need to know who they can appropriately allow to access My Health Records and the level of access different that different types of staff should have to ensure that the systems to monitor use and access are in place. They need to have systems that detect unauthorised use and access.

Health providers need to know what to do if there is a data breach, including who they should notify and whether they need to notify authorities. When it comes to notifying authorities, understanding who you should notify and when is a near impossible maze to navigate. Private providers must follow the Commonwealth Privacy Act and report to the Office of the Australian Information Commissioner. Public hospitals and community health centres are regulated by the states. State parliaments haven't enacted similar breach notification schemes.

My Health Record adds a new layer of confusion for two reasons. Firstly, it has its own breach notification provisions that use a different legal test to the Privacy Act. This means the circumstances under which health providers must notify patients and authorities of a breach are different to that set out in the Privacy Act. Secondly, My Health Record can be accessed by patients as well as by the public and private hospitals; healthcare providers, including GPs and specialists; pathology and diagnostic imaging services; and pharmacies. That means that if a patient's information is lost or accessed unlawfully, whether a notification to the person affected is mandatory depends on which of these legal regimes applies. What law applies depends on where that person's medical records sit at the time of the breach.

If this sounds confusing, Dr Megan Prictor, a research fellow at the University of Melbourne and an expert on health technologies and data regulation, illustrates the extent of this confusion with an example. She cites an example of Ms Smith. Ms Smith invites visits a private specialist, Dr Jones, for advice on a health problem that requires surgery. Dr Jones puts notes on Ms Smith's condition into the private clinic's record. Ms Smith is then admitted to a state public hospital for surgery, as a private patient, under the care of Dr Jones. Whilst she is there, information about her surgery and her recovery are entered into the public hospital record by nurses and junior doctors. Both Dr Jones and the hospital also upload some information about Ms Smith's treatment to the national My Health Record.

In this scenario, if information about Ms Smith's surgery is accessed by hackers, then whether Ms Smith must be told about the breach depends on where the information was taken from. Under current legislation, consumers will be informed about data loss from a private healthcare provider or My Health Record but not from a major public hospital. If it was held in Dr Jones's private rooms, under the Commonwealth Notifiable Data Breaches scheme, Dr Jones must tell Ms Smith about the breach as well as inform the information commissioner. If the same information is taken from My Health Record, Ms Smith must still be informed but the specific notification criteria and the procedures are different. Finally, if the information is taken from the public hospital records, there is no legal obligation to tell her at all. As Dr Prictor so ably illustrates, the complexity of rules is confusing to both healthcare workers and patients alike. It's clear that, on the issue of data security, My Health Record actually adds a new layer of confusion and, in turn, a whole new set of risks to protecting sensitive and private health information.

To reiterate, data related risks are not limited to 'cybersecurity'. That's just one of a bucket of risks. We need to consider fraud risk, like we saw in a recent incident with the selling of Medicare numbers on the dark web. There's third-party risk, where healthcare providers subcontract services to a third-party provider and are given access to My Health Record, adding another layer of risk. Blustering about military-grade security technology really makes you wonder whether the minister understands these different forms of risk.

We need to get better at this. Data governance and managing public anxieties about data collection and use are not limited to the health sector. Governments around the world are moving towards delivering more services online to improve quality of services, to reduce costs and to collect more information that can be used to inform the development of better policies. These are legitimate reasons for collecting and storing private information, but they will also only increase the public's anxiety. There's a need to do some big-picture thinking about these issues as a whole-of-government effort, not just limited to one department or sector.

Crucially, we also need to bring the public and the medical profession along with our thinking, something that this government has manifestly failed to do. To date, only around 13,000 provider groups have signed up to the My Health Record. That might sound impressive, but that's out of around 900,000 health professionals who could have signed on. To have a useful system, we need most of these groups to sign on. Although most hospitals have access to My Health Record, most have never looked up the system because a patient may not have a record if it's empty. Although there are significant public anxieties about the system, at this point there's not enough information for it to be useful in a practical sense for either patient or doctor. And so we come to the current situation: an angry and confused public that distrusts the My Health Record, a database used by only a small proportion of health practitioners and a government that has completely misunderstood what it takes to protect patients' privacy and data security.

Stephen Jones (Whitlam, Australian Labor Party, Shadow Minister for Regional Services, Territories and Local Government) Share this | Link to this | Hansard source

) ( ): The My Health Records Amendment (Strengthening Privacy) Bill 2018 is a government bill and I'm going to speak in favour of it, unlike many of the members of the government who contributed to this debate earlier. I want to set out why I think legislation such as this and the underlying scheme are necessary. But before I do that I want to congratulate the member for Gellibrand. There was very little that he just went through that I could disagree with. It was a very learned contribution to a complex debate.

I've got to say that it takes a lot of talent, a very peculiar sort of talent, to turn public opinion against a proposition which saves money and saves lives, but here we are. A proposition which saves money and saves lives has been so monumentally mishandled that we have a wall of public opinion against it, and for that reason I want to set out in my contribution why I believe a personally controlled electronic health record, the My Health Record, is an important scheme that we need to get right.

Why's it necessary? Well, the practice of medicine and the way we interact with our general practitioners has changed a hell of a lot since I was a kid. The idea that you would have a GP for life, a doctor who would operate out of a suburban shopping centre or a suburban practice and who would operate on his or her own with maybe one other doctor operating out of the same rooms, supported ably by a medical receptionist, is the model of medical practice that I grew up with and that my parents grew up with. But it's not the model of medical practice for the vast majority of interactions with general practice today. No longer is it the practice that, if you have an ailment after hours, you call that family doctor, who you've known all your life, and he or she turns up with their brown bag and sits by the bed and consults with you.

What is more likely to happen today is that you have a practice that you visit regularly, with many, many doctors who work in that practice. It is more likely that each time you attend that practice you see a different doctor. In fact, the way that medical practices are run is very different these days as well. They're staffed sometimes by partners of a practice and sometimes by employees. Sometimes they are part-time employees and sometimes full-time employees. Sometimes the doctors have trained overseas, and sometimes they're locally trained. Sometimes, they're a locum. In fact, the further you get from a capital city, the more likely it is that you're going to have a doctor working in a practice who wasn't there the year before. And, if you go to regional Queensland, the overwhelming majority of doctors who are staffing practices are overseas-trained doctors on short-term contracts. So the way we practise medicine is very, very different.

Gone are the days when one-third of the floor space of a medical practice was taken up by manila folders stacked in filing cabinets. More likely is the case that, when you visit a practice, your doctor keeps an electronic record and is not pulling a manila folder out of the compactus. It is also more likely that you'll visit many, many different practices, certainly over the course of your lifetime but often over the course of a couple of years. If you're living in rental accommodation and moving from one suburb to another, it is more likely that you are going to visit the practice which is closest to where you live at that point in time or perhaps closest to where you work. All of this builds up to a picture that shows that your medical records are going to be scattered, if not across a town then perhaps across a state and even, in many instances, across a country. This is not a good way for us to be managing somebody's health care, particularly if they have a chronic health condition or if they are a parent who is attempting to ensure that their child has continuity of care, that their vaccinations up to date, and that all of their records and the child's health care are in order.

It's also worth noting that a model with a transferrable electronic health record that is able to be accessed by a medical practitioner that you are seeing wherever you are at a particular point in time is going to save money. Putting this into perspective, the Medicare budget is tipping over $20 billion per annum. The Pharmaceutical Benefits Scheme budget is tipping over $11 billion per annum. We know that, if we're able to have a transferrable electronic file that can be accessed by a medical practitioner who is treating a patient at a point in time wherever they are, not only are you likely to be saving lives by ensuring that you have access to their historical medical record but also we're going to be saving money because the same pharmaceuticals that might have been prescribed by another doctor are being represcribed, and, in relation to medical imaging, which is an enormously expensive part of the health budget, it will be more likely that we are not reordering the same medical imaging, such as X-rays, CT scans and ultrasounds, that may have been ordered and could have been accessed by another medical practitioner. Pathology—again, a ballooning cost in the health budget—will be able to be accessed if it is a part of your electronic health record. This builds up to a picture that shows that a well-constructed, well-controlled, portable, personally controlled electronic health record can save lives and can save money.

That is not to lightly dismiss many of the concerns that were raised by the member for Canberra earlier this morning or the member for Gellibrand in the speech preceding mine. There are valid concerns. I've been contacted by single mums who are victims of domestic violence and who, quite rightly, make the point that they don't want to endanger their lives or their children's lives by their medical record being a back door to finding out where they may now be residing. These issues do need to be dealt with, and that's why Labor welcomes the amendments in this bill which would put more rigour into the requirements about who can lawfully access your personal eHealth record. We welcome the requirements in this bill that would mean that a law enforcement agency or any other government agency would need to get a court order to access an electronic health record. We also welcome the fact that under this bill—something that wasn't thought out properly before the government changed its policy settings on this—a person who opts out has their My Health Record permanently deleted, not able to be accessed. These are sensible changes to the legislation—sensible new arrangements.

But I'm keen to ensure that as we debate these amendments—and we rightly criticise the health minister and the government for mucking them up; we should criticise the health minister and the government for mucking this up—we don't throw out the baby with the bathwater. We should be having a debate about how we implement such a scheme. As the member for Gellibrand pointed out, a lot of the issues that we are grappling with, about access to personal data, are not unique to the health space. There are issues that we are confronting across all areas of our life. We should be having a debate about who can legally access our records. We should be having a precursor debate about who owns the record and what rights the owner of that record has, who they can exclude and who they can include in having access to that data. We should be having debates about how we can adequately protect the legitimate privacy concerns of citizens who have their data stored in a government owned and operated database.

But we should be having some perspective in that debate. I will give a few examples of areas where I call for some perspective. I'm wearing an Apple Watch. About half a million of them were sold in the past 12 months. They are consistently and persistently collecting health data—when I'm sleeping, when I'm awake, how much I'm moving, where I'm moving, heart rate data and all the rest of it. It is constantly being uploaded through the app to which this watch is connected. I'm reliably informed—in fact, there are papers available about the use to which that data is being put—that this is a private database, not a government owned database and not a government controlled database. In fact, there are real questions about the capacity of domestic law to be regulating the way a bunch of that data is being used in other jurisdictions.

These are issues that we should be grappling with. But as the wearing and the use of smart watches and smart devices is increasingly collecting more and more data, including personal health data, from us, we need to put some of this stuff in perspective. Over 85 per cent of Medicare consultations in the past 12 months were bulk-billed consultations. Closer to 95 per cent of those consultations involved some form of government payment. All that information was collected and stored on a Medicare database. The difference is that the individual who owns that data does not have access to it. Let me put it another way: the individual to whom that data is referring does not have access to it.

These are real issues, worthy of debate, but we need to put them in perspective. We are, rightly, critical of the government for stuffing this up. Let us not throw the baby out with the bathwater, though. We need proper, rigorous controls and security regimes in place to protect the integrity of the data that is stored, just as we need these controls and protections in place for all the existing data that is stored through Pharmaceutical Benefits Scheme databases, Medicare databases, hospital databases, existing general practice databases and existing pharmacy databases. All this information is being stored currently, often without the knowledge of the individuals to whom it applies.

It's important that we are collecting this data. It's also, I would argue, important that we have better access to it for predictive and medical research purposes. The next big leap forward in life-saving medical technology is not going to be the invention of a new molecule, as important as our pharmaceutical industries are. The next big leap forward is going to be around data and how we use the data for predictive and research purposes to ensure that we can live longer and better lives and that known risks to our health and longevity can be predicted, brought to the attention of an individual and treated appropriately.

This is the next leap forward, so I am deeply concerned that, as we have this debate, we do not get off on the wrong foot. The underlying idea is a very good one—that individuals have a portable health record that they can take with them throughout the course of their lives, from one treating physician to another, and that that information can be appropriately stored and appropriately used. These are important debates, not germane to the health space—that's the one that's currently before the parliament at the moment. Many of us on the Labor side have been saying for quite some time—I see the member for Chifley here, and the member for Gellibrand has been mentioned in dispatches—that we need to have a broader debate about how we are storing and using data in this country across all of the touchpoints of government and private sector data collection—who owns it, who gets access to it, how it's stored, how it's protected and how it's used for the betterment of the individual to whom it applies and of the society as a whole.

My concern, I say in concluding, is that we do not let an acknowledged stuff-up by the government distract us from the course that is necessary, that we have these debates and that we land at a point where we can ensure that individuals, government and society as a whole can benefit from the next big revolution, which is unleashing data for our mutual benefit.

Ed Husic (Chifley, Australian Labor Party, Shadow Minister for the Digital Economy) Share this | Link to this | Hansard source

I'll start my speech on the My Health Records Amendment (Strengthening Privacy) Bill 2018 by reflecting on protection of data, and I'll get my phone back from the member from Whitlam. I want to take up from where the member for Whitlam left off, and that was where we are at this point in time. This year, I've remarked on other occasions, is a threshold year when it comes to the issue of tech and, in particular, the notion of data. I think that the public have become a lot more enlivened and a lot more aware about the huge amount of data that is being generated through the multitude of devices that they have, and people are now starting to think a lot more deeply: 'Okay, this data is being generated. How is it being used? Will it be used in a way that does not benefit me?' People hear a lot about the benefits of this data and how it will be applied, but they're now starting to recognise that there is another side to this coin and that this needs to be explored further.

This debate that we're having right now comes at a time when the broader environment is seeing the gloss of tech start to wear. I speak as someone who recognises the value of the application of technology to do a lot better in terms of economic growth and generation of new jobs and to help people live better lives. But, with everything, we should have a clear-eyed assessment. As much as there's benefit, we should also be mindful of the things that we don't necessarily think are working in favour of the public. I think this is the year when, more and more, people will expect greater respect for data by both business and government. People will think about the data that's being generated in anyone's home at any one time. You'll probably have close to 20 different items connected through your wi-fi network at your home that are all pumping out data. The data is all going somewhere. Someone's got access to it. How is it being used? The someone is both business and government. It requires recognition by government of a higher level of sensitivity about how data is being used and how it's being protected.

I open my contribution today with that because context in this debate is important. It's why the public reaction to where we're at with the My Health Record initiative overtook this government and well and truly put it on the back foot. It has not appreciated the growing concern that exists in the minds of the public about how the data is being used by both business and government, and it failed to bring the public along. I might, at this point, make a reflection on the sweat-laden contribution of the member for Goldstein last night. He had spoken out against the government's management of My Health Record. Then, in the bizarre contribution that he made last night, he started by saying: 'I'm not going to be popular with the comments that I'm making tonight. I don't think My Health Record should exist, but it's all the Labor Party's fault'. He tried, in one manoeuvre—I wouldn't say deft; it was daft—to sheet home the problems that existed with this system. It typifies the operating approach of the government, particularly with respect to My Health Record.

The government made a number of fundamental errors in the implementation of My Health Record. They ignored it for ages. They thought that they could buy off a number of stakeholders to go out and promote on their behalf. They didn't do the grunt work of putting the framework in place to ensure the smooth implementation of this. Fatally, they roped the whole public in. They required people to opt out. It would be assumed they would be in rather than out. They thought that would work a treat. Well, how phenomenally wrong could you be? The problem with this government, particularly in terms of digital projects, is that they're there for the announcement but they're never there for the delivery and they're certainly never there to explain when things go wrong. A number of people have highlighted instances where the government has stuffed up the delivery of digital projects, including this one that has brought us to the chamber to discuss right now.

When it comes to digital projects, it's worth noting that we have had over a dozen different derailments through the course of this term of parliament. In one term of parliament we've had close to 15 different projects that have gone off the rails. We had, for example, as has been cited, the failure to smoothly implement the 2016 online census. We've had repeated crashes of the ATO website. We've had the delayed revamp of the Child Support Agency website and then other problems associated with the maintenance of that platform. They halted the start of the online NAPLAN testing. They guillotined the gov.au redesign proposal—wasted nearly a million dollars on that project. They shut down their Digital Transformation Office and then reopened it under another name. They waved goodbye to two CEOs, one for the DTO and one for the DTA. They scored the business thumbs down for the overhyped Digital Marketplace. They saw the arrest of IT contractors in the Department of Human Services for suspected fraud. They've notched up a record $10 billion spend on government IT—to give you context, that's almost as much as we spend on Newstart in this country. You can't forget robo-debt—there's another one. They dumped the apprentice IT platform. They suspended the ACIC biometric project. And then we come to My Health Record, where they tried to sneak everyone in the public onto this platform and make them opt out, rather than do the hard work of building confidence in the My Health Record system and getting people to opt in to the system. There are serious concerns about the management of this, and, given the litany of failures of this government on digital projects, you can understand that the public has been conditioned to expect less, not more, from government digital transformation, given the way that it has been managed by this government.

The government needs to invest more time in building confidence in this system and answering simple questions. For example, as was pointed out through the contribution of the member for Gellibrand, a number of people can access this system at different points in the system. How do you know how that access has manifested itself? For example, the My Health Records portal is a web based portal, from what I'm led to believe; if someone accesses the system and screenshoots or print-screen dumps data that's on that screen, how do you know that has even occurred? I'd be interested in whether the minister will be letting the public know whether they have mechanisms within their platform to detect that kind of activity.

These kinds of threshold questions are important to answer to build confidence. I said this a few moments ago: you need to be able to build confidence that the My Health Record system will respect the data that is used. The government say, 'In this bill we will ensure that, if someone opts out of the My Health Record system, their data will be permanently deleted.' How? And how do you test whether or not that has actually occurred? You could do it in word, but would it happen in deed? The government need to build more confidence in the system so they are able to prove that these things have occurred. Now the government may say, 'This is an onerous test to place on the system,' but, sorry, that's where we've got to. The government need to recognise that, in the minds of the public, the expectation has been raised about how data is being used. This will be a lot more important in the years to come, and they've got to be able to say, 'We've given you an assurance that this has been done. This will happen.'

The government make a big deal about the fact that they are being transparent and open, when experience suggests otherwise. They have been unable to deliver digital services that the public rates highly. For instance, even if you look at updating their own performance dashboards for various government services, you will find that they all lag in terms of being updated or that the user satisfaction with the actual sites themselves is low. The Australian Taxation Office's community website has got a user satisfaction rate of under a half. Community digital take-up for the Taxation Office is only 16 per cent, which is down 18 per cent. User satisfaction for the Human Services website has only just managed a pass mark. So people will also have concerns with the way that the systems are being used by the public and the way that the data is being collected, retained and protected. These are the types of things that the government have to be a lot more mindful about.

There were a number of points that the shadow minister for health, the member for Ballarat, raised in her contribution to this debate that are worthy of repeating and that we need to reinforce. The requirement for informed consent, which I've already touched upon, to build a strong relationship of trust is absolutely critical. We need to be able to see that occur. We need to be able to have much better communication with the public. As I said, there has been no letter on the national shift to the opt-out system and the importance of My Health Record. The government needs to invest time and effort to make sure that happens. The level of assurance needed to ensure that people's concerns about, for instance, how data will be used needs to be increased as well.

As the shadow minister pointed out, concern exists that My Health Record data accessed through pre-employment medical checks or workers compensation assessments could be passed to employers and used to discriminate against workers with pre-existing medical conditions. This is a genuine concern.

The member for Whitlam mentioned the fact that in the case of data that is generated through wearables that are connected through to the internet—the concern already exists in the United States about things like the Apple Watch, Fitbit or whatever—health insurers may try to demand access to that data as a condition of getting a better health insurance policy. We need to have those types of assurances that data that's generated through the My Health Record system isn't being used in a way that works against individual citizens. That type of thing needs to be stressed a lot more.

As the Australian Healthcare & Hospitals Association has told the Senate inquiry into this legislation, even changes to more thoroughly lockout insurers may not be enough. They've argued that consumer protections should be put in place to prevent third parties from discriminating against individuals who don't agree to the release of their My Health Record data. They've raised the prospect of businesses refusing to sell a product or service, or charging more, unless the individual provides access to their data. Exactly the type of debate that has been held in the United States over the interrelationship of wearables, generation of data and its application in different forms is being visited here on our soil, particularly in the context of this debate, and that does need to be addressed.

Again, these are not small things. They do require effort. They require a lot more time than what the government has said. I think the government needs to do a bigger job in terms of building public confidence in the system, particularly around the protection of data, recognising that people are much more alive to cybersecurity risks than ever before and, when the data is in the system, how it's being used by those who are supposedly allowed to access the data and how it might be used down the track in ways that people hadn't contemplated initially. It certainly needs way more time than the one month opt-out extension that we've seen by the government to date. This should be extended way further than what we are currently seeing. If the government fails to do that, then it comes to the very point I raised at the start of this, that they are not investing the time or care to ensure public confidence in this system.

Milton Dick (Oxley, Australian Labor Party) Share this | Link to this | Hansard source

Following on from my colleague and friend the member for Chifley, who stole my thunder about the top 15—I was only going to do the top three IT bungles, so he's really filled the breach on exactly where this government sits—I will be really blunt about this issue. I think it is important that we put these concerns on the record, because 25 million Australians are relying on this parliament, and in particular this government, to get a pretty serious matter correct. While the wheels might be falling off this government more and more each day, really and truly we've got another policy patchwork quilt that is, in my opinion, falling to pieces. You only need to look at the speakers list today to see the concerns that Labor are raising on behalf of our constituents and the broader community. It is pretty damning when the government won't even get up and defend their position. They have zero speakers, which is pretty normal.

Whilst we support e-health and the concept of the My Health Record, I believe the government has overseen another appalling rollout, which has now seen almost one million Australians decide to opt out and, let's face it, we've barely even begun. This is a long list of stuff-ups that the government is trying to be proud of, but we know that e-health could deliver tangible healthcare improvements and save healthcare costs through fewer diagnosis, treatment and prescription errors if it weren't for this error-riddled government.

On this side of the House, we began delivering an electronic health record system when we were last in office. Our system was opt-in, and we thought that was the right approach, so that anyone who participated had to give informed consent. But the government, as we know, time and time again thought that they knew better. They thought they knew better than health professionals, the AMA and now the almost one million Australians who have decided they don't want to risk their personal data when they know that this government simply cannot be trusted with it. It was only under Labor questioning in a Senate committee last night that the Australian Digital Health Agency finally admitted that 900,000 people have now opted out. That is the first update provided since 20,000 people opted out on day one. With two months to go in the opt-out period, that number is likely to rise to well over one million people. But the truth is we are already likely over the one million mark of people who have withdrawn, with the head of the ADHA saying that the estimate was 'not comprehensive' and reflected only opt-outs via the website or call centre, as paper forms have not been reconciled.

The mass exodus is because Australians simply do not trust this government. They know their track record when it comes to things, as we heard from the member for Chifley, like the census and robo-debt calls and do not want to be caught up in the drama or, as I call it, the hunger games of the Abbott-Turnbull-Morrison government. The government has completely botched the rollout of the opt-out period, undermining public trust in this important reform. Examples of this include that, under the original plan by the government, even if a patient asked for their health record to be deleted, some basic information would have been kept for up to 130 years—just extraordinary. Included in Australians who have opted out of the new system is the government's own member for Goldstein, who said that:

… instinctive position should always be as a Liberal that systems should be opt-in and people should be able to freely choose to opt into a system …

Not even the government's own members have faith in their system. What a complete and utter shambles. How can any Australian trust this government will keep their personal data safe and secure when their own MPs won't even sign up for it?

It is because of members of the government, who, like millions of Australians, are choosing not to place their personal data in the care of this government, that Labor, quite rightly, referred the My Health Record to a legislative inquiry in the Senate. The inquiry is hearing evidence from stakeholders across the board and will test whether this bill adequately responds to privacy and security concerns and develop possible amendments. This includes hearing from the Digital Transformation Office CEO Paul Shetler, who said:

… current access controls for the service are 'shocking', making sensitive medical data vulnerable.

He said:

In its current form I believe that the program will fail. Government should first pause and acknowledge what they are hearing from the public.

…   …   …

Even with the settings they've set up so far, people still can have wide-ranging access to data without having to hack it. It's just not set up in a secure way. The way the phrases are constructed, it's fairly broad who actually has access to this data …

It is the most intimate data about a person as possible. There is a problem there, and it has to be taken seriously. It's shocking how bad the access control is on it. It's a very real concern.

These are the experts in the field talking about exactly what the government is planning to do.

The bill responds to public anger over the scheme by making some changes that Labor welcome, including requiring law enforcement and other government agencies to get a court order to access records and permanently deleting the health information of people who opt out of the My Health Record. But we don't believe that these changes go far enough and so will do little to allay community fears about privacy and security. Workers have raised concerns that doctors who perform pre-employment or workers' compensation assessments may pass health information on to employers and that employers could use this information to discriminate against employees—for example, on the basis of pre-existing medical conditions.

Also, this bill does absolutely nothing to address the concerns the My Health Record may risk the safety of women fleeing abusive partners or children needing privacy from non-custodial parents. As reported in the media earlier this year, this includes a loophole in the system allowing a parent who does not have primary custody to create a My Health Record on their child's behalf without the consent or knowledge of their former partner. An abusive ex-partner can thereby gain access to details including the location of medical practitioners and pharmacies attended by the child with their primary caregiver, potentially narrowing down the locations of victims in hiding. An abusive ex-partner can thereby gain access to details where they may not have previously known that information.

Any Australian in such a position may contact the Australian Digital Health Agency and request that their child's personal identification number, which is linked to their Medicare account, be suspended immediately. The agency will then assess any requests by the respective parents to register as a person authorised to act on behalf of the child. If approved, this will give either parent the power to create, access and monitor the child's My Health Record with or without the parents' consent.

I want to read into the record comments by Angela Lynch, the chief executive officer of Women's Legal Service Queensland. I want to commend Women's Legal Service Queensland for the outstanding advocacy that they provide. I've had a little bit to do with them, particularly in their strong campaign against the Abbott-Turnbull-Morrison government and their savage attacks on community legal centres. Ms Lynch warned that:

… any refusal of access by the Digital Health Agency could be contested in the Family Court, including by an abusive former partner.

In reviewing the submission to the Senate inquiry by Women's Legal Service Queensland, they stated that the failure by the government to consult with women's agencies was particularly concerning—not surprisingly, when you see the record of how this government treats women in its own ranks—and that this has caused confusion, anxiety and angst in the community as domestic violence victims are concerned what the rollout will mean for them and their children's safety. However, even more disturbingly, I read that the service holds concerns that the current approach may create situations where a woman may be fleeing a domestic violence situation and they may be forced to decide between either taking their child to a health professional and potentially identifying their location to the perpetrator or not necessarily seeking treatment. Put simply, they state that the My Health Record system, as it stands, places women and children who are fleeing violence at risk of serious injury and death.

This is not something where the government can simply say, 'Well, this is scaremongering'—or their normal method of operation, which is to somehow blame Labor in their warped, twisted alternative universe. These are real concerns by health professionals and also legal practitioners who are worried about the implementation and implications regarding the government's rollout. That's why today I join with my Labor colleagues and again call on the government to suspend the opt-out phase of the My Health Record rollout until privacy and security concerns such as the ones I have addressed today in the parliament are dealt with. When community organisations such as Women's Legal Service are repeatedly saying that lives are at risk, we cannot continually, blindly, as the health minister seems to be doing, simply say 'business as usual'. We must stop and reflect to investigate whether there is a better way. Despite these revelations and despite this updated piece of legislation, it is under the control of a health minister who said, as recently as last month, that he maintained, 'There were no real problems with the first incarnation of My Health Record' but said that he was happy to provide additional reassurances on privacy to doctors and patients.

Well, I'm not too sure who the health minister is speaking to—well, we know he's not speaking to his colleagues, because they don't support him either, when he runs for the leadership position. Maybe he's a little bit too busy trying to destroy the government that he is a part of, instead of listening to the one million Australians who beg to differ with the health minister. That's one million Australians who are very concerned that, when it comes to this government and their personal data, it cannot be trusted. As you can see, these are very serious issues in the hands of a government with a woeful track record on IT security and privacy.

As I indicated and as Labor speakers have said, the government's record on the rollout of IT is nothing short of scandalous. Time and time again, we've seen bungle after bungle. I had a situation in my own electorate last week, where 130 childcare educators, working through a wonderful organisation, simply were in danger of not getting paid for up to five weeks because the government has botched its new childcare IT system. Now, it might not mean a lot to members opposite when a couple of people miss a pay cycle or two. For those on the other side, let me tell you: it means a lot to front-line workers. It is because of this government's bungling of IT systems and this system in particular. We've seen a failed rollout of the NBN and the NDIS. They gave us the census fail and the robo-debt debacle. Quite frankly, they have now stuffed up My Health Record.

We must get this system right. Rather than pushing through legislation and patching it up as they go, quite frankly the government should suspend the opt-out period until these and other issues can be addressed. If the minister, his office or his advisers are listening to this, and if you don't take my word for it, listen to the one million Australians who are concerned and are voting with their feet. Talk to your constituents who are raising concerns. I have no doubt members of the government are getting the same sorts of phone calls, emails and stress out there in community from health professionals and from people in the legal profession. It is time that the government stopped fighting amongst themselves; stopped trying to grief, bully and undermine each other; and actually started doing their job in this parliament, which is to listen to the community and start delivering what the community needs and, more importantly, what the community needs to keep them safe and protected. Australia's sensitive health data is of the utmost of importance. I call on members of the government to support the amendments that we have moved in this place to get it right.

Matt Thistlethwaite (Kingsford Smith, Australian Labor Party, Shadow Assistant Minister for Treasury) Share this | Link to this | Hansard source

I'm speaking in support of the amendments that have been moved by the shadow minister, the member for Ballarat, on the My Health Records Amendment (Strengthening Privacy) Bill 2018. This shouldn't be a controversial issue. The principle behind My Health Record is a sound one, and it is something that should benefit most Australians. If I'm involved in a serious car accident and I'm wheeled into a hospital unconscious, then I want those doctors and nurses who are treating me to be able to access as much information as possible about myself so that they can provide appropriate treatment and care. That is something that could be provided through a system such as My Health Record and having that data available electronically for easy access to ensure the most appropriate and best care for a patient. But, like many things that have been rolled out by this government in the IT space, it appears that they have bungled this rollout. You only have to look to the National Broadband Network, the NDIS, the census fail and the robo-debt debacle. It now appears they may have stuffed up the My Health Record rollout.

It is estimated that $1.2 billion has already been spent on this program and it appears that there are some serious issues. Australians do deserve better and to know that the system is working in their favour, rather than having millions of people looking at opting out of the system to ensure that they feel that they get the privacy that they deserve. The stakes are high when it comes to issues such as medical health records, and they can be the target of cybercriminals. In the United States, Verizon's Data breach investigations report states:

Healthcare is the only industry where the threat from inside is greater than that from outside. Human error is a major contributor to those stats.

But we should be able to produce a system that provides clinicians, medical practitioners and patients with access to the electronic information that is vitally important to ensure appropriate care, to ensure that the best interests of the patients are being catered for and, importantly, to ensure that the system works effectively, efficiently and, ultimately, gets value for money for taxpayers.

We should also be able to ensure that people's privacy is protected, that all Australians have confidence that the data relating to their health in the system will not be used or accessed by other organisations for purposes ulterior to those for which the information was intended. I'm speaking of insurance companies, law enforcement agencies and other agencies trying to access this data when most Australians want to ensure that their doctors and other health professionals can access that information—that's it—and that a person can't be discriminated against in an insurance policy or the outcome of an employment application because some other body has been able to access the health records of Australians through a system such as My Health Record. That's not what we want from a system such as this, and we should be able to deliver an outcome that provides access to medical staff but protects the Australian people from other access.

A Senate inquiry into this bill has been established that will no doubt look at these issues of privacy and access and for which purposes the information can be used by organisations external to the process. This bill seeks to deal with some of the issues and challenges raised in the rollout of My Health Record. Labor supports those elements but believes it should go further. Firstly the bill amends the act to require a court order or a consumer's express consent in order to disclose health information from their My Health Record to law enforcement agencies or other government bodies. The government argues that this is already the policy of the Australian Digital Health Agency and that no material has ever been released by law enforcement agencies, but this amendment will enshrine that into law, and that's something we and all Australians support. I argue that it should go further and apply to other external organisations like insurance companies seeking to access this information in respect of a particular member who may have a policy with them.

Secondly the bill amends the act to require the permanent deletion of health information for all consumers who opt out of My Health Record. The act currently requires the information held in the record to be locked down but retained until 30 years after the consumer's death. Labor believes this is another positive amendment and will support it. I've had a number of calls and emails to my office from constituents who are concerned about the notion that their records would be maintained after they've opted out of the system. Most people would expect that once you've opted out, that's it; you've opted out and those electronic records can no longer being accessed. If we're saying that's the intent of the scheme then that is what should apply. This amendment will hopefully do that.

Two further issues have been recognised and need to be looked at. Workers' representatives have raised concerns that doctors who perform pre-employment or workers' compensation assessments on behalf of employees could have access to employees' My Health Records and that information disclosed to employers could be used to discriminate against employees, for example, on the basis of pre-existing medical conditions. This is the issue I spoke of earlier with insurance companies. Advocates are also concerned that inappropriate access to My Health Record could facilitate family violence. For example, ex-partners or non-custodial parents could conceivably use the record to track the location and treatment of vulnerable people. So these are two further issues that we believe need to be looked at, and it doesn't go far enough. Once again the government has bungled this. It shouldn't be an issue that is controversial. We should be able to provide privacy for Australian citizens and still have their health records online.

Kevin Hogan (Page, National Party) Share this | Link to this | Hansard source

The debate is interrupted in accordance with standing order 43. The debate may be resumed at a later hour.