Helen Polley (Tasmania, Australian Labor Party, Shadow Assistant Minister to the Leader (Tasmania)) Share this | Hansard source

When the My Health Record controversy erupted four months ago, the government's first instinct was to bury its head in the sand and pretend there was no problem. It dismissed not just Labor's concerns but the concerns of senior respected medicos of the major medical groups, of domestic violence groups, of privacy, security and legal experts and of the union movement. It also dismissed the concerns of ordinary Australians worried about the security of their most sensitive personal information. Everything was fine, the government insisted: 'Nothing to see here. It's all a media beat-up'. After a couple of weeks of intense political and public pressure, Minister Hunt was dragged kicking and screaming into proposing two amendments to the scheme. Those amendments, requiring law enforcement agencies to get a warrant to access records and enabling the permanent deletion of records, were welcome ones, but they were also woefully inadequate as a response, addressing only a fraction of the privacy and security concerns that have been raised by concerned stakeholders. So Labor called for a comprehensive Senate inquiry to examine the system as a whole, to identify problems and to come up with solutions. The minister's response? He dismissed it as a stunt.

But it's lucky we did initiate that inquiry, because it exposed a whole range of further problems with this scheme that must now be fixed, and that's why one month ago Labor proposed six substantive amendments to the government's woefully inadequate original bill. Labor's blueprint included tougher penalties for breaches of the act, changes to address concerns around domestic violence and employer access, and better safeguards to prevent the privatisation and commercialisation of the system, including through banning private health insurer access. The government at first refused to engage with us on these changes. Then, with just a week to go until the end of the opt-out period, the government suddenly realised we were right all along, and they've now scrambled to implement all of our fixes. That's something we, of course, welcome, but I will flag we now have one further amendment, which I will be detailing in a moment.

But I want to be clear at the outset that Labor still supports the concept of a national digital health record scheme. That's why we established the personally controlled electronic health record under the leadership of the member for Sydney when last we were in government. We did it because we knew that the personally controlled electronic health record could deliver tangible benefits to clinicians and patients alike. It could improve coordination between GPs, specialists and hospitals and cut down on duplication and errors in diagnosis, prescriptions and treatments. And it could save our health system billions of dollars. It is an important 21st-century healthcare reform, and we continue to believe that My Health Record could save money and lives if implemented by a competent government.

Sadly, it's painfully clear that this is not a competent government, especially when it comes to digital service delivery. This is the government that gave us the census failure and robo-debt debacle, after all. In the health portfolio, this is the government that saw Medicare and the PBS data leaked and spent millions outsourcing the National Cancer Screening Register to Telstra in a contract that, several years later, still hasn't delivered a functioning system. And now we can add the implementation of My Health Record to that sad and sorry list. When the opt-out period for My Health Record began four months ago, it became clear that the government had bungled this vital program in two key ways. First, the government failed to communicate with Australians about the risks and benefits of My Health Record and what the opt-out system means in practice.

The opt-out model is a huge change from Labor's opt-in system. Every Australian will need to get a My Health Record unless they tell the government they don't want one. That means that, on the government's current timetable, about 17 million records will be created in the next few months. This moves the system from one of informed consent, a model that is fundamentally principled on the way that health professionals work together with those in their care. Informed consent is based on a very strong relationship of trust and is imbedded across the entire healthcare system. The government, in 2015, took the decision to move to a presumed consent model and provide a period in which people could choose to opt out of the system altogether. It is a significant change in the healthcare relationship.

For a reform like this to work, you have to bring people with you, but the government failed to bring both healthcare professionals and the Australian public along with these changes. There was no public information campaign designed to reach every Australian. It was almost as though the government didn't want people to know what was happening. The Digital Health Agency gave some money to Primary Health Networks to promote the reform. There have been rudimentary brochures printed and some stakeholder groups were given money to communicate with their members, but that was it.

In the opt-out trial sites, the government sent a letter to every person who would be registered for a My Health Record, informing them of the reform—what was happening, what their rights were and what they might need to do about it. That's a common and effective way for governments to communicate policy changes like this, but the government refused to send the same letter as part of the national rollout. It's only been in recent weeks, just before the opt-out period was due to end, that the government started rolling out a proper advertising campaign and it was only as a result of Labor's calls for just such a campaign. It's hard to believe. Again, the government had to be dragged kicking and screaming into doing the right thing.

The government's second mistake was equally damning. Put simply, it's trying to implement an opt-out scheme on an opt-in foundation. Other than minor changes in 2015, the legislation and policies that underpin My Health Record were designed for the opt-in personally controlled electronic health record. In that system, the government could assume informed consent because every consumer with a record had actively chosen to have one. A number of My Health Record features made sense in that context. For example, default settings that keep a record relatively open make sense if someone has deliberately created that record; but, when every Australian gets a My Health Record, many of them without any real engagement, those settings are no longer appropriate.

Those two fundamental blunders led to weeks of controversy on the My Health Record and finally forced the minister to announce the first of its changes. In its original form, this bill made just two changes to the My Health Records Act. First, it amended the act to require a court order or a consumer's express consent in order to disclose health information from My Health Record to law enforcement agencies or other government bodies. Even groups that are generally supportive of the My Health Record, like the Australian Medical Association and the Royal Australian College of GPs, had been alarmed by the government's previous insistence that a policy of the Digital Health Agency would suffice. The bill sets out a range of conditions under which a judicial officer may make a court order to disclose health information, including that the disclosure is reasonably necessary and that the requested information is not available from any other source. Second, the government's bill amended the act to require the permanent deletion of health information for all consumers who opt out of the My Health Record. The act currently requires the information that was held in the record to be locked down but retained until 30 years after the consumer's death. Again, that setting might have made sense when a consumer had previously opted in to the My Health Record and might want to rejoin the record in the future, but it makes no sense in an opt-out scheme.

Labor welcomed both of these changes, but it was clear to us, particularly after the Senate inquiry process, that those changes didn't go nearly far enough. That's why Labor flagged our intention to move six amendments to the bill. These amendments respond to a range of concerns raised by stakeholders during the inquiry—from clinicians, from the major health groups, from legal experts and from the unions. Lo and behold: a few weeks later the government announced that it would be amending its own legislation to match Labor's rescue plan. These changes will toughen penalties for breaches of the act, ensure that health insurers' employees can never access a person's My Health Record, strengthen the protections around the secondary use of identification data for research and public health purposes, address domestic violence concerns by ensuring that any parent with conditional access rights cannot be an authorised representative, explicitly prevent privatisation of the scheme, remove the ability of the scheme operator to delegate to an entity other than an APS employee of the Department of Health, and require that deletion of records also results in the deletion of copies, backups and previous versions of records.

These are all measures that Labor supports. Of course they are, because we came up with them. However, Labor still believes the government must delay the My Health Record rollout by extending the opt-out period. That brings me to Labor's new amendment, which will require the government to extend the opt-out period for a further 12 months, which is in line with a key recommendation of the recent Senate inquiry into the e-health system. We're seeking to make this sensible change because the Morrison government is refusing to do so itself. It is imperative that the rollout does not advance further until all privacy and security concerns are fully addressed.

While this legislation goes some way, there are lingering concerns. A 12-month extension will give the government time to commission and implement a Privacy Commissioner review to address outstanding concerns about system settings. If they don't do that, a Shorten Labor government will. The Senate inquiry found that the government's botched implementation of the opt-out model means that an unreasonable compromise has been struck between ensuring the utility of the system and safeguarding the privacy and safety of healthcare recipients. That's why we want a Privacy Commissioner review that would consider, among other things, the appropriate balance between utility for clinicians, patients and others, such as carers; privacy and security for individuals; the difficulty of ensuring informed consent in an opt-out model; measures to encourage consumer engagement and informed choice; changes to default access settings that are necessary because of the shift to an opt-out model from an opt-in model where informed consent was assured; and particular protections for vulnerable people, including minors aged 14 to 17 and families fleeing domestic violence. A 12-month extension will also give the government time to reach every Australian with its new public information campaign so that people can make a fully informed choice about whether they want to opt out of the scheme.

Under the government's current timetable, the opt-out period is due to finish this week. Once it does, the government will begin creating records for 17 million Australians whether they want one or not. This will occur even though the government hasn't actually passed this legislation yet. In fact, it cannot pass it before the opt-out period ends, meaning that some Australians may opt out unnecessarily over concerns that are addressed by the legislation. Assuming that the Senate agrees to this bill, with or without formal amendment, it will need to return to the lower house for approval. But the lower house doesn't sit again until the end of the month—10 days after the opt-out period ends—meaning that there's no guarantee that this legislation will even pass this year. And next year is an election year. As we know, an election could be called before parliament returns. The My Health Record rollout must not advance until the clean-up legislation has passed the parliament. As I said at the outset, Labor supports e-health, but we have to get this right. The government's bungling very nearly killed off this reform. Let's take the time now to fix this mess.