In May 2018 the Commonwealth Government released the Framework to guide the secondary use of My Health Record system data. My Health Record data will be released with the approval of a Data Governance Board following an application for access to the data. Any application can be made by any Australian organisation except for an insurance agency.
Secondary use of My Health Record data will not be permitted for:
- Solely commercial use which includes direct marketing or assessment of insurance premiums and/or claims;
- Non-health related use which includes eligibility for social security benefits or national security; or
- Remuneration or audit of individual clinicians, or determination of funds allocation for a health service.
Instead, secondary use of My Health Record data that will be permitted includes to:
- Identify service gaps to develop new health services;
- Develop government health policy;
- Recruitment for clinical trials;
- Research relevant to public health; and
- Construction of clinical registries.
It is acknowledged that secondary use of data may have a beneficial impact in these areas however caution is necessary with using the My Health Record data for the following reasons:
- The My Health Record is not a complete medical record for any individual patient in Australia meaning an individual data set is not complete.
- Individuals can opt out of the My Health Record or can limit access to documents in the My Health Record meaning the national data set of accessible data is not complete.
- Individuals can opt out of secondary use of My Health Record data even if they opt in to the My Health Record meaning the national data set is not complete.
An individual who has registered for a My Health Record will not have to provide specific consent for the secondary use of their My Health Record data. Instead, if an individual is not prepared to have data used in such a way, the individual must actively opt out by using the consumer access controls in the My Health Record. The reality is that individuals are likely to have little understanding of this process or that their data can be released for secondary use. Once they do, there are likely to be concerns around privacy and proper de-identification of data by Government agencies particularly having regard to the fact that on 21 March 2018 the Commonwealth Department of Health needed to make an enforceable undertaking to the Australian Information Commissioner relating to the release of de-identified data sets in 2016 that were able to be converted back to identifiable information by academics from the University of Melbourne.
It is therefore important that the Data Custodian treads with extreme caution with access to the secondary use of My Health Record data.
The My Health Record data will not be available until, at the earliest, 2020.
This article was written by Karen Keogh, Partner.