Shhh...it's a secret!

The implementation of #MyHealthRecord is causing some concern amongst medical, information technology, and privacy experts. You may have read about this online or heard it on the news already.

Or not. It seems like it’s a big secret….

I have opted out of MyHealthRecord already. This is based on my concerns over the system. Many other doctors have done the same based on informal polls online (see below). Perhaps these concerns will be addressed in the future and people will feel more confident to ‘opt in’ at a later stage.

Importantly, I fully support the decision of anyone to make their own decision

– whether to opt in or opt out of the MyHealthRecord.

Each person has to weigh up the pros and cons and make a decision that suits their circumstances best. I will support them in their personal decision regardless (although at this time the Clinic has chosen not to upload health summaries to MyHealthRecord nor integrate our clinical software with the system).

So what’s the deal?

Amongst medical professionals across Australia, there are heated discussions over the #MyHealthRecord. These often seem to be tangled up in weighing the advantages of utility (ability to access information that may not otherwise be available) vs. the problems of implementation (the concept of an ‘opt out’ system, the notion of standing consent, concerns re security and in particular problems of unintended secondary usage).

It is so important that folk take the time to learn about the MyHealthRecord, weigh the pros and cons and then make an informed decision for themselves.

However there is a time pressure to do this – the Government is running a three month ‘opt out’ period for MyHealthRecord….and the opt out period has already started!

– If you do not opt out within this period, you will have a MyHealthRecord automatically created for you. And once created, it cannot be undone (although content may be controlled if you are one of 0.1% of users who bother to lock down the security settings in the system).

– If you do opt out, you can always opt back in.

So why am I talking about this? Because as a doctor I take your health information seriously. The relationship between a doctor and patient is based on trust, on confidentiality. If we embark on a course of action, we are expected to advise you of the pros and cons (informed consent) and to re-visit this each time. Moreover we are bound to ‘first do no harm’ (primum non nocere).

This puts doctors in the frontline of the whole #MyHealthRecord debacle – especially the primary care workforce, as we are those most likely to be talking to patients about the system and are expected to upload a ‘shared health summary’ to the system. If we don’t talk to you about this, or if your health information is uploaded and you aren’t aware, or it is wrong, or it is accessed without your consent, then we will lose your confidence. We may face medicolegal action. More importantly, the trust placed in the profession will be lost.

Amazingly there are increasing reports of people going to ‘opt out’ and then discovering that a MyHealthRecord already exists! This causes massive distrust. Now it may be that the record was created in an earlier iteration of the system (the PCEHR)…or that the person gave their consent at some stage, not realising what this actually meant…or that an overzealous clinic has been uploading patient details in order to access funding! Who knows?

The opt out period for MyHealthRecord started on 16 July and runs to 15 October 2018

So this week I have been asking my patients and colleagues about the MyHealthRecord. After all, the opt out period has commenced and folk should be aware of the need to make a decision. The results have been surprising.

Of the 334 people I’ve asked about MyHealthRecord since 16 July (10 days into the ‘opt to period’):

– 163 had heard of the MyHealth Record, 171 had not!

– of the 163 who had heard of the MyHealthRecord, 76 had opted out already.

– 4 of the 163 had made an informed choice to have a MyHealthRecord for themselves or family.

– the remaining 83 expressed a wish to opt out of the MyHealthRecord.

This is where things get really murky. It seems that many folk do not know they have to actively do something to ‘opt out’ (58 out of 83).

Why does this matter?

MyHealthRecord is causing some questions to be asked in the medical profession. Having an ‘opt out’ system is almost unprecedented in our world. We generally require there to be a genuine ‘informed consent’ process and explain the risks as well as the benefits.

So what are the benefits? A joined up system of online health information is a worthy goal to aspire to. Suffice it to say there are concerns with the usability of the MyHealthRecord; it contains PDF documents not notes and is, at best, a summary of information – not the detailed and nuanced medical notes which most doctors use. There are also concerns that data which is uploaded in error could compromise care.

In terms of concern regarding the implementation, the obvious one is that a record is being created without people being aware it has happened. This seems to fly in the face of patient autonomy, beneficence and informed consent. Moreover, once consent is obtained for information to be uploaded, there is apparently ‘standing consent’ for further health summaries, letters and so on to be automatically uploaded – unless the patient specifically requests not. This is problematic for obvious reasons. Your consent for a ‘shared health summary’ to be uploaded now in 2018 may be used as consent to upload your recently disclosed history of substance abuse, of major depression, or increased cardiac risk at some stage in the future. A honeypot for insurers or employers.

It gets worse. Medical information is often sensitive. The default settings of the MyHealthRecord appear to be such that secondary usage is allowed under circumstances determined by the ‘System Operator’ (shorthand for the Australian Digital Health Authority). There are concerns that data may be shared for not just research purposes, but also with insurers and other agencies. Seemingly innocuous heath information (that consult over a relationship breakdown that was coded as ‘stress’, that script for azithromycin for a sexually-transmitted disease) may be ‘weaponised’ against you by overzealous insurers, employers and so on.

It is true that people can control the content of their record – deleting uploaded documents for example and setting up controls on who is able to access their notes, as well as setting notifications by email or SMS if their account is accessed. But you do need to be active in this. This favours some people over others. Obvious problems include

if a MyHealthRecord is created for you without your knowledge, then you will not be in control of the information within it. This is already the case for those Australians who were surprised to find a MHR had been created when they went to ‘opt out’,
the default settings on records are set to ‘open access’; you have to take control to beef up security and data from early versions of the MyHealthRecord indicate only 0.1% of people do this,
there are obvious disadvantages for the elderly, those from non-English speaking backgrounds, those who are not IT-savvy, those lacking health literacy, those who don’t have access to internet, those whose access is controlled via another family member (domestic violence) and so on,
whilst a notification may be made that your record has been accessed, this is typically tied to the level of the organisation, not the individual. This means you might get a notification that your record was accessed by Hospital X – but not tell you which of the 4000 employees actually read your record. Was it your doctor? The nurse looking after you? A bored ward clerk? Perhaps a disgruntled ex-lover? A future employer? Who knows!
the security settings can be overruled in certain circumstances,
some agencies have automatic access under legislation if deemed in the public interest (so you wont know),
health insurers are desperate for your data and may insist on it,
laws can change!

What are doctors doing?

We don’t know. It is certainly true that the Australian Digital Health Authority is trumpeting the support of organisations such as the Australian Medical Association, the RACGP, the Rural Health Alliance and so on. The Pharmacy Guild and other groups are very keen to have access to your health record.

We are not sure if these organisations, particularly the medical groups, have canvassed the opinion of their members. However many doctors organisations have (in the past) signed a ‘compact’ with the government in order to gain concessions (undoing the Medicare freeze is an obvious example).

Most clinicians (and I am one) support the notion of a national eHealth system and the project has been in the pipeline for over 6 years (it was formerly known as the Patient Controlled Electronic Health Record). At this stage it was an ‘opt in’ system which of course relies upon patients making a decision themselves regarding their health information, not having one created for them regardless!

I honestly think that the change to an ‘opt out’ system has caught many of us unaware. We are just beginning to wake up to the ethical dilemmas posed by a mandatory ‘opt out’ system, the unheard of ‘standing consent’ and the concerns re unintended secondary use. And organisations may now be ‘gagged’ by the compact with government made in good faith. Uh-oh!

Our hope of usability is being wrecked by poor implementation.

We do talk about this sort of thing amongst ourselves as clinicians. I am part of a group of about 5000 GPs online in the closed ‘GPs Down Under’ Facebook group. In under 24 hrs an informal poll asking ‘as a doctor, are you opting in or out’ gave the following results so far:

– 225 opting out
– 26 opting in
– 9 undecided

Of course such polls are subject to various bias (those with strong opinions more likely to vote, number of responders may not be representative etc). But in the absence of other surveys these sort of polls pop up on various online fora or medical media pages and all seem to show roughly same results – doctor opt out rates from as high as 10:1 opt out/in, to as low as 3:1 opt out/in.

That is still a lot more doctors choosing to opt out than in. You may draw your own conclusions!

So why havent I heard about this?

People seem to be surprised that there is so little information out there on the ‘opt out’ process. It doesn’t appear to have been widely publicised on TV, radio nor media. As far as I am aware the clinic has not (yet) received paperwork to either advise patients on the whole opt out period, nor any forms to help them do this.

I did manage to track down some ‘opt out’ forms at the local Post Office and imagine these will be duplicated across Penneshaw-Parndana-American River and Kingscote Post offices on the Island. I will see if I can get some for the clinic. It may be easier to just ring Medicare on 1800 723 471 and confirm that you (a) don’t already have a MyHealthRecord and (b) opt out.

In the meanwhile, we are almost two weeks into the 2 week ‘opt out period’ and I’d encourage people to read about this issue, talk to family and friends – or even ask their doctor.

Then make a informed decision as to whether to do nothing (and have a MyHealthRecord created automatically for you by the Government) or take the active decision to opt out before 15 October 2018

Again – if you do nothing a MyHealthRecord will be created for you and you will not be able to opt out in the future. The record will remain for 30 years after your death (or 130 years from your enrolment date if date of death is unknown). You will need to take active control of the record and adjust security settings to determine who has access to your data.

If you do not want this, you have until 15 October to opt out.

You can do this online via MyGov or ring 1800 723 471 to opt out.

Or you can click the link https://www.myhealthrecord.gov.au/for-you-your-family/opt-out-my-health-record

2 thoughts on “Shhh…it’s a secret!”

Leave a Comment Cancel Reply