default logo

Victoria’s New Non-Consent Health Data Sharing Program

There are “serious concerns” on the Victorian government’s ‘unprecedented plan’ to establish a centralized health data sharing system that would store information such as prescribed medications and hospitalizations, with no ability for individuals to opt out.

The state government plans to improve information sharing between health services through the creation of a new digital database and the unintentional collection of individual health data, in order to combat the system of patient health information currently fragmented.

But the program has been criticized by figures such as the Australian Privacy Foundation, Liberty Victoria and the Australian Doctors Federation for its lack of required consent, the potential for the database to become a “honeypot” for hackers. computers, and that it could endanger the doctor-patient. confidentiality.

The Victorian May budget included a commitment to reform and consolidate the state’s public pathology services, including improving laboratory information systems. This would include creating a health information exchange that would be hosted and supported by the state health department – a centrally hosted solution in the cloud environment that is “highly available, scalable. and reliable ”.

The Victorian government issued a tender notice for this work seeking a private sector off-the-shelf solution, which closed on December 20.

The legislation behind the new data sharing system has already been passed by the lower house and is expected to be debated in the Legislative Council before the end of the year. The bill formalizes the link between medical and patient health information in a single portal, which can be accessed by authorized users such as physicians or other clinicians.

The information collected in the database will span five years into an individual’s health records.

If passed by the state parliament, the program will come into effect in February 2023 to allow time for the solution to be developed. It will include public hospitals and health services, metropolitan hospitals, ambulance services and forensic mental health units.

Information to be shared in the database and with authorized users includes prescribed medications, allergies, admissions, discharge summaries, and other alerts.

Unlike the very controversial federal program My Health Record, Victorians will have no option to opt out of this medical health sharing program.

The legislation also includes two new criminal offenses to deal with potential unauthorized access to system data and to access it for unauthorized purposes, punishable by up to two years in prison.

“Having complete and accurate health information at the right time and in the right place will save lives and is essential to provide the best patient care,” Labor MP Shaun Leane told Parliament.

“We recognize that a consolidated picture of a patient’s medical and health history is essential to the provision of safe, high-quality care in our public hospitals. In Victoria, essential health information is currently divided between different health services, in separate systems and in paper files. This fragmentation of patient health information often means that clinicians collect patient health information manually, by fax or phone calls.

The state government has argued that the new database will be more secure than the current system using faxes and phone calls.

But the Australian Privacy Foundation has serious concerns about the proposal and has sent a series of questions to the government and the Department of Health. The organization is currently in discussions with senior officials from the Department of Health and Human Services on these issues.

The main concerns are the lack of consent, independent oversight and the risk of this hampering doctor-patient confidentiality, said Australian Privacy Foundation health committee chair Juanita Fernando.

“In view of the proposed exponential expansion of Victorian data collection, consent should be active, in the form of a clear, freely given, specific, informed and unambiguous indication of the individual’s agreement to the collection, holding, management and retention of personal information by health authorities, ”Fernando told InnovationAus.

“The bill erodes the protection of patient-physician confidentiality, and therefore high quality patient care which requires openness of patients, trust and confidence in their clinicians. This can prove disastrous in the context of mental health issues and other conditions related to the social determinants of health.

The Australian Federation of Physicians (ADF) has also raised concerns that the program could damage trust between clinicians and patients.

“ADF maintains that quality healthcare requires patient trust, as well as proper healthcare IT and high integrity data to aid clinical decision making,” the organization said.

“Unfortunately, governments have a very poor track record in implementing reliable systems that deliver quality health information while maintaining the trust of physicians and patients. ADF recommends that the proposal not be implemented until these and other key issues have been publicly debated, carefully considered and resolved.

Liberty Victoria also said she was concerned about the plan’s privacy implications and that there needed to be better public consultation on it.

“This Victorian bill contains no enrollment or opt-out provisions, all patients are enrolled and their consent is not required. There are no provisions for anonymizing people at risk. All data is open to all users of the system, ”said Liberty Victoria.

“Liberty Victoria has serious concerns about the potential of the suggested central database to become a vulnerable ‘honeypot’ for personal data. All patient data, including IDs for each clinic and hospital, should be stored. The database is said to be a major target for exploitation by hackers and organized crime and insufficient emphasis is placed on protecting this personal information. “

The Victorian government issued a declaration that the new law is compatible with human rights, believing that the right to privacy is not limited by powers and that it is normal for individuals not to be able to access or correct their own health information stored on the database.

“Information about a person that is kept in the system may only capture part of their health information, while individual health departments are more likely to have complete and contextual information,” the statement said. compatibility.

“If a person wants to access or change their health information, or has concerns about recording incorrect information, they can access and correct the information through their health service provider. “

But the government did not properly factor the need for confidentiality into that assessment, according to Liberty Victoria.

“The compatibility statement does not demonstrate any balance with the competing need for privacy protection and does not sufficiently address the issue of whether a person consents to their information being stored in a central database,” said the organization.

There is also a risk that having a centralized database of highly sensitive health data acts like a “honeypot” and attracts hackers, Fernando said.

“Aggregate information is, almost by definition, a jar of honeymoon. APIs are needed to access all of this data and many of it are inherently risky, ”she said.

“Health data theft is rampant around the world, and criminals find it very worthwhile to steal or ransom health information. It’s scary, and Australian governments don’t have a good track record here.

More time is needed to consult on the plan and ensure better protections are in place, the foundation argued.

“The range of changes required is manifold and the Victorians should be consulted here. The program should not be abandoned entirely, but should be accountable to the Victorians and be subject to independent oversight, ”said Fernando.

“Certain information should be removed from the collection permitted by the bill, especially when there is no patient consent. The health and well-being of patients, even lives, is at stake here. The bill is neither proportionate nor justified in its present form. Instead, it prompts questions about what it will allow in the future.

Liberty Victoria supported the call for the plan to be given more consideration.

“The speed with which this bill is being introduced into Parliament is of great concern. Such a fundamental long-term policy must be carefully monitored by the parties concerned and by Parliament. Liberty Victoria would be deeply concerned if this bill did not go through the most rigorous scrutiny before being finalized in the Legislative Council, ”he said.

Do you know more? Contact James Riley by email.