Date: Tue, 10 Nov 2015 12:04:46 +1100

To all Senators.

Re: the Senate Committee on Community Affairs report on the eHealth Bill

http://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Community_Affairs/eHealth/Report 

The APF has major concerns about the recommendations of the Senate Standing Committee on Community Affairs with respect to the eHealth Bill.

*Reliance on Civil and Criminal Penalties is Absurd*

The Senate Committee on Community Affairs does not understand that this Australian legislation will not protect health data on the Internet.

The committee believes that civil and criminal penalties will be sufficient to protect the privacy of Australian citizens' health and personal data.

This is patently absurd. The PCEHR is accessible in multiple ways, including over the Internet. The first line of defence should be highly effective systemic controls backed up by civil and criminal penalties. Relying primarily on penalties overlooks the fact that they are totally ineffective against criminals and cyber-terrorists operating overseas. Once a breach has occurred, the data cannot be put back in the box. Once an identity is used fraudulently, the damage is done.

We are also concerned about the suggestion that manifest failures in the design of the system can be ameliorated by means of a “public awareness campaign”.  Apart from being a bad and ineffective idea, it implies that such campaigns would need to be run repeatedly and frequently in order to reach people as they age and become eligible as well as migrants entering the health system. There appears to be little or no evidence that it will achieve its aims or estimate of the cost of such ongoing campaigns.

*What Is Required?*

What is required is a complete re-evaluation of the whole eHealth strategy and the development of a far more functional, secure and useful system that meets the needs of health clinicians and, most importantly, patients. We are concerned there is not a full appreciation of, and learning from, the complexities and  risks associated with National E-Health Systems which have run massively over budget or simply failed in many countries over the last decade. Equally claimed benefits have seldom, if ever, actually materialised.

Our recommendation is to take the advice of experts and reject the bill. Failing that, the bill should be returned to the House of Representatives with the recommendation that the whole initiative should be reviewed before any changes are made to legislation, including the proposal for an opt-out approach. Accepting the recommendations from the Review of the Personally Controlled Electronic Health Record in December 2013 merely continues with forced implementation of a bad solution to a poorly defined problem.

*Response to the Committee's Report*

In reading the Committee report released this week, it is obvious that the Committee has decided to ignore the advice and recommendation of Legal, Privacy, Health and Information System experts.

This is in spite of being told that it is insecure and a major threat to the privacy of most Australians, has little value to health professionals and has all the appearance of primarily being an aid to law enforcement and revenue collection agencies.

The APF is not alone in expressing concerns about the PCEHR and the proposal to make it opt-out. We note that of the twelve submissions, two were from NEHTA and the Department of Health. Carers Australia's only comment was to support an opt-out approach. All the other submissions had concerns, reservations and/or made recommendations for changes to the system or to the legislation.

In other words, excluding the two organisations with vested interests, only one expressed full support, and that was limited to one aspect of the eHealth Bill. 90% of the submissions did not support the proposals in the Bill. Yet, the committee seems to think that’s acceptable to continue with the legislation as is.

We also draw attention to the considerations by other committees - The Parliamentary Joint Committee on Human Rights and the Senate Standing Committee for the Scrutiny of Bills. Both these committees have raised significant concerns.

It would seem that this government is intent on giving the impression of consultation and consideration but is not really interested in obtaining informed and expert advice. This claim is supported by the fact that the eHealth Bill was referred to the Senate Standing Committees on Community Affairs, not the Senate Select Committee on Health, a far more logical choice.

We urge Senators to carefully read the report and, for further arguments and information, the submissions to the review.

We also suggest that the claims that the Department of Health have made regarding potential savings through leveraging eHealth be carefully scrutinised. As the RACGP says in its submission, and with which we fully agree: "There is currently limited evidence that supports the proposition that patients merely having access to their healthcare information leads to significant changes to healthcare outcomes."

-- 

Dr Bernard Robertson-Dunn
Australian Privacy Foundation
Chair Health Sub-Committee
Bernard.Robertson-Dunn@privacy.org.au