Thousands of records containing sensitive information such as HIV-status, past abortions and mental health issues are being requested by the police every year – and doctors and privacy experts are deeply concerned about it.
The battle for greater privacy protection around My Health Record (MHR) data appears to have been won, with the government pushing through legislative changes in November requiring police to get a warrant in order to access MHR data.
What has largely escaped the public’s attention thus far is that there are two other, equally-sensitive datasets held by the Department of Human Services that federal, state and territory police forces have been quietly accessing for years.
The police are not legally required to get a warrant to obtain Pharmaceutical Benefits Scheme (PBS) and Medicare Benefits Schedule (MBS) data.
An investigation by The Medical Republic recently revealed that the police were requesting around 2,600 MBS and/or PBS records every year.
While the Department of Human Services is legally required to report external disclosures of linked MBS and PBS data to the Office of Australian Information Commissioner, a loophole in the legislative instrument has allowed some disclosures to go unreported.
Now, doctors, politicians and privacy experts are questioning whether the legislation around PBS and MBS records needs to be brought up to the same privacy standards as the MHR.
Here’s what they said:
Dr Karen Price, co-administrator on GPs Down Under
Whilst most of us understand the need for reasonableness with regard to community safety, this data needs to have transparent and ethical oversight as to its management.
People do not lose human rights just because they are suspected of criminal activity.
All police and government agencies need to have an auditable and accountability trail for their actions. If acting in good faith, then reasonable actions are not likely to cause alarm.
Dr Chris Moy, the ethics chair at the Australian Medical Association
At this moment in time the My Health Record is the least of our worries, and it’s probably a gold standard in terms of privacy protection. My Health Record was always only about having copies of data – discharge summaries, pathology results, MBS data, immunisation data with originals still available in the GP practice, hospital, etc.
So My Health Record was always the secondary database for that information. Where the data originates from (including PBS or MBS data) doesn’t have the same level of protection.
At the end of the day it is a community decision about what is most important to them about privacy vs any benefit derived from release of this data – it’s their information. The AMA’s position is that we want the community to bereassured. In simple terms, it has to pass the ‘pub test’ for privacy and the AMA would support them in this.
Dr Harry Nespolon, RACGP president
Protecting sensitive health information is crucial to maintaining a trusted doctor-patient relationship, which enables us to provide the best possible care.
Any access to a patient’s medical history, directly or indirectly, without the patient’s consent, is unacceptable.
However, the law does make provision for access without consent in certain circumstances. These circumstances should be extremely limited, and when they do occur should be disclosed to the public on a regular basis, including the reasons for the access.
Dr Trent Yarwood, an infectious diseases physician based in Queensland
Doctors tend to think that administrative data doesn’t include any privacy-specific information. But that’s actually quite untrue.
So, for example, if you’ve been seen by a sexual health clinic and your PBS record says that you have received Valtrex, then I can pretty confidently put those two things together and say that you’ve got herpes.
There are lots of drugs that we use that are for single indications only. So if you’ve ever received a previous prescription for mifepristone then you’ve had a medical termination of pregnancy.
There is a big long list of antivirals that we give people for HIV are pretty much only used for HIV. Only patients with HIV would be taking Atripla, for example.
People might wave the issue away and say, ‘Well, what does it matter if I’ve just been to the doctor?’ It’s that whole ‘nothing to hide, nothing to fear’ thing.
But there are lots of examples where even having been to a particular sort of doctor can be an issue. People who have seen an HIV or TB specialist who have lied on their visas could potentially be deported. A woman having a termination of pregnancy is the obvious one. People don’t generally want their workplaces to know about it.
Once this data is out there, it’s available for people to put to other uses; you can’t get your privacy back once it’s gone. Even without being “hacked”, though, there is a threat to privacy from people who have legitimate access to the data.
A few years ago there was a very high-profile case in Adelaide of a teenager who had a psychotic episode and killed his Dad, who was the coach of the local football team. A number of people from SA health got disciplined for snooping on the teenager’s medical chart.
And, in the example of police, there was a case on the Gold Coast earlier this year where a police officer gave the supressed details of a domestic violence victim’s address to her ex-partner.
Michael Robertson, a psychiatrist and associate professor of mental health ethics at The University of Sydney
The issue that concerns me, beyond what on earth police would need with PBS/MBS data, is the potential for misuse in discrediting witnesses or discrediting complainants.
Globally, there is a long history of misuse of psychiatric diagnosis for political or nefarious purposes.
If it becomes public that the police seek to use your mental health data for conducting inquiring in matters on interest, that’s also going to dissuade people from seeking the help that they need, which is a concern.
There isn’t as much outrage about police access to PBS/MBS data as one would expect because there are just too many instances where the state is infringing on civil liberties at the moment, from metadata retention laws to the new encryption laws.
Hypervigilance is exhausting and we are exhausted. We’re not there yet but that’s how totalitarian states work. There is deceit, there is fatigue and trading on apathy.
We are sleepwalking into authoritarianism.
Tony Zappia MP, shadow assistant minister for Medicare
Labor supports the concept of the My Health Record, but has concerns about this government’s implementation, and this latest information further confirms those concerns and the need for strong protections for privacy.
Particularly concerning is that not all information provided needs to be disclosed in the annual report to the Privacy Commissioner.
Michelle Thompson, CEO of Marie Stopes Australia
A service such as abortion is deeply personal so it is important that if person accesses these services, they are assured confidentiality.
At Marie Stopes Australia we would not provide access to medical records unless a warrant or subpoena are in place.
Dr Chris Culnane, a cybersecurity expert at The University of Melbourne
The Medical Republic’s article contains this quote from the Department of Human Services: “The mere extraction of an individual’s MBS and PBS claims information into separate documents does not constitute linking for the purposes of the guidelines, even if those documents are sent to the same email address.”
It those are the lengths that a government department is willing to go to, in order to circumvent oversight and legal protections, that signifies a complete breakdown in trust and integrity. Doing it is one thing, being so brazen as to make a statement about it is quite another.
Justin Warren, chief analyst at PivotNine and a board member of digital rights organisation Electronic Frontiers Australia
When you have this environment of secrecy and underhandedness, it completely undermines people’s trust in government and the institutions that could be doing great things for society. And then people don’t want to deal with those organisations any more.
Unfortunately, rather than addressing people’s legitimate concerns, the government tries to hide things, authorities try to do it through hidden mechanisms without oversight.
