My Health Record access controls used only 214 times in million record trial

As one begins to work with numbers that approach zero, small differences in weightings and roundings can easily become orders of magnitude out of whack.

So it was that back in May, officials from the Australian Digital Health Agency (ADHA) told Senate Estimates that less than 0.1 percent of users in its trial areas had set access codes to change the default setting of general access to health care providers, and instead restrict data to nominated health care providers or people.

Thanks to numbers released by the Department of Health in response to Questions on Notice last month, we now know that "less than 0.1 percent" was incorrect by three orders of magnitude, or, more precisely, around 500 times smaller than ADHA said.

The department revealed that of the 971,252 records created during its trial period, only 214 access controls were set. Of that number, 196 records had a code applied to the entire record, 10 had individual documents locked down with a code, and eight had both record and document codes applied.

"Consistent with international similar programs," ADHA CEO Tim Kelsey said in May. "So people on the whole ... are engaging in the initiative to make sure their medical information is available, particularly in emergency circumstances to a care professional."

Given such a low number of interactions, it's quite a stretch from Kelsey to portray that users are engaged with the system. This appears to be more of a 'set and forget' scenario, and with the high number of people who have been surprised to learn they had a record when attempting to opt-out during the official window, that million also contains people ignorant that they were in the system.

Consistent with the 2 percent figure touted by ADHA in May, the numbers also show that 22,420 people opted out during the trial, and only 586 people cancelled their record in the three months after the opt-out period. The number of cancellations tapered down from 287 in June 2016 to 100 in August 2016.

With the opt-out period now extended until November 15, 2018, those who do not opt out will have a My Health Record created on December 12.

The department also said that only 3 percent, or 287, specialist organisations were hooked up to My Health Record as of June 3, and in the year to June 3, an average of 3,641 general practices had uploaded one document each week to the system.

At the end of last month, the Australian government finally began addressing some of the legislative problems with My Health Record: Overly broad access for law enforcement, and the retention of data even when a health record is cancelled. This followed weeks of assertions by Health Minister and failed Liberal deputy leadership aspirant Greg Hunt that such changes were unnecessary.

A leaked document has reportedly shown that ADHA rejected putting passcodes on My Health Record by default, amid a raft of other problems within the system.

Related Coverage

• Australian government moves to improve My Health Record privacy
• My Health Record woes detailed in leaked document: Report
• Labor promises inquiry into My Health Record
• Opt-out period for My Health Record officially extended until November 15
• My Health Record: Canberra is still missing the point
• My Health Record legislation to match ADHA policy in government backdown
• PM flags My Health Record 'reassurances' as RACGP expresses concern
• Ambiguity over access to My Health Record needs to end: AMA president