My Health Record had 42 data breaches in 2017-18 but no 'malicious' attacks: ADHA
Australia's troubled My Health Record recorded 42 data breaches between July 1, 2017 and June 30, 2018, the Australian Digital Health Agency (ADHA) has said in its 2017-18 annual report [PDF].
Three of the breaches were reported to the Office of the Australian Information Commissioner (OAIC) and involved one breach of unauthorised access due to an incorrect Parental Authorised Representative being assigned to a child, and two breaches due to suspected Medicare fraud that resulted in the potential fraudster seeing records without authority.
ADHA also said 17 breaches were found from the Department of Human Services identifying intertwined records where two or more people have been using the same Medicare record, and 22 breaches from attempted Medicare fraud where unauthorised claims appeared incorrectly in the My Health Record of affected users.
"There have been no purposeful or malicious attacks compromising the integrity or security of the My Health Record system," ADHA said.
The Department of Human Services had corrected the records in all instances, ADHA said.
The My Health Record operator said as of July 27, 2018, almost one quarter of Australians had a record.
"In 2017–18 the Agency, as System Operator, registered 935,206 people for a My Health Record," it said. "There were a total of 42,877 cancelled registrations during the year."
ADHA said 221,580,930 documents were uploaded to the system in 2017-18, and 798,000 people accessed their records through its portal in that time frame.
As of June, ADHA reported connecting 178 of the country's 208 private hospitals to My Health Record, and 815 of Australia's 1,108 public hospitals to the system.
Australians have until January 31 to opt-out of the national health record system or they will have a record created for them if they do not already have one.
By October 19, 1.147 million had removed themselves from the system, but ADHA said it was happy with the result.
In the wake of the annual report, Labor has reiterated its call for OAIC to review the system, and hit out at the AU$20 million deficit that ADHA reported.
"After spending 2018 focused on tearing down his own Prime Minister, Minister Hunt must now focus on delivering a My Health Record that is secure and on budget," Shadow Health Minister Catherine King said in a statement.
ADHA said in its annual report that it had created a privacy team to "embed privacy within the functions and culture of the agency".
"Maintaining community trust in the privacy and security of the My Health Record system is imperative to the success of the program," ADHA wrote. "The privacy team takes a proactive, privacy by design approach to managing the development and operation of the My Health Record system."
It was reported in November that its director of privacy had resigned over privacy concerns.
The same month, the government announced it would increase the maximum penalties for improper use of My Health Record data.
Under the changes, the maximum jail term will increase from two to five years, the maximum fine for individuals will jump from AU$126,000 to AU$315,000, and private health insurers will not be able to access health or de-identified data.
Employers will also not be able to use health information or de-identified data to discriminate against employees or potential employees.
"Importantly, employers or insurers cannot simply avoid the prohibition by asking the individuals to share their My Health Record information with them," Health Minister Greg Hunt said at the time.
Parents who have restricted access to a child, or are a potential risk to a child or person associated with the child, will not be allowed to become an authorised representative.
Related Coverage
Rushed My Health Record changes still missing the point
The Australian government seems obsessed with pushing everyone into its centralised digital health records system before they've even finished working out the rules. Why is that?
My Health Record data misuse penalties raised
Employers have been barred from using health data to discriminate against current or potential employees.
My Health Record opt-out officially extended to January 31
The House of Representatives has agreed that delete now means delete.
My Health Record privacy amendments 'woefully inadequate': Labor
An Australian senate committee has recommended passing the My Health Records Amendment (Strengthening Privacy) Bill 2018, but Labor senators have lashed out at the government's "stubborn refusal" to fix further problems.
My Health Record justifications 'kind of lame': Godwin
Australia has spent billions of dollars for 'nothing really useful', according to leading internet policy commentator Mike Godwin, and the proposed anti-encryption laws are 'inhumane, wrong, anti-democratic'.