The Department of Health has released the framework governing secondary use of data from the My Health Record, providing more detail on the opt-out approach it has settled on for releasing "de-identified" information.
Health Minister Greg Hunt said the framework [pdf] will inform how records data can be used for public health policy, planning and release purposes from 2020.
It has been more than two years in the making, with the department consulting with clinicians, medical researchers, consumers and the Office of the Australian Information Commissioner during its development.
The department had already revealed ahead of the plan’s release that it had chosen to adopt an opt-out model for the provision of de-identified data for secondary purposes from the My Health Record (MHR).
However it had been tight-lipped about whether users would be prompted to alter the automatically set permissions to share data.
Today the department provided more detail, indicating that individuals would be able to opt-out by using the “consumer access control mechanism and clicking on the ‘Withdraw Participation’ button”.
In cases where a consumer chooses not to opt-out, “any data or document that they have classified (using consumer controls) as being ‘Restricted Access’ or that they have removed will not be retrieved for secondary use purposes”.
Data in a cancelled record would also not be accessible for secondary purposes.
“...[W]here a consumer has initially chosen to have a record created for them but has subsequently cancelled their record, the data in that cancelled record will not be retrieved for secondary use purposes,” the framework states.
Hunt said this approach would allow users to “have a health record but elect for their data not to be used for research and public health purposes”, while “preserving privacy and security of data in the system”.
“The protection of patient information and privacy is critical and we have strong safeguards in place to protect health data in Australia," he said in a statement.
“If anyone is found doing the wrong thing with patient information they will face severe penalties, including jail sentences.”
However, the department is already considering how other consent models might work in the future.
“In time, the feasibility of moving to a dynamic consent model will be explored so that consumers may decide to allow or not allow access for defined secondary uses on a case-by-case basis,” it said.
“It is acknowledged that Australian consumers have different levels of health literacy and health system usage.
"This will be considered when implementing processes to convey consent.”
Who will have access?
The framework reveals that access to de-identified data under the plan will not be made available for commercial and non health-related purposes.
“Data cannot be used for commercial and non-health-related purposes, including direct marketing to consumers, insurance assessments, and eligibility for welfare benefits,” it states.
Insurance agencies will also be restricted from accessing data for secondary use.
A 'My Health Record secondary use of data governance board' will be established to assess applications for access to health record data for secondary purposes.
The board will decide which data should be released by assessing the risk associated with each application using the department’s health data access and release policy.
This will largely centre around a “‘case and precedent’ approach to determining what uses will be permitted and not permitted for secondary use” that focuses on “the use of data, not the user”.
It will take into account “knowledge, skills and incentives to store and use the data appropriately” when reviewing an applicant, as well as whether those “accessing the data can be trusted to use it appropriately”.
Overseas applicants must be “working in collaboration with an Australian applicant in respect to the proposed project”, with direct access to that data only available to the Australian applicant.
Data must also be stored in a facility within Australia and not leave the country.
A “public register of request for access to My Health Record system data for secondary” purposes will also be established, providing details about applicants.
The Australian Institute of Health and Welfare (AIHW) will be responsible for “manag[ing] and releas[ing] datasets for the My Health Record Secondary Use of Data Governance Board”.
It goes some way to explaining the $30 million provided in this week’s federal budget for the agency to improve access to health data through IT upgrades and better data sharing capabilities.
The board will work with the AIHW to “develop an electronic process to facilitate the consideration of applications to use health record data for secondary use”.
The Department of Human Services will also act as a data custodian in instances where health record data crosses over with the Medicare benefits scheme or the pharmaceutical benefits scheme.
However, before data flows from the e-health record, the AIHW ethics committee will “consult with stakeholders on planned ethics and approvals processes to ensure protection of individuals’ privacy”.
Regular statements about data availability and quality will also be released by the board.
The first release of secondary use data will not occur until at least 2020, with the framework to be reviewed two year after that.
