Controversial plans to share de-identified My Health Record data by default for research and public health purposes have been quietly pushed back, with basic arrangements necessary for the release of data not yet in place.
iTnews can reveal the Department of Health has delayed the release of the first de-identified datasets sourced from the federal government’s $2 billion digital health record system until next year.
Under the secondary data use framework, de-identified data sourced from the My Health Record was to be automatically shared for public health and research purposes from 2020, unless individuals opted out through the My Health Record access controls.
The framework stipulates that de-identified data can be released for a variety of purposes, including the development or improvement of health services, the development of new or improved health care products or services and the development of government health policy.
Legislation passed in 2018 to add new safeguards to My Health Record explicitly rules out the release of de-identified data from the digital health record to any insurers.
A spokesperson told iTnews that despite the secondary data use framework stipulating that data would be released this year, the department was now “not anticipating any data will be released under the framework before 2021”.
The delay appears to be down to problems establishing the critical governance and privacy principles that the secondary data use framework deems necessary for the release of data to occur.
“All critical governance, security, privacy and technical arrangements will need to be in place before data will be released under the framework,” the spokesperson said almost two years after the framework was originally released.
This includes the Data Governance Board, a critical feature of the secondary data use framework tasked with assessing applications for access to de-identified My Health Record data and deciding on what data should be released by assessing risks.
The board will comprise of members from the Australian Digital Health Agency (ADHA) and the Australian Institute of Health and Welfare (AIHW), as well as a range of independent experts across the fields of epidemiology, research, service delivery, data science and privacy.
“Neither the Data Governance Board, nor the process to apply to use My Health Record system data, have been established,” the spokesperson said, adding that no applications for secondary data use had yet been submitted.
The implementation plan for the release of data, as well as the development of the “rule that will impose requirements on persons handling My Health Record information for research and public health purposes”, is also yet to be introduced, according to the department.
Technical infrastructure require to support the data custodian and board receive and assess request for access to My Health Record data, including the public register for publishing outcomes, is similarly yet to be developed.
“The Department of Health is currently working with the ADHA and the AIHW (as Data Custodian) to develop advice for government to establish preparedness for future data sharing,” the spokesperson said, with data assessment activities currently underway.
Only 64,000 records won't share de-identified data
Under the secondary data use framework, the department has settled on an opt-out approach for the release of de-identified health data from My Health Record for research and public health purposes.
The approach requires that an individual login into their digital health record and manually select the ‘do not participate button’ in the section dedicated to the secondary use of data .
But iTnews can also reveal only 63,504 – or 0.28 percent – Australians with a My Health Record have opted not to share de-identified data, suggesting most individuals are in the dark about the controls.
“As at 2 February 2020, the proportion of active records that have set a preference not to participate in secondary usage of data is 0.28 percent,” the spokesperson said.
This is not surprising given less than 10 percent of Australians with a My Health Record have ever logged in, according to the most recent figures provided by the Australian Digital Health Agency.
“Since July 2012, the total number of records access by a consumer is 2.07 million,” the ADHA said in answers to question on notice from senate estimates last year.
There are currently 22.68 million My Health Records, just over half of which (13 million) have data in them.
More than 2.5 million Australians eligible for a My Health Record decided against having a digital record created for them during the six-month opt-out period between July 2018 and January 2019.
