My Health is shifting the control paradigm

Once the majority of Australians have a My Health Record, and more practitioners use the system, a new paradigm for health data control will emerge.

Since the creation of health records, it has been commonplace for their storage to be with the practitioner or clinic so they are available for future appointments. With My Health, digital records are stored in the cloud for over a century from the patient’s date of birth and are managed by the government’s system operator. The legislation affords patients mostly unfettered access and control over these digital records.

The right of a private patient to access their medical record first became part of Australian law after the 1996 High Court case of Breen v Williams, when legislative reforms took effect permitting patient access. The law had recognised the benefits of striking a balance between the rights of the practitioner and the patient to health information. Patient access gave them the liberty to move to another provider and take a copy of their file with them, and in some ways made it easier to file a complaint. My Health signals a further broadening of patient control over data. This will empower patients to control their medical information, but carries with it some practical limitations and risks to the practitioner.

How have patient rights been expanded under My Health?

1. Copyright exemptions

The copyright of a health record usually belongs to the practitioner, or may be assigned to the clinic as part of their employment. The introduction of My Health has led to exemptions under copyright legislation which mean that licences do not need to be obtained by practitioners or patients to access and use the records. This means that the fundamental right of practitioners to control their intellectual property has been further limited.

2. Patients can use records “for any purpose”

A patient using My Health will certainly be able to access the record at their discretion, request modification of the record, and hide medical particulars from any health practitioner. The patient could also cancel their record, but the current law states that the record will remain archived, and therefore not deleted.

As an example, section 67 of the My Health Act states that “a healthcare recipient is authorised to collect, use and disclose, for any purpose, health information included in his or her My Health Record”. The language of this provision means that it is unclear whether the Act permits patients to share details from their My Health Record in forums such as Facebook and other sites. It would be hoped that any such disclosures would not include the details of the practitioner.

3. Querying the diagnostic process

It will be easier than before for a patient to query a diagnosis. In the 2017 Victorian Supreme Court case of Kitson v Dennerstein, the patient was interested in what evidence existed in their health record to substantiate the psychiatrist’s diagnosis of Narcissistic Personality Disorder. It was decided in that case that the wording of the health record legislation in question prevented the patient from gaining access for the purpose of evaluating or testing the information. However, if the psychiatrist had been using My Health, the patient would have been at liberty to look through their My Health Record and determine what evidence the psychiatrist had to meet the Diagnostic and Statistical Manual of Mental Disorders (DSM) criteria. This would have then given the patient the ability to question the practitioner on their diagnosis, judging their advice to be inappropriate or not. Perhaps pre-emptive planning and risk management discussions with in-house counsel will help ease concerns of practitioners in this regard.

4. Limiting access to information

The Australian Digital Health Agency advises that “consumers can request that a particular document is not uploaded to their record, and healthcare providers must comply with such requests”. However, practitioners can advise patients “about the potential risks of excluding information from their My Health Record and explain the benefits of ensuring all information is included”. The key point here is that what the patient says, goes. Eventually we may see that patients give directions to their practitioner on what information should feature in letters of referral and in their My Health Record.

The Australian Commission on Safety and Quality in Health Care discussed these limitations in their 2017 report on My Health: “Enabling consumer control of their EHR is empowering for the patient; however, limited or inaccessible content by clinicians may be a consequence. Consumer behaviour could be driven by security concerns regarding unauthorised EHR access... Mental health, sexual health or HIV status are examples of sensitive information that consumers are likely to apply access controls on their EHR. This raises the possibility that less accessible clinical content may produce marginal benefit to clinicians using an EHR.”

In this light, it should be considered whether practitioners can rely on the information stored in a My Health Record for both its accuracy and completeness given that it may not include all of the needed information. Even if a practitioner is confident that their patient is disclosing all of the relevant information, the My Health Record does not contain a complete, retrospective clinical history of the patient. While there is an emergency override feature, which allows access to hidden records in emergencies, uses of that feature are tightly regulated and audited, and should never be accessed for other than a true emergency, as defined in this document.

Conclusion

Aside from the range of privacy and security issues that are at the forefront of the My Health debate, management should also consider the potential risks from increased patient and government controls, as well as other limitations. These matters should be weighed up against any evidence-based benefits for using the system, which are discussed in this report by The Australian Commission on Safety and Quality in Health Care and in PubMed literature.

The widespread use of My Health will bring about a paradigm shift for data control. Here are some tips for practitioners concerned about the changes:

• My Health remains opt-in for practitioners. Therefore, despite pressure that may mount from members of the community, practitioners are under no obligation to sign up to use My Health.
• If an employer has registered the clinic, but you do not wish to participate, you will still be required to upload records on the request of the patient. These concerns, however, should be brought to clinic management.
• Those not using My Health may still wish to consider the benefits of ensuring that patients and their guardians have a copy of information concerning their medications and allergies for emergencies, and how such information could empower the patient.
• Remember that what goes in the My Health Record may be there long after you cease practising medicine.
• Risk management planning with management, clinicians and legal experts is a good way to plan ahead, consider hypothetical scenarios and plan responses which conform with the legal frameworks.

*Bianca Phillips is a Victorian lawyer with a focus on medical law. She completed her Master of Laws at The University of Melbourne with her thesis on telemedicine, and is completing her doctoral thesis on law-making for the My Health Record System. She has authored a number of articles on the digitisation of medicine in both legal and medical publications. Bianca would be pleased to hear from management, clinicians and legal teams to discuss My Health in more detail — brphillips@swin.edu.au.

Image credit: ©stock.adobe.com/au/Zerophoto