Lisa Singh

 Wednesday 14 November

I think everyone in this place would agree that Australians should have the right to privacy. Our health records are the most highly personal information. It's information that we entrust to medical professionals acting in our best interests. I cannot think of a more important privacy relationship than that between a patient and their health professional. That is why it is so important that we get this My Health Record model right. What is clear from the Senate inquiry that has gone into this legislation is that currently we don't have it right—so much so that, as we speak, thousands, if not now millions, of Australians are on their phones and on the internet opting out of the My Health Record scheme proposed by the government. This government has lost the public trust debate, and that is why Labor has made it very clear that we want to put in place amendments to this legislation to put back the public trust that is so needed in this My Health Record debacle.

This debacle isn't the only one there has been, when we look at the government's record in the area of information technology. The government have a woeful track record on IT security and privacy. They botched the rollout of the NBN, they botched the rollout of the NDIS, they gave us a census fail and they gave us the robo-debt debacle—and now they have stuffed up My Health Record. If you look at the record of this government and its previous versions on sensitive data security, I think the Centrelink robo-debt debacle stands out, with lots of bells and whistles on. But, then again, what about the immigration department database breach that put the lives of asylum seekers at risk by revealing their details?

These are just a couple of examples of how this government has simply failed when it comes to information technology security and privacy, and that is why Labor is calling on the government to extend the deadline for My Health Record to go live, which it is due to do from tomorrow. In fact, my Senate colleague Senator Watt successfully passed a motion in this place this week asking for exactly that. I think the Senate, and indeed the government, should respect the passing of that motion and the amendment that Labor put forward to ensure that that happens for the sake of all of the Australians who are worried today, and who have a right to be worried, because this government cannot be trusted in how it is dealing with these sensitive privacy and security issues.

I'm also deeply concerned about some of the failings in this bill as it stands without amendment. I'm deeply concerned by the potential use by third parties of patient information. I think there is definitely a need for further protections for privacy and security, both in legislation and in policy. We need a government that will take all Australians with them to do that, to discuss and educate them about the benefits of My Health Record, which there clearly are, but also the risks, so that everyone can make an informed choice about whether to participate or not. That takes time, and it is something that this government hasn't done. It has failed to do that, which is why we're asking for an extension of the deadline.

What happens if you find that your data has fallen into the wrong hands? Katharine Kemp and David Vaile from the University of New South Wales law school and Bruce Arnold from the University of Canberra law school noted in a piece in The Conversation recently:

We have witnessed a stream of health data breaches in Australia and overseas, and the incentives for these breaches are only increasing.

Storing records digitally with online access greatly increases their accessibility for criminals, hackers and snoopers. Health records are valuable as a means of identity theft due to the wealth of personal information they contain. They are a huge prize for hackers, fetching a high price on the Dark Web.

That is really concerning, and I think everyone would share that concern. But, when discussing a medical condition with their doctor, Australians should not be concerned that it will end up in the wrong hands. There really should be the most searching review into the operations and behaviour of the Digital Health Agency, the ministers who signed off on this and the costs of the public disinformation campaign so far that has, I think, misled not only the parliament but, more importantly, the public. It needs to be reversed. We need to have information. We need to have education about the benefits and the risks, and that case simply has not been made by this government.

We need to remember very clearly some of the rhetoric that's come out of Minister Greg Hunt on this issue. I know that the government has now put itself in a position to bring forward amendments of its own bill, but I think we all need to remember that these changes the minister is making he was forced to make. He was not going to make any changes to My Health Record. These are not changes that he willingly has made. If you remember when Labor initiated the Senate inquiry, this health minister said it was a stunt. For a minister of the crown, of this government, to claim that the important process of legislative investigation through Senate inquiry—into something so pivotal, so important, when you're talking about privacy and security—was a stunt but then to go further and acknowledge, through the findings of that Senate inquiry, that his legislation was flawed and did need amendment and that he has now brought forward those amendments shows very clearly the failings of this minister. It also shows that he has provided disinformation to the Australian people on what he set out to do in the first place. Of course, they've now amended their own legislation. But I think we needed a much more informed consent model, and we didn't have that from this government.

It's not just those of us who were on the Senate inquiry or consumers who are raising some of these concerns; they are coming from health professionals themselves. They're coming from doctors themselves, who've made it very clear, saying, 'Yes, we want to have this partnership with patients.' They think the idea of the My Health Record is important but they also want to make sure that this relationship is not in any way jeopardised by the notion that the information is automatically shared and that patients can't have full control of it. They've raised those concerns throughout this process, particularly throughout this important Senate inquiry process.

In Tasmania, my home state, doctors have approached me with their own concerns. They have made me very aware of their worries about this simple tick-a-box approach. Errors on requests for pathology imaging tests can occur. Poorly edited shared health summaries or errors with pharmacy dispensing notifications may cause unintended or incorrect uploads of data, particularly with the My Health Record. Tasmanian doctors have made me aware of their concerns about what these records will mean for young people. They can foresee an inordinate amount of extra time and effort to ensure that their young patients completely understand the structure, the methodology and the supposed benefits but also likely risks of My Health Record and the real need for them to be alert for exposure of their sensitive information if they do not have control of their personal My Health Record.

The possible and increasing threats to their personal information coming from cyberspace, I think, are real. But the negative publicity around My Health Record also gives the likelihood that teenagers may—this is an unintended consequence—refuse to consult with their doctor, or other health professional such as psychologists, through the Medicare system. That would be terrible. To have a loss of faith would be catastrophic for Australian health care, with serious consequences for those patients over not just the short and medium term but also the long term. The doctors I've spoken to do fear it would all but destroy that long accepted recognition by young people that doctors will safeguard the confidentiality of their records.

Labor's privacy and scrutiny concerns about this were clearly expressed through the Senate inquiry process and through the committee report process. We laid bare the government's botched implementation of this opt-out model. We made additional comments in that report which urged the government to commission an independent review of the My Health Record system by the Privacy Commissioner and the Office of the Australian Information Commissioner, which has itself called for further consideration of several privacy and security concerns. In particular, we highlight that the Privacy Commissioner and the OAIC should consider the appropriate balance between the utilities, the clinicians, patients and others, such as carers; privacy and security for individuals; the difficulty of ensuring informed consent in an opt-out model; measures to encourage consumer engagement and informed choice; and changes to default access settings that are necessary because of this shift to an opt-out model from our original opt-in model, where informed consent was assured.

That is part of the big problem here: the fact that the government has changed this from an opt-in model—which is what Labor's proposal and the legislation were originally—to an opt-out model means that the issue of informed consent is limited and jeopardised. Further, we ask for particular protections for vulnerable people, including minors aged 14 to 17 and families fleeing domestic violence. Further legislative policy and system changes are needed to achieve these aims, but in the meantime I think that the government does need to heed Labor's call and support Labor's amendment—and I urge the crossbench to do likewise—to suspend the opt-out rollout until the Privacy Commissioner and the OAIC report is taken into account, until the government makes those necessary changes and until public confidence in this important reform is restored. That's all going to take time. It's simply not going to happen overnight and it's simply not going to happen by tomorrow, with that date looming for the government's proposal.

The government needs to explain to the people of Australia what it's doing to minimise these risks, otherwise the whole enterprise will be hobbled by distrust and scepticism, and we'll never move away from that. This reform needs public support to work and, unfortunately, that's where the government has failed. We certainly support the amendments that the government will be moving, particularly in relation to issues around domestic violence, employers and workers compensation. But these are all amendments, as I said earlier, that we signalled months ago. Of course we're pleased that the government is basically picking up Labor's recommendations now.

But, that said, we still think there are issues around the default settings of My Health Record that do require the Australian Privacy Commissioner to have a look at this whole thing again. We think that 12 months is a reasonable time for our Privacy Commissioner to look at this, to see whether those default settings are right. And at the same time that is going on, throughout that 12-month period government could be running an education campaign, not just telling people about the benefits of My Health Record but actually telling them what they need to do to actively manage this very important piece of health information—their My Health Record. There needs to be that consumer confidence put into the system, and it's simply not there at the moment.

I think that what has also been clear is the role of and concern about the Digital Health Agency, in particular: what exactly are doctors being paid to sign up their patients to do, and what for? What information about access and usage has or has not been fully—or at all—disclosed to them? Again, those are unknowns. I think, though, implemented by a competent government, e-health could deliver tangible healthcare improvements and save healthcare costs through perhaps fewer diagnosis, treatment and prescription errors. I think that that could actually work. But what we don't want to see is people's patient health records falling into the wrong hands. We certainly don't want to see it privatised—there should be no privatisation of patient records—and we don't want to see it falling into the wrong third-party hands at any cost at all.

That's why, when we began delivering on electronic health record systems when we were last in office, our system was an opt-in system. We thought that that was the right approach. Anyone who participated had to give informed consent; they had to give their full, informed consent. But this government has failed on that completely. Worse, it seems to have actively refused to communicate with Australians about the risks to My Health Record and what this opt-out system means in practice. What worries me today is how many Australians are unaware and do not realise that tomorrow is the deadline for opting out of this model if they choose to do so. Very concerning to me today is the fact that they haven't been given that education, communicated by government, of what this opt-out system means to them and what the risks and the benefits of their My Health Record are.

I think the absolute failure by Minister Greg Hunt and this government to communicate has fuelled so much of the privacy and security concerns that Australians quite rightly have about My Health Record. It didn't have to have come to this, but it has because of the failure of this government. When the Senate Community Affairs References Committee was scrutinising the My Health Record system in September, representatives of the Australian Digital Health Agency conceded that more than 900,000 Australians at that point had already opted out of My Health Record. It is well over a million today, and goodness knows how many more by tomorrow.

With one day left before the deadline my message to Australians is: please make yourself informed today about the options and about not only the benefits but also the risks. Choose what you want to do today, whether or not you wish to opt-out. But, more importantly, my pitch this morning to this chamber, to the government and to the crossbench is: please support Labor's amendments. Support these amendments to ensure that we put back in place the trust that Australians need in this My Health Record model. We need more time to get this right. It is nowhere near right as it currently stands, despite the government's amendments that they were dragged here to put forward. We need more time, we need the review and we need to ensure that Australians trust what we are doing when we say we want to ensure we have a great health system with a digital capacity to improve efficiencies. We are simply not there yet. Please support Labor's amendments to this bill.