Unclean Bill of Health

Victoria's plan for centralised health records ... Compulsory opt-in ... No opt-out ... Human rights and privacy concerns ... Potential leakage of sensitive personal details ... Digital records of the unhealthy ... Hugh Vuillier reports from Yarraside 

Patients not given a choice whether their medical information is shared across the Victorian health system

A Bill to create a centralised health record recently landed in the Victorian parliament and is expected soon to receive vice-regal consent. 

The Health Legislation Amendment (Information Sharing) Bill 2023 provides for medical details to be electronically shared across the state's health agencies. It has no opt-out provision and no avenue for Freedom of Information requests. 

Needless to say, it has been criticised by all-and-sundry, including the Opposition.

In her second reading speech, the health minister, Mary-Anne Thomas, argued that a unified access point for patients' health information would help save lives and improve patients' care, particularly in emergencies.  

Both Government and Opposition have acknowledged the need for improved record-keeping in healthcare. The proposed system will replace fragmentation of medical records still reliant on fax and phone.  

The new database will include Victorian's health conditions from the last three years - including allergies, injuries, physical and mental diagnoses. 

The decision to implement the database follows a recommendation from an independent report commissioned by the government in 2015, prompted by several infant deaths at Bacchus Marsh Hospital. 

The Law Institute of Victoria has raised concerns about the lack of an opt-out option, noting that sensitive personal information will be stored without patient consent. The institute's president Tania Wolff goes on:

"Patients must have the right to say who can access their health information - even if this means their health information will not be shared under the scheme. Patient autonomy is a fundamental human right: it's the same principle that allows a patient to refuse medical treatment."

Similar issues arose with the federally-funded My Health Records, leading to the implementation of an opt-out model in 2018. 2.5 million people withdrew from the scheme, including 10 percent of Victorians.  

Critics of the Bill also point to the risk of unauthorised disclosure of sensitive information, including mental health diagnosis, sexually transmitted conditions, and past domestic abuse.

During debates in the Legislative Assembly on February 22, Liberal MP David Southwick suggested that such a centralised database may deter patients from using healthcare services - each time a person used the Richmond injecting room, their visit was added to their medical record. 

Liberty Victoria has criticised the scheme for creating a "honeypot" of personal data vulnerable to cyber-intrusions. 

In 2019, the Auditor-General Andrew Greaves uncovered vulnerabilities in the health systems of state departments and major health care providers - including the health technology system within the Department of Health, which was found to be susceptible to "basic password cracking techniques". 

Although the Bill introduces three new criminal offences to deal specifically with unauthorised access, critics believe these measures to be of limited use, pointing to section 134ZS of the Bill which specifically excludes any Freedom of Information requests with regard to the proposed system. 

Looming behind this project lies the failure of HealthSMART, a previous attempt to overhaul the IT systems within the Victorian health system. 

Originally introduced by a Labor government in 2003, the project was later scrapped by the Coalition in 2012 due to delays and significant overspending. 

As the Second Reading debates began in the Legislative Council on March 7, LIV, Liberty Victoria and Digital Rights Watch issued a joint statement to implore upper house members to incorporate an opt-out provision in the Bill.