The elephant in the room is Section 71 of the myhr legislation "Prohibitions and authorisations limited to health information collected by using the My Health Record system". This effectively says, even if there are privacy protections and access controls in the legislation, they don't apply if the data can be sourced elsewhere.
Considering most clinical data can be sourced elsewhere (that's how the system has been designed), that doesn't leave much data to be protected. IMHO, the legislation (in addition to the possibility of future governments changing it as they see fit) is totally useless. This is the full Section 71, make of it what you will. IANAL. 71 Prohibitions and authorisations limited to health information collected by using the My Health Record system (1) The prohibitions and authorisations under Divisions 1 and 2 in respect of the collection, use and disclosure of health information included in a healthcare recipient’s My Health Record are limited to the collection, use or disclosure of health information obtained by using the My Health Record system. (2) If health information included in a healthcare recipient’s My Health Record can also be obtained by means other than by using the My Health Record system, such a prohibition or authorisation does not apply to health information lawfully obtained by those other means, even if the health information was originally obtained by using the My Health Record system. Information stored for more than one purpose (3) Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if: (a) the health information is stored in a repository operated both for the purposes of the My Health Record system and other purposes; and (b) the person lawfully obtained the health information directly from the repository for those other purposes. Note:For example, information that is included in a registered healthcare recipient’s My Health Record may be stored in a repository operated by a State or Territory for purposes related to the My Health Record system and other purposes. When lawfully obtained directly from the repository for those other purposes, the prohibitions and authorisations in this Part will not apply. Information originally obtained by means of My Health Record system (4) Without limiting the circumstances in which health information included in a healthcare recipient’s My Health Record and obtained by a person is taken not to be obtained by using or gaining access to the My Health Record system, it is taken not to be so obtained if: (a) the health information was originally obtained by a participant in the My Health Record system by means of the My Health Record system in accordance with this Act; and (b) after the health information was so obtained, it was stored in such a way that it could be obtained other than by means of the My Health Record system; and (c) the person subsequently obtained the health information by those other means. Note:For example, information that is included in a registered healthcare recipient’s My Health Record may be downloaded into the clinical health records of a healthcare provider and later obtained from those records. -- Regards brd Bernard Robertson-Dunn Canberra Australia email: b...@iimetro.com.au web: www.drbrd.com web: www.problemsfirst.com _______________________________________________ Link mailing list Link@mailman.anu.edu.au http://mailman.anu.edu.au/mailman/listinfo/link
