Nearly one million Australians have opted out of the federal government’s My Health Record service halfway through the opt-out period, a senate inquiry has been told.
But according to the Australian Digital Health Agency, this figure is “significantly lower” than it had projected prior to the opt-out period being launched in mid-July.
The Senate inquiry into My Health Record held its second public hearing on Monday evening, and heard from representatives from the Australian Digital Health Agency and the Department of Health.
The inquiry also heard that only a tiny fraction of those with a My Health Record have chosen to implement privacy control measures that many argue should be set by default.
ADHA boss Tim Kelsey told the inquiry that about 900,000 people have opted out of the service in the past two months via the online platform and call centres. This number does not include those that have opted out through the paper form.
That number represents about 3 per cent of those eligible for a My Health Record having opted out of the service.
“This is significantly lower than the original forecast we had anticipated and is in-line with other international examples,” Mr Kelsey told the inquiry.
The government had earlier expected that about 10 per cent of the eligible population would opt-out of the service, with the final consolidated figure not revealed until the end of the year.
The opt-out period will run for another two months until mid-November, then all Australians will be given a My Health Record by default.
Mr Kelsey said there was a “significant surge” in opt-outs when the period began, followed by a “significant drop-off”.
In the same timeframe, about 181,000 people opted in the the service.
The inquiry heard that about 6.1 million people now have a My Health record service, with the scheme having been running for six years.
There are now 830 public hospitals registered with the service, with plans for all of these institutions to be signed up by the end of the year. Nearly 200 private hospitals are also registered.
One of the main topics of debate during the hearing was the level of security and access controls included in the My Health Record infrastructure, and the level of security applied to a record by default.
Earlier at the inquiry, former Digital Transformation Office boss Paul Shetler said that the access controls are “shockingly bad”, with the service “not set up in a secure way”.
Those with a My Health Record can implement record access controls, meaning only those with the PIN can access the entire record. Users can also employ limited document access control, which puts the same security on a specific document in the record.
Neither of these access controls are implemented by default for My Health Record users.
Nearly 17,000 users have implemented record access control, while just over 4000 have employed limited document access control, equating to just 0.25 percent of My Health Record account holders.
Over 130,000 people have activated email or SMS notifications for when somebody accesses their My Health Record or its contents are updated.
Providing these access controls by default would “effectively move it back into an opt-in system”, the ADHA’s Meredith Makeham said, and would limit its usefulness to clinicians.
“Doing that would interrupt the clinical workflow. If for more consumers a healthcare provider was unable to access the record without asking for a code then it would interrupt that clinical workflow and impede the use of the record,” Ms Makeham said.
“Feedback was that clinicians would not support that interruption to their workflow and would then not use the My Health Record service.”
The access control options available to users are a “very live component” of the ADHA’s wider communications efforts, Mr Kelsey said.
“An intrinsic part of the responsibilities the agency has is to communicate the benefits of My Health Record and the opt-out options, and the privacy and security controls they are able to exercise,” he said.
“All the material we are producing, all the different channels that are being used for communications are providing a combination of all three of those messages.”
Do you know more? Contact James Riley via Email.