This Bills Digest replaces a preliminary Digest published on 25 November 2024 to assist in early consideration of the Bill.
Key points
- The Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Bill 2024 establishes a legislative framework for requiring certain health information to be shared with the My Health Record system, subject to exceptions.
- The Strengthening Medicare Taskforce and others have called for sharing by default arrangements to increase the amount of health information in My Health Record and allow it to deliver greater benefits to users and the health system.
- The Bill establishes two compliance mechanisms — civil penalties against corporations and the ability to recover Medicare benefits from providers. Medicare rebates would continue to be paid to patients in the usual way, however, if prescribed providers do not upload specified information within the required timeframe, the Medicare payment received would need to be repaid to the Australian Government by the provider.
- Details regarding the providers and types of healthcare service required to comply with the framework, as well as the information to be shared, upload timeframes and exceptions, are to be set out in rules, which will be disallowable.
- Providers within the pathology and diagnostic imaging sectors are intended to be the first required to share test results to the My Health Record system.
- The Senate Community Affairs Legislation Committee is due to report on the Bill by 30 January 2025.
Introductory Info
Date of introduction: 21 November 2024
House introduced in: House of Representatives
Portfolio: Health and Aged Care
Commencement: Most components commence the day after Royal Assent. Schedule 1, Part 2, Division 3 commences on the later of the day after Royal Assent and immediately after the commencement of Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024. Schedule 1, Part 2, Division 4 commences on the later of the day after Royal Assent and commencement of Schedule 2 to the Administrative Review Tribunal (Miscellaneous Measures) Bill 2024 (if enacted). Provisions in Schedule 1, Part 2, Division 2 commence on the day after Royal Assent, but do not commence at all if Schedule 1 to the Health Insurance Legislation Amendment (Assignment of Medicare Benefits) Act 2024 commences on or before that day.
Purpose of the Bill
The Health Legislation Amendment (Modernising My Health Record—Sharing by Default) Bill 2024 (the Bill) proposes to amend the My Health Records Act 2012 (the MHR Act) and the Health Insurance Act 1973 (the HI Act) to establish a legislative framework for requiring certain health information to be shared with the My Health Record system, subject to exceptions.
As explained in the Minister’s second reading speech:
We're starting with pathology and diagnostic imaging. However, this framework will position the My Health Record system to deliver access to key information, and become a routine, central part of our health system.
There are also related amendments to the A New Tax System (Goods and Services Tax) Act 1999, Fringe Benefits Tax Assessment Act 1986, National Health Act 1953, National Health Reform Act 2011 and Private Health Insurance Act 2007.
Structure of the Bill
The Bill comprises 2 Schedules:
- Schedule 1 contains the main amendments
- Part 1 amends the MHR Act to require prescribed constitutional corporations to become registered under the MHR Act and to upload prescribed information to the My Health Record system.
- Part 2 amends the HI Act to provide that Medicare benefits will no longer be payable for prescribed healthcare services, unless required information is shared to the My Health Record system. It also provides for exceptions in certain circumstances.
- Schedule 2 contains other amendments to:
- enable limited data matching between Medicare and My Health Record information to support compliance and enforcement with the new share by default requirements
- enable the Australian Commission on Safety and Quality in Health Care to disclose information about healthcare providers to the Secretary or My Health Record System Operator for compliance purposes
- make consequential amendments to the HI Act and other Acts to ensure that, even if Medicare benefits are not payable because information hasn’t been uploaded, this doesn’t affect how those services are treated by other Acts and programs.
Background
My Health Record
My Health Record is a secure digital place to store health information and records. It commenced in July 2012 on a voluntary opt-in basis, then known as the Personally Controlled Electronic Health Record system (PCEHR). In March 2017, Australian governments agreed to move the My Health Record system to an opt-out model.
Every Australian now has a My Health Record unless they ‘opted out’ before the end of January 2019. People who cancelled their My Health Record do not have one. A person can delete their My Health Record at any time.
The My Health Record system operates under the My Health Records Act 2012. The Act establishes:
- the role and functions of the System Operator (currently the Australian Digital Health Agency)
- a registration framework for individuals and healthcare provider organisations to participate in the My Health Record system
- a privacy framework specifying which entities can collect, use and disclose certain information in the system and penalties on improper collection, use and disclosure.
A consumer’s My Health Record can include information such as vaccinations, prescriptions, test and scan reports, pathology reports, hospital discharge information and emergency contacts. Authorised healthcare providers can upload and view a patient’s health information, however, it is currently voluntary for providers to upload information.
Prior efforts to increase the volume of health information available in My Health Record have included: financial incentives, industry offers to subsidise the development and rollout of My Health Record functionality, education and engagement, and progress toward national harmonisation of legislation, regulation and policies across governments. See pages 29–31 of the Bill’s Impact Analysis for further information.
The move to sharing by default
A 2020 Review of the My Health Records Legislation recommended that the Australian Government examine options for tying eligibility criteria for specific government health benefit payments to supporting increased core clinical content in My Health Record and extensive adoption by healthcare providers (p. 6).
The Strengthening Medicare Taskforce (established in 2022 to recommend ways to improve primary health care for all Australians) recommended that the Government:
Modernise My Health Record to significantly increase the health information available to individuals and their health care professionals, including by requiring ‘sharing by default’ for private and public practitioners and services, and make it easier for people and their health care teams to use at the point of care. (p. 9)
The Productivity Commission’s 2023 Advancing Prosperity inquiry report recommended using My Health Record as the foundation for sharing and using health data, including by requiring healthcare providers to share relevant health records to My Health Record where a consumer has not opted out (p. 60).
In the 2023-24 Budget, the Australian Government committed $429 million over 2 years to modernise My Health Record, including investment to improve the sharing of pathology and diagnostic imaging information (p. 149).
On 17 September 2023, the Minister for Health and Aged Care announced that the Government would require pathology and diagnostic imaging reports to be uploaded to My Health Record by default.
According to the Impact Analysis:
… some large private providers have indicated that meeting new share by default requirements for uploading reports to My Health Record would not become their standard practice until a legal requirement to do so is established.
… For the sharing by default of health information such as pathology and diagnostic imaging reports to become normal practice, an approach that goes beyond voluntary participation is required. (p. 13)
Consultation
The Impact Analysis provides a detailed overview of consultation undertaken on the proposal, which included targeted consultation, public consultation, state and territory government and partner agency engagement and ongoing engagement with the sector (pp. 75–77). In summary, the Department of Health and Aged Care observed:
Overall, there was general support and recognition of the benefits of introducing a requirement to share by default, noting a range of barriers, challenges, concerns and enablers. Most stakeholders agreed that there should be a requirement to improve health information being made available in My Health Record. They understood and commented on pathology and diagnostic reports being a good place to start. (p. 79)
The Department also noted:
The views of some software vendors and pathology and diagnostic imaging providers are that financial incentives are also required in addition to a requirement to upload, in recognition of the additional resources and costs required to uplift their systems to be conformant with My Health Record. (p. 78)
Further detail on areas of disagreement and potential risks identified by stakeholders are at pages 79–82 of the Impact Analysis.
Policy position of non-government parties
The Coalition did not oppose the Bill passing the House, but sought to refer the Bill to committee in the Senate for further scrutiny, including regarding the details to be set out in ‘currently unseen rules’, explaining:
We want the committee to fully explore any potential issues related to the bill around privacy as well as to achieve a greater understanding of which other health providers will also be subjected to the new mandated requirements.
The Greens supported the Bill in the House and reserved its position in the Senate pending the outcomes of committee inquiry, noting:
There have been considerations raised by advocacy groups about the potential effects of this bill on healthcare providers. There is a likelihood that not all practices that will be subject to this legislation currently have the technical capability for the relevant information sharing. Upgrading software systems can be a costly endeavour and could be a process that would delay compliance. The Greens want to hear from the impacted practitioners about the impact that this bill would have on them.
The Senate Community Affairs Legislation Committee is inquiring into the Bill and is due to report by 30 January 2025.
Key issues and provisions
An outline of the key elements of the legislative framework can be found at pages 3–4 of the Explanatory Memorandum. The Department of Health and Aged Care has also published a Frequently Asked Questions document on the Bill and made a joint submission (with the Australian Digital Health Agency) regarding the Bill to the Senate Community Affairs Legislation Committee.
Requirements to register and upload certain information
Part 1 of Schedule 1 concerns amendments to the MHR Act.
Item 5 inserts proposed section 41A, which requires prescribed healthcare provider organisations to be registered under the MHR Act. As defined in proposed amendments to section 5 at item 3, a prescribed healthcare provider organisation is a Constitutional corporation of a kind specified in the My Health Records Rules.[1]
Item 16 inserts proposed section 78A. This requires registered prescribed healthcare provider organisations to share certain information with the My Health Record system within the period specified in the My Health Records Rules unless an exception applies.
Proposed section 41B (at item 5) provides for healthcare provider organisations to apply to the System Operator (the Australian Digital Health Agency) for an extension of the time required to register. Proposed section 78B (at item 16) provides for prescribed healthcare organisations to apply to the System Operator to approve a period during which sharing is not required. In both circumstances, the System Operator must take into account the organisation’s size and technological readiness, impacts on the provision of healthcare and any other relevant considerations (proposed subsections 41B(6) and 78B(6) respectively). Items 21 and 23 amend section 97 (review of decisions)[2] to provide that a decision to deny an extension under sections 41B or 78B is subject to review.
Consumer, clinical and technical exceptions are available
Proposed section 10B outlines circumstances where an upload exception applies:
- if the healthcare recipient does not have a My Health Record (10B(a))
- the healthcare recipient (or their authorised or nominated representative) has advised that the information must not be uploaded (10B(b))
- an individual healthcare provider reasonably believes that the information should not be shared with the My Health Record system because of a serious concern for the health, safety or wellbeing of the individual (10B(c))
- the information cannot be shared due to circumstances beyond the reasonable control of the entity (10B(d)).
Further exceptions are detailed in proposed subsection 78A(3), for example, that another organisation has already shared the information with My Health Record, or that state or territory law prevents the sharing of the information.
The Consumers Health Forum (CHF) considers the upload exceptions are reasonable, comprehensive and consistent with those requested by consumers. However, it queries how proposed paragraph 10B(c) will be managed and whether there is any mechanism to prevent providers from excessively relying on this exception. CHF recommends mechanisms be put in place to detect operators with unusually high utilisation rates for this exception.
COTA (representing older Australians) argues the clinical exception allowing a healthcare provider to permanently prevent information being included in My Health Record ‘removes consumer choice and control and allows the continuation of paternalistic approaches to health care information by health professionals’ (p. 3). COTA urges removal of this exception, otherwise addition of requirements for providers to obtain informed consent from patients that such information never be uploaded.
LGBTIQ+ Health Australia (peak body promoting health and wellbeing of LGBTIQ+ people and communities) raised privacy and safety concerns for LGBTIQ+ populations. Specifically:
Automatic uploading of sensitive health data to the MHR system, such as pathology results for blood‑borne virus testing or hormone levels, could unintentionally disclose personal information to healthcare providers or third parties, violating privacy and exacerbating mistrust … Sharing by default may discourage individuals from seeking necessary care, particularly for stigmatised health issues, if they fear breaches of confidentiality. (p. 2)
LGBTIQ+ Health Australia suggests introduction of mechanisms to allow consumers to opt out of the automatic upload of specific types of pathology or diagnostic imaging results (rather than just individual results at time of collection), targeted education campaigns to support LGBTIQ+ populations to navigate My Health Record privacy settings and establishing clear accountability measures for inappropriate access or misuse of sensitive health data.
The Australian Diagnostic Imaging Association has called for further clarification of the scope of exceptions in the rules, for example, when a patient is unable to make an informed choice about consenting to the uploading of information, guidance on tests and/or patient populations to be automatically excepted from sharing requirements, and clarification of technical exceptions (p. 2).
Civil penalties apply
Civil penalties apply for failure to comply with requirements, including a maximum penalty of 250 penalty units ($82,500)[3] for not registering in compliance with proposed section 41A, and 30 penalty units ($9,900) for failing to upload required information in the specified time in accordance with proposed section 78A.
Australian Pathology (representing private pathology businesses) and the Royal College of Pathologists of Australasia have urged amendments to remove the civil penalties, or limit them to instances of intentional and malicious withholding of patient information.
The Australian Diagnostic Imaging Association called for lead time of at least 12 months before application of civil penalty provisions (and tied Medicare rebates), to enable extensive testing of exceptions (p. 1).
Medicare benefits to be repaid by healthcare provider if upload requirements are not met
Part 2 of Schedule 1 amends the HI Act to provide that Medicare benefits will no longer be payable for prescribed healthcare services, unless required information is shared to the My Health Record system.
Proposed section 19AI provides for the Minister to make rules concerning the upload requirements required or permitted by the Act (referred to as the upload rules).
Proposed subsection 19AD(1) provides that a Medicare benefit is not payable in respect of a professional service specified in the upload rules unless the person providing the service shares information specified in the upload rules with the My Health Record system within the time period specified in the upload rules. Exceptions are set out in proposed subsection 19AD(2) and mirror those contained in subsection 78A(3) in Part 1. Similar to provisions included in Part 1, proposed section 19AE allows entities to apply to the My Health System Operator to approve a period in which the entity is not required to share information with the My Health Record system. A note clarifies that the Operator can use the same application form and process for the purposes of this section and section 78B of the MHR Act, discussed above.
Proposed section 19AG provides for advance payment before information is shared with the My Health Record system. Proposed section 19AH provides for recovery of payments from the service provider where they have not uploaded, by the end of the period specified in the upload rules, information specified in the upload rules.
In summary, the Bill establishes a post payment compliance framework, whereby benefits will continue to be paid to patients per current processes (that is, they are not dependent on the upload occurring). However, should the healthcare provider fail to upload the required information within the required timeframe, the Medicare benefit would be retained by the patient but repayable to the Australian Government by the provider.
Substantial detail is to be defined in rules
The Bill provides for substantial detail to be set out in 2 sets of yet to be made available rules. With respect to MHR Act requirements, this will be through a My Health Records Rule (it is unclear if this will be through a new rule or amendment of an existing rule, such as the My Health Records Rule 2016). With respect to HI Act requirements, a new set of rules (the upload rules) will be developed. The rules will be disallowable. Essentially, the Bill’s requirements will not come into force until the rules are made. The rules will include:
- the kinds of healthcare providers required to register under section 41A of the MHR Act
- the kinds of healthcare services for which information is to be uploaded
- the information to be uploaded
- the time period within which information must be shared with My Health Record
- additional information on exceptions.[4]
The Department of Health and Aged Care explains that:
The Bill … intentionally does not dictate what health service, or health practitioner and what health information, is in scope of the requirement. This detail is intentionally prescribed in Rules to support flexibility to adapt as health services and community health needs change over time. (p. 17)
The Department further states that based on consultation to date, the readiness of the pathology and diagnostic imaging sectors, and the clinical impact of associated health services, it intends to initially consult on amendments:
… that would require constitutional corporations that are proprietors of pathology labs and diagnostic imaging premises to upload reports about prescribed pathology and diagnostic imaging services. (p. 17)
No further detail or timeline regarding future providers and types of healthcare services to be included in upload requirements is available, beyond the Department noting that during previous consultations, ‘the benefits of sharing information about medication management have been highlighted consistently.’ (p. 17).
Australian Pathology and the Royal College of Pathologists of Australasia have urged the Bill be amended to require the My Health Records Rules to be subject to regular and independent statutory review.
Most stakeholders are generally supportive
Several stakeholders made submissions on the Bill to the Senate Community Affairs Legislation Committee. Many have been broadly supportive of the Bill.
Australian Pathology considers the Bill has some flaws and does not represent ‘appropriate or good public policy at the current time, given the state of existing medical information systems and the current clinical practice of medicine in Australia’ (p. 7). It has suggested passage of the legislation should be delayed until there has been consultation with all stakeholders in the health sector who may be affected in future (pp. 2, 5–6). Australian Pathology’s submission identified several concerns including limited consultation and compressed timeframes to respond on the specifics of the Bill, and that compliance will incur significant costs for providers. If the Bill is to be passed, Australian Pathology has suggested several amendments, including that the Bill not come into force until 2026 at the earliest, ‘to allow for proper consultation on the detail of clinical exclusions and other technical aspects of the systems implementation’ (p. 2).
Timing of patient access to My Health Record information
The Government’s September 2023 announcement of My Health Record upgrades stated patients would be able to see reports immediately after they are uploaded, unless there is a clear need to delay a report to protect the wellbeing of a patient. This would represent a change to the long-standing ‘7-day delay’ arrangements. The 7-day delay has in recent years been removed for a small number of tests, including COVID-19 pathology results and pathology results for 13 other respiratory pathogens (see consultation paper for further background and detail).
COTA supports moving to immediate access by an individual to their results as the default, with an optional healthcare provider-initiated delay. The Health Care Consumers Association noted positive consumer responses to real time test results being available through the ACT Government’s My Digital Health Record.
Medical groups are opposed to any change to current arrangements (see also RACGP submission and comments from the Australian Medical Association).
The Bill does not change current arrangements (which appear to be set in policy rather than legislation), but it is possible changes could come in the subsequent rules. The Department of Health and Aged Care recently stated:
The Australian Digital Health Agency has established a Clinical Reference Group that is currently reviewing the existing 7-day consumer access delay policy. Any changes will involve further consultation and be made following the establishment of the ‘share by default’ legislative framework (p. 3).
The Department of Health and Aged Care and ADHA submission to the Senate Community Affairs Legislation Committee notes:
It is intended that healthcare recipients should have access to their health information at the same time as their healthcare provider, unless exceptions, including those related to clinical safety apply. For pathology and diagnostic imaging, it is proposed to require sharing at the same time as results are sent to the referring healthcare provider. (p. 18)
Concluding comments
In establishing a framework for mandatory uploading of health information, this Bill represents the most significant change to the My Health Records system since move to an opt-out system. It reflects continued efforts to enhance the utility of the My Health Record system for consumers, healthcare providers and the health system.
The Bill provides a broad framework of requirements, exceptions, and civil and financial penalties, however significant implementation details will be contained in yet to be defined rules. Stakeholders are generally supportive of the policy intent but have identified a range of issues to be worked through in developing these rules.