Chapter 1


Chapter 1

Introduction

Referral

1.1        On 15 October 2015, the Senate referred the provisions of the Health Legislation Amendment (eHealth) Bill 2015 (Bill) to the Senate Community Affairs Legislation Committee (committee) for inquiry and report by 9 November 2015.[1]

1.2        The reason for referral outlined in the Selection of Bills report was to give detailed consideration to 'the implications of the changes to the collection, distribution and use of personal information' outlined in the Bill.[2]

Conduct of the inquiry

1.3        Details of the inquiry, including a link to the Bill and associated documents, were placed on the committee's website. The committee also wrote to 16 organisations and individuals, inviting submissions by 29 October 2015.

1.4        The committee received 12 submissions. Submissions are listed at Appendix 1 and published on the committee's website.

Background

1.5        The personally controlled electronic health record (PCEHR) system allows individuals and their healthcare providers to access their key health information online. The PCEHR system was implemented in July 2012 in response to recommendations by the Department of Health's Healthcare Identifiers Act and Service Review, Final Report 2013 to improve the Healthcare Identifiers Service, a national system for consistently identifying individuals, individual healthcare providers and healthcare provider organisations for healthcare communication purposes.[3]

1.6        A review of the PCEHR system was undertaken in 2013.[4] The review found that 'there was overwhelming support for continuing implementation of a consistent electronic health record system for all Australians, but that a change in approach was needed to correct early implementation issues'.[5] The review made thirty-eight recommendations, including:

  • establishing new governance arrangements;
  • moving to an opt-out system for individual participation; and
  • improving system usability and the clinical content of records.[6]

1.7        In the 2015-16 Budget, the Government announced it would provide $485.1 million over four years in response to the PCEHR review to 'continue the operation of the eHealth system, make key system and governance improvements and implement trials of opt‑out arrangements'. This included renaming the PCEHR as My Health Records and transitioning governance arrangements from the National E‑Health Transition Authority to the new Australian Commission for eHealth. The Government also announced that trials would be held in at least two regions in 2016 to 'assess public and provider responses to revised participation arrangements, including to an opt‑out model'.[7]

1.8        In her second reading speech, the Minister for Health (Minister), the Hon Sussan Ley MP, noted that the Bill:

...takes the first important steps to reboot our national electronic health records system to deliver an effective system that will help improve the health of all Australians, as well as realising the benefits that instant access to and sharing of electronic health records can provide.[8]

Purpose and key provisions of the Bill

1.9        The Bill proposes to amend the Personally Controlled Electronic Health Records Act 2012 (PCEHR Act), Healthcare Identifiers Act 2010 (HI Act), Privacy Act 1988 (Privacy Act), Copyright Act 1968 (Copyright Act), Health Insurance Act 1973 (Health Insurance Act) and National Health Act 1953 (National Health Act) to:

  • change the name of the PCEHR system to the My Health Record system;
  • enable trials of opt-out participation for individuals to be undertaken and, if the trials prove successful at improving uptake of the system, enable opt-out to be implemented nationally;
  • prepare for establishment of the Australian Commission for eHealth (to be progressed separately through rules made under the Public Governance, Performance and Accountability Act 2013);
  • revise the way permission to collect, use and disclose information is presented and include several new permissions necessary for effective operation of the PCEHR system and Healthcare Identifiers Service;
  • introduce new civil and criminal penalties and make enforceable undertakings and injunctions available in both systems;
  • remove restrictions on sharing of healthcare provider organisation information;
  • clarify that health-related disability, palliative care and aged care services are considered health services;
  • apply mandatory data breach notification requirements equally to all participants in the My Health Record system; and
  • revise the obligations of people who provide decision-making support.[9]

1.10      The Bill is comprised of four schedules. Schedules 1 to 3 of the Bill would commence upon Royal Assent. However, application provisions in proposed part 2 of schedule 1 would mean that some provisions in schedules 1 to 3 will not apply until a later time fixed by proclamation. Schedule 4 would commence at various specified times.[10]

Schedule 1 – Healthcare identifiers and health records

Part 1 – Amendments

1.11      This part proposes to amend the handling of healthcare identifiers and the information flows relating to the PCEHR system (to be renamed the My Health Record system under schedule 2), and allow for a trial of an opt-out My Health Record system.[11]

Trials of opt-out arrangements

1.12      Item 106 proposes changes to the PCEHR Act to provide the authorisations necessary for opt-out trial regions to be selected and for healthcare recipients to be registered and their information uploaded to the My Health Record system for use by participants for health purposes.[12] This measure also ensures that healthcare recipients can choose to opt-out.[13]

1.13       The proposed changes provide rule-making powers for the Minister to 'impose opt-out participation for healthcare recipients', allowing the Minster to prescribe opt-out arrangements to a class or classes of people. The trial rules are not required to set a time frame for the trial; however, if a timeframe is specified and the trial concludes without a decision being made to extend the trial or implement opt-out arrangements nationally, the system will revert back to an opt-in system. In making the trial rules, the proposed measure requires that the Minister must:

  • be satisfied that applying opt-out to the class, or classes, of healthcare recipients will provide evidence of whether the opt-out arrangements result in participation in the My Health Record system at a level that provides value to those using the My Health Record system; and
  • consult with the subcommittee to the Ministerial Council. The EM notes that in practice, the Australian Health Ministers' Advisory Council will be consulted.[14]

1.14      In addition, the proposed changes provide that the Minister may make rules to implement the opt-out arrangements nationally 'provided the outcomes of the opt-out trials have demonstrated the value in adopting an opt-out model'.[15]

New governance arrangements

1.15      Item 72 proposes changes to the PCEHR Act to abolish the Independent Advisory Council and Jurisdictional Advisory Council that currently provide advice to the System Operator. The EM notes that in 2016, it is intended that the yet to be established Australian Commission for eHealth will become the new System Operator and new advisory bodies will be established as part of this new entity.[16]

Simplification of privacy framework

1.16      Item 34 proposes changes to the HI Act to insert restructured provisions 'to make clear how and why healthcare identifiers and other information can be used, and by whom'.[17]

1.17      Proposed new subsections 20 and 25D of the HI Act would allow for future regulations to be made allowing prescribed entities to collect, use, disclose and adopt identifying information and healthcare identifiers. This includes limits to ensure that regulations may only be made authorising the collection, use or disclosure of identifying information and healthcare identifiers for purposes related to the provision of healthcare or to assist people who, because of health issues including illness, disability or injury, require support.[18]

Criminal and civil penalties

1.18      Item 36 proposes changes to the penalties for contravening the prohibitions on the use or disclosure of a healthcare identifier outlined in current section 26 of the HI Act.[19] The proposed changes would amend the existing prohibitions and exemptions and introduce the following penalties:

  • a civil penalty of up to 600 penalty units (currently $108 000 for individuals and $540 000 for bodies corporate); or
  • a criminal penalty of up to two years' imprisonment and/or 120 penalty units (currently $21 600 for individuals and $108 000 for bodies corporate).[20]
Restrictions on sharing healthcare provider organisation information

1.19      Item 1 proposes changes to the Copyright Act to simplify the registration process for healthcare provider organisations to participate in the PCEHR system. This would include copyright infringement exemption to 'ensure that sharing and use of health records does not infringe any copyright that might subsist in health records'.[21]

Definition of 'health services'

1.20      Items 99 to 101 propose changes to the definition of 'health service' to include that a health service is 'an activity performed in relation to an individual that is intended or claimed (expressly or otherwise) by the individual or the person performing it':

  • to assess, maintain or improve the individual's health;
  • where the individual's health cannot be maintained or improved – to manage the individual's health;
  • to diagnose the individual's illness, disability or injury;
  • to treat the individual's illness, disability or injury, or suspected illness, disability or injury;
  • to record the individual's health for the purposes of assessing, maintaining, improving or managing the individual's health.[22]

1.21      The EM noted that this change responds to a recommendation by the Australian Law Reform Commission's 2008 report, For Your Information: Australian Privacy Law and Practice.[23]

Mandatory data breach notification requirements

1.22      Item 90 proposes changes to the PCEHR Act to centralise data breach reporting requirements for all participants in the My Health Record system. Proposed new section 75 of the PCEHR Act would require that data breach reporting would apply to:

  • the unauthorised collection, use and disclosure of health information in an individual's My Health Record;
  • any event that has, or may have, occurred that compromises, may compromise, has compromised or may have compromised the security or integrity of the My Health Record system; or
  • any circumstances that have, or may have arisen (whether or not involving a contravention of the Act), that compromise, may compromise, have compromised or may have compromised the security or integrity of the My Health Record system.[24]
Obligations of people who provide decision-making support

1.23      Items 63 and 64 propose changes to the PCEHR Act to provide that a person providing decision-making support 'should, instead of acting in the person's best interests, give effect to the 'will and preferences' of the person to whom they provide decision-making support. The EM noted that this proposed change responds to a recommendation by the Australian Law Reform Commission's 2014 report, Equality, Capacity and Disability in Commonwealth Laws.[25]

Part 2 – Rule-making powers, application and transitional provisions

1.24      This part describes how the changes set out in part 1 of the Bill would operate and have effect and when the various changes would commence.[26]

Henry VII clause

1.25      Item 128 proposes changes to allow the Minister to modify the operation of the HI Act, PCEHR Act and Privacy Act by making rules, and may result in the operation of primary legislation being expressly or impliedly amended by subordinate legislation (known as the Henry VIII clause).[27] The EM notes this clause is required for transition purposes and is consistent with similar rule-making powers. The EM asserts that the purposes of the provision is to:

...allow the Minister to deal with any unforseen or unintended consequences that may arise at a later date, specifically regarding the opt-out trials and the changes in governance of the System Operator to the Australian Commission for eHealth.[28]

Schedule 2 – Renaming PCEHR as My Health Record

1.26      This schedule proposes to amend the Health Insurance Act and the National Health Act to change the name of the PCEHR to the My Health Record. The EM notes that this change is intended to 'recognise that a health record is the result of a partnership between a healthcare recipient and a healthcare provider' and that 'it is becoming unnecessary to differentiate between digital and physical information'.[29]

Schedule 3 – Renaming consumers as healthcare recipients

1.27      This schedule proposes to amend the Health Insurance Act, National Health Act and PCEHR Act to change all references from 'consumer' to 'healthcare recipient'. The EM notes that this change aims to align with the terminology used in the HI Act.[30]

Schedule 4 – Further consequential amendments

1.28      This schedule proposes to make further consequential amendments to align terminology and clarify when the Minister, the Secretary and the Chief Executive Medicare may delegate their powers.[31]

Financial implications

1.29      In the 2015-16 Budget, the Government announced funding of $485.1 million over four years for the My Health Record system. The EM noted that the measures outlined in the Bill are expected to cost $57.7 million over the forward estimates.[32]

Consideration by other committees

1.30      The Parliamentary Joint Committee on Human Rights (PJCHR) considered the Bill and found that:

  • the opt-out model provided for by the Bill engages and limits the right to privacy;
  • the automatic inclusion of the health records of all children and persons with disability engages and limits the rights of children and persons with disability; and
  • the civil penalty provisions engage and may limit the right to a fair hearing.

1.31      The PJCHR sought advice from the Minister as to:

  • whether there is reasoning or evidence that establishes that the stated objective addresses a pressing or substantial concern or whether the proposed changes are otherwise aimed at achieving a legitimate objective;
  • whether there is a rational connection between the limitation and that objective; and
  • whether the limitations is a reasonable and proportionate measure for the achievement of that objective.[33]

1.32      The Minister's response had not been published by the time this inquiry had concluded.[34]

1.33      The Senate Standing Committee for the Scrutiny of Bills (Scrutiny Committee) made a number of comments on the Bill in its Alert Digest of 14 October 2015. The Scrutiny Committee sought explanation from the Minister on:

  • the rationale for placing an evidential burden on the defendant for the increased civil and criminal penalties;
  • concerns about provisions that would allow the My Health Records Rules to incorporate other material which may change from time to time, and asked whether a requirement that any material 'incorporated by reference be freely and readily available' can be included in the Bill itself;
  • why the conduct of the trials of the opt-out model are provided for in delegated legislation, rather than the matter being considered by Parliament and the change being made through an amendment to the primary legislation; and
  • more information, and examples of possible circumstances in which the 'Henry VIII clause' could be needed, to assist the committee in understanding why the clause is necessary.[35]

1.34      The Minister's response had not been published by the time this inquiry had concluded.[36]

Acknowledgement

1.35      The committee thanks those individuals and organisations that made submissions.

Navigation: Previous Page | Contents | Next Page