My Health Record will share de-identified data by default

De-identified health data from the personal e-health records that will soon be created for every citizen will be mined by default under the Department of Health’s yet-to-be released secondary data uses plan.

The department said in answers to questions on notice at additional budget estimates hearings that My Health Record data would be provided for research and public health purposes uses unless citizens opted out.

“Individuals will be able to choose to opt-out of having their data used for secondary purposes through the My Health Record access controls,” it said.

The advice comes ahead of the release of the framework for the secondary uses of My Health Record data which is currently planned for the middle of this year.

It “will specify the access process, identify permitted uses of My Health Record data and determine the timing of release of data”.

The department has spent the last several years developing the framework, approaching the market for advice on the steps it would need to take before allowing the “secondary use” of the information collected.

It is keen to make data available for “public health policy, planning and research purposes”, as well as to improve healthcare services and treatments.

Health industry management firm HealthConsult was engaged in 2015 to begin consultations on the development of processes and controls for the use of My Health Record data, and last year the department opened the consultation process to the public.

Data collected through the My Health Record cannot currently be used for any secondary purposes, and remains accessible to only individuals and healthcare providers.

The opt-out approach to secondary uses of data is in keeping with the rest of the record, which allows users to restrict access to healthcare providers or remove documents using privacy and security controls.

However it is not yet clear if users will be prompted to alter the automatically set permission control toggle feature.

In the case of the My Health Record opt-out, consent is implied if a person does not opt-out.

A spokesperson for the Department of Health declined to comment on how the consent process would work, but said the operator of the record system, the Australian Digital Health Agency, would be responsible for "establishing the access controls and associated messaging".

The ADHA has recently begun to ramp up preparations for the nearing three-month My Health Record opt-out period.

It recently entered a partnership with the Royal Australian College of General Practitioners (RACGP) to improve awareness around the My Health Record.

The education program will prepare GPs for questions about the purpose of the e-health record and its use during the opt-out process.

The agency is also currently on the hunt for a peak stakeholder liaison officer to oversee the opt-out period.