Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Joint Select Committee on Cyber-Safety
Cybersafety for senior Australians

BENNETT, Ms Carol, Chief Executive Officer, Consumers Health Forum of Australia

GREENWOOD, Ms Anna, Deputy Chief Executive Officer, Consumers Health Forum of Australia

Committee met at 16:25

CHAIR ( Senator Bilyk ): I now declare open this public hearing for the Joint Select Committee on Cyber-Safety's inquiry into cybersafety for senior Australians. I ask a member to move that the committee authorises audio broadcasting of the evidence about to be given at the public hearing this day.

Mr HAWKE: So moved.

CHAIR: There being no objection, it is so resolved. I welcome our witnesses. The Consumers Health Forum of Australia has told the committee, in its submission to this inquiry, that it has some concerns about issues relating to safety and security for older consumers in relation to personally controlled electronic health records. Thank you for your submission, which has been received as No. 15 to the committee's inquiry. Before proceeding, I remind you that this is a public hearing and is being recorded by Hansard and audio broadcast. Although the committee does not require you to give evidence under oath, I should advise you that this hearing is a legal proceeding of the parliament and warrants the same respect as proceedings of the House and the Senate. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. I now invite Ms Bennet to make an opening statement before we proceed to questions.

Ms Bennett: The Consumers Health Forum is very pleased to be participating in this important inquiry. As you know, we have a particular interest in this inquiry, as many of our members are older Australians or organisations that support older Australians. There are two areas that I want to focus on in my opening remarks today. The first is the vast amount of health information available online. The second, as you have already mentioned, is the recent launch of the personally controlled electronic health records system.

There is a huge volume of information about health and health care online, and we know that almost 80 per cent of Australians use the internet to seek health information. Older Australians who are active users of the internet are particularly likely to seek out this information if they experience chronic or complex health conditions. As we are all aware, the problem is that anyone can put anything on the internet and it can be difficult to assess what is credible and what is not. Many of the submissions to this inquiry have emphasised the importance of education for older consumers, advising them to be wary of online scams and frauds. We would suggest that this education should also include general guidance to consider the credibility of the information, including health information, that they find online.

There are a range of tools and codes that can support consumers to assess health information online. Consumers can also self-assess websites by asking some key questions, such as who has developed the website, whether there are any commercial links and where information has been sourced from. We recognise that government's ability to monitor and control the content of websites is limited, but it could play a role in providing guidance on things to take into account when considering whether online information is credible.

I would like to now turn to the PCEHR system and briefly revisit key points in our submission. CHF is very supportive of the concept of e-health and electronic health records, and older Australians are one of the population groups who can really gain the most benefit from this introduction. But it is really important that we get this system right. Since we provided our submission in February, there have been some changes. The PCEHR system is now live and the legislation which was still under consideration when we made our submission is now law.

Some of our concerns have been addressed. For example, we raised concerns about consumers being coerced into providing access to their PCEHR to third parties such as employers and insurers. The legislation now states that access is only permitted for the purpose of providing health care. Our recommendation that consumers be notified of all breaches of the system affecting their record was also addressed in the final version of the legislation.

Some of our concerns though do remain outstanding. The audit trail will still only provide consumers with information on the healthcare organisations that have accessed the record, not individual health practitioners. We also remain committed to the need for a review of all governance arrangements including complaints handling two years after implementation of the system.

Since the launch of the system other concerns have emerged for CHF. Overall awareness and uptake of the system are very low. We anticipate that this will change over time but we would like to see much greater awareness of the availability of the record and its potential benefits for consumers. Once someone has signed up for the record, we want to be sure that they understand what information it will contain and how they can control that information. Many consumers will be happy to share all their health information with all their health professionals; others though will want to hide and restrict access to sensitive information. It is essential that they have the right and the ability to do this, and the system allows for this in a number of ways: by limiting which health professionals access all or some of the information on their PCEHR, telling a health professional that they do not want a document to be included, or effectively removing a document from their PCEHR. Information is available online about how to do this but it is not clear to us whether this will provide enough education and guidance for consumers, particularly those who have low levels of IT literacy.

Consumers might also face barriers to controlling their health information due to the attitude of some health professionals about the personally controlled nature of the record. The Australian Medical Association has recently released a guide for medical practitioners using the PCEHR, which advises medical practitioners to consider refusing to use the PCEHR for any patient who asks that information not be included in their record, or asks that information be removed from their record. The last thing that we want to see is for Australia's significant investment in better coordination and information sharing not to achieve its full potential because consumers do not know about the potential benefits of the record or do not feel comfortable using it because they are not able to exercise their rights about how they share their information.

To conclude, the internet offers enormous potential benefits for consumers including older consumers with an interest in becoming more informed and playing an active role in their health care. The new PCEHR system creates particularly exciting opportunities, but consumers of all ages need to have access to the right information and know what their rights and responsibilities are if they are going to reap the full benefits.

CHAIR: Thank you, Ms Bennett. Ms Greenwood, would you like to add anything?

Ms Greenwood : No, I have nothing to add.

CHAIR: I thank you for your previous submission. I am wondering whether you are thinking of putting in an up-to-date submission, for the benefit of committee, bearing in mind some of the issues have changed since the legislation has been introduced.

Ms Bennett: We would be very happy to do that and to outline some of the newer concerns that we have as a result of the new legislation.

CHAIR: Thank you. Overall, I think that you are supportive, as you said, of the e-health process though, and I think that is quite good to hear. A couple of the concerns you talked about were the audit trail and the review of complaints. Do you have any specific ideas on how that might be improved? What could be put in place to improve that?

Ms Bennett: From our perspective, we were disappointed that the audit trail did not provide the capacity for the identification of individuals who had accessed the record, because at an organisational level it is very difficult to know which individuals are accessing information about somebody. And that was a particularly important issue for consumers when we consulted with them on the PCEHR—that, in instances where there was a clear breach or they had concerns about who was accessing their record, through an audit trail they would be able to identify which individuals had access to that information. As you know, organisations can be very large, and it can be very difficult to pinpoint who is accessing information and whether that access is legitimate. In order to create confidence in the system, it is important that consumers feel that there are mechanisms in place that protect them if needed. So that was a real disappointment for us, because our understanding was that it would enable the identification of individuals accessing the record.

Ms Greenwood : There is a requirement for healthcare organisations who are involved in the system to be able to identify at an individual level who is accessing the system, but that is not reflected in the audit trail that consumers see. They can only see that X hospital or Y hospital has accessed their record, and that could be an enormous institution.

CHAIR: Okay. Thanks. You mentioned consultations. I am just wondering whether you have any information for the committee about how those consultations have taken place, where they have been, if you have had any complaints, if you keep stats—that sort of stuff. That could really help us as well.

Ms Bennett: Sure. We are very happy to provide you with the reports of those consultations. We have consulted with consumers over the last two or three years about the PCEHR, all around the country, nationally and in particular states, at different stages of the development of the legislation and during its drafting. Consumers raised issues about confidence in the system, so it is critical that the legislation addresses these sorts of issues. There are couple of things there that remain a concern for consumers—the audit trail issue but also the governance of the system, the complaints mechanism and how all of that will work well into the future. It is not clear whether or not there will be a review, but we would certainly like to see a review of that system within two years to see how it is working and how it can be more independent from the Department of Health and Ageing than it is at the moment.

CHAIR: Since the legislation has been in and the program has been up and running, have you had any specific complaints; and, if so, do you have any stats on those?

Ms Bennett: I would not say 'complaints'—

CHAIR: But from someone who is using it now the program is up and running, as opposed to before the legislation was put in place?

Ms Greenwood : We have received some anecdotal reports which have indicated issues with sign-up which now seem to have been resolved. But also a lot of people have indicated that their networks are not really aware of the record. So people who are in our networks have been kept informed through our publications, but often broader networks, without necessarily the same interest in health, are simply not aware of what is going on.

CHAIR: Are you talking about computer networks, computer groups?

Ms Greenwood : No, consumer groups—our member organisations and their members.

Ms Bennett: So the big issue for consumers is, firstly, knowing that this record exists and then knowing what the parameters are around it and how it works for them—how they can sign up, and what protections and controls they have under the legislation if they do choose to sign up. That has been fairly limited to date. We imagine, over time, that there may well be some imperative to educate people about the system if we are to see greater uptake, but so far that has not been the case. Certainly, there have been some teething problems with the sign-up, as Anna said, and that has created a few issues for individuals, but I suppose time will tell just how effective the system is. It is important that it does work when people sign up and that they find it useful; otherwise, it is not going to get the uptake that we need it to have if it is to be effective.

CHAIR: We took evidence from the National E-Health Transition Authority that the web learning centre would include resource packages, including a how-to-register guide for consumers and an assisted registration channel for older Australians who do not have internet access at home.

It may well be—I am not purporting that it is or it is not—that, because it is a new program, and the pilot program was specifically around elderly people or seniors, that it is a bit slower in the uptake. Sometimes things like this take time to build momentum.

Mr HAWKE: The chair referred to an earlier set of evidence we received. We had a discussion around unauthorised access or access which had been authorised but was in the hands of carers, children, other family members or guardians and things like that. Have you got any evidence or have you had any feedback, since the operation in July, about any of that being of concern to consumers? Are they concerned about family members putting pressure on them to access their health records?

Ms Bennett: I suppose the key issues remain. We have not had any specific feedback, I do not think, around authorisation issues, but the sorts of issues that consumers were most concerned about were the age at which people could get individual access to their records. The age is set at 14, consistent with Medicare. I think there were some issues around who the carer or authorised person would be that would be able to access records. So I think those principles that were identified as part of the drafting of the legislation still apply.

Mr HAWKE: So, essentially, is it too early to really have an understanding?

Ms Bennett: In practice we do not know how some of those issues might unfold.

Mr HAWKE: For the seniors it would appear that access to people's passwords and usernames was a concern raised with us. The concern was about people pressuring to have that information.

Ms Greenwood : It came through when we consulted on the legislation late last year, when it was still in the development phase, and consumers were very supportive of the idea of authorised and nominated representatives, particularly with different levels of access being available. But, as you say, with the rollout of the system it will be really worthwhile getting some feedback about how it is working in practice and whether people are feeling pressured.

Ms Bennett: It is difficult to do that at this stage because I think there are 6,000 signed up so far. So it is a bit early to tell. And I am not sure what portion of those are older people.

Mr HAWKE: Are you going to provide that information in terms of demographics?

Ms Bennett: I think you should be able to get that information, certainly from NEHTA. I am sure it is available. That is going to be quite important to evaluate how it is working.

Mr HAWKE: In terms of the overall system, do you feel there are sufficient safeguards around the potential for information to be hacked and sought inappropriately be different organisations—either commercial or otherwise—from what is, essentially, a non-government entity?

Ms Greenwood : The Office of the Australian Information Commissioner is currently consulting on the data breach notification requirements. I think the consultation closes next week. They have set out some quite strict guidelines around who has to be notified when there is a data breach. That goes to the system operator, and consumers will need to be notified when there is any breach that will affect their record. If it is a widespread issue then there is going to have to be a public announcement. Obviously we do not want to get to the point where there have been data breaches but I think there are some pretty strong protections in place.

Mr HAWKE: There has to be transparency as well. Do you feel there is enough in there in terms of transparency? That is one of your concerns in your submission.

Ms Bennett: I think it is going to be really important that this system is evaluated. Yes, we have raised all these concerns, and we have reflected particularly what older people have said. We have a large proportion of older people within our networks because of the fact that they tend to be high-end, chronic-condition users of the system. It is really critical that we have good evaluation mechanisms about how the system works in practice. I guess that is the question mark. We have certainly raised these concerns at the development stage but it would be interesting to know whether that is reflected in practice. These are all important things that we need to flag and keep front of mind in terms of how it works.

CHAIR: Before I go to Mr Zappia, and while the question is fresh in my mind, what specific changes to the legislation would you like to see?

Ms Bennett: There are two of them. The first is the audit trail. As I said, we would like to see individuals who access the record identifiable to consumers who own the record. And if it is to be a consumer centred record then that information is quite important. People need to feel as though they have control of it. The second one is the review of the governance arrangements and how they are working. As a subsequent issue, there needs to be a good evaluation, initially and early, of how the system works to achieve what it sets out to do, which is to provide a better basis for consumers to make informed healthcare decisions, and a more coordinated set of information regarding their healthcare status.

Mr ZAPPIA: Thanks to both of you for your presentation. Firstly, could I just clarify something, and I think Mr Hawke partly touched on it with his own questions. When you say people are concerned about their medical records being accessed by others, can you be more specific about what their concerns actually are?

Ms Bennett: Some of the examples that we were given were things like people did not want their sexual history being accessible by their physiotherapist or their mental health history being accessible by their dentist, for instance. So the controls need to be very specific around which practitioners you are giving access to particular parts of your records to. Not all of your health providers need to have access to all of your information, and there are very good reasons for that. One woman gave us the example of having had an abortion when she was in her early 20s; she had subsequently re-partnered and she did not want her partner to know about her history, and that was a legitimate concern for her. She was concerned about signing up on the basis that that information would be available to her practitioner and possibly to her partner. So there are a whole range of reasons that are very individual and, in some cases, very legitimate why people might not want particular practitioners to access their records. So that control is critical to people feeling confident that they can sign up to the record and not have those sorts of breaches of privacy.

Mr ZAPPIA: Have you had any discussions to ensure that those concerns are going to be, if nothing else, at least considered and taken into account with respect to the system that has been put in place—the e-health system?

Ms Bennett: The system is supposed to be sensitive to people's capacity to nominate a provider and then to screen parts of the record from other providers. The question becomes: is it sensitive enough to protect consumers in those sorts of very specific instances? As I said to you, there are some concerns that, for instance, practitioners might choose not to treat consumers who want greater privacy controls around their own records. That creates concerns amongst the users of the system about how private their information will actually be. They are the sorts of things that I think we really need to closely monitor. If people are not signing up, there may well be good reasons why not, and they are some of the reasons that we have heard from consumers.

Mr ZAPPIA: One of your recommendations talks about Medicare perhaps not being the most appropriate body to which people can appeal. Can you nominate another department, or even an ombudsman, that you would prefer to see instead of Medicare?

Ms Bennett: Consumers did identify a number of options. Do you want to talk about that, Anna?

Ms Greenwood : In our consultations, consumers indicated quite strongly that they wanted governance and complaints-handling to be separate from the Department of Health and Ageing, which has deputised some of its system operator responsibilities to Medicare. We have accepted that, for the initial period, the system operator will be the Department of Health and Ageing in conjunction with Medicare, but that is one of the things that we would really like to see reviewed. Consumers have indicated to us that they want to see an independent governance arrangement which is not directly linked to the department.

Ms Bennett: In terms of the specifics of that, I do not know that there was a particularly firm view, but there were a number of options raised around ombudsmen and healthcare complaints commissioners and so forth. So there are options, but this is where having a review in two years time is quite important—because it is about the oversight of the system and making sure that people feel as though the things that are in place will protect them.

Mr ZAPPIA: Thank you.

Mr HAWKE: Previously this committee has considered an internet ombudsman. Would you see there being a role for that kind of person in this sort of space?

Ms Bennett: I think there is the emergence of greater access to information on line than ever before. In Australia we are talking about 80 per cent of people accessing health information on line; internationally those statistics are even higher. The reality is that we are going to have greater instances in which people accessing information are concerned about their privacy and are concerned about the quality of information, and there are going to be some legitimate concerns that consumers will have as a result of that. That will need some way of being dealt with. Certainly I think there is going to be a greater need for some kind of arbitrator around those kinds of concerns for consumers, and a legitimate avenue for pointing towards complaints that identify system-wide problems that affect consumers.

CHAIR: If there are no further questions, I thank you again for appearing and giving evidence today. We look forward to receiving another submission from you as well. Should the committee have any further questions, the secretariat will seek further comment from you at a later date.

Committee adjourned at 16:51