The deadline to opt-out of the federal government's controversial My Health Record system should be extended by 12 months and legislation substantially rewritten to safeguard patients' safety and privacy, a Senate inquiry has found.
The Labor-led inquiry, which released its findings on Thursday, found that Health Minister Greg Hunt's implementation of an opt-out model had meant that “an unreasonable compromise may have been struck" between the system's utility and patient rights.
Opposition health spokeswoman Catherine King renewed Labor's call for the government to suspend the My Health Record rollout and "commission an independent review of privacy provisions".
Labor has already promised to extend the opt-out period by a year beyond the November 15 deadline if the party wins government.
But Health Minister Hunt refused to further extend the opt-out following the Senate report's release.
“The opt-out date has already been extended and the opt-outs are travelling at a significantly lower rate than expected," a spokesperson for Minister Hunt said. "We will not be extending it further as it would not be appropriate to delay the benefits to patients."
The spokesperson added that the government would "review and respond to other items in the report".
Submissions to the inquiry by privacy advocates, domestic violence campaigners, medical practitioners and unions had raised a raft of concerns about the potential for sensitive data to be misused by employers, insurance companies and even violent offenders seeking information about the whereabouts of their former partners.
Default access codes, locking out employer doctors, restriction on data matching by government agencies and a blanket ban on commercial use of data were some of the amendments proposed in the Senate report.
"Access codes should be applied to each My Health Record as a default and ... individuals should be required to choose to remove the code," the report said.
Currently, it is up to patients to set-up access codes and most people enrolled in the system have not done so.
"The committee further recommends that the ability to override access codes in the case of an emergency should only be available to registered healthcare providers for use in extraordinary and urgent situations," the report said.
It also called on Mr Hunt to "extend the period for which a My Health Record can be suspended in the case of serious risk to the healthcare recipient, such as in a domestic violence incident" beyond the current 30 days, and strengthen the legislation to ensure that patient data could not be used for commercial purposes.
Currently, while data may not be used soley for commercial purposes, it can be used for a mixed public health and commercial purpose.
The Community Affairs References Committee also recommended that the government amend the My Health Record Act "to protect the privacy of children aged 14 to 17 years unless they expressly request that a parent be a nominated representative".
Doctors had warned that the current system could undermine the ability of young people to access confidential medical care, by discouraging them to discuss their sexual health with their GP.
Mr Hunt has already drafted an amendment to the My Health Record Act to ensure that patient records will be destroyed if the person decides to opt out of the system, and the police will only be able to access records with a court order.
A separate Senate committee last week recommended that those amendments be passed.
The Community Affairs References Committee said the agency in charge of My Health Record, the Australian Digital Health Agency, should engage with "vulnerable groups" and provide additional support "to ensure that they have the means to decide whether to opt out, whether to adjust the access controls within their My Health Record and how to do this".
A ban on third-party access without patients' explicit consent, except "to maintain accurate contact information", was recommended by the committee, which said the legislation must be amended to make clear that a person's My Health Record "cannot be accessed for employment or insurance purposes".
Data matching by government agencies should be restricted to a person's name, address, date of birth and contact information, it said.
The ADHA should "revise its media strategy" to provide "more targeted comprehensive education" and report regularly and comprehensively to Parliament" on the My Health Record system's management, the report said.
