To:  A Suite of Senators
Subject: Email/submission sent to all Senators
Date: Fri, 30 Oct 2015 14:58:00 +1100

The Australian Privacy Foundation has major concerns with the PCEHR and the government's proposals to make it opt-out.

We have made a submission to the Community Affairs Committee (attached) which explains and justifies our position and claims.

We are sending this to every Senator in an attempt to draw attention to the highly dangerous proposals of the government to create an eHealth record for all Australians whether they need one or not. The risks of creating such a massive and intrusive database of health and personal data with very poor security and access controls make other breaches pale into insignificance.

The best ways to prevent data from leaking are a) only hold that data you really must keep and b) put the most stringent security and access controls on all aspects of the system. The PCEHR and making it opt-out does neither.

We encourage Senators to read our submission and form their own opinion as to the wisdom of allowing the government to take such a gung-ho attitude to Australian's safety and welfare.

We draw Senator's attention to just a few recent media reports on vulnerable government IT systems. The PCEHR is just as susceptible, if not more so, to attack and data leakages. Criminal sanctions are highly unlikely to prevent such failings.

Five hundred tax file numbers hacked every day
Date October 30, 2015 - 6:51AM
http://www.smh.com.au/it-pro/security-it/five-hundred-tax-file-numbers-hacked-every-day-20151028-gklcx7.html 

Medicare scam hits patients: Confidential files stolen from medical centres
Date: September 22, 2015 12:00am
http://www.dailytelegraph.com.au/news/nsw/medicare-scam-hits-patients-confidential-files-stolen-from-medical-centres/story-fni0cx12-1227537621350?sv=6b3199f7e728e36b3bd54dbbae226630 

Do the Senators wish to be held responsible for data leaks and breaches that could ruin people's lives? That could lead abusive partners to their families trying to flee from attacks and vengeance? That could result in identity theft and fraud against individuals and the government?

We also draw Seantor's attention to this article which discusses reputational damage in the case of data breaches.

The reputational damage of data breaches: don’t hope for customer apathy
29 October, 2015 14:16
http://www.cso.com.au/blog/cso-bloggers/2015/10/29/the-reputational-damage-of-data-breaches-dont-hope-for-customer-apathy/ 

The final paragraph is worth repeating and we ask Senators to consider how it might translate into the context of voter's health data and the political ramifications:

"Reputational damage of a data breach is complex to measure and is dependent on the type of business service offered, the customer base segmentation, the competitive landscape, any goodwill that might already be established towards the brand, timing and the type of data exposed. A breach will either result in a short-lived impact or total loss of business. What’s certain is the impact on the personal branding of top executives like CIOs, CISOs and IT managers, whose careers could literally end overnight."

The following are some further observations, beyond those we included in our submission.

After a decade of engagement, we now have reservations about the latest turn-around: to make the  re-branded, unpopular and under-used eHealth record system rely on an "opt-out" process to manufacture deemed consent. Our reservations centre on the risk many people will now face having a new, redundant, poorly-secured centrally-controlled record without even realising some of their sensitive medical and personal data has been harvested and put into a system accessible from the Internet - not the safest of places.

This appears to be done solely to crank up the the bureaucrats Key Performance Indicator of "numbers enrolled", conveniently avoiding the messy problem of actually having to persuade Australians to voluntarily opt-In (which they have proven consistently reluctant to do, given the choice), and which they would have done if they saw any benefit in it.

Health Minister Sussan Ley's comments at the press club on Wednesday 28 October suggest that the government is now proposing to weaken further the already ambiguous, uncertain, incomprehensible and largely useless access controls on the Personally Controlled eHealth Record.

A major reason for this claim is that the access controls operate at the institution level, not the individual level. A patient will not know who has looked at their record, only that someone from a health care institution has. That someone could have been a receptionist, an admin assistant or a world leading cardio-thoracic specialist. So much for control and awareness.

We compare the access controls on the PCEHR with just about every other Federal Government IT system where each user not only has a unique UserID/Password but they are only allowed to access that data for which that have a valid need to know. They've also all had a police check and have been security vetted. Does the Federal government really believe that the data in its own IT systems is more important than the health and personal information on most Australians?

Even worse, the PCEHR also creates an un-necessary new potential target for bad actors intent on fraud and identity theft, for over-zealous governments unwilling to accept your sensitive personal medical life-story is not theirs to "share", and for overly-opportunistic businesses keen to monetise such highly prized information. The more data in the system, the more attractive it becomes.

It is a little acknowledged fact that the existing PCEHR legislation allows the operators of the PCEHR to give patient's health and other personal data to law enforcement bodies and those protecting public revenue (read the ATO, amongst others). Without a court order. Without informing parliament. Without informing the patient. The government has not been particularly keen to publicise this, but it's there in Section 70 of the eHealth Act 2102 (and our submission) for all to see.

It is important to note that APF, which has input from a range of relevant expertise in medical informatics, risk management and health care research, remains supportive of and committed to the application of information technology and advanced data analytical capabilities to clinical treatment, medical research and the efficient operation of the health system. However, it needs to proceed on a basis of trust, respect and mutual confidence.

What we object to is the implementation of a flawed, risky and unjustified data aggregation project and have it forced upon every Australian. Only some will have the ability and capability to opt-out. Everyone else will be sucked in.

The modern online economy relies on digital citizens having a real choice, and being willing to exercise it, not to be 'nudged' or tricked into it. This re-animation of an old, moribund and unconvincing data aggregation project is not a promising start for the new-look government. The design needs a complete re-think followed by a few iterations in the Gov-hack lab. It also needs a more basic respect for the punters' rights, before it is ready for release. We also think that the new ACeH should be running with this well before the Department of Health is allowed to start opt-out trials.

Bernard Robertson-Dunn

-- 

Dr Bernard Robertson-Dunn
Australian Privacy Foundation
Chair Health Sub-Committee
Bernard.Robertson-Dunn@privacy.org.au