Nomination for the Australian Privacy Foundation ‘Big Brother Awards’ 2009 
BBA 2009 FINALIST 

Criteria for a BBA 2009 Award
The nominee must  be:
•	in or associated with Australia
•	responsible for a truly outstanding abuse (or defence) of privacy.
As appropriate for the particular Award Category the nominee should be a public or private sector individual or organization, a government program or initiative,  a private sector business activity.
The deed for which they are nominated should have at least partially been put into practice – they lose points for just planning or announcing something!  Further details about BBA2009 are available at http://www.privacy.org.au/bba/.

A.	Name of Nominee

NEHTA – National Electronic Health Transition Authority

B.	Award Category - Privacy Abuser for an “Orwell” Award 

Worst Public Agency or Official – for a government agency or official that has shown a blatant disregard for privacy.

C.	Description 
Award is for failing to address the privacy risks of a unique personal identifier that must be used by all health and aged care providers.

NEHTA recommended that the Commonwealth Government must introduce unique personal identifiers for health care by 1 July 2010. This use of a single identifier, known as an IHI is similar in concept to the Social Security Numbers used in other countries. The  misuse of a unique number assists identity theft and fraud. The IHI has low security because it will be used in all health records, read by health care support staff,  and can be related to a Medicare Number. The IHI raises significant privacy concerns.

NEHTA has recommended to the Commonwealth Government that the payment of public and private benefits for all health and aged care services must be dependent on the provision of data to patients, their authorised carers, and their authorised “health service providers”, in a format that can be integrated into a personal electronic health record. This means that unless patients can segment irrelevant past and/or sensitive health data (eg haemochromatosis, sexual and mental health information), they face significant risks to their privacy and may suffer damage to their personal lives. A patient evidently will not have the right to opt-in to providing access to specific health records segmented by episode or event or health issue.

The definition of “health service provider” has not been confirmed. Publicly available information suggests the definition includes service providers (eg home carers, meals-on-wheels, ear candling professionals) that are not registered medical practitioners. This implies access to sensitive health data will be extended to people who are self-regulating practitioners.

Some unprotected health information relating to other people, including family members will also be made available. Even if a patient does give informed consent to access health data, this recommendation poses privacy risks not only the patient but to others.

There appears to be a culture in NEHTA that is unaware or unwilling to address the privacy concerns related to eHealth. At plenary session of health informatics conference HIC'09 , NEHTA's CEO, Peter Fleming, assured the audience that eHealth security and privacy frameworks posed *NO RISK* with  regard to information privacy. (source: http://www.hisa.org.au/system/files/u2233/hic09_MrPeterFleming.pdf_slide6). 

Despite obvious risks to consumer privacy NEHTA has not engaged in an appropriate consultation process with consumers. NEHTA claims to be consulting stakeholders, but the stakeholder group appears to be health professionals and organizations. The stakeholder group  contains only a single representative consumer group out of 33 members, and none that has a focus on privacy (source:
http://www.nehta.gov.au/about-us/stakeholders).

Even when NEHTA does invite consumer groups to consultation meetings, they attend by invitation only. On at least one occasion representatives of a consumer group were required to sign a confidentiality agreement as a prerequisite for attending a ‘consultation’ meeting which meant they were not able to inform or discuss the content and documents provided with their own members. 

D. 	Evidence of the Actions and References
The range of privacy enquiries authorised by health authorities at NEHTA  some of which raise but have not resulting in addressing privacy concerns to our knowledge, include the following:
1. Some preliminary work on unique health identifiers (UHIs) for health in 2006
2. The PIAs alluded to in NEHTA’s “Privacy Blueprint – Unique Healthcare Identifiers”  (http://www.nehta.gov.au/privacy).
3. A series of discussions by the Consumer & Clinician Forum during 2006-07
4. NEHTA's approach to privacy v1.0, July 2006
5. The Privacy Roundtable on November 17 2006
6. Privacy Blueprint - UHIs v1.0 - December 2006 (at Privacy Context and Strategic Directions)
7. The Shared Electronic Health Record (SEHR) Privacy Roundtable on 28-29 June 2007]
8. The Secondary Uses Roundtable in November 2007
9. Privacy Blueprint for the Individual Electronic Health Record July 08
10. Privacy Blueprint for the Individual Electronic Health Record - Report on feedback November 2008, which was subsequently unpublished but is referenced in NEHTA PowerPoint presentation, of May 2009.
11. A PIA on UHIs that was conducted in early 2008
12. NHHRC Supplementary Paper to its Interim Report - Person-controlled Electronic Health Records for Every Australian (30 April 2009)
13. The PIA on IHIs commissioned in January 2009 and referenced at the consultation workshop May 29th 2009.
14. Final Report of the NHHRC A healthier future for all Australians - June 2009

The range of PIA reports authorised by health authorities at DOHA and its predecessors include, but are not limited to our knowledge, the following:
1. The Electronic Consent Symposium 16th & 17th July 2002
2. National Health Privacy Code (draft) Consultation Paper, The Australian Health Ministers’ Advisory Council, National Health Privacy Working Group, December 2002
3. COAG Health Working Group - Consumer Consultation 25 October 2006
4. National eHealth Strategy forum, 30 March 2009
5. APF IHI submission (www.privacy.org.au)

The Australian Privacy Foundation’s policy statement on ‘eHealth Data and Health Identifiers’ is at http://www.privacy.org.au/Papers.eHealth-Policy-090828.pdf

E.  Why the Nominee Deserves the Award
Scope of the Impact
The scope of the proposal affects all Australians and visitors to Australia who seek health care. It affects all health providers and many ancillary services (eg home care, chemists). 

Seriousness of the Impact
The proposal for a IHI as a unique identifier creates an additional risk of identity theft and fraud. It also poses a risk to privacy because of the link to personal data and health information. The risk can result from the provider (eg poor data management, carelessness, insecure systems, deliberate misuse of data access), or from the patient (eg accident loss or theft of the card).

The proposals for wide access to electronic health records including non registered health providers are extremely serious because health information is very sensitive personal information. Misuse or disclosure of some health information can detrimentally affect lives and livelihoods. Misuse and errors in information creates a risk to life.

There is a  risk of function creep including  the use of IHI by other agencies for other purposes.

F. Other Comments
This nomination form was emailed to NEHTA for comment on 19 October for comment by 31 October 2009. No response was received from NEHTA by the Coordinator of BBA2009 by 1 November 2009.