Tuesday, 21 March 2023
Bills
Health Legislation Amendment (Information Sharing) Bill 2023
Bills
Health Legislation Amendment (Information Sharing) Bill 2023
Council’s amendments
Message from Council relating to following amendments considered:
1. Clause 4, page 4, after line 26 insert –
“Privacy Management Framework means the Privacy Management Framework established under section 134ZT;”.
2. Clause 4, page 14, line 17, omit “1982.’.” and insert “1982.”.
3. Clause 4, page 14, after line 17 insert –
“Division 6 – Privacy Management Framework
134ZT Minister must establish Privacy Management Framework
(1) The Minister, by order published in the Government Gazette, must establish a Privacy Management Framework for the Electronic Patient Health Information Sharing System as soon as practicable after the day on which this Part comes into operation.
(2) In establishing the Privacy Management Framework, the Minister must consult with the following persons and bodies in relation to whether certain health information or classes of health information should require additional levels of protection under the Privacy Management Framework –
(a) relevant groups and organisations that represent the interests of patients, carers or health care workers;
(b) any relevant public sector body within the meaning of the Public Administration Act 2004;
(c) participating health services.
(3) The Privacy Management Framework must –
(a) specify categories of health information that are sensitive in nature and include a process to safeguard that information; and
(b) include a process to safeguard the identity of patients who may be at risk of harm, including patients who identify as being at risk of family violence; and
(c) include a process to facilitate patients accessing reports that specify who has accessed their health information through the Electronic Patient Health Information Sharing System; and
(d) include a process for regular audits and compliance checks of the Electronic Patient Health Information Sharing System.
(4) The Privacy Management Framework takes effect on –
(a) the day on which it is published in the Government Gazette; or
(b) a later day as specified in the order.
Note
Section 41A of the Interpretation of Legislation Act 1984 provides that the power to make an instrument includes the power to repeal, revoke, rescind, amend, alter or vary the instrument in the exercise of that power.
134ZU Compliance with Privacy Management Framework
Any person who is authorised or permitted under this Part to access the Electronic Patient Health Information Sharing System must comply with the Privacy Management Framework to the extent reasonably practicable.
Division 7 – Independent review of this Part
134ZV Independent review by expert panel
(1) The Minister must cause an independent review of the operation of this Part, including the Privacy Management Framework, to be conducted by an expert panel after the second anniversary of the day on which this Part comes into operation.
(2) The independent review must examine and make recommendations in relation to the following –
(a) whether health information is sufficiently protected;
(b) which health services should be participating health services for the purposes of this Part;
(c) the misuse of specified patient health information;
(d) the costs of compliance and the administrative burden imposed on participating health services by this Part;
(e) whether the Electronic Patient Health Information Sharing System is operating as intended.
(3) The independent review may examine and make recommendations in relation to the following –
(a) current issues and trends relating to health information systems;
(b) data management;
(c) information technology security;
(d) patient privacy;
(e) any other relevant matter.
(4) The independent review must be completed no later than the third anniversary of the day on which this Part comes into operation.
(5) The Minister must cause a copy of a report of the independent review to be laid before each House of Parliament no later than 3 sitting days after the day on which the final report of the independent review is given to the Minister.
(6) The Minister must consider any recommendations made by the independent review, including any recommendations to amend this Act, and within 18 months of receiving the final report –
(a) implement the recommendations made by the independent review; or
(b) advise Parliament why the recommendations have not been implemented.
134ZW Appointment of expert panel
(1) For the purposes of section 134ZV, the Minister must appoint 3 persons to form the expert panel.
(2) The Minister must ensure that each person appointed to the expert panel has experience in one or more of the following –
(a) human rights and privacy matters;
(b) legal and regulatory compliance;
(c) health information systems;
(d) clinical care;
(e) health care quality and patient safety;
(f) consumer or patient advocacy.
(3) The Minister must not appoint a person to the expert panel if the person is –
(a) a current employee or executive officer of a registered political party within the meaning of the Electoral Act 2002; or
(b) a current or former member of Parliament.’.”.
That these amendments be agreed to.
We are thankful for the work of the Council, and we look forward to the adoption of these amendments.
Emma KEALY (Lowan) (18:01): It is always good when we have legislation which comes through the Legislative Assembly, where amendments are put in this house, that we go through to the Council, there are amendments put there and then there are some amendments to the bill where we have an opportunity in this place again to review those amendments and to ascertain whether what we sought to achieve was actually delivered in the legislation that we see before us today. The amendments that have been accepted by the Legislative Council are around improving some of the aspects and dealing to a level around concerns that there was never an opportunity for patients to opt out of the health information sharing system, but further there was not an opportunity to FOI the people who have access to that information and get an understanding of how that information may have been used. While the amendments put forward today outline a privacy management framework and also the establishment of an independent review by an expert panel, there is certainly the feeling amongst colleagues and also with serious organisations who understand privacy, the legalities of privacy and the importance of retaining patient privacy also that they still retain significant concerns the amendments put forward in this house today simply do not go far enough when it comes to protecting patient choice around their own health records and even about their own right to choice within the health system.
The primacy of Victoria’s healthcare system – and we have always been a leader in this – is to ensure that the patient has rights and that we have patient choice. This legislation and the amendment that we are looking at today simply do not protect that longstanding, decades-long understanding and practice around patient choice, because there is no patient choice when it comes to what information will be uploaded into a generic whole-of-Victoria public health data information system. This is of significant concern for so many people across the state, and there is a good reason why this is so. This morning ABC news reported that private health records of some Canberra Health Services patients were deliberately sent to an industrial partner, and this sort of scenario could absolutely happen in Victoria in very similar circumstances under the legislative framework that we are looking at today. I will summarise the ABC report and make this report available to the house also, but it is deeply concerning, because whole mental health clinical records of 13 patients had been deliberately emailed to individuals outside the organisation over a period of years. This goes to the concerns that many in the community have that by having a whole-of-public-health-accessible medical record which is now available to the hundreds of thousands of people who work within the health system, what you are actually doing is taking away the patient’s right and the patient’s choice to selectively keep that information to themselves.
We see in Canberra that this exact scenario has played out today and been reported on today, where information – mental health records, no less – has been sent to an industry partner. It was not a health fund, it is an industry partner – I think we can join the dots in working out where this information has been sent to. It has been leaked. There has always been deep concern that a blanket patient information sharing scheme would make people who are some of the most vulnerable people in our community less interested and less empowered to make that choice to engage with the public health system. When we think about people who are survivors of sexual violence, they do not want to have that information shared amongst their work colleagues in an environment where family members or friends might work, where, really, on the basis of it, we are actually relying on a high degree of trust that people will not be tempted to just have a peek to have a look at somebody’s sexual history, to have a look to see if a woman has ever had an abortion or any other sexual health service in the past, to look at somebody and before you employ them look at their mental health records, when we are looking at people who are victims of family violence where their partner is still an aggressor and looking at court cases for custody of their children and seeking information to use against their partner that they are able to access that information. When we look at mental health providers, we know we have to break the stigma of mental health and encourage Victorians wherever possible that when they are not feeling 100 per cent, when they know they need support, they do not have this additional concern and they are not going to enter into the public mental health system because they think that their information may be accessed and may be made public in the future, as has now happened in Canberra Health Services.
Of course we look at it as well in the alcohol and other drugs sector, where there are so many barriers already in place for people to reach out and seek support for treatment. Or perhaps even going to the North Richmond injecting room, this information now will be brought in as part of the statewide public health record. There is great concern that has been raised with me by Victorian Alcohol and Drug Association, the peak body for alcohol and other drugs in this state, about having a whole-of-health information record where every single person across the health network, right up to the Minister for Health, has the opportunity to be able to access your record to see whether you have attended the injecting room, how often you have been there, the frequency, the time frames that you have been there and whether it coincides with perhaps other things that you have been undertaking, including working somewhere or whether there is other treatment at that time. These are things that VAADA are very, very concerned may actually be a disincentive to engage with a service like the injecting room, because in that particular community, where they are extraordinarily vulnerable and where they feel that there may be additional ramifications if they are seen to be an illicit drug user, this is a massive disincentive, and these individuals, who are so vulnerable, will not utilise the injecting room into the future.
While these amendments go some way towards improving legislation which I believe is heavily flawed, they simply do not go far enough until there are amendments in place that strengthen the right of every single patient over what information is shared across the health network and what health information is put in an environment where hundreds of thousands of people have opportunity to access your health record. We are talking about the day-to-day regularity of what information is included in your health record, and it is not just about the patient that comes on a gurney unconscious where you do not know what their history is and you cannot communicate them, which is such a small segment of the health system in its entirety. This is what we need to see addressed in this legislation. I hope that the instances that we have seen from Canberra Health Services today are not soon replicated across the state of Victoria, because I cannot see, to be quite honest, that it will not be a scenario that we see in Victoria. That is why I do not believe that the health amendments go nearly far enough.
While there is an attempt within the amendments put to us today to establish a privacy management framework, which will involve looking at safeguards around whether certain health information or classes of information should require additional levels of protection under the privacy management framework, we have to also accept that an individual absolutely has an opportunity to have their right to say, ‘This is my information. I do not consent for it to be shared amongst the statewide health information network. I do not want that to be there, and I have my own individual reasons for and concerns about that.’ While I think that the vast majority of people in Victoria will subscribe to the system if they have the opportunity to do so, there will be a small group of people who will not want all of their health information shared, and for the most part this will be due to an extraordinarily reasonable position and circumstance in their own life. We cannot accept or presume that everybody will automatically be happy for their information to be shared. Having a privacy management framework and a periodic review by an expert panel simply does not go far enough for people to have that embedded trust in the system, so that is why I do not think that these amendments go far enough.
We need to ensure that there is a level of public reporting when it comes to breaches of expected access to health information records. There should be an obligation upon the government to disclose to individuals when suspicious access has been detected, so they have full understanding of who has accessed their information and then of course they may have an understanding over how that information could be utilised. Further, there should be fines or some other protections in place for a loss of private information when it is shared and when trust has been breached because the health information system does not have the effective security measures in place to protect people’s private information. This is not something that is unusual. We have heard it not just with health records and the Medibank campaign. We have heard so many times, particularly in recent months, that hackers are looking to target very sensitive personal information on a more frequent basis and to utilise this information against individuals but also to look at gain for themselves, and when that temptation is in there for financial gain and benefit, simply having a privacy management framework is not something they are going to attend to or to pay attention to in any great detail. So that is also of key concern. In the past we have not had a system created in Victoria which has been robust enough to withstand external hackers, and having a single data information system means that everybody’s information in the state of Victoria is available as a one-stop shop for these hackers. There is no doubt in my mind it will be a future target for hacking activity, and given we have not got a fabulous record when it comes to the establishment of health information systems in the state of Victoria and there have been issues around maintaining the security of those health information systems, I simply do not have confidence that the Victorian government has the ability to deliver on this to keep Victorians’ health data safe.
This is already playing out in the community, and I have been very surprised that in my local community I have had a number of people come to my office with concerns about this who have now said, ‘Emma, I’m not going to go to the public hospital anymore. I’m not going to utilise public health services anymore, because I do not want my information to be shared in the future.’ This is quite legitimate, and while you might laugh it off and think this is quite hilarious from the government benches, these are serious concerns that are held by individuals about how their health information will be used. This is not just a one-off. There are a number of people who are very, very concerned around this. They are the most disengaged and vulnerable people in our community. They are people who have suffered from family violence or sexual violence or who are seeking drug and alcohol treatment. They are people who are seeking mental health support. They are people who should be protected at every single step, and this legislation and the amendments simply do not go far enough to protect the individual’s right to maintain their own information.
There is a saying that we often utilise within the health system, which is ‘Nothing about me without me’, and generally it is embedded that there should always, at every step, be informed patient choice. I believe that that patient choice should extend to the sharing of records. There was always an opportunity to have an opt-out element in relation to either an entire record or specific elements of a record that people would like to have withheld from the whole-of-health information system. This amendment does not go far enough to protect that.
I would like to place on record some of the comments from the Law Institute of Victoria, who have been fierce advocates when it comes to protecting the rights of individuals and Victorians to have autonomy when it comes to sharing of their health information. A media release issued on 10 March this year from the Law Institute of Victoria explicitly outlines their concerns around the amendments that this chamber is reviewing today. I quote this from LIV president Tania Wolff:
‘The LIV has been unequivocal on the need for an opt-out provision within this legislation’ …
‘We are not opposed to the creation of this system, we simply believe that Victorians deserve a choice in how their sensitive health information is used and disclosed.’
…
‘While we appreciate these amendments aim to strengthen privacy protections for Victorian patients, the reality is it still falls short of what is required.’
‘This framework does little to strengthen patients’ rights to autonomy which should be an embedded principle with this Bill, as it has been for a raft of health legislation over the past decade.’
There are also concerns around the opportunity for an opt-out system to be included by fierce advocates Liberty Victoria and also Digital Rights Watch. These are key groups within our community who understand the right to privacy and particularly patient privacy, perhaps having more expertise than any of us will ever have. I think it is important that we do listen to them, that we listen to organisations of mental health providers and also alcohol and other drugs, family violence and sexual violence – people who give some of the most vulnerable people a voice. They are all expressing concern that these amendments do not go far enough, and for that reason I do ask that the government reconsider this legislation.
The amendments do take a very, very small step towards what we need to see in Victoria, but there are simply far too many risks when you are talking about a system which has not yet been established, whose security has not yet been built and when we have so many people across Victoria who are already loath to get public health treatment simply because they do not want their information to be shared. Again, I will always stand up for the individuals. Being a former shadow minister for family violence and women, I will certainly always endeavour to give those survivors of family violence a choice. I will always endeavour to give women a strong voice in this place – the women who have sought family health services in the past and women who have been victims of sexual violence; I strongly support their choice around that. I strongly support the view that any Victorian should be able to receive drug and alcohol treatment without considering that that information may be shared with their employer, with their union, with an insurer, with somebody that they work with or with their partner who is abusive towards them.
There are so many risks around that when we have people involved, and while certainly as a whole we have fabulous people involved in the public health system, we also have examples where data has been accessed inappropriately under our current system. Again I point to the news today from the ABC around Canberra Health Services patients having mental health clinical records deliberately sent to an external body, an industry relations partner. I am just so sorry for those individuals, because not only does this do so much damage to those 13 people who have had their mental health records made public without their consent but also it has a massive impact on other people who are considering accessing public mental health support.
Having a system which is weak, which does not allow patient choice and which has insufficient securities, no matter what the review panels are, no matter what framework you have in place, will deter people from accessing support when they need it the most. Again, I urge the government to reconsider the inclusion of an opt-out provision. While these amendments are supported and are a step towards a better system, I certainly do not believe that they go far enough. An opt-out provision should be included as soon as possible.
Dylan WIGHT (Tarneit) (18:20): It is a pleasure to rise and speak on this bill, the Health Legislation Amendment (Information Sharing) Bill 2023. Just before I do, I would like to acknowledge all of the health workers – nurses, doctors, allied health workers and paramedics – in my community of Tarneit and indeed around Victoria as well as recognise the hospital in my community, the Werribee Mercy Hospital, a hospital that is undertaking currently a $109 million upgrade of its emergency department thanks to the Andrews Labor government.
The Victorian government is of course committed to patient safety, and that is what this bill is all about. A core aspect of that is ensuring that through our health records our healthcare providers have access to necessary information so that they have the tools to care for their patients in the most appropriate manner. It would be no surprise to anybody in this place that most Victorians will visit a number of different healthcare providers and professionals over their lifetime. I have said before in this place that it is particularly pertinent for my community of Tarneit, an incredibly mobile community and a community that did so much to keep this state running during the pandemic.
Making sure that critical information can be securely passed between health services is important in ensuring patients receive the best possible care. It is crucial that our healthcare providers have access to information, including medications that may interact, drug allergies, alerts of severe asthma, past biopsy results, diagnoses that may have taken months and months to make and, of course, results of tests and expensive scans that may have potentially cost either the individual or the healthcare system thousands of dollars when they were made. All of this information at the moment is scattered across individual recording systems both online and, in some cases, on paper – an archaic system, to be quite frank. This ends up forcing medical practitioners to spend precious time manually gathering patient information, time that could be far better spent attending to people that are presenting in our healthcare system. Fax machines and phone calls needlessly delay medical professionals, who should be spending their time, as I said, caring for patients, not chasing up information that could be easily accessible under the changes that we propose to make through this bill.
This becomes even more of an issue, as we can imagine, in emergency departments, where every second counts and patients may be unable to express the details of their previous medical history. Every person’s medical history is different, and in stressful situations remembering every single relevant detail is nearly impossible. One of the incredibly important aspects of this bill is taking the responsibility and taking the onus off the patient, off the person presenting in our healthcare system, to remember the finer details of their medical history. As we can imagine – and I used the example of presenting to an emergency department previously – with a patient potentially presenting to an emergency department, it is near on impossible for that person in different circumstances to remember what can at times be an incredibly complex medical history. Taking that responsibility off the patient is incredibly important and is one of the incredibly important aspects of this bill.
This bill will allow us to modernise the systems we use for information sharing in health care and to follow the approach taken by other jurisdictions. When I spoke on this bill in this place previously, only a few weeks ago, I spoke about the fact that this legislation brings us into line with other jurisdictions that have already done this, such as New South Wales, Queensland, the ACT and South Australia, and have successfully implemented health information sharing at the point of care.
This bill is not about whether public health services should share information. Indeed that is already happening; we are already seeing that happen. The problem is that the way it is happening at the moment is archaic, as I suggested. The use of fax machines, the use of phone calls and the delaying of the treatment of patients that are presenting at times as critically ill – that is already happening. All we are doing is establishing a secure and more efficient platform for clinicians to access that relevant clinical information to treat patients safely.
The proposed amendments from the other place give us an interesting framework with which to tackle some of these issues raised in favour of an opt-out clause. This legislation comes before us after extensive consultation throughout the health industry. Indeed there is incredibly strong support not just from the industry – not just from our doctors, not just from our nurses, not just from our health professionals – but also from people accessing health services. Indeed there is incredibly strong support from my constituents in the suburbs of Tarneit, Mount Cottrell and Hoppers Crossing, because as I said, my community is one of the most mobile communities in Victoria and people in my community would like to know, if they are out for work or if they are out enjoying everything that Victoria has to offer and a health emergency was to occur, that whichever health professional they present to will have the relevant information to treat them adequately.
What this bill does not do is change a patient’s right to access their full medical records from a health service provider under FOI and privacy legislation. Fundamentally what that would mean is that patients would still absolutely have ownership and access to their own health records – a function of this legislation that is still incredibly important. To ensure efficiency and timely care, the information that will be included on the proposed platform is only the most relevant clinical data for the purposes of treatment, not the full medical history of the person. I think that is an incredibly important point, given the contribution that was made previously to mine. This includes allergies to medications, hospital treatment summaries and diagnosis reports. This bill does not enable FOI requests on the health information sharing system. This is because it would require the department to access clinical information to respond to questions, which would be inappropriate and counteractive to the strict protections and access controls the bill seeks to establish.
I think it is also incredibly important to touch on the security and protections of the data that will be on this system. The government is obviously committed to ensuring that patients’ data is stored securely and stringent protections are in place. It is a really important aspect of this bill. When we speak about how this information is being shared at the moment, we are talking about some of this information being shared on a fax machine.
I am not quite sure how it could possibly be more secure for a patient’s medical records to be sent via a fax machine and for a piece of paper to be perhaps sitting in a dusty old fax machine that rarely gets used in some room for people to pick up that maybe should not have access to that. I am not quite sure how that could possibly be more secure than what the government is proposing.
The bill will introduce strict controls, and these include frequent auditing to make sure authorised people are accessing health information. The bill specifies that only healthcare providers who are directly involved in a person’s care and treatment can access medical information and only for the purpose of providing care. I commend this bill to the house.
Tim READ (Brunswick) (18:30): It is a pleasure to speak on this Health Legislation Amendment (Information Sharing) Bill 2023, which has changed a little since it last appeared in this place. It is particularly important to comment that the Greens recognise how critical it is for our public health system that this bill pass the Parliament, particularly after a similar bill failed to pass the Parliament about a year ago. We were very worried that a similar situation could arise again.
Ask any doctor, indeed most health workers, and they will tell you that they are accustomed to spending time trying to track down health records that are in another institution or another clinic. Doctors will just roll their eyes and talk about the many hours of their lives wasted trying to get vital pieces of information. This is information that patients often do not realise is important, or they do not know or they cannot remember the details. But then there is the other kind of information that the doctors do not even know exists because the patients are not aware of it or have forgotten or are unconscious. In any case enormous amounts of time are wasted. While we can all tell you stories of missed diagnoses, catastrophes and so on, those are probably less common and maybe even less important than the sheer cost of person hours to the public health system and the dollars.
Medication reactions are responsible for a significant proportion of medical accidents in hospitals. Inappropriate treatment when patients are allergic or known to be allergic to medications is also a problem, and other warnings or alerts in people’s medical records that are missed are also problems, whether they are about the severity of someone’s asthma or their tendency towards violence or whatever. Delayed diagnoses are not uncommon, but repeat investigations are very common, and I would warrant that every minute of every day blood tests and other pathology investigations are needlessly repeated at enormous cost to the public purse. While this bill will not stop all of that, it will prevent some of it because if clinicians can see that tests were ordered last week or yesterday and that those results are to hand, they will not need to spend those hundreds of dollars. Before we even think about the consequences to individuals, if we just think about the use of resources and think about the resulting improvement in the productivity of our healthcare system, which right now cannot find enough staff, then it is clear that this bill needs to pass.
I want to turn briefly to the notion that people should be able to opt out of this. Obviously there were concerns expressed by the Department of Health that this might follow the pattern of My Health Record, which is currently unusable because there is insufficient information uploaded but also because too many people have opted out of it. Even if that did not happen, it is important to understand that opting out of participation in this does not just affect the health of the individual who opts out. Okay, so you opt out, and next week you are carried unconscious into an emergency department where you have got no record – it is clearly going to affect your health, but it is also going to affect the health of the other patients in the unit because the staff are wasting hours chasing your information because you have opted out. This is above all about a collective responsibility to participate in making our public health system as efficient and as effective as we possibly can so that it will help everybody. It is not just about the health of individuals here. We were also concerned, though, that people need to be able to trust the system. Opting out does not mean you trust the system; opting out means you do not trust the system. But we wanted to strengthen the privacy protections in this system so that everybody could trust it.
I particularly want to acknowledge the efforts of my upper house Greens colleague in the other place, Dr Sarah Mansfield, who spent with me considerable time probing the capability of the system proposed by the government. I want to acknowledge the chief digital health officer and others from the department, who through repeated briefings gave us a lot of their time answering our questions. Through that process we were able to seek and obtain these amendments from the government plus additional assurances on the record in the committee stage of the bill in the other place.
Just briefly, the review clause is timed to require an external independent review after the system has been operating for a couple of years to see what problems have arisen rather than to try and address theoretical problems. The other important amendment is that the privacy management framework is codified in the legislation. That should be established in a way that consults with groups representing patients and health workers on what extra health information needs extra levels of protection. According to this privacy management framework, there should be a process to safeguard that information and there should be a process to safeguard the identity of patients at risk of harm, particularly those at risk of family violence. There needs to be a process so that patients can learn who has access to their health information, and the amendment requires regular audits and compliance checks so that we can see if there are episodes of inappropriate access. That privacy management framework, as written into the legislation, now adds an additional layer of protection around people’s health information in a way that I believe means Victorians will be able to trust the integrity of the system and use it with confidence.
Reflecting on the process of working with the government to get these amendments, perhaps we should have asked more about why our public hospitals are not actually using the same electronic medical records, which is what occurs in many jurisdictions around the world – in fact it happens in Parkville. There are four hospitals in Parkville, the royals, which all use the same electronic medical records. They do not need a separate platform to share information. If you type a comma in one hospital, you can read it minutes later in another hospital, and that is proposed soon for multiple hospitals in the Latrobe Valley. The three Alfred hospitals also have shared medical records; the problem is they are different shared medical records. It may well be better to have all of Victoria’s public health institutions on the one system, but I guess that is a challenge for another day. But it is worth addressing because it could well bring further efficiencies to our stressed health system.
Regardless, I will be very glad to see this bill pass. Perhaps the Greens could have jumped up and down more, demanding an opt-out clause and the removal of the FOI exemption, but fearing that the bill may not proceed or work as intended and knowing how valuable the bill will be to the public health system, we opted instead to negotiate with the government and push for the improvements that we and the government achieved. This bill is not as glamorous as a promised new hospital – it does not have the photo opportunities and ribbon-cutting potential – but I believe it will contribute a lot more to the health system, and I look forward to seeing how this information sharing system is developed and how it is used.
Roma BRITNELL (South-West Coast) (18:39): I rise to speak on the Health Legislation Amendment (Information Sharing) Bill 2023 and the amendments that have been made by the Legislative Council. I spoke on this bill when it was here in the lower house, and I am pleased to see that when we do bring up important changes that do need to be considered, sometimes they are taken into consideration. I commend the hard work of my colleague in the other place the Shadow Minister for Health Georgie Crozier, who worked incredibly hard. Georgie, like me, has a long history of working in the health sector and understands the complexity of the issues around the health information system and the challenges that we have probably both seen, and I certainly have seen, over the years.
I concur with what I just heard from the Greens representative in that it would be ideal. Certainly working in accident and emergency I thought many, many times how crazy it was that I could not just pull up electronically the patient’s blood group when we had someone come in. But that is actually not that often, and the onus on the patient is something that I think, yes, is a focus. The challenge really for me around this bill is that I am not convinced that the government is ready to take this responsibility. We have already seen examples of hacking in our state alone into our medical systems. There was an example in South-West Coast. Barwon’s South West Alliance of Rural Health (SWARH) was hacked a short time ago, and that resulted in six months of people running around the hospital with USBs trying to cope. We had a real example here in Victoria after the Auditor-General put it clearly on the table for the government to see. He had identified the risk in the system – that it was not robust and it was absolutely open to be hacked. I think he hacked it himself or had one of his team hack it to demonstrate how easy it was. But despite that the government did not do their role and actually strengthen the system.
We have also recently seen Medibank Private and some big companies being hacked. This sort of health information of very vulnerable people is a real target for hackers. If we have got a government that is not listening to the Auditor-General around processes that they can do better – we see that in many other examples, but I will stay focused on health and will not head down other roads at this point in time – then how can we say to patients that they can go into the health system and be comfortable that their very private information will not get into the wrong hands? Just today, which is incredibly relevant – this could not be more time relevant – we saw that a Canberra health service had a serious breach of privacy, with 13 records of patients gone to an industrial partner over a period of years – mental health records, nonetheless.
This is why I have major issues with this. Patient-centred care is what we talk about in health – making sure the patient is at the centre of their care. The patient having a right to opt out of a system seems a fairly basic right. We cannot say that we focus on patient-centred care when we ignore their right to their privacy and to have their data kept secret and not shared on a centralised platform. They have every right to be nervous of a centralised platform, given the examples I have already raised. I am going to repeat it: just today in Canberra we saw health data of mental health clients going to an industrial partner, deliberately. I do understand it would be ideal to be able to trust. But I am not convinced that I can trust a government which has already demonstrated failures in its technological capability in many, many areas where it has tried to implement systems – be it ambulance, be it the CFA, be it births, deaths and marriages or be it in its own health system with the example I have already put up with SWARH in Barwon south-west.
People might have sexual health issues that they do not want anyone else to know about. They might have had very private surgeries or may have an HIV status that they are very protective of. They might have been victims of family violence and want to move on with their life and do not want to have that risk exposed. They might be worried about future employment issues. They might be worried about their children and protecting them. I am worried about these vulnerable individuals who would perhaps avoid seeking help. And I know – as a community nurse who worked in health promotion for many years – it is very, very hard to get people to prioritise their health and seek health prophylactically. This will be a setback if those people who are anxious about their health information being shared cannot trust the system.
So these amendments do not go far enough. I mean, the opt-out opportunity is in the federal arena; 10 per cent of our community have decided to do just that, opt out, and I feel there is a real imposition on people’s rights to their own private information by not allowing in this bill for them to have their information kept private. I will quote from the organisations who spend a lot of time looking at privacy issues and probably are the experts on the importance of privacy and understanding privacy, organisations like the Law Institute of Victoria, Liberty Victoria and Digital Rights Watch. I quote the president of the Law Institute of Victoria, Tania Wolff. She said that this public health system change ‘must not come at the cost of patient autonomy’. This is what came out 10 days ago. They were unhappy with the original piece of legislation, but they are still uncomfortable with the amendments. The LIV has repeatedly called for amendments to be made to the legislation to provide for an opt-out – which is the part I am very bitterly disappointed has not been included in these amendments – for Victorians who do not wish to have their records shared. The Law Institute of Victoria still feels this legislation is inadequate and still falls short of what is required.
It is very disappointing when we see that the government has recognised that it did need to strengthen the legislation. I see that the privacy management framework that they have put in place, which these amendments actually bring forward, is actually not strong enough, and that is what the Law Institute of Victoria have identified. I think it is good that there will be a review process, but a couple of years is a fairly long time. We are seeing a lot of hacking going on and, as I say, vulnerable Victorians and their health data seem to be a focus for what people are searching for in that horrible world of hacking, where they are looking for personal data and taking advantage of vulnerable people’s situations.
I think an opt-out clause is just simply reasonable. I do not think it is a lot to ask. It is reasonable in any circumstance, but we have got a government who have had so many failures in their technological adoptions into different systems, into different departments, and we have got an Auditor-General who warned the government that their health system was fragile and could easily be hacked and actually demonstrated that, but that was not taken on board by the current government and was ignored by the Labor government, and as a result we saw a hacking which put major, major disruption for a very long time into the systems of Warrnambool South West Healthcare, Camperdown, Colac, Geelong – right through the South-West Coast area.
Whilst I would love when I am working in accident and emergency to have a system I could trust that was able to give me the information quickly that I wanted, and I would love to not see the anaphylaxis that occurs from an allergic reaction that the patient was not aware of or forgot about, I do not think it is too much to ask, for those who want the opt-out clause, to have it put in to protect those people. In that case, I am disappointed that it has not gone far enough as a bill. I look forward to the review process, and I think the government should strengthen it further.
Tim RICHARDSON (Mordialloc) (18:49): It is great to rise and speak on the amendments for the Health Legislation Amendment (Information Sharing) Bill 2023. At least the member for South-West Coast was a little more measured than the original discussion on this bill. I remember the member for Caulfield said lawyers were literally streaming up to the Magistrates Court, waiting for the next case that would happen on this bill, despite patients’ information already being shared in Victoria across health services and that support and collaboration literally saving lives.
It also goes to the heart of the ridiculousness of the fear campaign that was brought in around this bill and the commentary that undermines the trust and confidence in this system. Of course during that contribution I talked about there not being a department breach in information, and that was a critical point that was to be raised, because this is a system that has been established within the department and the work that will underpin supporting the transfer of information of patient care. One thing that was absent in that bill speech a couple of weeks ago and is absent in this contribution now is a recognition of the risk to lives in not acting in this space. Will we front up to the families when information is not shared and tragic outcomes happen and we lose Victorians from not being able to share information between health services? Who is going to be there at the Coroners Court apologising because the Victorian Parliament did not pass that legislation? Luckily the 60th Parliament in all its forms in this chamber and in the Legislative Council saw reason in this bill. It did not go down a pathway of fear campaigns and talking about opt-outs, of unquantifiable things that are put forward and the suggestion that there would be a rush of legal services coming forward. That really is at the heart of that undermining of information, facts and reasonable debate – because that is already happening right now. That sharing of information has been so critical and important across health services, and we are enhancing that to make sure patient care and safety is at the heart of everything we do.
Antiquated systems that still rely on faxes, that have hard-copy paperwork, that could be accessed at any time by people passing through, seen by various different officials – this is modernising our health service and providing that support and care and comfort, and I think that is the work that should be put forward in this Parliament, and I am really appreciative that we have passed that bill through and it is going to support Victorians. I could not in all conscience as a member of this place be able to consider that by not doing this work, not bringing about these changes and these legislative reforms, could lead to poor patient outcomes or indeed risk the lives of Victorians. That is really at the heart of what this bill is all about and why those safeguards that were put forward in the original bill were really important as well – the work that is to be done by the Department of Health and the implementation of that work and the security and safeguards that are underway right now.
It is important to reflect that jurisdictions across Australia have moved in this space as well. We do not see those criticisms or a sudden uplift in Magistrates Court or Supreme Court presentations because New South Wales has brought in HealtheNet, which was implemented to establish a secure statewide clinical portal which shares summary-level patient and clinical information, or Queensland – the Queensland Premier has not come out to say that there has been a massive rush on the courts based on the changes that the government introduced. The government implemented the Viewer, which collates data from multiple Queensland health systems, enabling healthcare professionals to access patient information quickly without having to log into different systems. I mean, this is a pretty simple thing – but no, take it a little step further: in the ACT, the Digital Health Record was implemented, which stores health information for patients who use any of the ACT’s public health services.
So what is this really about, then – those speeches that were put forward before around a rush of legal services, saying that there should be an opt-out based on unquantifiable metrics that are put forward, the lack of acknowledgement that health services in all of our communities collaborate, support and share information now and this is enhancing that process and support into the future? Well, I called it out then and I will call it out now – it was about the fear campaigning that we have seen in health policy and work over that period of time. The contributions again in the Legislative Council, if you followed that debate, gave a window into the soul of the coalition. It is not about patient outcomes; it is about political outcomes. They saw an opportunity to try to fear campaign once again on health policy, and we have seen absolute form in this space for the last few years undermining health information. We have seen other circumstances out on the steps of Parliament, but we all remember seeing people stand out there undermining the advice of our health officials, undermining the work of our nurses, our doctors and our paramedics who each day front up to support Victorians, making their job harder by talking down our health professionals and talking down the health sector. This was another chapter in that playbook. This was about undermining public confidence; it was unquantifiable and not based in fact. That is the biggest challenge in those contributions. Reading through some of them, some of them were very much fear campaigning and not based in fact.
That is, I guess, where the coalition find themselves at the moment, particularly the Liberal Party in Victoria. They find themselves down a narrow path of fear, of division in community, which Victorians resoundingly rejected, and they have learned nothing. We are four months into the 60th Parliament. There are 1354 days to go, and still they are muddling around now with fear campaigns and preaching to undermine trust and confidence in science once again. It is a disappointing place we find them in. But that luckily was not the process that we went through the Assembly and in the Council, and thankfully this bill will be passed through.
I am really keen to see how this will support the people that are on the front line each and every day, from health services – our primary health services and our community health workers, who do such an incredible job in the preventative health space – all the way through to our emergency departments. We see the dedication and incredible work and interaction that they have with our community. They are some of the best people. We had an interaction with health services just a couple weeks ago, and the nursing staff and doctors at the health service we interacted with were just absolutely immense. It really gives you goosebumps to think that that is just one moment of interaction that brightens your day and makes you feel that comfort, care and support but that happens thousands of times across a health service each and every month. That is just going about daily business, doing the 10-, 12-hour shift and getting smashed all the way through and coming home and thinking, ‘Those are the lives that I improve each and every day.’
We want to be on the side of our health workers and our officials and make sure that we are not hampering the job that they do. We know the pressures that we have had on our health system, and we have made a record investment, with more than $20 billion in health infrastructure investment coming. It is a substantial uplift, and when we see how much we have invested over our term, the health workers that we have supported – the more than 24,000 that we have brought in and tens of thousands more that are coming in; those are our values, and we are investing in the future as well – well, we do not want to make that job harder and to embed any more inefficiencies in systems, whether it is faxes or whether it is hard copy printouts. When seconds matter in patient safety outcomes and care, we need to make sure that we build a system that provides that support. That is how important these legislative reforms are.
I hope some of those members that contributed to the debate on the bill reflect on their contributions and maybe choose a different path in the future and maybe do not talk about random hypotheses underpinning their fear campaign that are not quantifiable at all. It was absolutely another fear campaign in community health messaging and safety. Get a brief. Listen to the advice. Come forward. Do the work. Speak a bit more on the bills and represent your communities and look at the evidence that is put forward and the safeguards that are put in and the fact that just up the road, literally a few hours to the border, we have got a similar system under Premier Perrottet in New South Wales. I mean, goodness me, you could not be any more out of touch on that side. New South Wales and Queensland have already put those systems forward. And we have already got patient information being shared today. It is not a new thing. Some of those opposite speaking on the amendment even seemed to suggest that patient information sharing is just a new 2023 thing. This is happening in community health services around Victoria now, but it is making it safer, more streamlined and more effective and efficient for the future.
I would like those opposite and anyone that opposed the bill to come forward, and I ask: would you front up to the Coroners Court? When they are talking about lawyers having a rush on a place, where there would be gaps, where people’s information not being shared would lead to poor outcomes and even costs lives, would they be willing, after the rhetoric that they have shared, to go and talk to those families? Because of the consequences, I could not live with myself, knowing that could have an impact, and that is why this bill is so very critical. That it is why the Andrews Labor government has been trusted by Victorians to get on with delivering, and this is just another element in the work that we are doing to keep patients safe.
David SOUTHWICK (Caulfield) (18:59): The member for Mordialloc made a whole lot of assumptions there. If the bill was right, we would not be back here again talking about the amendments that were proposed. What we have seen is that the government could not get the bill right in the first place, and we are now talking about these amendments to protect Victorians and make sure we get information right.
The DEPUTY SPEAKER: Order! I am required under sessional orders to interrupt business now. The member may continue their speech when the matter is next before the house.
Business interrupted under sessional orders.