Tuesday, 7 March 2023

Health Legislation Amendment (Information Sharing) Bill 2023

Second reading

Debate resumed on motion of Ingrid Stitt:

That the bill be now read a second time.

Georgie CROZIER (Southern Metropolitan) (14:37): I rise to speak to the Health Legislation Amendment (Information Sharing) Bill 2023. I feel like this is deja vu or groundhog day, because in October 2021 we had a very, very similar bill introduced to this Parliament around information sharing. At the time we had just come out of COVID, there were significant concerns and there were a lot of people who were also very concerned about the nature of that bill. As members who were in the previous Parliament will recall, that bill was fully debated – the second-reading debates were concluded in May of 2022 – and then it just sat there and did nothing. It just sat there. The government made the bill sit on the notice paper, and we did not debate it again. The absolute rubbish that we got around this being an urgent bill – it was rushed into the Legislative Assembly and was brought in within a week, there was no consultation – shows the sham process that the government went about with the first iteration of this bill and how badly managed that was.

Now, at the time there were a lot of people that had contacted me – a lot of people within the health industry and a lot of people outside the health industry – who were concerned about the privacy and human rights issues. I want to address those with this latest iteration of that same bill, but I want to make the point that at the time the government said, ‘This is urgent, this is urgent, you need to pass it,’ and I was told by health professionals that it was up to me to pass this bill. I made the point at the time, and I make the point again to those listening today, that my concerns about the government’s bill have not changed; they are exactly the same. In fact in this bill I think it has gone a little bit further, and I want to explore that through the second-reading debate that we are having now and also in the committee stage.

So what I said back whenever it was that we debated it the first time around was that I absolutely understand the intent of this bill. The government was arguing that it came out of the Targeting Zero task force, which wanted to support the Victorian hospital system to eliminate avoidable harm and strengthen quality of care, including recommendation 4.13.2 that:

The department should adopt a goal of ensuring that, by 2021, all major hospitals have a fully electronic health record that enables interchange of information with other hospitals.

That recommendation is quite significant because it talks about ‘all major hospitals’. Whilst this bill takes this into consideration – and they have laid out the scheduling and what health services it includes, and it includes both major and minor hospitals – it does have some issues that I will come back to in relation to the definitions around other health entities that I want to explore in more depth.

As I said, I fully understand the purpose of this and why so many health professionals are so concerned about what they are seeing in the emergency departments and what is happening on the ground. As we know over the last three years, with extended lockdowns, code browns and the lack of people being able to have procedures like cancer screenings, we have got a lot more people whose health conditions have worsened. That is a concern to me, and it will continue to be a concern, because I am still hearing the same stories as I was hearing six months ago, 12 months ago, 18 months ago. People cannot get in to see their doctors. They cannot get in to see a specialist. They are on a hidden waitlist, and when they get on that waitlist it is years sometimes before they can even be seen and treated. Of course we have got the issue of record numbers of people coming into emergency departments, and because there are no staff and hospital beds are closed we cannot get the throughput of patients through an emergency department into the hospital system. Then of course you have got that flowing back into the ambulance response and the ambulance system – and whilst I am on it, those issues have not gone away either.

So while the government might say they have invested billions, the outcomes for Victorians remain extremely concerning to me: too many Victorians are not getting the health care that they deserve and need. I say that they are standards that are falling in this state and they are standards that should never have got to this point. I say again: with Victoria having the harshest of restrictions over the last three years and with the government control that went on for those three years we have the worst outcomes of anywhere in the country.

It is another reason why people have got concerns about this particular piece of legislation, which will allow for the sharing of information – your private health information – with health services across the state without your consent, without your ability to say, ‘No, I don’t want that shared’. There is no opt-out provision like there is with My Health Record. Look at that. When that was coming into force it took years to get it in place and there was significant debate around it. In fact it was the federal Greens and their leader Adam Bandt who argued for an opt-out system. They were talking with the then opposition, the Labor Party, about an opt-out provision because it was the right thing to do, it was a human right and it gave patients autonomy over their patient information.

Matthew Bach: I opted out.

Georgie CROZIER: Dr Bach opted out, and there are many people in this chamber who have told me they are not a part of that, so I will be interested to hear their contributions and their reasoning for either supporting this bill or otherwise.

I understand, as I said, the intent of what the government is trying to do here: to have information on a patient – whether it is medication, diagnoses, their admissions, their disabilities or any aspect that is related to their health and wellbeing that they might have on their patient record – shared in the interests of having some continuity of care. However, I say again that there are instances where people do not want their sensitive patient information shared through health services. And look at our health services. As this government continues to amalgamate health services, more people working in one will be affiliated with a health service that could have access.

Whilst I am on the issue of the concerns that have been raised, I will just refer to the Medibank cyber attack of last November, in which 9.7 million Australians had their data hacked or their data accessed up in the cloud. That was extremely concerning for so many people because they had not only their service provider names and the codes that are associated with a diagnosis or a health-related issue that they might have had associated when they come into a hospital but their diagnoses, their procedures, their names, their email addresses, their home addresses, their dates of birth, their Medicare numbers, policy numbers, phone numbers and health claim data loaded up into the web and the dark web – and then of course we know the disgraceful ransom threats that were applied. That was extremely concerning, and I know there are people, again, affected by that attack. Is it any wonder people are very nervous about their private health information? It is information like cancer diagnoses, history of STDs, terminations and mental health issues. You could have been subjected to domestic violence, and you would not want that information shared, particularly if you had a partner or ex-partner working in the same health service.

For this government to say point-blank we are having this system come into play without taking into consideration some of the sensitive natures around why people would want to have an ability to opt out just defies all logic in my mind, particularly when we have got, at national level and elsewhere, an opt-out system. The government will argue, ‘Well, it works in other jurisdictions,’ but if you look at some other jurisdictions, they do have an opt-out system as well.

I say again: the cyber attacks in this state have been very significant. Austin Health had a very severe cyber attack not so long ago that brought the whole hospital to a standstill. There were surgeons that could not access the patients’ data, and they did not know who had hacked into it; that was a terrible attack. We had another shocking cyber attack in the south-west region that affected so many hospitals down there. These attacks in Victoria have been very significant, and as we know, there are more sophisticated ways to access this information. Some experts are saying that health-related data is the number one thing that these cyber criminals are after. So is it any wonder that people are nervous about cybersecurity?

This government has got a very poor track record, let us make no bones about that. We know that the department gets attacked hundreds of times a day or a week or whatever the latest data shows. But they get attacked very, very frequently – we know that; all government departments are. But I say again, because of those breaches that have occurred, there are concerns around this government’s ability to manage IT projects and security – and let us not forget HealthSMART back under the former Brumby government.

I want to move on to some very pertinent points that have been raised by the Law Institute of Victoria (LIV), which has been very vocal on this point, talking about patient autonomy and the right for people to have an ability to say where their information, their sensitive patient information, is shared. Why is that an unreasonable thing to ask? It should be absolutely paramount. They have quite rightly expressed serious concerns regarding aspects of the bill because it proposes a new system of sharing health information without the knowledge or consent of the patients involved. It abandons patient autonomy.

My main concern is there is no opt-out provision. They also say, in the recommendation that I referred to at the start of my contribution, that the Targeting Zero task force did make the recommendation, but it did not recommend automatically sharing every patient’s information with every other health service and it did not recommend sharing patient information with the Department of Health. So that aspect alone, where the government justifies that it is part of that task force and we need to have it done, is actually not quite accurate. You are not getting the full picture about what that Targeting Zero task force recommended. They certainly did not recommend broad sharing of information without consent.

Again, they also, in their documentation that they have provided to me, crossbenchers and other members, do understand the potential for safety benefits for patients. We all understand that. That is not what I am arguing here. I understand that, I understand the intent. But there is the concern about how it could be unsafe – and I want to stress that: it could be unsafe – for some patients who do not want their sensitive information shared. That includes patients that might not therefore tell the medical professional that they are seeing the full story about their history if they know it is going to be shared all over the place. Or how do they get a second opinion with confidence? What does that mean if they are not sufficiently satisfied with one opinion from one medical specialist and want to go and get a second opinion? That information is all shared, so it breaks down the trust in the system. It actually breaks down that trust. Again I say patient autonomy and the ability for a patient to be able to have a say in where their information is to be shared is incredibly important.

The LIV also raises concerns about sufficient safeguards. The government says there are sufficient safeguards here, and I note that the Minister for Health, when she was speaking, said, ‘Well, there are safeguards, there are penalties,’ and she also said the new system is protected by strict security and privacy controls. As I said, I am not convinced that this government has got that down pat, knowing what we do know from recent months. And of course we had the contact tracing debacle back in 2020. That information was shared without Victorians’ knowledge. That was sensitive information as well. So there is a track record of this government already doing this without people knowing where their information has gone, and I do not think that sets a very good precedent in the free and democratic community and society that we live in.

We want to be able to help people, we want to have the best systems in place, but we also should be respecting the rights of individuals and those individual rights that are slowly being eroded by this government because they are taking more and more control of what we have and what we see to be our own personal information. I do not want that. I do not want government in my life to the extent that we have just lived through over the last three years. The controls of this Andrews government have been off the scale, and we never got to the bottom of a lot of those issues around some of those decisions that they made, so I have no faith in this government securing our information in the Department of Health without people accessing it. For people not to be able to then go and check to see, ‘Well, actually, I can’t even FOI. I can’t even find out who might have accessed my private health information in the Department of Health,’ shows another level of control by this government.

Frankly I am sick to death of that control, and that is why I think it is incredibly important that we have the ability to opt out – that every Victorian has the right to choose. That is a fundamental right that we should be absolutely proud to have. We all should be acknowledging that. We should all be proud to have that right. Yet this government comes over the top and says, ‘No, you don’t have that right.’ Well, that is what I am, frankly, fed up with, because I think too many Victorians have suffered at the hands of government control. I think we are slowly eroding those rights, and I do not think that that is at all helpful.

I want to just also state that some community health services have written to me and said they actually have got concerns. They have said they are concerned about information being shared across all manner of services that are identified under the act and by the department secretary without the consent of the client patient – it is not an opt-in system. While this is efficient, I am not sure many of the clients of a community health service would want to have information shared with other services even if it is for the purpose of providing better health care. We have seen this with My Health Record at a Commonwealth level. There is concern out there in some community health services, who have expressed that. Again I would like to also read from the Victorian Alcohol and Drug Association press release from just a few days ago about what concerns they have about this piece of legislation. They say:

This Bill will further exacerbate stigma as information relating to substance use (such as overdose or support through opioid substitution therapy) will be visible to a range of health professionals without patient consent.

…

… We know with the Medibank hack, some of the first efforts at extortion were directed towards those who had sought assistance for alcohol and other drug and mental health concerns …

They have raised issues around where this information is going to be shared and the lack of trust and the stigma that could apply to their clients.

The joint media release today from the Law Institute of Victoria, Liberty Victoria and Digital Rights Watch reiterates the calls to respect patient autonomy, just what I have been speaking about. LIV president Tania Wolff says:

All Victorians should be concerned about the failure to include an opt-out provision in the Bill. This signals a departure from a human-rights and patient-orientated framework which is well established in other Victorian legislation.

I could not agree with her more. They go on to say that they feel that this bill does not strike the appropriate balance between clinical efficiency and safeguarding patients’ rights. Again, I could not agree with them more.

I have got concerns with this bill, as I have just outlined: those issues around there being no opt-out provision, those issues about there not being the ability for a Victorian patient to FOI the Department of Health and access who has actually been looking at their patient information. This bill does not allow that to occur. I have also got concerns about the definitions in clause 4, subsection (k):

a prescribed entity or a prescribed class of entity that provides health services …

The other definitions actually talk about scheduling – a denominational hospital listed in schedule 2, a metropolitan hospital listed in schedule 3, a multipurpose service, a public health service listed in schedule 5 et cetera – and outline a whole lot of health services which this bill captures. They are public health services. But what does that definition in subsection (k) – ‘a prescribed entity or a prescribed class of entity that provides health services’ – mean? Does that mean every private health system in Victoria? Does it include private GP practices? And if it does, who is going to be paying for this technology and this information? That is why I have got three amendments that I am happy to circulate now, if I may.

Amendments circulated pursuant to standing orders.

Georgie CROZIER: I would just like to speak to these while they are being circulated. Obviously they relate to the issues that I have just highlighted, but with the definition in relation to that prescribed entity – I will be interested in the government’s response, and I will be asking this in committee – what does ‘a prescribed entity or a prescribed class of entity that provides health services’ mean? If it is confirmed by the minister that that does take in private health services, then the first amendment I will move is to exclude that clause, because I do not believe that they have been consulted with at all on this legislation. I will be asking more questions in relation to that.

The second amendment relates to the opt-out provision. Again, you have just heard me speak about why I am very strong on this. This is about patient rights; it is about patient autonomy. It is incredibly important that patients have the right to understand where their sensitive patient information is being shared and why they cannot have an opt-out clause, which is in line with My Health Record, which is operating at the Commonwealth level.

The third amendment I have relates to the issue around the FOI aspect, where there is no ability for a Victorian to actually ask the health department, ‘Who has accessed my private health information that you are storing?’ I think that, again, is another absolute right that any Victorian should have when you are dealing with very sensitive information, whether it is physical or mental health implications, whether it is drug abuse, whether it is the termination of pregnancy, whether it is cancer diagnoses or whether it is a history of STDs or blood-borne viruses – something that people just do not want others to know about other than their treating doctors. I have heard the minister on radio. She could not really answer why there was no opt-out provision. She just answered it by saying it will save lives. Well, I am concerned that with many people concerned about their information being hacked, being exposed, as we have seen, and having it spread throughout health services that are getting larger as the amalgamations take place people will not be up-front and will not be giving their true medical history.

As somebody who has worked in this area, I understand when they say, ‘You can go along to a paper file and check out somebody’s information.’ That is absolutely true, but that is confined to a ward, to a hospital or to a medical records department. It is not spread throughout systems and then stored in the Department of Health – and that is the difference. I say again that I remain extremely concerned about the lack of ability of patients to have control over their sensitive health information. It is their right to understand where that information has been shared, where it has gone and who has accessed it. It is their right because it is their information.

As I have said, this government wants to take more and more control. We have had a taste of it over the last three years. It is incredible that they are just unwilling to budge on this. As I said, the task force might have recommended information sharing, but it did not recommend that every patient’s information would be automatically shared with every other health service, and it did not recommend sharing patient information with the Department of Health.

With those words I urge the crossbench to consider what they are about to vote on. This is an incredibly important piece of legislation that we are debating. I understand the intent; I understand what the government wants to do. But I also understand the increasing groundswell of Victorians who want a right over their information. They want to have a say about what is shared and what is not, and they have every right, in my view, to have an opt-out provision. I am looking forward to the rest of this debate, and I would urge the crossbench to support the amendments that I have put forward that provide for an opt-out provision and that not every single health service in Victoria will be captured because of the unintended consequences that could then apply. Also, there is the third amendment around the ability to FOI the Department of Health to understand exactly who may have accessed your private health information.

Michael GALEA (South-Eastern Metropolitan) (15:06): I also rise to speak on the Health Legislation Amendment (Information Sharing) Bill 2023. In doing so I would like to begin by commending our health workers across this state, who work extremely hard day in, day out providing exceptional care to all of us when we need it the most. Of course that ranges from high-ranking professionals – surgeons and doctors – right through to administrative staff in the healthcare system, paramedics, nurses, ward attendants: the whole lot. This is a bill that will help them as they do their jobs.

The bill will aim to improve the Victorian healthcare system by enhancing information sharing between healthcare providers, and it will lead to better decision-making and also better treatment outcomes. This is something that is critical in today’s healthcare landscape, which has become increasingly complex and fragmented. The reforms will move our healthcare system into a place that can deliver better outcomes and better, more responsive decision-making by healthcare providers. We have moved beyond the days of an individual’s medical history being stored in physical folders spread across various GPs, hospitals and other treating providers. The platform that this bill establishes will establish a safer and more secure method of information sharing. The current methods used by some clinicians are not actually comparable in terms of either efficiency or, quite importantly, security. I think it is important to note that a number of medical services and healthcare providers already do operate their own systems and they may not have the same robust level of security as this bill proposes for this new system. So, addressing Ms Crozier’s concerns, there are already some concerns which this bill will actually directly address.

There are a number of ways that records are currently kept and dealt with. In fact in a lot of cases there are still faxes being used to distribute medical records, which is something that is quite surprising to hear. Many of us thought that perhaps the days of faxing were gone. I remember that when I started my professional career back in 2011 the organisation I worked for had a fax machine. I think it might still do so; it might be in the archives now. It maybe got one fax a year, but that was still a thing back then. But we are now in 2023, and I think it is fair to say that we have moved beyond the need for fax machines. In fact when I was volunteering at the Puffing Billy Railway as a 15-year-old I had to fax the daily departures from Gembrook station back to Belgrave to tell them how many people had gone on the train that day. It took about 20 minutes, to be honest. It is much easier to send a text or use a secure platform to do that, which I am sure is what they do now. It is ridiculous that we still have information being shared over fax machines in this day and age, and this is one platform that will help us to address that significantly. It will help the storage but also the communication of information for our healthcare systems, which is something that should inspire a bit more confidence than a humble fax.

By establishing this robust framework for information sharing, it will address the fragmentation of the healthcare system. It will empower patients by requiring health service providers to seek consent before sharing their information. The bill also ensures that patients will receive optimal care and ultimately achieve the best possible health outcomes. Information sharing between health services will occur through a secure platform operated and managed by the Department of Health. The department will be the body authorised to store and share health information between public health services electronically. Health services will not be allowed to store and share information of their own accord; they will have to use this platform, again which will improve security. Establishing a health information platform where information can be stored, managed and shared in a manner that is responsible, discreet and secure is at the centre of what this bill seeks to achieve.

The bill recognises the significance of information sharing in providing topnotch healthcare services and provides safeguards to protect personal information consistent with privacy principles. There are provisions for the information to be shared without consent only if it is necessary to provide healthcare services or if there is a serious threat to that particular patient’s health or safety. This will ensure that patient privacy is protected while still allowing for vital information to be shared when it is absolutely necessary to do so. It is also important to note that this bill does recognise the importance of obtaining patient consent before sharing their information and includes provisions for sharing information without consent only in those situations where it is strictly necessary to provide healthcare services or if there is a serious threat to the patient’s health or safety. The bill will not allow for unauthorised sharing of patient information.

Discussion of this bill has brought up the potential for there being an opt-out system, with the Commonwealth’s My Health Record and its opt-out mechanism being floated as an example. I will touch on this briefly and note that under existing law public hospitals actually already can share health information – as many in this room who have medical backgrounds would be aware – required in connection with the treatment of a patient. Hospitals can access this information without the requirement to get permission. In this instance the bill will adopt a similar approach to how the law currently functions, allowing for the sharing of health information for the continued care and treatment of patients. What this secure health information system will do is improve the way in which information is accessed as well as the security around the sharing and storing of that information.

So there are some particularly demonstrable benefits that this legislation will bring. The Health Legislation Amendment (Information Sharing) Bill 2023 will build upon the information-sharing systems already implemented, as has already been noted, in various other states. Health information sharing will bring Victoria into line with other similar jurisdictions which have already integrated their electronic health information sharing between public hospitals and other medical providers at the point of care, such as HealtheNet in New South Wales, the Viewer in Queensland – which is perhaps a bit of an odd name for it, but they can do them – and the Digital Health Record in the Australian Capital Territory. These systems have demonstrated the benefits of a centralised system for sharing patient information between healthcare providers. With their implementation we have seen these systems assist in improving patient outcomes and ensuring that healthcare providers have access to the information that they need to make timely and informed decisions.

Information sharing is of course not a new concept. Both Liberal and Labor governments have implemented similar systems in the past, as I referred to, such as those in those other states and the territory that have implemented those other equivalent pieces of software. The Health Legislation Amendment (Information Sharing) Bill 2023 builds on this bipartisan legacy by creating a framework for information that is flexible and also scalable. The approach will ensure that the healthcare system can continue to meet the needs of patients whilst also allowing for future advancements in its technology. Given the existing success of information-sharing systems, the Health Legislation Amendment (Information Sharing) Bill should be a bipartisan effort. The bill’s provisions prioritise patient privacy whilst still enabling healthcare providers to access the information that they need to provide effective care. This balance is crucial to ensure that patient care remains a top priority of the healthcare system regardless of political affiliation.

All that hopefully sounds all very well and good, but I think it is also important to reflect on some of the real-world examples of what this actually means. We can talk about information sharing and amendments and everything else for days, it is all very important to do so, but let us have a look for a moment at what this bill will actually mean.

In looking at this debate, I had the opportunity to read up on the member for Monbulk’s contribution on this bill in the other chamber a few weeks ago. I strongly recommend other members read it too. It was a very, very moving contribution. She spoke very well about her family experiences with the healthcare system. She has had a number of interactions with them, for her mother and also for her son. She told the house that she had to take her mother to an appointment just last month – quite a serious medical appointment. Unfortunately she had had a rather bad fall and was on a number of medications at the time. The member for Monbulk had to then bring out every single one – I think there were about a dozen, so 12 medications – to the treating practitioners to explain one by one what medications her mother was taking at the time. She showed them the empty bottles – if she had not had the empty bottles, she probably would not have been able to actually do it – and the pharmacist on duty duly noted down by hand each and every one of them. Obviously the absolutely inefficient use of time, let alone the risk for error in that process, does not lead to the best and fastest possible patient outcomes. That is a very, very good real-world example of the sort of thing that this bill seeks to achieve.

The member for Monbulk further contributed that her son had to be taken from his school by ambulance to hospital due to a cardiac-related issue. The attendants and the medical practitioners believed that he had been suffering from drug-related symptoms given the extreme nature of those symptoms. Now, he was not, and the member for Monbulk certainly explained that, but in the time it took her to actually speak to the medical practitioners decisions could have been made – fortunately they were not – which could have adversely affected her son, that patient. That just goes, again, I think, to show the real importance of this bill and what it actually seeks to achieve for patients right across this state.

An independent oversight committee supported by a clinical advisory group will be established as part of this bill, before the commencement of the legislation in February 2024, to ensure privacy and security. This committee will also provide advice to the Secretary of the Department of Health on the implementation and successful operation of the information system. The bill will address cybersecurity concerns, and it protects patient privacy by implementing strong access controls and encryption to secure sensitive information. The measures established by the government will mitigate cybersecurity risks by implementing strong access controls and using encryption to protect sensitive information. A primary management framework, or PMF, will be implemented to limit access to and ensure the management of sensitive health information. Restrictions on sensitive information ensure additional protections for vulnerable groups, including victims of domestic violence. The PMF will ensure that only designated healthcare staff who need to see the information for decision-making purposes will have access to it. This bill also establishes a framework for information sharing that is consistent with those privacy principles. It ensures that healthcare providers can access the information they need to make informed decisions. The framework is flexible and scalable to allow for future advancements in technology, as I said, as well.

There must be high standards and strict controls to protect information and to minimise the risk of loss, misuse and, of course, unauthorised access to health information. The Department of Health will establish a health information sharing management committee, which will oversee the implementation of advanced cybersecurity tools and services as well as ensure that the implementation of the necessary systems to safeguard health information are in place. This committee will function as an arms-length body of the department and provide strategic direction and assurance. It will consist of various experts from different fields, including health, privacy and legal professional backgrounds. The committee will be responsible for monitoring the use of the system, ensuring that patient privacy is protected and also making recommendations for improvements. Moreover, it will ensure that the system is being used appropriately and that personal information is being protected. It will promote transparency and accountability and ensure that health service providers are accountable for any breaches of patient privacy. The committee will also provide guidance to health service providers on how to use the system safely and effectively.

By establishing strong governance arrangements and an oversight body the Andrews government is demonstrating its commitment to ensuring that patient privacy is protected in this bill and that the healthcare system is being used appropriately. The bill includes provisions to address cybersecurity concerns. Misusing the system can trigger an investigation, disciplinary action and criminal penalties. The three new criminal offences are introduced in this bill to prohibit unauthorised access to the system, unauthorised disclosure or unauthorised use of information.

These can carry considerable penalties, which are very important to have in place. This includes 240 penalty units, which is currently approximately $44,380 or two years of imprisonment, for any unauthorised access of the information. In addition, treating clinicians will have an obligation to ensure that health information they access is kept safe. This work will be done in conjunction with a duty to comply with their existing professional and legal obligations. Cases of there being a failure to comply with both their professional and legal obligations may trigger investigation or of course other disciplinary action.

In closing, the Health Legislation Amendment (Information Sharing) Bill 2023 is a continuation of the Andrews Labor government’s commitment to enhancing the health outcomes and general wellbeing of all Victorians. I believe that the mechanisms and safeguard measures established in this bill demonstrate an appropriate and strong level of protection to ensure that health information stored by the department is securely stored and managed and that it will be shared appropriately. The bill does not compromise people’s personal information but ensures a high level of security to maintain their privacy and confidentiality. By enhancing this information sharing, though, the Health Legislation Amendment (Information Sharing) Bill 2023 will improve the healthcare system of Victoria, guaranteeing patients receive the best possible care and the best health outcomes. I commend the bill to the house.

David ETTERSHANK (Western Metropolitan) (15:21): I rise to speak to the Health Legislation Amendment (Information Sharing) Bill 2023. There is no doubt that in an emergency room context having a patient’s medical history at hand can be life saving. It can also be time saving and cost saving: life saving in terms of immediacy of treatment and time and cost saving in terms of diagnostics, quicker treatment and reduced wait times. There can be no doubt that our health system is currently at a point of crisis, a crisis that has the potential to become worse if, or rather when, a more virulent strain of COVID presents itself. There is no doubt that in Victoria in 2023 there has to be a better alternative to doctors and nurses faxing each other, because that is how information is being exchanged across our public health system this very minute. We support the intent of this bill in that regard, but it is a bill with criticisms from a range of prominent stakeholders, on which we are well briefed. Patient autonomy and privacy are very legitimate concerns already canvassed in this chamber and privately. These are issues of great concern too to medical cannabis patients, who remain stigmatised both inside and outside of the health system.

This bill as originally presented could not have had our support. A range of concerns will hopefully be ameliorated in part by government house amendments. Further concerns may be addressed via undertakings given on the floor of this chamber by the minister representing. Some may be remedied via amendment. We currently await a response from the government to a number of matters raised, and we will be paying close attention to the remainder of the debate.

David DAVIS (Southern Metropolitan) (15:23): I want to make a contribution to this bill, the Health Legislation Amendment (Information Sharing) Bill 2023, which sets up a large data system for our state health system in Victoria. As Mr Ettershank has just said, there are good reasons for data sharing but there are also significant risks. We are very concerned about the way this will operate, and I think it is worth putting those concerns on the record. The objectives of better data sharing, of better information to support clinicians and of cost saving potentially – where information is available and tests and otherwise do not need to be duplicated – are perfectly understood.

Equally, there are significant concerns with this bill. This bill sets up a centralised repository for information. It sets up a repository where hacking can occur, and we have seen repeatedly over recent times some of the concerns that have arisen where significant hacking of central repositories of information occurred. The Optus example I think resonates in everyone’s mind, where telephone, text and other data was significantly mined and put out onto the web at huge cost to individual people. The Medibank Private example is also recent and I think bears heavily on how people view this. I am told that more than 9 million records in terms of the Medibank Private hack were got by the hackers and released in regular tranches of information. And it is the most sensitive information that is always the target of these hackers. Whether it is illegal drugs or whether it is pregnancy terminations, whether it is cancer or STDs or other diagnoses, information and test results being put out after a hack, it is a great concern to most Victorians.

We have heard the government and government speakers blithely say, ‘Oh, there are checks, there are balances, there are protections.’ So we heard with Optus, so we heard with Medibank Private. I for one am completely and utterly unconvinced, and I say this as a former health minister, having dealt with the data issues in the department. I inherited a set of circumstances where the HealthSMART system – administered initially from about 2003 on but in the more recent years, before I came in as health minister, by Daniel Andrews as health minister – was an absolute debacle, an absolute dog. It was hundreds and hundreds of millions of dollars over budget and a data system that did huge damage to a number of health services, most famously up at the Eye and Ear, where clinical errors increased as HealthSMART was put in place. It was a very, very bad system. One of the things that the government sought to do with that was to force records together. Interoperability is actually the key, and an ability to have dispersed records that can be accessed in a comprehensive and thoughtful way with appropriate protections is a much better way to go than the central repository, the central storage. The government’s concerns and problems with health data management before the 2010 election when Daniel Andrews was health minister I think are indicative. We saw data mismanagement, we saw data manipulation, we saw cheating. We saw a whole series of serious and problematic interventions, all administered and overseen by Daniel Andrews as health minister. So I for one have little faith in him or anything of this type that comes from a government that is administered and oversighted by him.

I also want to say that the need for greater protections has never been greater. The difficulty with these large centralised repositories is becoming greater, not lesser, and we actually need to make sure before we proceed with these matters that there is a solid and reasonable set of protections in place.

Again, I think the national system is quite different but also controversial. There is an opt-out arrangement with the national system. I for one, again, with the national system am far from convinced that it is actually as secure as it should be, and I will just indicate to the chamber quite clearly now that I have opted out and made sure my whole family has opted out of that system because I do not trust it and I do not think –

Nicholas McGowan interjected.

David DAVIS: No. But let me be clear here: I am less trusting of this system at a state level, run by Daniel Andrews and his government. This is simply a terrible grab for power and a terrible grab for centralisation.

I think at a minimum you need an opt-out arrangement. We need that ability for people to opt out of the system and to clearly state that they do not want to be part of that system. And why is the government trying to suppress FOI oversight, FOI access to the central repository and who has accessed people’s personal records? Why can’t people see their own records as they are held in the central repository and held by the Department of Health? Why is that? What is the problem with people exercising an FOI access to the details of their own personal health records and the holdings that the government has on their own personal records? I cannot understand why the government has those concerns.

Ms Crozier has indicated that the opposition will seek to introduce those important amendments. An opt-out provision and also a guarantee of that FOI on the centrally held information and who has accessed that centrally held information will be opposition amendments. I welcome those amendments, and I urge the house to support them.

I should say that this is a bill that SARC – the Scrutiny of Acts and Regulations Committee – ought to have played a bigger role in. I understand the difficulty that SARC has faced, as it has been recently set up. I am clearly a member of SARC, but my long-term criticisms of SARC remain. Mr Limbrick, you will understand my long-term criticisms of SARC. It is a committee that has got a very important oversight of the rights and privileges of Victorians, and this is the sort of bill on which SARC should become very active. In my view – and this is a general comment – it should not just be having submissions from one or two or three bodies; it should be hearing from a wide audience about these matters, including technical matters, in my humble view. It is not enough for a committee like SARC – and this is a general comment I am making about these sorts of bills – to sit back and make the sort of standard sets of analyses. I am not diminishing the importance of those, but SARC needs to become more engaged, in my humble view, in the work of actually scrutinising these bills at a deeper level. This is such a bill. I admit it is very early in the Parliament. The committee has just been established, and the government has come in headlong with this bill. But in fact a similar bill was in the last Parliament, and in the last Parliament SARC could also have played a very significant role. It could have held hearings; it could have sought to find out the best methods of protecting the personal information of people. That is not what it has done with this report; it is not what it did with the previous report. I make the point that SARC has a very important role, and that role should not be short-circuited. It should not be a cursory role. It should not be a role that is limited to the desk analysis that is routinely what SARC reports are and what they produce. It needs to be deeper, it needs to have community input and we need to make sure that rights and liberties are actually protected. That is the role of the committee, at the end of the day.

As with the earlier report, I am far from convinced that the report comes to grips with the depth and the problems with this bill. I really firmly believe that the issues in this bill are profound. The government has brought this bill to the chamber, and I know many of the health practitioners that support the bill do so in sincere belief. I understand precisely the advantages of bringing together health information in a constructive way and enabling clinicians to see more-complete sets of information. I fully appreciate that point. But clinicians also need to understand that a critical matter for people is to have confidence in the system, and I, for one, do not have confidence in this government’s ability to put in place such a health data management system. I far from have confidence in that ability. We have seen a number of our health services hacked already. You only need to think what is going to happen with the central repository of information, a centrally managed arrangement in the Department of Health – 50 Lonsdale Street or one of the outlying areas – and think of the risks that are involved here.

The depth of the data should not be underestimated. It is Ambulance Victoria data; it is community health data; it is the public health service data from all around the state, and with some of the definitions that are put there it is pretty clear that the government intends to rope in the private sector as well, so private hospitals will be an early target for this information. What the government will do with GPs, what the government will do with other health practitioners, is also an open question. Will the government seek to use the powers in this, which are clearly more than adequate to do whatever the government wants? They are able to rope in any registered health practitioner and perhaps some that are not registered too to the data control that is involved with this. Will they do that? I do not know, but I would posit at this point that the major private hospitals are an early target for the government with respect to –

Nicholas McGowan: And pathology.

David DAVIS: Pathology as well, and some of that would of course be captured in information in our public health services. But yes, I can see pathology and radiology services dragged into this as well. If people think it is a good idea to have a central repository that is not protected in an adequate way and people think that it is a good idea to have people’s mental health information, their test results, a whole range of other critical pieces of health information hacked and from a central location, this bill will set the way forward for that to occur.

Let us not make any mistakes here. If anyone thinks that a Department of Health repository managed and controlled by the Department of Health is safe from hacking, good luck to you, because I predict that if this is set up, it will be hacked. Data will be released. People will be compromised. Their personal information will be released, just as we saw with Medibank Private, just as we saw with Optus and just as we have seen with individual health services – there have been significant hacking attempts at those. So these things will occur. It is not a question of if, it is a question – after the central repository is set up – of when that hacking will occur and when it will successfully break into the system.

I think this is a very significant bill people have not understood, and people need to think very, very carefully about this. I know the government is putting enormous pressure on the crossbench to buckle, to bend, to bow down in front of the government on this and to tick the way forward for this bill. I understand that that is what is occurring, but I urge the crossbench to think very carefully about this and to think about actually standing up for the long-term rights of Victorians. At a minimum, support the opposition’s key amendments about FOI and an opt-out provision. At least with an opt-out provision people have the ability and right to say, ‘No, I don’t want to be part of this system, this Orwellian system.’ This is like Hal, the central computer – (Time expired)

Jacinta ERMACORA (Western Victoria) (15:39): The passing of the Health Legislation Amendment (Information Sharing) Bill 2023 is a serious commitment by the Labor government to the highest possible communications across our health sector. Public hospitals and specified health services will be able to share patient health information electronically for the purpose of providing medical treatment to patients. This bill is about patient care. It obviously has the potential to save lives and improve health outcomes, and it will also help streamline our medical system and stop diverting essential resources to the publication of tests, diagnoses and treatment information.

The health information will be shared through a secure system operated and managed by the Department of Health. A secure patient health information sharing system will provide a far safer way to exchange information than we currently have. As my colleagues have mentioned, faxes and phone calls are still used today, and the lack of a coherent and consistent paper trail can lead to mistakes and lost information. Indeed having information available in one place is essential to providing the best care and treatment for patients across Victoria. This bill will establish the legislation needed to create the right authorising environment to collect patient health information as well as put appropriate controls around how and why that information is accessed, used and disclosed. Advanced cybersecurity tools and services are applied by the department to all health operational and personal data, meeting the security levels set by the Victorian and Australian governments. This bill creates strict rules around restricting access in the system for the purposes of medical treatment, information security and data management only. This will provide frequent auditing, security identity and access management capability to regulate who has access to patient information and data. This security demonstrates the serious commitment the Andrews Labor government has to the highest possible cybersecurity to safeguard our communications.

A privacy management framework will restrict access to designated health service staff – those who need the data to make the best clinical decisions possible with all relevant information at their fingertips. Very importantly – and I understand why there is some concern about this – this framework will provide additional protections for groups in circumstances like family violence, child protection and health justice. It is recognised that vulnerable and high-risk groups may have heightened expectations and needs around processes in place to safeguard their privacy and to minimise the risk of the wrong eyes seeing their health information. Only authorised clinicians working in public hospitals will have access to the secure health information sharing system, and it is worth noting that there are already strict controls in place at the hospital level.

Confidentiality is not a new concept for the health sector. The security framework is seriously backed by the introduction of this bill. There are three new criminal offences completely prohibiting unauthorised access to the system. Breaching the system for unauthorised use or disclosing information will be criminal offences that will attract a fine of 240 penalty points, translating to over $44,000 or upwards of two years imprisonment.

The Department of Health will also establish a health information sharing management committee to provide independent advice to the secretary on the department’s governance, risk, control and compliance frameworks. This committee will be supported by clinical and consumer advisers. Detailed policy and procedural guidelines will support the operation of the bill. Let us be mindful that data breaches can happen the old-fashioned way, as we have already heard in this chamber today. Medical information stored at a doctor’s office is vulnerable to a physical break-in through a window or through a door, and as we know, faxes and phone calls are hardly above the risk of abuse or negligence.

It is also important to note that significant consultation took place for this bill during 2020–21, and the new system is expected to start operation by February 2024. There has been and continues to be an extraordinary level of attention to detail and consultation throughout this process. The department has conducted engagement with peak bodies and the hospital and clinician communities, and the lead time of this bill ensures consumers, patients and health services will be well aware of the new information-sharing provisions ahead of implementation.

This access to all health records will help alleviate pressure and streamline processes for our health sector. We all agree that, particularly since COVID, our health professionals have been under huge pressure with staff shortages, and we must recognise that our systems need to adapt and become more efficient. It is not uncommon for old ways of doing things to become superseded by better ways of providing health care, and I think we have all experienced over the last couple of years the transition from meetings only being available in person to now being hybrid meetings or meetings completely online. Prior to COVID we probably would not have considered that to be acceptable – it was something we were not used to – but also it was something that perhaps was not technologically available to everybody, nor was it inclusive of everybody. Since COVID everybody has become able to access – or most people have – that mechanism for meeting. It is a really good example of how changing the way we do things can be change for the better.

Many people now have multiple points of contact for their health: changing GPs, accessing specialists and moving from city to country. Information sharing will significantly reduce red tape and embarrassment for patients, who will no longer need to tell their medical history over and over again. This will also impact on reducing administration costs. For a period of time I worked at a primary care partnership, and my role was to work with health service consumers and patients and to listen to them and understand what their needs were in relation to information and information sharing. The feedback that was provided to me and the primary care partnership in Warrnambool was that patients were sick of telling the same story over and over to every practitioner that they went to see. They wanted all of their practitioners, everybody providing health services to them, to be working together in what in the health services sector is called an integrated health service. It seems to me that this model is going to meet that consumer request, that patient request.

This bill delivers on key government commitments outlined in the 2016 Targeting Zero report. As we all experienced, COVID also reinforced the need for less barriers with information sharing. In recent years natural disasters, such as floods and bushfires, have shown the importance of information sharing when facilities are damaged. These factors have led to a dramatic increase in the use of telehealth, showing us that up-to-date electronic health information is vital as systems change to meet new challenges and as systems change to meet the demands of patients. The take-up of telehealth under COVID was, I think, unexpected. It was seen as very popular, particularly in regional communities. It allowed them to access their doctors without risking their own health further.

The opt-out principle undermines the primary objective of the bill, which is to ensure clinicians can have access to all relevant medical information to provide timely care. Right now under the existing law public hospitals can share health information required for the further treatment of a patient. I personally find it irritating when I go to a specialist and they do not have my medical records with them; that is really frustrating.

The bill adopts a similar approach, with the changes allowing for a single point of complete and accurate patient information for the following entities: public hospitals, multipurpose services, denominational hospitals, metropolitan hospitals, prescribed health services, registered community health services, the ambulance service, the Victorian Institute of Forensic Mental Health and the Victorian Collaborative Centre for Mental Health and Wellbeing. The secure sharing of information amongst these entities will naturally lead to increased efficiency and faster time lines in understanding a patient’s medical history. Clearly, by aligning these entities under the bill and including all Victorians, our health system will be far more robust. If the opt-out model was to be adopted, patients might be required to redo tests, which we know can be distressing for the patient and creates unnecessary cost and delays.

The bill lapsed due to COVID, and it is now logical to pass this bill into law, particularly as COVID has shown us firsthand how better integrating our health services will improve health outcomes. The introduction of the secure system will bring Victoria in line with New South Wales and Queensland. New South Wales introduced the HealtheNet platform in 2015 and Queensland introduced the Viewer in 2017. The ACT and South Australia have also implemented integrated digital health record systems across their hospitals. Consultation has been ongoing with our state counterparts, and many learnings have been observed from the operation of their systems and their current procurement of any upgraded platforms – and the market is continuing to develop for these products.

There is different legislation and there are different purchasing agreements in different states, and Victoria’s secure system will be tailored to operate within the Victorian health IT systems. However, this bill will align us far more closely with our state counterparts and in the future will facilitate a larger conversation about our health system federally. Border health services such as Albury Wodonga Health will use and have access to the Victorian security health information sharing system. Victoria, New South Wales and South Australia do adhere to the same health national information standards, and it will place all states in a strong position to support care on all sides of the borders.

As the Minister for Health Mary-Anne Thomas has stated, secure health information sharing will deliver Victorians the same benefits that patients around the country are already getting, ensuring they receive the best possible care. I support this bill.

Renee HEATH (Eastern Victoria) (15:54): Acting President McArthur, may I extend my sincere congratulations on your appointment to this role.

I rise to make a contribution on this bill. I agree with this bill in its intent. The integration of health records under a centralised electronic patient health information sharing system – it is a mouthful – is an essential step towards Victorians experiencing the best health outcomes. A more efficient and effective health system is something I support. However, the lack of an opt-out system represents a major breach of the right to privacy and could risk the safety of our community’s most vulnerable.

It is deeply concerning for many Victorians, including victims of domestic abuse, violence and stalking to name a few. A mandated data system could risk victims and their children being exposed to their abusers if they were to gain access to this information. Implementing an opt-out system upholds the principle of patient autonomy by giving patients the choice to decide who can access their health information and how it can be used. The right to privacy is paramount. The erosion of this right risks Victorians disengaging from our healthcare system in fear of their safety or in fear of how their information could be used, and this could result in Victorians avoiding critical medical services which they really need.

The neglect of our right to privacy is significantly troubling given recent events in the health industry. While those opposite will cite the perceived improvements to data protection in this bill, we cannot ignore the increasingly dangerous environment that electronic databases are facing. In recent months Australians have been aware of major threats that the IT industry faces when it comes to databases, notably through the hacking of Medibank and Optus. In fact the UK’s National Health Service was last year involved in a major ransomware attack. This concerning pattern of attacks has unfortunately been the topic of many conversations with my constituents. The Law Institute of Victoria, which is the peak body for the legal industry in this state, has expressed grave concerns regarding the Andrews Labor government’s refusal to include an opt-out system. I refer to the LIV’s media release from 15 February this year. It says this:

Patients must have the right to say who can access their health information – even if this means their health information will not be shared under the scheme. Patient autonomy is a fundamental human right: it’s the same principle that allows a patient to refuse medical treatment.

Just hours ago the LIV, in partnership with Liberty Victoria and Digital Rights Watch, reiterated its call for a patient autonomy to be respected and described this bill as a departure from a human rights and patient-oriented framework which is well established in other Victorian legislation.

I am also worried about the government’s exemption from freedom-of-information requests in this bill. This provision prevents patients from requesting information on who has accessed their health data and why. The Law Institute of Victoria president Tania Wolff said the following:

Such a provision leaves patients in the dark on how their health information has been accessed and by whom.

My constituents are calling for an opt-out system, the Law Institute of Victoria is calling for an opt-out system and therefore I am calling for an opt-out system. While I agree with the intent of this bill to improve the health outcomes for Victorians, I will not stand by while the principle of autonomy is yet again trashed and neglected by this government.

John BERGER (Southern Metropolitan) (15:59): I rise today to contribute to the productive debate on the Health Legislation Amendment (Information Sharing) Bill 2023. I want to explain the bill in detail and comment on the significance of the amendments and ultimately demonstrate the benefits that it will provide to the community of Southern Metro and ultimately indeed to all Victorians. Put simply, the bill will make provisions on health services more efficient, and consequently the quality of medical treatment will be improved. What is this all about? Essentially, the bill will amend the Health Services Act 1988 to allow a centralised electronic health information sharing system. Health providers will share information with the purpose of it being used to treat their patients.

In practice health information will be collected and disclosed to the Secretary of the Department of Health, the head of the administration, to establish the electronic health information system to help hospitals and other health services such as Ambulance Victoria, denominational hospitals, multipurpose services, public health services, registered community health services, the Victorian Institute of Forensic Mental Health, residential care services and the Collaborative Centre for Mental Health and Wellbeing to share the information efficiently and securely. From a practice standpoint, the amendments will come to be in effect on 7 February 2024 unless the department and the heads need more time to design and construct the system. The amendments will allow for the secretary to establish and maintain a system with the purpose of sharing this information with the other health services providing medical treatment under section 134ZF.

The bill will also allow for specific information to be collected and given to the secretary under section 134ZG. The secretary will have the power to specify in a notice that patient health information being shared may include medicines prescribed to the patient and other relevant information such as allergies, alerts, admissions, discharge summaries, outpatient consultations and laboratory and imaging results. The bill will allow the secretary to ask for information up to 7 February 2021 – and uniformly the information on that system. A retrospective date is needed for a context of a patient’s medical history to allow for a proper holistic view of the patient.

Importantly, division 3, section 134ZO allows for the effective maintenance and operation of the system and includes securely hosting the system with unique identification numbers. Why? Because it provides better security and data management, guaranteeing the system operates safely, securely, effectively and with the correct information.

I would also like to outline the provisions of the legislation that are designed to keep personal information safe. Division 4 lists the offences that protect the information that is being collected and stored by the secretary. It will be an offence to access private information unless authorised to do so. Penalties will include two years imprisonment, which demonstrates the sensitivity of the matter.

There is a new section, namely 134ZS. This stipulates that the system will hold specific information at one point in time. The initial health service providing that medical treatment will have no more information on that patient. As a result, the Freedom of Information Act 1982 does not apply to the healthcare database. There is a lot to consider on this front. I am not a lawyer, but I have had 40 years of working experience and I have got a bit of common sense from it.

This government is not in the business of engaging with political arguments for the sake of it, but some have used straw man arguments to create division over this piece of legislation. I want to call it out, not by name, not by finger-pointing, but by specific incidents. I do not want to engage in gutter politics. The Premier has pointed out there are no opt-out provisions in similar legislation in New South Wales, the jurisdiction in Australia most like Victoria. Health practitioners already share information and have full visibility of your pharmaceutical history – they can see holistically your treatment journey.

It has been pointed out that this legislation will strengthen data integrity, not diminish it, and it has been pointed out, this important note, that in the 21st century, particularly after the year of hacks we saw in 2022, Victorians must be sure that their private data will be protected. This legislation will strengthen cybersecurity. So let us be clear, this is about ensuring Victorians get the best health care possible. The Premier has noted that health care is not negotiable and that this system will only work if there is no opt-out measure. And I agree – it is not up for debate.

In Victoria hospitals already use internal digital databases where healthcare records are stored and can be viewed by different healthcare practitioners. The reality is that the staff that do the wrong thing, if they use the information improperly, will face fines of up to $10,000 or face the sack or jail. This sort of information being shared is already out there, but under these proposed changes people face jail time for up to two years and we are beefing up the punishment for people doing the wrong thing. It is big, important stuff and is seriously strengthening what is already out there. Make no mistake about it: the Premier has made it clear that clinicians already share information electronically. These measures will strengthen the data integrity and safety.

The Premier has been up-front publicly around what this is all about. There is much to talk about in the media, who are whipping this up into a frenzy. I saw on Channel 10 last week talk of human rights breaches and using victims of stalking to create false equivalency. It is disingenuous and wrong by all those that are involved. Make no mistake: this information sharing already occurs. Now hospitals share medical records over the phone or ad hoc. This is not sustainable, and it is reckless. Imagine at 3 am in a crisis trying to find medical records. I think this needs to change, and we have made it quite clear that we want it to change.

In the other place Minister Thomas made it clear in her statement of compatibility speech that she was satisfied those interferences with individuals’ privacy that may occur under these provisions will be predictable and proportionate to the objects of the system and will therefore not be arbitrary. But I want to emphasise the next point the minister made, which is that the amendments will not require the collection of new information from individuals but rather facilitate the transfer of copies of existing information already collected and held by public hospitals and health services to a central platform. Let me stress that point: no new information; it is merely to facilitate the existing information.

I want to talk for a few seconds, if I can, about some of my own personal experiences. I was with a family member not more than two or three weeks ago, and I did not know the historical background of that person I took in. I was lucky that the records on this patient were held in the hospital, because that patient had an allergy to a particular medication. You can imagine what could have gone wrong. In the heat of the moment things can fall through the cracks. How hard would it have been had I been in another hospital; things would have been a lot different. I have had countless operations – numerous arthroscopies, numerous knee reconstructions and recently two knee replacements. I would be mortified if I went into a hospital unconscious and was not able to be treated because they did not have my health record. If I was involved in a motor vehicle accident and had the same issue with my legs whilst unconscious, I would not be able to identify what had been done to me. I was in a motor vehicle accident a few years back. Luckily it was not too serious. The same could have been the case. I want to know that I will receive the best care in hospital no matter what part of the country I am in.

What if I came across someone at a local sporting event who had had a concussion and they had a history of concussion? I know from experience, from seeing firsthand the dangers of concussion, how successive concussions increase the risk factor for serious long-term medical issues and increase in the short term the chance of serious brain bleeds. I have been the president of local footy clubs, and I have seen from time to time, when parents drop off their kids and they are not around to see the game in its entirety, that sometimes we have had to call an ambulance. That ambulance has arrived, and we have been unable to find out what the medical history was. So if there is no family around, what if nobody knows what the underlying conditions could be if they are treated and they are hurt and if anybody can help? What if someone collapses on the field? The list goes on.

I respect the work that civil libertarians do to protect the freedom and liberty of Victorians and people around the country. I hear concerns on this, but I do not agree. The argument is that hackers might access personal details that can be used to victimise and stalk people, but I have already outlined how hospitals already keep records. GPs keep these records, pharmacies keep these records, the local pathology clinic keep these records. Wouldn’t it be better to have a centralised, secure, locked-down system rather than smaller ones where the public who use the system have no idea –

Members interjecting.

The ACTING PRESIDENT (Sonja Terpstra): Order!

John BERGER: If there is a breach, they have no recourse. Now they are streamlining the process.

I do not want to get sidetracked about the reality of what is going on. I saw in the Guardian the other week a great point from Victoria’s peak medical body, the Victorian AMA, who said that the benefits outweigh the risks 99 to one. The Victorian AMA president Roderick McRae made it clear that the system aligns with the existing schemes in New South Wales and Queensland. Mr McRae said:

If someone is in … intensive care … you may have no idea what … medication they’re on.

This sort of stuff is life and death, and we have got to change the system.

I feel quite bad for victims of stalking who have had their stories exploited in the media like this. Make no mistake, the data breaches are serious, but the reality is that current systems do nothing to stop the data breaches. This will create a uniform system and beef up those protections and will make those data breaches less likely, because if we have a few ad hoc systems and random systems that local GPs operate and who knows what, how do we know that they are secure? They often have lower budgets and are less secure, less transparent. This will increase the integrity of those security systems. It pains me to see victims’ lived experiences exploited in this way. Make no mistake: this is game-changing legislation.

Western Health CEO Mr Russell Harrison has stated that the new system will be a game changer for clinicians. I want to quote a statement he made to the ABC during an interview prior to the last sitting week. He said:

We share information between health services all the time … generally it is on the phone … it is by fax … So this just makes it much more efficient, much more secure and much safer …

much more efficient, much safer and more secure. How is a fax machine more secure than an online system? Come on. Paper is sent through fax machines and blurted out the other end and anyone can pick it up, and the reality is that there is no evidence of who picked up that paperwork. Some random people can access that information, view it and put it back, all without anybody knowing. Having a centralised database will provide clear evidence of who accesses this information and severe punishments for those who use it the wrong way. It does not diminish privacy, it strengthens it. It does not diminish safety, it strengthens it.

Only treating clinicians directly involved in healthcare patients can access medical information. But let me take pause. It pains me that this debate has become about privacy. It pains me that we must humour these arguments, because it is about patient health care, simple –

Members interjecting.

The ACTING PRESIDENT (Sonja Terpstra): Order! Those on my left!

John BERGER: You always want privacy in terms of your financial arrangements. I know myself that I do not want my financial arrangements being made public. But the reality is that there are measures in place to hold individuals accountable and to ensure that nobody is playing with the system. That is why our tax records, public filings, financial records and much more can be shared with complete strangers during an audit or other business of this kind – because the benefits outweigh the detriments. On a privacy level there is no difference. Let us not forget this is about health care, not about privacy. This is about ensuring that if you rock up to a hospital and you have a heart attack, the clinicians can treat you properly.

In conclusion, I would like to reference Minister Thomas’s remarks to Raf Epstein on the ABC. As the minister explained, doctors share information with other doctors about the patients they are treating all the time. The information has been shared, but until now it has been through a medium of paper or phone calls – outdated 20th century means of communicating sensitive healthcare records. The legislation today, as the minister said, is about allowing information to be shared on a digital platform.

This bill is about ensuring that clinicians have the resources to make decisions quickly. This bill is about saving lives. You cannot opt out of a doctor having a conversation with another doctor when you are in an emergency room. You cannot tell someone how to treat you when you are unconscious. The legislation is about ensuring Victorians always get world-class health care, that Victoria is in line with New South Wales. I thank the house for giving me the opportunity to speak today, and I commend the legislation to the floor.

Gaelle BROAD (Northern Victoria) (16:13): I am standing today to speak on the Health Legislation Amendment (Information Sharing) Bill 2023. Constituents across Northern Victoria have written to me about this bill, and I will speak to their concerns. But first let us consider the purpose of this bill and what is actually proposed.

The bill establishes a centralised electronic patient health information sharing service for participating health services to share certain health information. It makes it mandatory for specified health services to adopt this new system. It will apply to services including ambulance services, hospitals, metropolitan hospitals, multipurpose services, public health services and public hospitals, registered community health centres, the Victorian Institute of Forensic Mental Health, public aged care facilities and the Victorian Collaborative Centre for Mental Health and Wellbeing. It permits the Secretary of the Department of Health and their delegates to create and maintain an electronic health information sharing platform. The secretary would have powers to specify the information required and contained in the system and be able to direct health services to provide this information without requiring the consent of patients to whom the information relates. It enables specified health services to access information about patients and their previous treatments including medications, allergies, alerts, admissions, discharge summaries, outpatient consultations, laboratory and image results and any other information as determined by the Secretary of the Department of Health. The overall purpose of this bill is to allow for better information sharing between public health services in order to improve patient safety and patient outcomes to ensure that clinicians at specified health services have access to complete and accurate health information on a patient.

As a parent of a child with allergies, I can understand the benefit of information sharing between health services to transfer information from one service to another to ensure efficient treatment – so that details such as about previous treatment, health conditions, medication and allergies can be easily transferred. But I am also aware that many stakeholders have indicated broad support for a system that provides a secure information-sharing platform for public health services. Given that the health system is under immense strain and experiencing workforce shortages, it is worth looking at ways to share this information and save time. But while the intent of the bill is to improve patient safety and give better outcomes, there are clearly some gaping holes that need to be amended before the bill goes any further. The major concern regarding this legislation is the fact that there is no provision for individuals to opt out of the system.

When the federal government introduced a health information sharing scheme known as My Health Record it allowed people to opt out, and 10 per cent of Victorians chose to do so. Ten per cent is a large number of people choosing to opt out. A similar system that operates in Queensland also has an opt-out provision. The automatic sharing of information without consent undermines the privacy and right for individuals to choose – an issue that can be resolved by amending this bill. People may choose to opt out for a range of reasons, and we need to maintain people’s trust in our health system. If people are concerned about who is accessing their data or that it may be used against them, they are less likely to come forward and seek help. People who have experienced mental health issues or victims of family violence may feel trapped and vulnerable to information being used against them, and they are less likely to reach out for support.

We cannot afford to put barriers in the way of people accessing health care and mental health services. First and foremost, any legislation put forward in this house should consider the impact on people. From the representations made to my office I am already aware that there are many people who do not wish for their personal details to be shared. One of the constituent letters I received was from a social worker who wrote these words:

I am very concerned about the possibility of the Legislative Council passing legislation to allow centralisation of all Victorians’ personal medical records and access by thousands of health workers.

In view of recent major breaches of data security we can no longer assume the privacy of government information systems.

The key safeguard which must be available for citizens themselves is provision for them to “opt out” of this data collection. The importance of this right certainly outweighs the need for the health system to gain in efficiency.

I can assure those with a similar view that the Nationals share your concerns. Implementing an opt-out system upholds the principle of patient autonomy and would give patients the choice to decide who can access their health information and how it can be used. The Law Institute of Victoria is also calling on the government to allow patients to opt out.

Another major concern with the bill is that the scheme is exempt from freedom-of-information requests to the Department of Health. Patients will be unable to find out who has accessed their health records under the system and for what purpose. The Law Institute of Victoria expressed serious concerns that the bill does not include sufficient safeguards to protect patients’ rights and expressly exempts the system from freedom-of-information requests.

The Liberals and Nationals are seeking to amend the bill so that Victorians can opt out of the system and individuals can lodge an FOI request regarding the sharing of their personal health information. We want appropriate safeguards to protect individuals’ rights in relation to privacy of personal information. There is strong support from key stakeholders and members of the public for these proposed amendments. A petition has been presented to the Parliament with more than 10,000 signatures calling on the government to make amendments that protect patients’ rights.

There are additional questions that need to be addressed in relation to this bill: the funding, what the actual technology might be, how it will be compatible with other systems – including the My Health Record and also across state borders – how privacy will be protected and how cybersecurity will be delivered. There has been no business case and there has been a lack of budgetary consideration. This bill presents a worthy concept that has the potential to benefit people. Overall the Nationals support the intent of the bill, but first there is homework that needs to be done. We want to see the opt-out and FOI amendments included to ensure that individuals’ rights are protected.

Tom McINTOSH (Eastern Victoria) (16:21): Victorians want and deserve access to world-class, 21st-century health care. We have incredible people working in the healthcare system to make that a reality. From doctors to nurses, specialists, scientists, radiographers, personal carers, managers, cleaners and caterers, I am in awe of the work that our health workforce undertakes and the challenges that they have overcome. The government has an obligation to provide an exceptional health service for all Victorians, and we are continuing to do this in a range of ways, including workforce recruitment, investment in infrastructure and upgrades, support for women’s health, major changes and reforms to mental health, voluntary assisted dying legislation and other important investments in the health system.

A modern, world-class health system is a complex system. Going to the GP and having all your health needs met in one place is a thing of the past. This is not to put down the fantastic work of GPs – they play a crucial role in treatment, referral and stewardship of patients’ journeys – it is just a reality of the modern healthcare system. There are great advantages to this complexity. Specialists know more and more about specific areas, meaning that people can receive life-changing care for rare or complex ailments rather than just surviving on generalist advice. There are also challenges with a complex system. This bill seeks to address in a small and meaningful way the greatest one of those challenges, and that is sharing information. Most Victorian patients will often be treated at different health services over their lifetime, and patients cannot know what information from their medical past will be critical to their medical future. The information is also often complex, and patients cannot be expected to self-report full medical histories in new or emergency situations.

The government has an obligation to address the major challenges affecting our health system’s safety and cost effectiveness, and that is what this bill does. The Victorian government is committed to improving patient safety and continuity of care for Victorians. This also means ensuring our health services and clinicians have the most appropriate tools and information at their disposal. The bill will allow health information sharing at the point of care for patient care between specified Victorian public health services. The health information will be shared through a secure system operated and managed by the Department of Health. The data available on the system will include a summary of a patient’s visit to the Victorian public health service, and it needs to be understood that this is not a complete medical history.

To discuss the changes in this bill we first need to understand the current practice of information sharing in our health system. Critical health information is spread across different health services, depending on where a patient has visited or been transferred. These records are also in separate systems and paper files. A new patient at a hospital in Victoria will have no record with the hospital and their digital records are not shared. The treating physician will contact previous hospitals and physicians over the phone and through email, and fax is still often also used. So after locating the correct physician, finding accurate contact details, making contact with the previous physician and the previous physician making the time to find the record and send it, the information can be shared over a less secure system than the one that is proposed in this bill. Information in this current system is not controlled as tightly as it could be and there is no audit log of who has accessed patient health information.

Having verbal information bounce around through phone calls and written information through email and fax is less secure than a platform that has strict access requirements and an audit log. The proposed new secure health information sharing platform will fix that by establishing a single point of complete and accurate patient information for clinicians to provide safe and timely care. Important life-saving summary information will be shared through this platform, including medications; allergies and alerts, such as severe asthma; biopsy results; diagnoses that may have taken months to make; and results of tests and expensive scans. Making this information readily available will save time, money and lives.

Health professionals looking up a phone number and then waiting on the phone while a paper file is located is not a practice the community expect of a world-class 21st century health service, and we do need it to change. The reform is needed and supports wider digitisation efforts in government, like My Health Record and online vaccination records, and in the private sector. When people contact their bank or insurance provider, they expect that different parts of the organisation will be able to help them with their inquiry by quickly looking up their circumstances, and the community expects this level of service from Victoria’s public health system.

There are well-known privacy concerns about sharing patient information. Health services currently share health information; the bill introduces no changes to that simple fact. One of the proposed responses to this concern is to create an opt-out provision. There is currently no opt-out provision for health services sharing patient information. This bill does not introduce one, and again, there is no change to current practice through these changes. The changes that this bill introduces are about accessibility of the data.

For the gains in patient safety, health outcomes and overall system efficiency, summary patient data will be more accessible, and there are risks with that increased accessibility acknowledged in the bill. The mitigations to those risks are strong and targeted. The bill specifies that only healthcare providers who are directly involved in a person’s care and treatment can access medical information and only for the purpose of providing care. The platform will be frequently audited to see who has accessed patient data, and there are three new criminal offences prohibiting unauthorised access and unauthorised disclosure of information. The penalties in the bill include 240 penalty units – that is $44,380.80 – or two years imprisonment for any unauthorised access, use or disclosure of information held in the system. It is also worth noting that health professionals are licensed by professional bodies and have existing duties to comply with their professional and legal obligations regarding privacy.

Access to highly sensitive health information will be more limited, and these protections will ensure additional protections for vulnerable groups, like victims of domestic violence and child protection and justice cases. This approach is consistent with other Australian jurisdictions such as New South Wales, Queensland, the ACT and South Australia, which have all successfully implemented health information sharing at the point of care.

The opt-out model suggested is a step backwards by winding back current information-sharing protocols under the existing law that public hospitals can share health information required in connection with the further treatment of a patient without getting their consent first. It will lead to expensive duplicated tests, misdiagnosis, inefficiency, delays – not just for the patient who opted out but for other patients – and a lower level of patient safety. It is unclear whether opting out would be for total records or individual pieces of information. Would physicians be expected to sit there and redact parts of a discharge summary before uploading them to the platform?

In terms of case studies, I would like to mention some cases that I know of where this system would have made a difference. An example is a case where diseases are rare and new treating physicians may not be able to easily diagnose what is happening. I know of a case where a man with a rare blood disease who was still going through the long process of getting a final diagnosis experienced extreme pain and suffering and drove himself to the emergency department in the middle of the night. Before he attended, he scrambled to find a letter from his specialist that outlines where things are up to with his treatment and expressly instructs staff at the ED to use a rare and expensive drug that is withheld but for the most serious of cases. If he forgot the letter or the information was not clear, he would not have got the necessary relief from the excruciating pain and would have needed to wait until the specialist was contacted by phone for confirmation.

The example I hear all the time is of chronic illness, especially as illness is advancing and people are becoming hospitalised frequently, being transferred by ambulance frequently and perhaps being transferred from aged care. Consider someone with advanced chronic illness who now resides in aged care. In the middle of the night they fall and need to be transferred to hospital. Their regular hospital has no rooms available, so they are transferred to a different hospital, which does not have their records. The illness is advancing and cognitive difficulties are coming into play, but there is not a formal diagnosis of dementia – not that the hospital could access it if there were. Self-reporting from the patient is now limited and unreliable, and their carer is unavailable because it is the middle of the night, and now they live separately as the patient is in aged care. Snippets of information come through from the aged care, but the patient has not been there long. This is done verbally with night staff to ambulance staff and then to emergency department staff at the new hospital. The patient is distressed, the carer is distressed after the middle of the night wake-up call, and there are hours of anguishing wait until morning when inquiries to relevant physicians to get the summary information can start.

Sadly, I think many of us know of a case like this, and the bill will help to ease the distress families feel at a difficult time. Endless examples can be given, including of asthma, infections and cancer, but the key point to me is clear – and that is that we need these changes to information-sharing technology. Ultimately, patients are the reason for the changes, and their rights must be upheld and respected along with changes that improve care and outcome.

Under the bill patients retain all their current freedom-of-information rights to access their full medical records from the health service provider under FOI and privacy legislation. The information shared through the new platform is not a full medical record or history but a summary of the most relevant information for their treatment purposes. It is a subset of the information that is available under FOI. The bill does not enable FOI requests on the health-sharing system itself, because it would require the department to access clinical information to respond to questions, which would be inappropriate and counteractive to the strict protections and access controls the bill seeks to establish.

Everyone has the right to feel safe at work. The health, safety and wellbeing of Victorian public healthcare workers is a high priority for the government. The system will provide new safeguards for clinicians working in health care to be alerted to a history of occupational violence and aggression from patients. Risk assessment and management strategies will be able to be included in the system in the same way they are included in medical records – both hard copy and electronic – and patient care plans in line with the department’s framework for preventing and managing occupational violence and aggression. The timesaving impact of this information sharing cannot be understated. Rural and remote health services still have many records on paper file and in some cases will need to send someone from medical records to get a file for it to be sent to the new hospital if someone has been admitted elsewhere.

Overwhelmingly healthcare professionals and bodies support the changes and consider this a part of getting on with the job of providing world-class care to patients. Healthcare providers work in challenging environments, and saving time using information sharing is a matter of course for our healthcare professionals. The government understands that there is nothing more important than getting the best care close to home, and we are investing in our healthcare system. There are currently several large-scale hospital projects across Victoria, including the Wonthaggi Hospital upgrade, the new West Gippsland Hospital in Drouin and the expanded Latrobe Regional Hospital in Traralgon in my electorate of Eastern Victoria. This includes delivering the biggest hospital infrastructure project in Australia by building the new Royal Melbourne and Royal Women’s hospitals alongside Metro Tunnel’s new Arden station, giving patients across Victoria access to the very best care. From 2025 both the Parkville and Arden medical precincts will have brand new train stations and be linked, making it a 2-minute trip between hospital campuses and connecting them to the Monash Medical Centre in Clayton – again improving access.

The government will continue its focus on women’s health by delivering a $71 million package to create 20 new women’s health clinics at public hospitals, a new statewide service, and more sexual and reproductive health hubs across Victoria. The government will also work with the Aboriginal health organisations to deliver the first ever dedicated Aboriginal-led women’s health clinic. Delivering new women’s health clinics will completely change the way women’s health issues are treated in Victoria and will provide comprehensive care for Victorians experiencing conditions like endometriosis. Endometriosis is a good example of a diagnosis that can take a long time to get and results from several presentations to hospital with different sets of tests. An information-sharing platform with the results of previous tests and discharge summaries will be good for women’s health.

Again, Victorians want and deserve access to this system. The government has an obligation to provide an exceptional health service for all Victorians, and we are continuing to do this in a range of ways, including workforce recruitment, investment in infrastructure and upgrades, supports to women’s health, major changes and reforms to mental health, voluntary assisted dying legislation and other important investments in the health system. This bill will allow health information sharing at the point of care for patient care between specified Victorian public health services. The health information will be shared through a secure system operated and managed by the Department of Health. The data available in the system will include a summary of patients’ visits to the Victorian public health service, and this will improve the safety and health outcomes for patients in Victoria’s public health system. (Time expired)

Melina BATH (Eastern Victoria) (16:36): I am pleased to rise to make a brief contribution today on the Health Legislation Amendment (Information Sharing) Bill 2023. If you listen – and I have been listening – to the debate, all is rosy in the health sector under the Andrews government. ‘All is well; trust us, all will be well’ is the overarching theme that I have heard while I have been sitting in the Parliament.

This government has certainly been a progressive government. It has made social reforms like never before. Many a time I have heard in this chamber about giving Victorians choice. We want to enable you to have more choice – more choice about your body, more choice about what you can do with your body. We heard the previous contributor just then talk about the Voluntary Assisted Dying Bill 2017, how you can choose through a whole variety of steps to end your life, providing that choice. What we are asking on this side of the house is to continue that theme about choice, to enable Victorians to opt out of this information-sharing scheme, this information-sharing legislation, to provide them with autonomy, with their own right to take control of their health – as much as we can take control of our own health. There is a need to better share information; there is a reason. This bill has merit, but give Victorians a choice.

The bill in essence establishes an electronic platform for patient information sharing to provide, in its benefits, access about a patient’s conditions. They can be a variety of conditions. They can be previous treatments, current medications, allergies, alerts, admissions, discharge summaries, outpatient consultations, laboratory and imaging results. I am sure we have all had our bodies looked at and scanned in some form or other, and we value those assessments.

The other thing that the bill will do in its current form is make it mandatory – and here is that word ‘mandatory’; we have heard it a lot over the COVID pandemic – that specified health services adopt a new health information platform: metropolitan hospitals, multipurpose services, denominational hospitals, public service hospitals, registered community health services, the Victorian Institute of Forensic Mental Health, public aged care facilities and the Victorian Collaborative Centre for Mental Health and Wellbeing. Also we have heard on one hand in the bill briefing that GPs will not be included in this, and then we have heard from others from the government on the other side of the benches that GPs will be included in this, so that needs to be clarified.

I have had constituents come to me who are very frustrated with the current system, and I can give you an example without naming names. At a local hospital in Eastern Victoria Region an elderly father went in, had multiple health issues, and the family provided information. His health was deteriorating, and he was moved from our smaller hospital over to a larger centre in Gippsland. The family went over and again related the medication, the information, the high-alert things that should be known, like when to have his medication, whatever it be, diabetes medication – it is better for him in the morning. They provided all that information. Then a couple of days later it was not given in the right sequence, and they went back to the new set of doctors or the new set of nurses that are there in the same hospital.

I am not sure how this will be the panacea to that issue. If it improves it, that is good, but there are constituents who, under the shadow of COVID, feel very nervous about enabling this information to be shared. We all have had constituents or members of the public write to us – I think the government benches have said it is all straw man tactics or something like that – with their genuine concerns about if information is adversely shared. They are keeping their privacy. Their privacy is absolutely paramount to their safety and the safety of their children. If that is somehow shared on a platform – and we have seen an example of that in the media – then their mental health can be eroded. If they cannot have an opt-out provision, their mental health can be eroded. Do we not care? Do we not consider that mental health is part of our overall health as human beings and our nature of living?

I put it to the crossbench – and I thank them for listening to the arguments that Ms Crozier and others have put forward, and I thank Ms Crozier for the great deal of concern she has and the in-depth work that she has put into this over many years – that we should have an opt-out clause. Indeed that Commonwealth health platform My Health Record has shown that 2.5 million Australians have decided to opt out. They feel more comfortable with that. Many people will not care if their information is shared from pillar to post, but some will, and I think it is a retrograde step if we do not allow opting out to happen. Also in this bill there is a denial in that individuals – again, choice – cannot FOI the department to see who has been speaking to whom about information.

Matthew Bach interjected.

Melina BATH: I pick up Dr Bach’s concern around potentially Labor staffers being involved in some of that information sharing. The government will say that is not an issue. I think there are people that are concerned. Indeed I congratulate Mr Limbrick for putting forward a petition with 10,000 signatures over a small number of days. If it was not a concern, you would have had 1000 signatures. We do have 10,000.

The government has been spouting Targeting Zero: Supporting the Victorian Hospital System to Eliminate Avoidable Harm and Strengthen the Quality of Care. This is about quality of care. One of the recommendations is that the department should adopt a goal of ensuring that by 2021 – so we are behind the times already – major hospitals have full electronic health records that enable interchange of information with other hospitals. The difference is that this task force did not recommend an automatic sharing of every patient’s information with various health services and it did not recommend the sharing of patient information with the health department. I put to the house that the intent of this has merit. It does need to be amended; I think the government has amendments that we are yet to see. I would ask the crossbench to consider those Victorians who do not feel comfortable with their information being shared, who want the choice to opt out and who also want the choice to see what is going behind the system and to put those amendments put forward by Ms Crozier in a positive light.

I also go back to the government saying that we have a leading, world-class health service. We have heard from the AMA. We have heard from others about an 85,000-person – we will call it – elective waitlist. But we all know it is not superficial surgery, it is must-have surgery – and this waitlist is blowing out. I believe there should be an intense focus on that, particularly for our regional hospitals in my electorate – I am allowed to be parochial. These flaws in this bill need to be rectified if we are going to vote in favour of it.

Moira DEEMING (Western Metropolitan) (16:46): I rise today to speak on the Health Legislation Amendment (Information Sharing) Bill 2023. I note that this government have just admitted to us that they cannot conceive of a way to run a functional healthcare system in this state without first requiring that every single Victorian gives up wholesale their right to own and control their own personal health information. They tell us that our choice is between an online, centralised, government-controlled website and a fax machine. They tell us that it is for our own good. They tell us that it is life and death. Members of this government have even just told us that the people of Victoria, patients in Victoria, have asked for this. I personally do not recall any evidence of patients lobbying to hand over their medical privacy and autonomy to this government. In fact I have very strong memories of exactly the opposite type of lobbying by tens of thousands of people over the past few years not 50 metres from where I stand. Everyone in Victoria is frustrated with the catastrophic mismanagement of our health system, so I am sure we are all glad that changes are on the table. But this bill cannot be allowed to pass without amendments. The plain and simple truth is that we can achieve better outcomes and patient care without destroying patients’ rights to confidentiality. The plain and simple truth is that there is nothing reasonable, nothing proportionate and nothing necessary about denying people their right to privacy, safety and dignity that comes with genuine confidentiality and with reasonable personal controls over their own medical information and choices.

The government have told us that they have introduced new offences to punish unauthorised access to and use of this smorgasbord of lucrative medical personal information, and then in the very same bill they have removed our ability to collect evidence if such a crime is committed against us. This government assure us that we can trust them but also tell us that we are not allowed to know the who, what, why, when or where when it comes to how our personal medical files are being used – and not even via an FOI request. They tell us that there are safeguards, that we can trust them, but then they demand that we never check up on them. We need an opt-out and we need to know who is accessing our records when and why. The truth is this is not good enough.

Matthew BACH (North-Eastern Metropolitan) (16:48): It is good to rise to join this debate with just a brief contribution. I know other members want to make further contributions too. I have been listening, as others have been listening, to both government speakers and speakers on this side of the house. I confess my chief concerns with this legislation are very much in keeping with the concerns that Mrs Deeming has just very eloquently explained.

I was honestly quite surprised to hear that new bloke Mr Berger say that arguments put forward by organisations here in Victoria as revered as the Law Institute of Victoria should not be humoured. That is what he said. He did not misspeak, he was reading from notes – because members opposite just read from their talking points from the Premier’s private office. He said they should not be humoured and that these were straw man arguments. Honestly, I cannot recall – I have only been here three years – an organisation as revered as the law institute being referred to with such a lack of respect even by members of a government that is this arrogant and this hubristic. I would trust Tania Wolff over members opposite any day when it comes to, well, basic truthfulness and certainly when it comes to the issues of privacy and of patients’ rights that Mrs Deeming and Ms Bath before her spoke about. Here is what the law institute said recently:

This signals a departure from a human-rights and patient-orientated framework which is well established in other Victorian legislation.

… the Bill fails to strike an appropriate balance between clinical efficiency and safeguarding patient rights.

It:

… unjustifiably erodes privacy rights …

Members opposite have said, ‘No, well, that’s not true; there’s no impact on rights.’ They have mounted a strange argument that on the one hand there is no change here, that records are shared all the time in exactly this way – there is no change, chill out – but on the other hand the changes are going to be so significant that lives will be saved across the board. We have heard a whole array of bizarre hypothetical medical cases put forward from members opposite where lives would be saved by this legislation, which also, according to members opposite, makes no changes to current practice. I think Mrs Deeming put it best when she said we are being offered a proposition here from the government that the only way to move forward when it comes to medical records is to do that either via the use of fax machines or via this particular system that none of us can opt out of.

And people have spoken about the fact that constituents have reached out to us to express their concern; that is a fact. The government has said that so many Victorians are crying out for this. Well, I am not aware of any evidence, as Mrs Deeming said, that that is the case. I have seen Mr Limbrick’s petition – 10,000 people in such a short period of time – so there is ample evidence that there is great concern in the community. I do not mind saying I opted out of the federal scheme. I do not want federal Oompa-Loompas in the department of health having access to my medical records – no way. And there members across the Parliament worked together to get a better outcome. I want to quote briefly, if I may, from comments made by the Leader of the Greens at the time, Mr Di Natale. The Leader of the Opposition simply misspoke a little earlier when she attributed some similar comments to Mr Bandt. These comments were actually made by the former Leader of the Greens party. He said at the time:

They need to understand –

meaning people need to understand –

how this information is managed and then they need to make some decisions about how they want their own personal information to be managed.

He made these comments in the context of supporting an opt-out, and I am really hopeful that many members of the crossbench will support an opt-out.

David Limbrick: That would be the old Greens.

Matthew BACH: That was the old Greens, Mr Limbrick said. Mr Di Natale went on:

We do think that Australians have got the right to make an informed choice about this, and they –

Australians –

haven’t been given that opportunity. Indeed, everything that’s happened so far has undermined confidence in the system.

Well, for goodness sake, if our confidence in health systems was undermined some years ago, think about what has happened since then. Think about the catastrophic failures that have occurred on this government’s watch, especially when it came to contact tracing. So no, I do not have confidence that just because Mary-Anne Thomas in the other place says, ‘Trust me, I’ve been working on it,’ we should trust the minister. She spends her time trawling through my social media to try to put forward ridiculous motions attacking me – and do not worry, I like the attention – in the other place. That is what she has been doing over the course of the last few days: a motion in her name specifically attacking me because I called the Suburban Rail Loop a mangy dog. It is a mangy dog, and it is interesting that one of the reasons for that assessment that I put forward in the lead-up to the election was the fact that there is no business case. Other members have referred to the fact that there is no business case here either. So that person is not a serious person. I would not trust her to manage this process. I would not trust some of the former Labor staffers who they have attempted to stack out the Department of Health with to manage this process either. It was Paul Sakkal of the Age of course last year who did some excellent forensic work demonstrating the extent of the politicisation of the public service. Once you get to my age –

Bev McArthur: So old!

Matthew BACH: Well, once you start to commence upon a journey into middle age, as I have done –

Bev McArthur: How’s it going?

Matthew BACH: badly – as a bloke, you start to develop closer relations with your proctologist and you start to develop closer relations with your urologist. But I would say to the Minister for Health in the other place: you will take my proctology records and my urology records from my cold, dead hands.

Evan MULHOLLAND (Northern Metropolitan) (16:54): I note the contribution of Dr Bach. We in the Liberals and Nationals I think support the purpose of this bill for better information sharing between public health services in order to improve patient safety and outcomes. More efficient use of resources to deliver practical healthcare outcomes aligns with our Liberal values on this side of the house, so of course we support the intent of this bill. More efficiency is needed in our health system, which is being stretched to the limit after years of wasteful mismanagement by the Andrews Labor government. But as is always the case when it comes to this government, there are serious and sensible amendments that need to be made first. They always take it that step too far, the Andrews government, and instead of seeking collaboration and consultation, they seek to bulldoze through this Parliament, bulldoze through this place, in attempting to get legislation through that many do not agree with.

This legislation is about sharing data, and some of this data relates directly to individual patients and their medical history. While many of us may be fine with this, there should always be an option for people to opt out of sharing their personal information. Currently this legislation does not provide for that safeguard. By contrast, the federal government’s health information sharing scheme, My Health Record, gave all Australians a choice over who has access to their medical history. They could opt in or they could opt out. Indeed 10 per cent of Victorians have exercised their right to opt out, and it should be their right to do so regarding this bill. We should give those 10 per cent of Victorians a chance to opt out of this bill. The equivalent system to the proposed system that operates in Queensland also has an opt-out provision. Why shouldn’t Victorians have that right, just as Queenslanders do, to decide this and who can access that information?

So we have got the Commonwealth and we have got Queensland, and I note the Premier in his press conference was like, ‘Whoa, whoa, you know, New South Wales doesn’t have an opt-out. Look over there, look over there!’ Well, I say to that point – and I do not agree that they do not have an opt-out; I think they should – that it is apples and oranges. New South Wales has Service New South Wales. They have a world-class digitised public service. They got some time ago security experts, digital experts, to focus on how they can have a public service system that is focused on the people rather than the bureaucracy. They have things like digital drivers licences. They have things like Dine and Discover to immediately interact with small business. Do any of those on this side – or maybe those on that side will – remember Labor’s chaotic regional travel voucher scheme in comparison to New South Wales? The website usually crashed. If you did not miss out on the lottery and finally got through, you basically had to pay all the costs up-front, and then after you got a written receipt for your travel, you had to either fax it in or email it to a single bureaucrat who would take ages to actually give you a refund, so you were fronting all the up-front costs.

But we see often with the Andrews government and their bureaucracy – the octopus that extends beyond the bureaucracy – that it is all about the bureaucracy and the public service rather than what is best for the people. I would not trust the Victorian IT systems to manage private data as well as New South Wales. There are quite clear investments in digital capability that they have made that Victoria, quite frankly, has not. It is like comparing current AI technology to Windows 95. That is what this is when the Premier says, ‘Oh, we can do the same as New South Wales’. No, you cannot.

Back to the legislation, further to this legislation, it fully prevents the system of freedom-of-information requests. This is a sensible protection when it comes to protecting Victorians from having their data being sought by others, but what it is about is Victorians who wish to inquire about how their own medical data is being used and distributed. It is a critical accountability oversight that is completely missing from this bill. Data accountability is critical, especially when it is clear that this government has no regard for confidentiality. I can give you an example of this. Just last Friday we found this government taking great delight in leaking confidential information of a highly respected journalist from the Premier’s private office for political pointscoring. If we cannot even trust the Premier and his office to not leak confidential information to the Herald Sun, how can we write them a blank cheque when it comes to every single Victorian’s private medical information? How do we know that someone in the Health Services Union or a bureaucrat or someone in the octopus of the Labor Party throughout the public service and union movement will not get the private information and use that, through the Premier’s private office, for political pointscoring? These are legitimate questions to ask because the Premier’s private office has form in this matter.

Matthew Bach: Last week.

Evan MULHOLLAND: Just last week. We already know that this government has form, but they do not seem to care about it. We should be able to FOI personal health data. How are we to know that someone’s private health data will not be accessed by other agencies through the Department of Health – through someone, a source, in the Department of Health maybe; that is another bill – to pursue police, security or health outcomes? We would only know that if a person was able to lodge a freedom-of-information request with those issues.

There are serious reasons why someone might wish to keep their personal medical information private, whether it is their sensitive medical history, family violence history, current or former drug use, or miscarriage, which one in four families go through. There are a number of highly personal reasons why someone might not want that data shared. Medical data in the wrong hands can open people up to discrimination, exploitation and even blackmail, and last year’s hack of Medibank Private should give all Victorians reason for concern. We know that cyber hackers are focusing on health data as a priority, so the government need to explain as a matter of priority what they are doing to ensure all of this data is held securely. I am sure the government intends to keep its word when it says that this data will be given the strongest possible protections to prevent cyber hacks, but Victorians who seek caution should be given that right to opt out of this system.

It is not just us here on this side who are concerned about this; it is the Law Institute of Victoria, it is Liberty Victoria and a number of other organisations. We are asking for the ability of a person to FOI. I know this government is not very forthcoming when responding to freedom-of-information requests, and I think I just saw another truck full of black ink roll back into Treasury Place for the amount of black ink they have to put on all their freedom-of-information requests. This is the most secretive government of any government in Victoria’s history. If you lodge a freedom-of-information request – if they do not try to fight it through the courts – what you will end up with will be completely blacked out.

With this bill they are taking it a step further. They just want to skip that process. They do not want the hassle. The citizens – Victorian taxpayers – to this government are just a hassle; they are just an inconvenience. We heard the comments from Mr Berger. I could not believe that side of the house would speak about the law institute in that way. You have got eminent, respected organisations coming out against this bill. Mr Limbrick and others – 10,000 people – have spoken out against this bill. There are very serious reasons why the government should just be collaborative, should just consult. All we are asking for is an opt-out clause and the ability for Victorians to see who has accessed their private medical data. As I said, you have got people with drug use in the past or present drug use, you have got family violence victims, you have got people that have gone through miscarriage or had abortions – there are serious reasons why Victorians do not want their private medical information given over to the state but also shared with other doctors. That relationship with your doctor is a sacred one and it is a very important one – it is a really important one – and just because your GP has that information does not mean bureaucrats or other doctors should also have that information. So I would implore the government: listen to this chamber, listen to the law institute, listen to Liberty Victoria, listen to us and work with us so we can get a better outcome on this bill.

Nicholas McGOWAN (North-Eastern Metropolitan) (17:05): I rise to speak on this bill, and in so doing I would like to take a bit of a walk down memory lane. I know that is inconvenient for many, but I think it is probably apt. I will take us all the way back to the Victorian Auditor-General’s Office report Clinical ICT Systems in the Victorian Public Health Sector. It strikes me that very often when governments take action they all too frequently ignore the lessons of the past, and yet here we are again doing precisely that. While I am not one to quote from documents per se, from time to time I do it, and today is going to be one of those times. It is I think valuable to remind members, particularly the crossbench, of what was said by the Auditor-General at the time, so I will quote a number of – only three – parts of this report, because I think it is that important. It says:

Timely and reliable patient information is fundamental to the delivery of safe and effective healthcare.

I do not think there is a person in this chamber that would disagree with that. That is not part of the quote of course. I will continue:

Modern technologies should enable patient records to be efficiently and accurately recorded, stored and shared across hospitals. However, the majority of our hospital patient records and practices are still paper based. They operate as unconnected islands of patient data and are unable to be efficiently shared with clinicians across the state’s various health services to improve patient treatment and care.

In 2003, the government committed to the $323 million HealthSMART program, which included the roll out of clinical ICT systems to 19 health services by 2007. Like any other transformational ICT project, clinical ICT systems require a significant investment of people and money. They are complex and risky, and unforeseen issues often emerge which need to be addressed.

This is the penultimate part of this particular page:

This audit found that poor planning and an inadequate understanding of the complex requirements to design and implement clinical ICT systems has meant that the Department of Health exhausted its allocated funds, and ultimately delivered the HealthSMART clinical ICT system to only four health services.

The report goes on, and members for themselves can receive obviously and – I hope in time they do – read that report.

Where to begin? Well, we have heard a lot of debate today, and unfortunately from the government side – expectedly perhaps – they have just gone off the script provided for them. I am hoping that the crossbench use a forensic mind, that they actually turn their mind to the questions that are before them at the moment. You need look no further than the bill itself, which is alarming in the extreme. It is alarming because at its very outset it refers to ‘health information’ – that is the information it will collect – and it refers that definition to the Health Records Act 2001. Let us be clear about what we are talking about here, because I think that is always a good beginning point. You need to look at the Health Records Act, which by the way could facilitate the sorts of objectives and goals that the government now say they seek to achieve, but they do not want to do that. That is not really what they seek to achieve at all. In the Health Records Act ‘health information’ is defined. People in this chamber might be surprised by what it means. It means a lot of things. It means:

(a) information or an opinion about –

(i) the physical, mental or psychological health (at any time) of an individual …

Keep in mind that this is the definition that will be the basis for the health legislation amendment act, should it pass. Health information also means:

(ii) a disability (at any time) of an individual; or

(iii) an individual’s expressed wishes about the future provision of health services to him or her; or

(iv) a health service provided, or to be provided, to an individual –

and I think this needs to be emphasised –

that is also personal information; or –

wait for it –

(b) other personal information collected to provide, or in providing, a health service …

any personal information whatsoever. Let us be very clear, and to the crossbench who are not here at the moment, except for one of my colleagues: if you pass it in its current form, what you are passing here is perhaps without question one of the greatest, largest grabs and attacks on personal privacy in this state’s history. Two things: there is no possibility to ever opt out; and, two, no scrutiny insofar as the FOI, freedom-of-information, legislation goes, because they have stripped that away carte blanche.

You cannot look at the integrity of the system. You cannot look at who looked at the system. It is very well to come into this place and talk about penalties. That is a joke. There is no policing in this proposal – none at all. I searched through the pages. I thought there would be more. There is nothing. There is nothing about policing. Of course there is not. There will be no policing. The only policing we will need to do is when we call the federal police to investigate why there has been a breach and we are all being blackmailed because all of our information – not only medical information but all the other information, because it is clear that is what it will include – has been collected.

But I have not even finished. I have not even finished this bit, so I have got some time to go. That act says:

other personal information that is genetic information about an individual in a form which is or could be predictive of the health …

That is captured by this, and that is how serious what we are talking about is. Gone is the patient’s right, gone is your right as an individual, gone are your children’s rights. I hope members in this place are absolutely clear about what is being proposed here today. Every single child in the state has no choice and will be dragged kicking and screaming into this, whether they want to or not, whether their parents have given their consent or not. You will be part of this if this passes in its current form. It is an abomination. There is no other word for it.

Other colleagues today have spoken about the Law Institute of Victoria, and it is important what they have said. These are not partisan people. These are people who have the best interests of all Victorians at heart, and it is for that purpose I will also quote from that they have said in their press release. They make a salient point, and it also illustrates that unfortunately in the Victoria of 2023 the government fundamentally misunderstand the basic human rights of individuals in this state. I quote from that press release:

While we acknowledge the aim of this Bill is to improve efficiency of medical care provided to Victorians, this must not come at the cost of patient autonomy …

Patient autonomy must be front of mind in any health legislation being put forward by government to protect patients’ rights. The implementation of an opt-out scheme would place choice back in the patients’ hands about the healthcare they receive in the Victorian public health system.

Patients must have the right to say who can access their health information – even if this means their health information will not be shared under the scheme. Patient autonomy is a fundamental human right …

I will repeat that:

Patient autonomy is a fundamental human right: it’s the same principle that allows a patient to refuse medical treatment.

That should be lost on nobody in this place.

What is more – and this is particularly for the crossbenchers to consider – if a patient chooses to seek the advice of another doctor because they are not happy with their existing doctor, there is nothing to prevent the next doctor from looking at those records, nothing at all. Not only do we then confront the issues of a bias but further than just the bias that a doctor might have, the bias that will permeate because everybody looked at those records. They think they understand the person in front of them. The unconscious bias could wreak havoc with that person’s treatment by that doctor. They have a fundamental right to seek a second opinion. We all have that right, but under this that would be polluted from the outset because that next doctor is already going to see, ‘You’ve already spoken to the doctor next door. You’ve already been somewhere else,’ to say nothing of people’s confidence in not being prejudged by other results. We live in a very modern society where people have, to this day, the right to privacy with respect to their healthcare results. Under this, that will all be thrown out the window – gone.

What is also alarming to me is the ease with which members on the other side accept what they are being told by those that give them their instructions – or perhaps behind closed doors they do share some of these concerns. But I can only hope the government does put forward sensible recommendations to make this bill palatable, because in the current form it is far from that, and I say that because the consequences are far-reaching. They go beyond just the bill itself.

There is no budget. The department do not even try and pretend they have done a budget for this. This will blow out. I mean, it will make HealthSMART, which was health dumb, look like a cakewalk, a cupcake by comparison. There is no budget, no budget whatsoever. There is no policing. They are doing away with transparency. Worst of all, we might go through all this and, guess what, there is no guarantee that there will actually be any improved health outcomes because of it. And no-one can, still to this day, explain to me with any satisfaction why we cannot simply work with the federal government, who have already undertaken this process, who have an opt-out and who are collecting records assiduously in large volumes every single moment of every single day in this country. There was no mention of that today. There was no mention of the duplication. There was reference to other states, but it ignored the fact that Queensland has an opt-out and completely ignored the federal scheme, where again we have an opt-out.

If those opposite are serious about improvements in our healthcare system – because if that is what this is about then I would support it – then put KPIs in the bill. Let us come back and review it. It is nonsensical to talk about improvements and just wish they will occur. The evidence we have, particularly in government and particularly in bureaucracy, is that it just does not happen, so put some KPIs in the bill. Outline how you think these improved outcomes will occur, because if you can do that and you can substantiate it and we can measure it, then I am all for it – provided of course it has an opt-out and provided of course we allow freedom-of-information requests. To segue from freedom of information – I mean, it is under this government freedom from information. I understand that, but this is taking it to the nth degree.

A member: Government freedom.

Nicholas McGOWAN: Government – they will not be sharing any information. The only information they are prepared to share is between the health department and every other provider, essentially.

We have not even started to touch on the cost of what this is going to take at every level, and that comes at a cost in terms of time. Time matters in health care, everyone knows that. I think that is an accepted concept right across the chamber. Yet we are quite prepared to now place an additional significant burden upon every hospital, every clinic, every healthcare provider you can imagine. Think for a moment that that will not impact health, and think for a moment that the information received will somehow have outweighed benefits for the same people, because then when you start to drill down in the bill and you start to look at how long these authorities have to provide the information, it could be up to six months. So in most cases or in very many cases, it could be argued that even by the time you collect the information, under the bill as it stands unamended, it could be superfluous. I hate to say it, but the patient could be long dead. That is the reality. I mean, has anyone actually bothered to look at and read the bill? Six months – that is assuming you get the information.

Then have a further look at the bill. What is to stop duplicate information? Under this bill every one of those listed hospitals, clinics and so forth, and some things that do not even have definitions at this point – we will get into that in committee – have to provide, presumably, the same information. So if I go and get a blood test at my local GP tomorrow, well, the GP has got the blood test results, they are going to have to comply and give that information. The pathology has got that result, so they are going to have to give the information, and if they sent it to a specialist, the specialist has got the result, so they are going to have to give the information too.

I have no confidence whatsoever that this government has any ability to be able to actually achieve the stated outcomes that they say they seek. If they were serious about it, they would put into this bill KPIs. If they were serious about this, they could have looked at the Health Records Act. They could have looked at how that tries to facilitate and create and achieve a balance between both the use, the timely use, of health records and the rights of the individual to be able to opt in or opt out as is their right – a fundamental human right which this government appear to have completely ignored or ridden roughshod over, which we are getting all too used to, unfortunately, in this place in the last term of government and in this term. This accelerates that and takes this to whole new levels.

I can only hope, I can only plead with the crossbenchers to use their common sense. I can also only hope and plead with the government members who do not support this nonsense, despite what they might have said, to come back to the table with commonsense amendments and something that we can all support.

Bev McARTHUR (Western Victoria) (17:20): In rising to speak on this bill and to criticise significant elements of it, I hope it goes without saying that I am highly supportive of its stated aim – that of improving health care for Victorians. Heaven knows that needs to be improved. We are in an almighty mess in the healthcare system in this state, and you are asking the people of Victoria to trust you after you ran the most appalling health operation during years when you locked us down and the contact-tracing system run by Commander Weimar was just hopeless. ‘Trust us’ – no, sorry, we cannot. The problem is that shot through this government’s DNA is a statist, centralist, bureaucratic, anti-individualist tendency which shapes even admirable policy aims into unwieldy, inflexible and deeply illiberal proposals. But as you will hear, I do not just oppose them in principle; I also believe that these flaws mean in practice they will fail too.

Firstly, on the positives, there are obviously significant advantages to having health records which follow the patient and allow the rapid transmission of relevant information to medical professionals in urgent situations. As one of my colleagues remarked when this bill was discussed in the lower house, it is remarkable and frankly shocking that in some instances we have more information on our cars when we take them for a service than doctors have on our loved ones when making decisions on critical treatments. So it is no surprise that this bill represents the latest attempt to address the issue, but it is deeply disheartening that the Andrews government, through ideological inflexibility, stubbornness, arrogance and maybe even laziness, has unaccountably refused to make any concessions to improve past efforts. Instead, they have simply rehashed their previous proposal with all its flaws. It is not good enough and particularly disgraceful when the goal is better patient care. I will be certainly supporting the coalition amendments that Ms Crozier has put forward and those of Mr Limbrick, which I have heard about. I am impressed by the work done by both sets of amendments to salvage the bill and will outline briefly now why I believe they are necessary.

I do not intend to make an exhaustive contribution, but I am particularly struck by certain aspects of the legislation and I wish also to relay an important contribution from a constituent who has significant experience in this area. Firstly, it is interesting to note the unusual coalition of domestic violence survivors, civil liberty groups, legal practitioners and cyber experts opposing the bill – what a collection of opponents. It is not just a single-issue group or even a unified political opposition, a self-interested employer or dogmatic unions who object. We should note too that it is extremely likely that similar objections are shared by a very significant percentage of the population. Even before the damage to public trust done by the COVID-19 lockdowns, 9.9 per cent of Australians – some 2.5 million – had opted out of the federal My Health Record system. So why does the Andrews government choose to deny those same people that opportunity? If the federal system allows opt-out, why would Victoria think they should do any different? I personally might have no issue with information sharing, and I am sure Labor ministers, staffers and the Department of Health do not – that is obvious – but is completely wrong to make public policy which disregards such a significant percentage of the population with no proportional justification.

As the Law Institute of Victoria media release last week put it, and I repeat what my colleague has just said because it is important to have it on the record everywhere:

Patient autonomy must be front of mind in any health legislation being put forward by government to protect patients’ rights … an opt-out scheme would place choice back in the patients’ hands about the healthcare they receive …

…

Patient autonomy is a fundamental human right: it’s the same principle that allows a patient to refuse medical treatment.

Why can’t we say no? Why can’t we make an informed decision that even though our care may be less good we still choose to opt out? There are serious matters here: mental health, sexual assault, domestic violence, abortion, sexually transmitted diseases, addiction and COVID vaccine status – all sorts of different reasons people might wish to keep their own information confidential. Rightly or wrongly, people may be scared for their financial future, for their reputations, for the custody of their children, for the safety of their families. How can we force upon them a system which creates nervousness, anxiety and even depression? I want to quote a constituent here who wrote to me at some length on her fears about this bill:

Many people may not want their personal health information shared in this way and I most certainly do not. Having worked in the health system for many years I am aware that privacy and confidentiality is extremely important to the majority of people attending for services. Indeed it is common for people to specifically ask if the information they provide will be kept confidential. This bill could especially seriously impact vulnerable people such as those in family violence situations, victims of sexual assault and those using or recovering from drug or alcohol issues. It can be very challenging for stressed, traumatised and vulnerable people to seek health care and they are less likely to do so if they feel unsafe because their personal information is not respected and not kept private.

My constituent then adds another important observation:

Having had my own personal information breached by Victorian Government departments several times and aware that others have also, I have no trust –

no trust –

that the Government has the ability to keep personal and sensitive information secure and safe.

So to me it is obvious. Sometimes people have developed relationships of personal trust with their practitioners. This can particularly be the case with psychologists and psychiatrists, dealing with difficult and complex cases, distressed people who might not in the eyes of the department or health bureaucrats be making rational decisions. But it is their decision to make, not the government’s and not the health department’s. Surely we do not want to set them back. Why take any risk?

It is problematic for the practitioners too, not just the patients. In fact I see this as much like the attack on an individual’s judgement and competence in the so-called gay conversion bill. It is another diktat from on high which will remove from practitioners via their employing organisations the discretion to treat individuals in the way they see best, which could include acceding to their heartfelt request to maintain confidentiality. What is so abhorrent to the government that they do not want people to be able to retain their confidentiality and not have their records go far and wide?

Even worse is another element – the retrospective nature of the legislation. We know now, looking at new section 134ZH, part 2, that up to three years of health records from before the commencement date may be uploaded to the information-sharing system. By this measure even the autonomy remaining open to Victorians not to seek treatment is retrospectively removed. Is it any wonder that with heavy-handed absolutist retrospective legislation like this paranoia and conspiracy theories are bred? And it is all so unnecessary.

The amendments presented by the coalition today and those Mr Limbrick I think plans on presenting address all these legitimate concerns while leaving the essential intent of the bill intact. It could be opt-ins, opt-outs or even allowing patients the discretion to choose which of their conditions or medical treatments are shared; there are many potential solutions, none of which the bill as introduced presents. Why should the government be so stubborn that it will not actually listen to what could make this proposal better?

The irony is that in failing to introduce these protections, patient care will be damaged. Some will simply not access care for the reasons I touched on earlier. It is also remarkable that the minister, in this place no less, specifically stated that a main objective of this bill is to deliver person-centred care. There is no doubt that in today’s health system patient-centred care – shared decision-making – is universally recommended. The idea of ‘No decision about me without me’ has become rightly central in the relationship between healthcare professionals and patients, yet this bill rides roughshod over that idea.

I want to conclude by reinforcing this point. There are other arguments to make on how useful the scheme will actually be – by analogy with My Health Record, on government competence in delivering IT projects, on cost blowouts, on cybersecurity in the light of Optus and Medibank Private, on hospitals’ understandable prioritising of patient care over IT investment and on the increasing prevalence of cyber attacks on healthcare institutions, as evidenced in my electorate by the disruption Barwon Health and the South West Alliance of Rural Health have suffered. But all these are secondary arguments. Believe it or not, I respect anyone’s right to have complete confidence in the Andrews government’s ability to deliver well-designed, on-time, on-budget, perfectly secure services. We do not ever see any evidence of it happening, but you know, they could have confidence that it might. But it is their choice to weigh up the facts and come to that decision. It should also be anyone’s choice to reach the opposite conclusion, so I cannot see how any member here can, without amendment, vote to impose this bill on all Victorians. I certainly will not be doing so.

Wendy LOVELL (Northern Victoria) (17:33): I rise to speak on the Health Legislation Amendment (Information Sharing) Bill 2023. I will be brief in my contribution. Many of my colleagues have canvassed this bill very extensively and the concerns that the opposition have with it. I have to say that I have some empathy with the bill. I actually think that it is a good thing that we can share health information, particularly if somebody is brought into a hospital in a situation where they have been in an accident or they are in a coma or something like that where they cannot give the information to the medical professionals. I think it would be a good thing to be able to access medical history to make sure that patients are being treated appropriately. But in saying that, I also have to say that I believe very much in an individual’s right to privacy and self-determination. Whilst I may want that for myself – that they can access my health records and give me the appropriate care – I respect everyone’s right, every individual’s right, to privacy and self-determination. That goes for whether they want their information shared or whether they want to be able to deny medical treatment.

The problem with this bill is there is no opt-out clause. As has been canvassed very extensively, the federal system, the My Health Record system, does have an opt-out clause, and 10 per cent of Australians have opted out of that system – and Victorians should have the same right. Mr Limbrick has collected in a very, very short time 10,000 signatures on a petition to say that they do not agree with this bill. If there had been further time, I am sure that number would have been tenfold or twentyfold or probably even a hundredfold.

It should be an individual’s right to opt out. It should also be an individual’s right to lodge a freedom-of-information application if their records have been wrongly accessed, and yet this bill expressly denies Victorians that right. We do know that this government is the most secretive government ever. They do not like being asked for information. I have a freedom-of-information application at the moment just for some minutes of a cemetery trust that I am having dreadful problems getting any information from the government about. They are cemetery trust minutes; they are not minutes of a cabinet subcommittee or something. They are minutes of a cemetery trust, and the government are going to all sorts of lengths to try and stifle that application.

I actually had – sorry, I have got a bit of a migraine today, so I am not exactly thinking extremely straight as I am putting this contribution together, but I am trying to contribute to the debate anyway – an incident very early on in my career where I had a phone call from a journalist where a member of another party had given that journalist some information about me that was medical information. It was inaccurate medical information that had been given to that journalist, but the journalist was interested enough to ring me up and ask me was that true. Now, I did not think that it had anything to do with my ability to do this job, whether that was true or not. It was not true, but the journalist was interested enough to ring me up and ask me if it was true. Were they interested enough to put it on the front page of the paper if it was true? We should not have to go through that as members of Parliament, and members of the public should not have to go through that at all either.

We know this government’s history of developing IT systems is absolutely stellar – not. It is pretty concerning, this government’s history of developing IT systems, and we could talk about a number of systems that have been huge failures in the IT area under this government. So do we trust them to actually put together a system that would be secure and would not be subject to people accessing it for the wrong reasons? We know that the law enforcement assistance program database is often – often – accessed for the wrong reasons, and we are continually hearing in the media stories of the LEAP database being accessed and used inappropriately. We do not want that happening with health records here in Victoria, and therefore we will as an opposition, as the Liberal Party, move amendments to this bill to allow for an opt-out and to allow for freedom of information, and I appeal to the crossbench to support those amendments to make this bad bill a slightly better bill.

Ann-Marie HERMANS (South-Eastern Metropolitan) (17:38): I rise to speak briefly about the Health Legislation Amendment (Information Sharing) Bill 2023. This bill seeks to centralise an electronic patient health information sharing system by amending the Health Services Act 1988. This bill also allows health information of Victorians to be centralised and accessed by non-disclosed government authorities. While centralising appears initially to make sense for medical consistency, today’s Victorians under an Andrews government live in very different times where they may not feel safe, and unwanted disclosure of personal details can be challenging for vulnerable people who wish to keep aspects of their medical information private. This has been shown by the fact that this government have demonstrated their preference to be secretive with their own data with responses that they ‘don’t recall’, but they want access to everyone else’s data.

After so many lockdowns from this government in recent years, many Victorians will have many reasons to be concerned with this bill. In an age when many people have lost faith in this government to be fair in its ability to keep people’s records and personal details private, there is no transparency to protect Victorians so they feel safe from being discriminated against. Some have lost faith in this government and their ability to protect all Victorians.

It is congruent with a Liberal Party value to have the freedom to protect personal beliefs and values, to maintain the right of the individual and protect personal details. This is essential for all Victorians to feel safe. So it is important that my colleagues and I fight this bill in its current form. All Victorians should be able to choose whether a person can have access to their personal health records. At a time when non-vaccinated people still suffer discrimination, why would they want their health record accessed by Victorian government authorities? Even vaccinated patients should have the fundamental human right to keep their own health records private.

I do not support this bill in its current form, because it does not permit Victorians the freedom to opt out or to opt in or to prevent unknown or undisclosed people from having access to their personal records. It is yet another draconian measure of this government, which would allow current Victorian government authorities to inappropriately use highly personal data, which should be permitted to be maintained as confidential for any and every Victorian, should they wish. Should there be an opt-out or opt-in clause, I would support the concept of allowing medical practitioners to access data for medical purposes, should the patient be prepared to share it. But I do not – will not – support this bill in its current form because it denies the individual the opportunity to protect their personal data from unknown, undisclosed government authorities.

Lee TARLAMIS (South-Eastern Metropolitan) (17:42): I move:

That debate on this bill be adjourned until the next day of meeting.

Motion agreed to and debate adjourned.