Thursday, 9 March 2023

Bills

Health Legislation Amendment (Information Sharing) Bill 2023

Second reading

Debate resumed on motion of Ingrid Stitt:

That the bill be now read a second time.

Sonja TERPSTRA (North-Eastern Metropolitan) (10:00): I rise to make a contribution on the Health Legislation Amendment (Information Sharing) Bill 2023. This is an important bill and is something that I know concerns a lot of people, and in a good way. It is basically the government making sure that we have a fit-for-purpose, modern information-sharing system that accommodates and accounts for patient needs. The Victorian government is committed to improving patient safety and continuity of care for all Victorians, and this also means ensuring our health services and clinicians have the appropriate tools and information at their disposal. The proposed new secure health information sharing platform will do exactly that by establishing a single point of complete and accurate patient information for clinicians to provide safe and timely care.

For example, if I am taken to an emergency department – hopefully that never happens – and I am out to it and I cannot speak for myself or a family member is not there, I would like to think that the clinicians that are treating me in that circumstance can have access to the information they need. I might have an allergy to medication, for example, and it would be great if they knew that before they started administering medication. But if I am not conscious and I cannot talk to them, then obviously there are going to be some delays that occur before they can get access to that information. So these sorts of systems really are critically important to ensuring that time can be gained and that there is no lost time when we look at getting access to patients’ information. It is critically important. Time gained in those circumstances can make a big difference to outcomes for patients, so it is critically important.

Victoria’s public hospitals were divided into autonomous networks in the early 1990s. That would have been a function of privatisation. Under which government? Their government over there, the opposition benches; that was another legacy. I think they even closed public hospitals, if I remember rightly. So we are still dealing with legacy issues that have arisen from those opposite. They want to lecture us about all manner of things today. Well, shame on them, because we are having to make sure not only that we address the legacy issues that were left by those opposite but that we move forward, we look into the future and go, ‘Well, actually, we need to not only fix the problems of the legacy left by those opposite with their absolute obsession with privatisation but look forward as well and make sure we are providing the best regime for patients in our public hospitals.’

Nurses – aren’t they great? Don’t we love nurses and our public health practitioners? They are fantastic. Our nurses provide the best care in our public hospital system, and we value them. Not only do we value our nurses, we value our midwives and our doctors and everyone who works in the public health system. We know you hate the work ‘public’, because you always privatise anything that is public.

Members interjecting.

Sonja TERPSTRA: We know you hate it, and shame on you. You are embarrassing. Let us keep talking about our fantastic public hospital system and all the amazing people that work in it. Shame on you over there; you are an embarrassment and a rabble.

As I was saying, public hospitals were divided into autonomous networks in the early 1990s by those opposite but have been operating as parts of a single system, especially during COVID, but their digital records are not shared. I know that if anyone suffers a severe health issue and they are taken to hospital in an ambulance, they are going to a public hospital and a public emergency department, and the great thing about public EDs is that this government introduced nurse-to-patient ratios. Why? Because we know that that actually saves lives and gives better patient outcomes. It is about safety. Only this government on the government benches over here, a Labor government, makes sure that our public hospitals and the great nurses, midwives and doctors that work in them are supported –

Members interjecting.

Sonja TERPSTRA: whereas you guys over there close hospitals and sack people. That is what you do. Most Victorian patients will be treated at different health services over their lifetimes, and patients –

Members interjecting.

Sonja TERPSTRA: I do not know, but I can kind of hear an irritating whining noise in here. It is really, really fascinating. It is like something going down the gurgle hole of irrelevance in political history. I do not know, but in the last election, didn’t people vote for us? Yes, we were returned and increased our majority. I will leave you with that comment over there because, honestly, the whining noise – I do not even know where it is coming from, Mr Berger. Do you? No. It is the whine of irrelevance.

Anyway, I will return to my contribution. Most Victorian patients will be treated at different health services over their lifetime, and patients cannot know what information from their medical past will be critical to their medical future. This is actually true: you never know what might have happened in your past – how you have been treated, the issues or illnesses that you have had – and how that might impact patient outcomes in the future. Currently in Victoria critical health information is spread across different health services, depending on where a patient has visited or been transferred, and these records are also in separate systems and paper files, making them difficult to find in times of need. The fragmentation of the patient health information system means that clinicians, as I said, are often needlessly delayed by manually gathering patient information through faxes or phone calls. I was surprised: some doctors still use fax machines – oh, my goodness. I thought it was a relic of the past, but it is clearly not.

Nevertheless, you can see why having a joined-up system is pretty important. When someone has been treated in an emergency department it is critically important. If someone is suffering a stroke, time is really, really critical to make sure that they get the best treatment. When you have got a brain that is under pressure because of a stroke, time is critical when they can adequately and quickly get the information that they need. That is why we introduced stroke ambulances as well. Those things are critical, and they improve patient outcomes.

Just to depart from my contribution for a moment, I know also in regard to this bill the government has house amendments, and I call on the Clerk to circulate those house amendments now.

Amendments circulated pursuant to standing orders.

Sonja TERPSTRA: Medications that may interact, drug allergies, alerts such as severe asthma, past biopsy results, diagnoses that took months to make – especially psychiatric diagnoses – and results of tests and expensive scans all sit in the digital records, and with this bill we can make that information readily available, reducing delays and risks of misdiagnosis, or alternatively we can continue to let clinicians wait on the phone. The current way of doing things is clearly inconsistent with modern health information sharing standards and the approach taken by the Australian jurisdictions, such as New South Wales, Queensland, the ACT and South Australia, which have all successfully implemented health information sharing at the point of care.

Having been an official for the Australian Nursing and Midwifery Federation, I have worked with many nurses, and not only in our great public hospital systems. I was fortunate to have in my team people who had worked in the emergency department but also nurses who had worked in the mental health space. They talked to me quite often about making sure they had access to patient records in a quick and timely manner. I know that that information is critically important to their practice, because nurses talk a lot about making sure they have good practices, and they do continuing education to make sure that in the way they operate and provide care in our great public hospital system they have the best practice available to them. This tool I know will be very much appreciated by nurses because, again, it allows them to have access to information. For clinicians and doctors it allows them to get access to information as quickly as possible, and that can only be a good thing. As I said, if I was out to it, if I was unconscious and being brought in by an ambulance into an ED, I would want to know that the clinicians treating me – nurses, doctors – had access to my information. It does not bother me; I actually would prefer that to be public.

In terms of the bill and what it does about information, the bill is not about whether public health services should share information. That is really important for the public to understand. It is about establishing a secure and more efficient platform for clinicians to access the relevant clinical information to treat patients safely. There are currently no opt-out arrangements under existing legislation, and Victorian public health services share information for the purposes of treatment.

The opt-out model suggested by David Limbrick and others is a step backwards. It actually undermines the primary objective of the bill, which is to ensure clinicians can have access to relevant medical information to provide timely care. An opt-out model also undermines the efficiency of our health system. An opt-out patient may be required to redo tests to safely effect diagnosis and treatment. It is distressing for the patient and creates unnecessary costs and delays for health services, who are already under significant strain. These inefficient, duplicative and unsafe manual processes increase wait times and delay care for other patients, such as when they present at emergency departments. Like I have just been saying, time is everything. Especially with stroke and with some other illnesses or injuries, time is everything. We can provide systems whereby treating clinicians – nurses, doctors – can save time and actually save costs.

It is kind of interesting to me that those opposite want to bang on about this, because really we want to make sure that we are actually saving money. Those opposite always carry on about how inefficient we are. We waste money and time and rah, rah, rah – standard catcalls from standard casting over there. No-one is listening to you. You are an embarrassment. Whenever we come up with good ideas over here, all you can do is rubbish them, because you have got no ideas between you over there. You are an embarrassment. You have got no ideas. God forbid you guys ever get into government, because you know what, you sell everything and privatise everything. That is what you do. You sack people and you hate the word ‘public’. You privatise everything –

Nicholas McGowan: On a point of order, President, the member is referring to the members on this side of the chamber as ‘you guys’. That is unparliamentary. I would ask you to bring the member to order.

The PRESIDENT: I will bring the member back to the bill, but I request that she gets heard in silence. Interjections are unruly, and they can provoke a response.

Sonja TERPSTRA: Thank you, President. As I said, there is strong support from clinicians and health services for these reforms, which will result in improvement in practice and patient outcomes – and that is important, because as you can see, whenever we go about implementing reforms and improvements we consult with people and we consult with those very people who are working in the system. We do not just sit here and make stuff up. What we do is consult with people, and as I said, these improvements are strongly supported by clinicians and health services.

Those who oppose the bill are content to point out the challenges we are facing without being part of the solution. As I was saying, these are critical reforms that are going to improve patient outcomes. It is very easy to be critical; it is easy to criticise. The hard part is actually coming up with solutions to make sure that patients get the best outcome, because ultimately this is about patient safety, and that is something that those opposite do not understand.

I know other colleagues of mine will be speaking on this bill, and I know they will also have a lot to say. I think I have addressed it in a substantial way. There is another thing that I might just quickly touch on in the 2 minutes I have got left, FOI. Those over on the opposition benches and some on the cross bench like to run the line that everything we do either is corrupt or has conspiracy theories attached to it. It could not be further from the truth. As I have been saying in my contribution, it is incredibly tedious and predictable but just boring to listen to the constant stream. There is nothing more, nothing different. It is all more of the same, just talking to yourselves, and you keep doing that while we over here get on and make the changes that we know our health system actually needs.

On FOI rights, just in the 1 minute and 44 that I have got left – I will finish on this note – the bill does not change a patient’s right to access their full medical records from their health service provider under FOI and privacy legislation. To ensure efficiency and timely care the information that will be included on the proposed platform is only the most relevant clinical data for the purposes of treatment, not the full medical history of the person. This includes allergies to medication, hospital treatment summary and diagnostic reports. That is actually being helpful. It is going to help nurses and doctors who are treating a patient to have the best, most accurate information they need to give treatment options for that person and make the best clinical decisions they can in the time that they need to. The bill does not enable FOI requests on the health-sharing system. This is because it would require the department to access clinical information to respond to questions, which would be inappropriate and counteractive to the strict protections and access controls the bill seeks to establish.

I know my colleagues will have much more to say on this, and some will probably talk about what happens in other jurisdictions as well. But as I say, as a former official of a nursing and midwifery federation, the nurses union, one of the largest unions in this country, I know that nurses and doctors and those who work in our public healthcare system greatly appreciate this. They support these reforms. Ultimately, it is about patient safety. The reforms that this government has made previously around nurse-to-patient ratios – again strongly opposed by those opposite – were all about improving patient safety. This mechanism and the bill we are introducing, this Health Legislation Amendment (Information Sharing) Bill, will also improve patient outcomes and improve patient safety.

Sarah MANSFIELD (Western Victoria) (10:15): Before I start my contribution, for transparency I would like to state for the record that my partner is employed at a public health service and is also a board member of another entity to which this legislation applies. This is already on the public record via my regular interest disclosures; however, in my assessment and based on advice received, the passage or otherwise of this bill has no relevance to his private interests and therefore does not present a conflict.

This is a significant piece of legislation, and I intend to do it justice by taking the time to outline the reasons why the Greens support the intent of the bill but why we also worked with the government to secure amendments to improve the bill and why we will need additional assurances from the government in order for them to get our vote. In developing our position we have liaised with a wide range of stakeholders, including health service providers, various consumer and privacy representative bodies, healthcare workers and the Department of Health. There are widely varying views about what is appropriate and workable, and we have sought to find a balance between these perspectives.

Like my colleague in the other place Dr Tim Read, I am acutely aware of the problem this legislation is attempting to address. As an emergency medicine registrar at the Austin and Geelong hospitals I spent countless hours chasing up medical records and became a pro at using fax machines. It has been said that some doctors use fax machines still. All doctors use fax machines; it is the most hardworking machine in the hospital. I have been in those middle-of-the-night situations where you are working with incomplete information – patients and their relatives trying to remember critical details about when, where and what you need to know happened. In the absence of this information, you hope the patient is not on a medication that might react or that they have a condition that affects their treatment, or you order another round of tests, because it is faster and easier than trying to get hold of previous results they might have only just had done. I remember once when I was a junior doctor – this is a true story – my team had to put a CD with images of a brain scan in a taxi so that they could be viewed by a neurosurgeon at another hospital to assist us with our management. That was some time ago; I would hope things have improved, but I do not think they have improved that much since then.

It is hard to convey just how much time is spent by nurses, midwives, ward clerks and doctors chasing patient records and information and how much duplication occurs. In a system strapped for resources, particularly human resources, one of the questions we have to ask ourselves is: is that the best use of our hospital staff’s time? In a system that is under financial pressure, should we be ordering costly tests again and again despite being unnecessary and possibly putting patients at risk of harm? While this bill is certainly no silver bullet for solving all health system problems, it is a step towards improving efficiency.

The Greens recognise that patient safety was the driver of the proposed legislation. The investigations and subsequent review into the tragic cluster of baby deaths at Bacchus Marsh hospital called for a statewide information-sharing system for greater hospital safety and quality assurance in Victoria. In an ideal world we would have a seamless healthcare system – integration between all aspects of care across the country, within the state and between primary, secondary and tertiary care – and we would have a record system that reflects this. Instead what we have is a highly fragmented system, with health information to match.

In Victoria our public health entities do not operate as a cohesive, effective health system. Since the time of Kennett, who broke up Victoria’s health system, each health service has acted as an independent entity, each with its own records, management system and software. There is no mechanism for these different electronic records to talk to each other. Information is therefore scattered. It is stored in different places, it is in paper and electronic forms and it is duplicated and difficult to manage.

In 2009 I gave evidence to an inquiry into public hospital performance data to the Standing Committee on Finance and Public Administration – Mr Davis was actually a member of the panel – and one of the hot topics was the parlous state of our fragmented hospital IT system. I actually looked up the transcript to see what we had said – neither of us said anything to contradict our current positions. But it was really interesting to see that the same discussion could be had today.

A lack of information sharing increases the risk of errors or omissions and duplication of tests and procedures, which can be costly and even harmful. It is particularly challenging for people who have complex chronic health conditions or require care across multiple facilities. Increasingly, people who are from rural or regional areas must travel to metro areas for specialist treatment such as multidisciplinary cancer care. They might have surgery in one place, radiotherapy at another and continue chemotherapy at their local community health centre.

Again, in an ideal world the way we would deal with our fragmented health system would be to find a way that all the hospitals could communicate with each other efficiently without needing to centralise a platform hosted by the department, but getting every health service onto the same system within a reasonable time frame would be almost impossible according to health IT experts and others in the health department. They have not been able to achieve this in decades.

So we have before us the proposed mechanism attempting to bridge the communication divide that exists. The proposed system is not a panacea for all the ills of the health system or indeed even of health information sharing, but we recognise that it is a genuine attempt to fix a longstanding problem. The Greens support the intent of the bill: to improve quality and safety of patient care. However, provision of good clinical care is reliant not just on healthcare worker training and systems but on trust from patients. They must be able to trust that they will receive good-quality care. Having the right information at hand is part of that, but they also need to be able to trust that their sensitive information is going to be kept private and secure.

This is not a binary debate between effective, efficient clinical care versus patient privacy on opposing sides. A lot of focus has been on the fact that the proposed bill does not provide an opt-out or opt-in provision. We have spent considerable time consulting with various stakeholder groups and have worked constructively with the government to see how the bill can better address their concerns. Many arguments being made against this system assume that the existing systems are somehow more secure or afford people more choice. At present laws require the collection and storage of information by a health service. This cannot be opted out of. Some health services are networked together already. Information is shared already between health services via email, fax, verbal communication and screenshots, which I would argue is less secure and lacks any ability to audit who has accessed the information in many cases. There are a range of laws that exist to govern how health information can be recorded, stored and shared and consent processes required, who can access information and what it can be used for. We must remember that these laws remain in place.

While we will not be supporting a blanket opt-out provision as has been proposed, the Greens do hold a range of concerns about privacy, autonomy and data integrity related to this bill. For this reason we have worked with the government to secure a legislated privacy management framework so we and the public can have confidence patient privacy will be central to the development of the platform. I thank the government for working constructively with us to improve the legislation. Amongst other things, the privacy management framework that we have secured in legislation must create a process to safeguard information that is highly sensitive; a process to protect the identity of patients who may be at risk of harm, including survivors of family violence – that is in the legislation; a process to allow patients to get reports on who has accessed their records – that is in the legislation; and regular audits and compliance checks of the system so that any inappropriate use can be detected.

Critically, we have ensured that consumers will shape and inform what additional privacy protections are needed. We have also pushed to have a review of this legislation incorporated into the bill, including a review of the privacy management framework. We want an independent expert review conducted and a report to Parliament no later than a year after this starts. When implementing important and complex legislation like this, where there are still many unknowns and where public concern is rightly elevated, a review process is essential to ensure that we are on the right track. The minister must either adopt the recommendations of this report or explain to Parliament why not. That is in the legislation.

While we welcome the government’s willingness to work with us and include the amendments, we will still require assurances on a number of issues during the committee stage. We want confirmation that additional privacy and security measures will be afforded where required – for example, in the case of people who have sensitive or stigmatised conditions and for survivors of family violence. This is not new. Local health services already have systems in place to manage situations like this, and we want the privacy management framework to build on those systems. We also want assurances that people and agencies other than those directly involved in the clinical care of a consumer will not be able to access the information on this platform. We do not want law enforcement agencies or health department bureaucrats accessing these records. We want the government to provide details about the process for people to obtain a report listing who has accessed their electronic health information, and we want assurances that the department has appropriate resourcing to support the implementation of this system so it does not compound the workload of already overstretched hospital and health services. I have spoken with health service providers who are concerned about how they will meet the compliance requirements of this legislation and are concerned about having the budget to do so.

While the Greens understand the clinical safety and quality issues that are at stake here, the public also need to be able to trust the system to keep their information private and secure. That is why we have worked constructively with the government to achieve improvements in this legislation, and provided we receive appropriate assurances about other concerns, we will be supporting it. If the legislation passes, regardless of what amendments are made and what assurances are provided, ultimately responsibility for this system rests with the government. A lot will come down to how this is implemented, including the amount of time and money invested in ensuring that protections for people’s data and privacy are the highest possible. Be assured that from the Greens’ perspective passage of this legislation is not the end. We will be watching closely and holding the government to account. The government must invest adequate time and resources to develop robust privacy measures and support health services to deliver those to ensure ongoing trust in our health system from the public.

Ryan BATCHELOR (Southern Metropolitan) (10:26): I am pleased to join the debate on the Health Legislation Amendment (Information Sharing) Bill 2023. I also want to start by thanking Dr Mansfield for her contribution. I thought it was exceptionally thoughtful and gave us an insight into the realities that our health and medical practitioners face on a day-to-day basis, which has really been absent from some of the contributions from the other side of the chamber. I do also want to acknowledge the small matter of my partner’s employment in a medical service, which is reflected on my register of interests, and share the lack of concern that that poses any conflict of interest.

It is important to state in the context of this debate that we do see our health practitioners constantly trying to do the absolute best that they can for the patients that are presented to them on a day-to-day basis, often in very difficult circumstances, and what we as legislators in government can do to help give them the tools and information that they need to provide the best quality care is something that should be top of mind always in consideration of legislation that is before us. We know that better information, as complete and as accurate as we can make it be, may be a necessary but perhaps not sufficient ingredient in ensuring that high quality of care.

The bill before us today does a range of things, including enabling the Department of Health by amending the Health Services Act 1988 to create and establish an electronic health information platform to allow the sharing of information between specified health services via that secure platform for the purposes of treatment and patient care. It also facilitates the secretary of the department to have the necessary powers and controls to allow that process to occur and introduces new offences, new requirements and new penalties for unauthorised access or disclosure of that information. The legislation when it is passed – and we hope that it is passed – will sit alongside the very significant protections that exist in the Health Records Act 2001 and under the five health privacy principles to ensure that the use of health information in Victoria is both properly and well regulated and also has sufficient and necessary oversight. I think the government does take those concerns seriously, and clearly in the discussions with other members of this place and other members of the other place it has certainly been very willing to make sure that the sort of oversight that is put into this framework is the best that it possibly can be.

The other thing I want to reflect on – and this is something that I made a contribution on in the chamber last night – is the work that we have done previously that I have had the personal experience of working on in another sensitive context, that of the family violence reform context, and the information sharing that the government put in place following the coronial inquest into the death of Luke Batty and the Royal Commission into Family Violence in 2016. What was clear to us arising from the recommendations of both the coroner and the royal commission was that the lack of facilitation of information sharing between practitioners that are involved in support services – for victims of family violence in that case, and we can draw an analogy here to the provision of patient care in our health settings – had the potential to increase risk. An inability to see the full picture meant that the decisions that those trying to help needed to make sometimes were not fully informed. When we have a lack of full information, we can only make – health practitioners in this case – the best decisions available. I think it should be within the capacities of our government in governing to provide the necessary legislative and technological support to our medical and health professionals – that they are provided with all the tools they need in order to provide the best possible quality care to patients.

In approaching the task and thinking about this challenge in family violence, but I think it is applicable here in health as well, we need to think less about the health systems that we have in place and more about the people who use them. Always, always the operation of our health systems and the technology that supports them should be developed to consider the lives of the people that they are trying to help – to deliver a seamless patient experience but also to provide the best possible care. It is one of those features that I think has the most striking impact on the provision of that high-quality care that this bill is trying to address.

At the moment, because of decisions that were taken more than 20 years ago about the structure of our health services in Victoria – and I am not going to the merits of those decisions, I am just looking at the consequences the structure of Victoria’s health system have on patient experience and the potential of the receipt of high-quality patient care – by having effectively autonomous health service regions that have their own boards with their own structures, with their own information systems in place, what we have allowed to occur in Victoria is a siloing of information within the boundaries of those health services. I have got to say I have not met many patients who understand what a health service is, let alone know which health service they are turning up to when they are sick and need care at a community health centre or at a hospital. They are less interested, frankly, in the way we choose to draw lines on a map than they are about getting the best quality care.

What we have seen in Victoria and what the Targeting Zero report laid out in such stark terms is that the structures of the bureaucracy should not be impediments to patients receiving the quality of care that they need. Facilitating through the use of modern technology relevant information to be securely transmitted from one health practitioner to another to enable best practice, high-quality care to take place is something that should be within the capacity of a state and a state government that prides itself on having a world-class healthcare system. The health care Victorians receive should not be determined in its quality and efficacy by lines that were drawn on a map 20 years ago. That is fundamentally what this bill is trying to overcome.

The other thing that I think it is important to recognise in the course of this debate, which I think has been sadly lacking from the contributions of those opposite, is that the current arrangements under the health records act and the health privacy principles do already empower health professionals and clinicians to share information that they deem necessary for effective patient care. Effective patient care already allows health practitioners to share information. But as Dr Mansfield so eloquently explained, the way our health systems are structured and the technology that they provide for clinicians mean that often the tools that those health professionals have available to them are suboptimal at best. If the fax machine was not becoming too much of a cliché in this debate, it is a very real feature of our health system here in Victoria. I do not think that that is something we should be proud of, and I think that it is a good thing that this bill is trying to do away with those technological restrictions on effective health care in Victoria.

What the bill actually does is simply enable the facilitation, under existing health law, of new mechanisms for information to be shared. The bill in its current form and under the terms of the amendments that the government has circulated today will allow increased oversight of those platforms and will increase the penalties for inappropriate use, including imprisonment. Most importantly, unlike the way things work now, where people pick up the phone, call each other and open a paper file, what we will have is a much more detailed and secure audit log so that patients are able to see who has been looking at their files so that oversight can occur if those in management or other positions of responsibility have concerns about these practices taking place, and there will be actually something there to look at that, because at the moment there is no way of knowing who is going in and having a look at a patient file when they should not be. There is no way of keeping track of someone who might have less than honourable motives and is looking with improper purposes at someone’s information. The provisions of this bill will put in place more penalties and put in place better mechanisms for keeping track of whether or not that is occurring. I think and the government thinks under the terms of this bill that that will be a positive for patient confidence in the operation of health records in Victoria.

We do think that it is time we got with the program. We do think it is time that Victoria’s health system moved beyond fax paper and started getting to technology that enables information sharing and enables a doctor in one hospital to know whether the person who has presented to them, whether they be from the city going to the country or whether they be from the country coming into the city, has had a blood test in the last couple of weeks or whether the person who has just turned up to the emergency department on a Saturday night, for example, has had a blood test or has a range of allergies, so that those tests and unnecessary procedures are not repeated, preventing unnecessary trauma on a patient who is required to go off and do unnecessary tests. Let us not forget that every time a doctor orders a blood test a patient has to give blood. If we have got the capacity for pathology to be shared more effectively between our health services, we might actually be providing a health outcome for patients that is much better for them.

This bill will make sure that when someone turns up for treatment, the treatment they are receiving is as fully informed as possible. It prevents duplication, reduces inefficiency, ensures that our doctors are spending less time rifling through paper and asking for stuff to be faxed to them from their colleagues – if they can get hold of them – at another hospital or another health service and enables them to be making the kind of informed clinical decisions that they require to provide high-quality patient care. It brings Victoria into line with other jurisdictions. It does what is necessary to demonstrate our commitment to the continual improvement of our health services here in Victoria.

It responds to key recommendations of the Targeting Zero report, which is all about trying to reduce avoidable harm in our health system and making sure that just like in other settings that we have moved on – as I mentioned earlier, in the family violence context, but in others – decisions that professionals make are more fully informed by the resources available to them, that there is increased oversight, that there are better protections, that there are new penalties and that the way that this framework is going to be operated and implemented will be subject to the kind of oversight and monitoring that gives this Parliament the confidence that the government is doing what it said it would do. Most importantly, and it brings me back to my original point, it allows our health system to be designed and operated for the benefit of patients rather than the administration of a health bureaucracy on the basis of decisions about administration that were taken more than 20 years ago. I think putting patients first in our health system should always be our absolute priority.

David LIMBRICK (South-Eastern Metropolitan) (10:41): Protecting privacy is key to ensuring human dignity, safety and self-determination. It is a fundamental human right that underpins freedom of association and of expression as well as freedom from discrimination – at least that is what it says on the website of the Office of the Victorian Information Commissioner. Both the previous and the current federal governments have acknowledged how important it is to get the laws and regulations around privacy right, with the federal Attorney-General releasing the Privacy Act Review: Report 2022 just last month. Running at over 300 pages, the report concludes years of work to update our national privacy framework, which has been widely criticised for being woefully out of date. Some highlights that are relevant to the discussion today include proposal 11.1:

Amend the definition of consent to provide that it must be voluntary, informed, current, specific and unambiguous.

Proposal 11.2, that the Office of the Australian Information Commissioner:

… could develop guidance on … consent requests.

Proposal 11.3:

Expressly recognise the ability to withdraw consent …

Section 4.7 relates to sensitive information, noting that sensitive information:

… may only be collected with consent unless an exception applies, and more stringent requirements apply to its use or disclosure.

This includes health information. We have a situation now where the Greens have apparently done a deal with the government to look at privacy, which takes into account none of these issues around consent. There is no ability for someone to withdraw their consent, to give consent or to opt out of the system. They are just talking about security, basically. Consent is a key feature of this report into privacy frameworks. Today we have got a bill that ignores the consent of the patient.

The report also recommends reforms focused on more control for individuals over their personal information, with a number of proposals modelled on the European Union’s General Data Protection Regulation, or GDPR, which I will come back to later, as they interact with exactly the kind of digital health sharing systems that we are discussing today. It is hard to think of any information any of us might have that is more private than our medical information. In this case sharing is absolutely not caring.

I am not here for a second to endorse the old ways of handling medical information, like through fax machines. Clearly it needs to be updated. This need was identified in another report published in December. The Strengthening Medicare Taskforce Report clearly identifies an urgent need to improve IT infrastructure, modernise the My Health Record system, better connect health data across all parts of the health system and make other improvements. Absolutely no-one I am aware of continues to argue that the clunky system does not need updating. The debate here is about consent.

But this is pretty much the opposite of the proposal before us today. Under this proposal a range of people working for health services, not just doctors but many people working throughout Victoria’s health system, will be able to find all the private information you have provided over the last three years. You do not have access to it. You have no choices at all. Your information does not belong to you. It is hidden from you, collected and shared without your knowledge, consent or participation. Here it will be kept safely in a handy database where it will supposedly be kept safe and secure.

Australian governments have a shocking record when it comes to managing IT projects. The federal government’s COVIDSafe app is probably the most famous example, but the Victorian government is every bit as inept, having overseen Fines Victoria’s new IT system, which incinerated $60 million of money. No doubt some of the people involved in these projects will be put in charge of handling this information. If not, maybe they will get them from Optus or Medibank.

It is worth noting that the first targets of the Medibank hack were high-profile figures threatened with the release of their sensitive health information related to mental health and substance abuse – exactly the kind of information that could be scooped up and widely accessed under the information scheme proposed by the government. While I am sure all efforts will be made to ensure that the database is secure, people who have concerns – and there are probably more of them now than there were a few years ago – have very good reason to be concerned.

Some examples of where data breaches have resulted in the exposure of sensitive health information include the following. In 2019 New Zealand primary health organisation Tū Ora Compass Health disclosed a data breach that exposed the medical information of roughly 1 million people. In Norway in 2018 South-Eastern Norway Regional Health Authority experienced a data breach where the personal information and health records of 2.9 million people – over half the population – were stolen. In 2019 Canadian clinical laboratory service LifeLabs experienced a hack that exposed the records of up to 15 million patients, including 85,000 lab results. They chose to pay the hackers to return the data. In Sweden in 2019, 2.7 million call recordings to a health service line were exposed after being uploaded to an insecure server. In the USA in 2022 the Department of Health and Human Services listed 701 major data health breaches, affecting 59 million individuals. Global risk management firm Kroll has reported that health care has overtaken finance as the most breached global industry in 2022.

I could go on at length as there are so many examples, but the point I am trying to make here is that the proposed centralisation of our health records in this database will be one of the most valuable cybersecurity targets in the nation. Shouldn’t we have the option of whether we want our information included? Shouldn’t we have the option, even if we want to participate in the scheme, to choose to keep our most sensitive information private? Of course the government will assure you that your information will be kept safe, but tell that to the Victorian information commissioner. They reported 124 data breaches in their most recent annual report. This new database would become a honey pot for organised crime, international intelligence or even marketers. In particular I am concerned about the dangers for women. It is not hard to imagine that a jilted lover you met on Tinder or a stalker who works in a hospital could get hold of your information and send it. All it takes is one breach for this information to be all over the internet, and the internet is forever.

The risks are real, and they do not just come from external threats. The Healthcare Sector Cybersecurity Coordination Centre in the US Department of Health and Human Services published a report in 2022 on insider threats in health care. They noted a decrease in external threats that also corresponded with an increase in internal threats. These came from a mix of malicious insiders and negligent ones, with negligent insiders making up 61 per cent of insider threat incidents.

In the latest data breach report from the Office of the Australian Information Commissioner, health services remain the sector with the highest number of notifiable data breaches. For the purpose of our debate today, it is worth highlighting that it was easily the sector with the highest number of data breaches caused by human error. It is a cliché in cybersecurity but it is true: the people are the weakness. It is not that they are bad or lazy, but we know that people are more susceptible to cyber attacks, such as phishing emails, when they are tired and overworked, and we know that healthcare workers can be among the most overworked people in the state.

My concerns about the structure and security of the system are not really a good reason to oppose the legislation, however. It is clear that we do need to speed up the integration of digital records into the health system. The central question here is simply: who owns your private medical records? Do you have any right to view and control your own medical records? Are other people, agencies, services and businesses authorised to have control and streamlined access to your records while they are hidden from you?

We have had this debate before. The debate around the federal My Health Record scheme covered many of the same issues: the sensitivity of certain records relating to sexual health, substance dependence and mental health issues. But even worse, the legislation needed to be amended because it left an open door to other agencies, such as the ATO, Centrelink and police, to access these records without a court order. At the time, the head of the Royal Australian College of General Practitioners revealed that he opted out over concerns that these other agencies would have access to his records. Parliament had to come back and fix it, and while about 10 per cent of Australians had opted out, the design was much more ethical and patient centred than what is being proposed today. The system also allows you to view your own records, check them and choose what may be viewed.

Unless it is amended, this bill will give you no such luxury. There is currently no opt-out or opt-in mechanism and no independent oversight. This is a flagrant breach of every written principle of health care, right up to the report on patient-centred health care that you will find in the Australian Charter of Healthcare Rights launched in 2019. According to this charter, patient-centred health care is about treating a person receiving health care with dignity and respect and involving them in all decisions about their health. This government has a different view. The new law means information collected from you will be exempt from critical parts of the Health Records Act 2001 and these pesky health privacy principles. It is also arguably another breach of section 13 of Victoria’s Charter of Human Rights and Responsibilities, the right to privacy and reputation. As the website of the Victorian Equal Opportunity and Human Rights Commission states:

This right applies to surveillance such as closed-circuit television, collection of personal information by public authorities, results of medical tests or examinations and other confidential matters.

What a strange debate we are having over this legislation – as though the idea that patients should be centrally involved in decisions about their health is some radical and outlandish prospect. No doubt in the next couple of weeks we will hear about some new announcement of what the government is doing to implement the recommendations of the Royal Commission into Victoria’s Mental Health System. Maybe we should talk about recommendation 62, where it says:

a new user-friendly online consumer portal (web and mobile) connected to the Mental Health Information and Data Exchange that allows consumers to view key information about themselves and authorise –

or not authorise –

sharing of information with members of their care team, including families, carers and supporters …

It is hard to understand why we have these very sensible recommendations that the government has committed to implementing, and then we have the bill before us today. Do ministers in this government even talk to each other? Does this mean that we will have parallel systems for mental health data – one where service users have access and the ability to authorise sharing, and another one where their information is scooped up and shared without their consent? It is not a radical idea to centre patient rights and consent when it comes to electronic medical records and data sharing.

The Law Institute of Victoria has publicly expressed its concerns with the legislation, as has Liberty Victoria. The Victorian Alcohol and Drug Association have expressed concerns, noting that people with drug and alcohol issues were the very first people targeted in the Medibank leak. The Health Issues Centre, the Australian Privacy Foundation and Digital Rights Watch have all echoed similar concerns.

How do other jurisdictions handle this? The government would like us to believe that this is simply standard operating procedure and not some sinister violation of our medical privacy. The balance between privacy and convenience is one that any country with digital health infrastructure will have considered in recent history or may be in the process of considering at the moment.

Let us start with the European Union, returning back to the GDPR that I mentioned earlier. The GDPR explicitly provides for a right to access your own personal data and approve its transfer to another entity and have it transferred directly to you. You have the right to request rectification of your data and have a right to erasure and several rights ensuring consent around medical data.

In the UK a 2013 plan to centralise GP records in a database was abandoned in 2016 after confidentiality complaints, and more recently the department of health had to concede that they had taken the trust of the public for granted in relation to a medical data-sharing scheme that was badly rolled out in 2021. They have since committed to ensuring better engagement with the public, improving individuals’ access to their own health records and simplifying opt-out processes.

In Ontario in Canada health privacy is governed by the Personal Health Information Protection Act. This gives the right to refuse or give consent to the collection, use or disclosure of your personal health information, except in certain circumstances. It gives you the ability to withdraw your consent by providing notice, expressly instruct that your personal health information not be used or disclosed for healthcare purposes without your consent, access a copy of your personal health information except in limited circumstances, and request corrections to be made.

Even Thailand has been undergoing this same process of centralising health records and streamlining data sharing. Data privacy in Thailand is governed by the Personal Data Protection Act. Many elements of this legislation are similar to the EU GDPR, with individual privacy rights central to its function. Consent, particularly in relation to sensitive data, which includes health data, is central to its function, with guidelines for obtaining consent from data subjects published late last year. These require that consent be freely given and that it be informed, specific and able to be withdrawn – totally unlike this bill or the proposed amendments. So here in Victoria we are clearly laggards in both technology and also medical ethics.

Why not look at the country that ranks as a leader, or I should probably say the leader, in digital health on every measure that is ranked: Estonia – a country that is globally recognised for its innovation when it comes to creating a digital economy and integrating this with government services. They were early movers in digital health, regularly reviewing and updating legislation and processes. Ninety-nine per cent of health data created in Estonia since 2015 is fully digitised, 99 per cent of hospital discharge letters are sent electronically to the central database, 99 per cent of prescriptions are electronic and nearly every hospital and pharmacy is on the network. In stark contrast to the approach proposed in the legislation before us today, patient rights are absolutely central in this scheme. By logging into the patient portal you can view your health data, provide additional information and update records.

Nicholas McGowan: It’s a former communist state.

David LIMBRICK: That might be a good point there. If you wish, you can close the data, removing it from view, even if this would negatively impact your health care – because it is your choice. You can make various declarations authorising or refusing certain procedures, authorising persons to purchase medicine on your behalf, consenting to organ donation, otherwise consenting to or withdrawing your consent from medical care or stating what happens to your medical data.

I could go on at length describing the various approaches that different countries have taken to this issue and to navigate the tensions between data security, efficiency and patient autonomy, but I will simply conclude by stating that the staff in my office have spent many hours poring over different health department websites, journals and medical technology press from around the world and have struggled to find another example where an electronic health record system exists that does not allow for patient access and have either an opt-in or an opt-out provision. What is being proposed here is completely out of step with best practice, with human rights, with international best practice and with the Australian Charter of Healthcare Rights. We saw this throughout the pandemic. Under a state of emergency government ministers and health bureaucrats determined that they knew what was best for us and that any dissent was irresponsible – they know best and our preferences be damned.

Frankly, I am sick to death of our basic rights being trampled with some hand-waving justification. Our rights are not just an inconvenience for the government and bureaucrats to dispose of as soon as it becomes difficult. It is not good enough. The idea that this is the only legislation that could achieve the intended outcome and that there is no alternative, less restrictive approach that could be adopted is a farce. It makes an absolute mockery of our human rights charter, which creates a legal obligation for Parliament and the public service to act in accordance with the charter, including considering less restrictive approaches.

An e-petition calling on this chamber to consider amending this legislation took only a few days to collect over 10,000 signatures. People in this state are clearly concerned about their medical privacy. While I cannot speak to the reasons that each of these people signed for, the simple fact is that it does not matter. It does not matter if their reasons are based on misunderstandings or if they are so profound they would make you cry – it does not matter. All we need to know is that they want to have control of their own sensitive medical information. This should be enough.

I would like to signal to the house that I have two amendments that I would like to circulate now that address some of these issues.

Amendments circulated pursuant to standing orders.

David LIMBRICK: The first of these amendments addresses the issue around consent. It ensures that patients are not brought into this system without their consent, in line with the charter of healthcare rights. It also ensures that people can select certain pieces of information if they want certain healthcare providers to be included or not included. It also caters to provisions around consent for children, where consent is a much more complicated issue. The second amendment deals with the ability to access audit logs and these sorts of things. I note that the house amendments, which were only circulated a while ago, from the government also address this issue, so at least one thing that I am concerned about might be addressed. But I think it is absolutely essential that people know who has accessed this system, who has accessed their records and what information is actually being held in the system.

Also, I would like to signal that these amendments that were circulated only a few minutes ago have not been viewed by any of these organisations that have expressed concern. They have not been looked at by the Scrutiny of Acts and Regulations Committee.

There are very serious human rights implications with this bill and the proposed amendments. I will be moving after the second-reading debate that this bill goes back to SARC for reassessment, including the amendments, so that we can get a better understanding of the human rights implications of what is being proposed here. With that I will conclude.

Sheena WATT (Northern Metropolitan) (11:00): I rise to speak on the Health Legislation Amendment (Information Sharing) Bill 2023 and in doing so want to put on the record how proud I am to be a member of the Andrews Labor government, which is committed to improving our health system and committed to improving patient safety and continuity of care for all Victorians.

What this bill will achieve is establishing an electronic health information sharing platform, and it builds on the Andrews Labor government’s proud record of investing in our health system. As the last few years have highlighted, there is nothing more important than having a strong, robust and well-funded health system, and I am so proud that the Andrews Labor government will fund the biggest hospital infrastructure program in Australia’s history, right up the road in Parkville, by building new Royal Melbourne and Royal Women’s hospital campuses. Once completed, the project will dramatically increase the capacity in the emergency, critical care and birthing departments as well as provide more elective surgery for Victorians.

Victoria’s public hospitals were divided into autonomous networks in the early 1990s but are now operating as part of a single system – especially during COVID. But their digital records are not shared. Most Victorian patients will often be treated at different health services over their lifetime, and patients cannot know what information from their medical past will be critical to their medical future. Currently in Victoria critical health information is spread across different health services, depending on where a patient has visited or been transferred. These patient records are also in separate systems and paper files, making them difficult to find in times of need. The fragmentation of patient health information means that clinicians are often needlessly delayed by manually gathering patient information through fax or phone calls. This can be of particular risk and distress for patients presenting in emergency departments.

The government will continue its focus on women’s health by creating two new women’s health clinics at public hospitals and more sexual and reproductive health hubs across our state. The Andrews Labor government will also work with Aboriginal health organisations to deliver the first ever dedicated Aboriginal-led women’s health clinic. This also means ensuring our health services and clinicians have the appropriate tools and information at their disposal. The proposed new secure health information sharing platform will do exactly that by establishing a single point of complete and accurate patient information for clinicians to provide safe and timely care.

Medications that may interact, drug allergies, alerts such as severe asthma, past biopsy results, diagnoses that took months to make – especially psychiatric diagnoses – results of tests and expensive scans all sit in these digital records. With this bill we can make this readily available, reducing risks of delays and risks of misdiagnosis, or alternatively we can continue to let our most valued health workers and clinicians wait by the phone. The current model of doing things is clearly inconsistent with modern health information sharing standards and the approach taken by other Australian jurisdictions such as New South Wales, Queensland, ACT and South Australia, which have all successfully implemented health information sharing at the point of care.

This bill is not about whether public health services should share information, it is about establishing a secure and more efficient platform for clinicians to access the relevant clinical information to treat patients safely.

There are currently no opt-out arrangements under existing legislation, and Victorian public health services share information for the purpose of treatment. The opt-out model that has been suggested by Mr Limbrick and others is a step backwards, in my opinion. It undermines the primary objective of the bill, which is to ensure clinicians can have access to relevant medical information to provide timely care. An opt-out model also undermines the efficiency of our health system. An opt-out patient may be required to redo tests to safely effect diagnosis and treatment. This is distressing for the patient and creates unnecessary costs and delays for health services, who are already under significant strain.

These inefficient, duplicative, unsafe and manual processes increase wait times and delay care for other patients, such as when they present critically in our emergency departments. Our public hospital emergency departments are experiencing record demand, with the equivalent of one in 10 Victorians seeking treatment in the last quarter alone, and there is strong support from clinicians and health services for these reforms, which will result in improvement in practice and patient outcomes.

Those who oppose the bill are content to point out the challenges we are facing without being part of a solution. Of course there are concerns when it comes to FOI rights, and this bill does not change a patient’s rights to access their full medical records from their health service provider under FOI and relevant privacy legislation. To ensure efficiency and timely care, the information that will be included on the proposed platform is only the most relevant clinical data for the purposes of treatment, not the full medical history of the person. This includes allergies to medication, hospital treatment summations and diagnostic reports. This bill does not enable FOI requests on the health sharing system. This is because it would require the Department of Health to access clinical information to respond to questions, which would be inappropriate and counteractive to the strict protections on access controls the bill seeks to establish.

The government in this bill is committed to ensuring patients’ data is stored securely and stringent protections are in place. The bill will introduce strict controls, and these include frequent auditing to ensure authorised people are accessing our health information. The bill specifies that only healthcare providers who are directly involved in a person’s care or treatment can access medical information and only for the purposes of providing care. Three new criminal offences are being introduced prohibiting unauthorised access and unauthorised disclosure of information. The penalties in the bill include 240 penalty units – which is, for those wanting to know, $44,380.80 – or two years imprisonment for any unauthorised access, use or disclosure of information held in the system.

An independent oversight committee supported by the clinical advisory group will be established to provide advice to the Secretary of the Department of Health on the implementation and successful operation of the information system before it commences in February 2024. This includes establishing appropriate risk control and compliance frameworks. A primary management framework will be implemented prior to commencement to limit access to and management of highly sensitive health information. Restrictions to sensitive information will ensure additional protections for vulnerable groups, like victims of domestic violence, and only designated health service staff who need to see the information for clinical decision-making purposes will have access to it.

The bill’s changes will apply to the following specified entities, and this is important to note: public hospitals, multipurpose services, denominational hospitals, metropolitan hospitals, prescribed health services, registered community health organisations or centres, the ambulance service across our state, the Victorian Institute of Forensic Mental Health and the Victorian Collaborative Centre for Mental Health and Wellbeing.

Of course, as I mentioned earlier, there have been some reflections on other states and their practices. I will begin with the reflection on the state of New South Wales, which has implemented HealtheNet. It is there to establish a secure statewide clinical portal which shares summary-level patient and clinical information across New South Wales health services. It provides clinicians with immediate access to an aggregated view of patient and clinical information from New South Wales health clinical systems and the federal government’s My Health Record. Further north in the state of Queensland the government there has implemented the Viewer, which collates data from multiple Queensland health systems, enabling healthcare professionals to access patient information quickly without having to log into different systems. Further south and close to home is of course the Australian Capital Territory, which has Digital Health Record implemented, which stores health information for patients who use any of the ACT’s public health services and is available to clinicians in those public health services.

The Health Legislation Amendment (Information Sharing) Bill 2023 has been introduced, and there are no issues with the original legislation as was introduced in 2021. Can I just note that this bill will continue to build on our proud record of delivering on health. I will just take a moment to reflect that when it does come to the work of our health providers and our health services there is of course much that I can personally reflect on, and I have not yet had a chance to do that. I will say I have been involved in health organisations now in a governance and operational sense in executive and operational roles for a number of years and of course also, with part of that, policy and advocacy roles that have led to the implementation and rollout of systems such as My Health Record and other health management data systems, including in highly sensitive settings such as health services providers, family violence shelters and refuges, dental services and others.

I can say that it is of course entirely a very, very complex system and requires sensitivities when dealing with particular groups. My experience there is particular to Aboriginal and Torres Strait Islander people, victim-survivors of family violence and those that have had contact with the justice system. In that there are many, many stakeholders with many, many views, and I do appreciate, having taken the time through the implementation of My Health Record some time ago, hearing from those groups regarding the concerns that they had. Whilst certainly it was far from perfect – the implementation of My Health Record – I will say that the valuing of Aboriginal people’s perspectives and those of victim-survivors of family violence in the use and application of My Health Record, including access from family members, was something that has rested with me quite considerably over the years. One other reflection on my time in a health organisation is managing disclosures of health and sensitive records, which of course is something that I think needs due respect and consideration in the systems and structures of our health system here in our state.

There are of course enormous challenges when it comes to data management, data integrity and data access as appropriate in our state. They have come up time and time again through health services. The example that comes to my mind is rolling out of upgrades. It is true that a great number of our health services across the state – and I am thinking of those that I listed earlier, not the large, major hospitals but some of those that are smaller in size but no smaller in impact – have challenges when it comes to upgrading their systems, so this will have some statewide application, particularly for those services that do not fit neatly within a geographic area but may in fact be a service provider, given the specialised nature of what they do, over a great geographic area that could cover a range of different patients and applicable partnering health organisations. One that might come to mind would be a specialist rehab clinic or something like that.

It is tough stuff. The governance of health data, the access of health data has come up time and time again. So I am just reflecting that that is challenging, and I really appreciate the efforts that have been made to really enhance cybersecurity and safety when it comes to our health system and our health records and thank those professionals and data scientists and others that have been putting in an enormous bit of work over the last number of years as we move into a very new way of doing in our health system.

I know that there are of course a number of amendments on the table, and I look forward to hearing from members with their various contributions to amendments to this bill when we do get to that in the committee stage. I thank you for the opportunity and those members in the chamber here for hearing me out as I reflected today on the Health Legislation Amendment (Information Sharing) Bill 2023.

Adem SOMYUREK (Northern Metropolitan) (11:13): I have a strong belief that where a government is potentially breaching individual civil liberties in any form in rolling out systems for the common good, unless there are extenuating and compelling circumstances individuals must be given the opportunity to opt out. Even though I acknowledge that the legislation is clearly in the common good, I do not believe such extenuating and compelling circumstances are in existence in this case.

Having opt-out certainly does not put the viability of the potential system at risk. Data from the Commonwealth data sharing scheme, where opt-out provisions apply, certainly demonstrates that the overwhelming majority of Australians do not opt out of the system, and in Victoria I understand that the number of Victorians that choose to opt out of the Commonwealth system is only about 10 per cent. Had that figure been much higher, I do understand a cogent argument may have been able to be mounted to support compulsion, but the fact is there are a very minimal number of Australians and Victorians opting out of that system, meaning that the viability of the proposal is not at risk. Therefore in this situation the advantages of compulsion do not outweigh the cost of breaches of privacy of Victorians, who may be anxious about their records being shared.

This debate reminds me a bit of the NBN rollout when the then Rudd government introduced the NBN when he took office in 2007. At that point the NBN was a $44 billion project, as I recall. I entered the debate in 2010 when I became the Shadow Minister for Technology in the Andrews opposition. The viability of that project entirely rested on the number of people that took up the NBN. There was a great pressure on the government at the time to make NBN compulsory, but they did not; they chose opt-out legislation instead. As I said, it was critical at that point for Australians to jump on board the system. Therefore there was a great pressure for compulsion, but they chose to respect Australians’ civil liberties. On the other hand, Turnbull, who is a great civil libertarian but in this instance was clearly acting out of political expediency, was arguing for an opt-in model. The reason why he was doing that was to smash the fibre to the node model of the NBN. I must note that the government at the time was respecting people’s civil liberties even though the minister who had carriage of the NBN project Mr Stephen Conroy would not understand the notion of what civil liberties are. He certainly does not respect anyone’s civil liberties. I make the point that we have come a long way since those times. The erosion of civil liberties in this country should be a source of concern for every Victorian and every Australian.

Another problematic feature of the bill is that the scheme is exempt from freedom of information. From my perspective I think it is only logical that if your files are being accessed, if your privacy is being impeached, you ought to know who has accessed those files. For the record, the Law Institute of Victoria also has trouble with these two features of the bill.

Lizzie BLANDTHORN (Western Metropolitan – Minister for Disability, Ageing and Carers, Minister for Child Protection and Family Services) (11:18): I thank all members for their contributions on this important bill. Obviously there are deeply held views across the chamber on the bill, and we look forward to taking it into committee. I apologise in advance for the state of my voice and my cough. Perhaps I am a good advertisement for the bill itself. I thank everyone for their contributions. It will support clinicians working in Victoria’s public healthcare system to connect care securely and in a timely manner whilst continuing to recognise patients’ rights to confidentiality and privacy. In passing this bill the Andrews Labor government hopes to deliver on a key commitment to strengthen our hospital networks by ensuring secure sharing of certain health information between clinical teams at the point of care. A patient’s care journey can take them to different health services in different locations over the course of illness. Secure access to complete and accurate health information at the right time and at the right place will save lives and improve care, and it is essential to providing the best care and treatment for patients.

The opposition has discussed and moved amendments to put an opt-out option into the bill. This would be a backward step for a more connected and patient-centred care system in Victoria. Health services can already share patient information for the purposes of medical treatment, but this bill will enable the operation of a secure and modern platform to do so more safely and more efficiently than relying on phone calls and faxes.

This bill will bring Victoria into line with other jurisdictions in Australia. Queensland, New South Wales, the ACT and South Australia all operate secure electronic health information sharing across their public health systems without an opt-out.

The opposition has also suggested that patients will not be able to access their information under FOI legislation. This bill does nothing to affect patients’ existing rights under Victorian privacy legislation to access and correct any personal or health information held by them directly with their health service provider. The FOI exemption in this bill is important to ensure that management of patient requests remains where it should be – with your treating health service. If the system was subject to the Freedom of Information Act 1982, the Department of Health as the host of the system would be responsible for accessing, assessing and responding to requests from patients, which would not be appropriate. Patients will be able to access their medical information from their health service provider, as they do now, and they will also be able to get a record of which providers have accessed their information from the system, including where and how patients’ information has been accessed.

Additionally, Minister Thomas has committed to requesting that public health services are reminded of their obligations to facilitate and optimise patient access to their health information outside this process. The government has also committed to working with all public health services to ensure that by the time the electronic patient health information sharing system is operational there are mechanisms in place so that a patient’s individual health information will be available to them without cost in an accessible and, where possible, machine-readable format without having to use freedom of information.

Some members in the house have raised concerns about the concentration of so much sensitive information in one place. The information in the new secure system will be protected by robust safeguards in the same way other health data is secured by the Victorian government. Access to sensitive information will be governed by the privacy management framework, which will provide additional protections for vulnerable groups, such as those subject to or at risk of family violence.

The framework and operation of the system will be overseen by an independent oversight council to ensure and report on its safe, confidential and secure operation. A clinical governance body with consumer participation will advise the Secretary of the Department of Health on ongoing enhancement of the system’s clinical utility. The system will also be subject to robust audit arrangements to ensure patient information is safe and that privacy is maintained. An independent review of its operation will be tabled on completion of three years of operation. I am pleased to commend the bill.

Motion agreed to.

Read second time.

Referral to committee

David LIMBRICK (South-Eastern Metropolitan) (11:22): I move:

That pursuant to standing order 14.12(b) the Health Legislation Amendment (Information Sharing) Bill 2023 and all amendments that have been circulated for the bill be referred to the Scrutiny of Acts and Regulations Committee for inquiry, consideration and report by Tuesday 21 March 2023.

As I stated in the second-reading debate, I am very concerned that these amendments that we are talking about today have not been examined by the Scrutiny of Acts and Regulations Committee. There has not been an opportunity for many of the stakeholders, such as the Law Institute of Victoria, Liberty Victoria, the Victorian Alcohol and Drug Association and all these other groups, to see them, and they have not been able to consider them and form submissions. I think that SARC would be the appropriate place to examine the human rights implications of what is going on here.

Aside from the amendments, I have concerns about the human rights issues that were detailed in the recent SARC Alert Digest. One of the requirements under the charter of human rights is that any limitation on rights must be the least restrictive. The SARC Alert Digest clearly identified another system which has less restrictive means on freedom of information, which is the firearms registry, which does allow freedom-of-information requests to request your own information, unlike the proposed system here. I think that this is to be examined in more detail. There are most likely many, many other issues that need to be examined in further detail, so I urge the house to support allowing SARC to examine the human rights issues around this.

Georgie CROZIER (Southern Metropolitan) (11:24): I rise to speak in support of Mr Limbrick’s motion to refer the bill off to the Scrutiny of Acts and Regulations Committee to have further scrutiny of this important legislation. Mr Limbrick has just highlighted an example of what came out in that initial meeting with SARC, and I note that in a vote on that the committee sought further information from the Minister for Health about what less restrictive means of implementation were considered, noting the above comparison to the firearms registry. On that, it was clear the government did not support that.

We need to understand the implications of this legislation and how it could impact on the rights of the individual. This is not absolutely time sensitive in terms of what we are doing here today, but we need to get this right. This Parliament has a role to play in supporting legislation to get it right. The government is introducing amendments at the last minute because they know they have not got this legislation right. So we have a job to do, and I would urge all members of the Parliament to allow SARC to do their job and have a look at this very important element so that we can get this legislation right.

Nicholas McGOWAN (North-Eastern Metropolitan) (11:25): I rise to also support the referral to the Scrutiny of Acts and Regulations Committee. These additional amendments that we have been handed today come at very late notice, with less than an hour or so to consider them, and we need no further evidence than point 2 of the government’s suggested amendments, where it says:

2. Clause 4, page 14, line 17, omit “1982.’.” and insert “1982.”.

This is rushed. It has got mistakes littered throughout it. We and the Parliament and the chamber and the people of this place have every right to look at this in a detailed fashion rather than rushing it through. There is no time imperative here, and the suggestion in the motion put is a sensible and commonsense one.

Lizzie BLANDTHORN (Western Metropolitan – Minister for Disability, Ageing and Carers, Minister for Child Protection and Family Services) (11:26): I rise to speak against the motion, and I note I also do so as a former chair of the Scrutiny of Acts and Regulations Committee. I used to find it interesting as chair of SARC and certainly in the time post that how many members of this place do not actually really appreciate the full role of SARC itself, what its role actually is to do. Its role is to consider the intent and the purpose of the bill, to scrutinise the bill for compliance with the Charter of Human Rights and Responsibilities and to ensure that all legislation is not infringing on human rights in the appropriate recognition and hierarchy of those rights.

What is very clear – and I might say I also find it a little ironic that a bill that is about saving lives is also in many respects being compared here to the firearms legislation – is that this bill has been considered in detail by SARC, and the amendments that have been proposed are not contrary to the original intent of the bill and do not in any way further restrict any human rights in their application beyond what has already been considered by SARC. This bill is about saving lives and it is about ensuring that patients get the best possible care by establishing secure digital health information sharing across our public health system. There really can be no more important right in my view that this place is here to ensure and be protected by the Parliament, which is people’s right to live a happy and healthy life.

The information in the system will be protected by robust safeguards. There is going to be a privacy management framework. That was indeed the original intent of the bill and through these amendments has been put into further detail. It will be implemented to ensure that there is restricted access to sensitive information and to provide additional protections for vulnerable groups – for example, in circumstances such as family violence and mental and sexual health conditions. The establishment of the system will be oversighted by a health information sharing management committee. The committee will have a wide range of expertise, including medical experts and patient advocates. It will oversee the development of the privacy management framework to make sure that robust policies and safeguards are in place to protect health information and safeguard patient privacy and confidentiality. In order to reinforce the government’s commitment to transparency and accountability and oversight of the new health information sharing system, the amendments themselves as they have been circulated go to continually ensuring that effectively the right to protection of one’s health is met by also ensuring the right to the protection of information. The amendments themselves are not in any way contradictory to what was originally considered by SARC, and a referral back to SARC is just prolonging what is an important reform that is about protecting the health and safety of Victorians.

Council divided on motion:

Ayes (17): Matthew Bach, Melina Bath, Jeff Bourman, Gaelle Broad, Georgie Crozier, Moira Deeming, Renee Heath, Ann-Marie Hermans, David Limbrick, Wendy Lovell, Trung Luu, Bev McArthur, Joe McCracken, Nicholas McGowan, Evan Mulholland, Adem Somyurek, Rikkie-Lee Tyrrell

Noes (21): Ryan Batchelor, John Berger, Lizzie Blandthorn, Katherine Copsey, Enver Erdogan, Jacinta Ermacora, David Ettershank, Michael Galea, Shaun Leane, Sarah Mansfield, Tom McIntosh, Rachel Payne, Aiv Puglielli, Georgie Purcell, Samantha Ratnam, Harriet Shing, Ingrid Stitt, Jaclyn Symes, Lee Tarlamis, Sonja Terpstra, Sheena Watt

Motion negatived.

Committed.

Committee

Clause 1 (11:38)

Georgie CROZIER: Minister, as you are aware, the government tried to introduce very similar legislation in 2021, and by the time we finished the second-reading debate there were exactly the same concerns as are going on with this debate. One of those concerns that I had in relation to what was proposed by the government was around the implementation of this scheme – the electronic patient health information sharing system, which I will probably refer to from now on as the information-sharing system. But I am wondering if you could tell the committee what funding requisites will be required by the government for the implementation. Will the government be fully responsible for all of the implementation, or will it be up to individual health services to fund and install it?

Lizzie BLANDTHORN: The funding decisions are obviously decisions that will be considered at a further point in time in the appropriate way. To take to your original point, this is an important bill, and that is why we are very pleased to be returning to this conversation and this bill at this point in time following the re-election of the Andrews government.

Georgie CROZIER: I take it from that there is absolutely no money being put aside for this implementation of this system?

Lizzie BLANDTHORN: That is not what I said. What I said is that we are here today to discuss the legislative changes themselves and to go into the legislation, not to make announcements in relation to budgets.

Georgie Crozier: On a point of order, Deputy President, I know the minister is new to this place, but this is clause 1, and I have every right to ask about these questions in relation to this system. The minister cannot brush it off and just go off on her frolic to say we are here to look at the legislative requirements. This has a huge budgetary cost, and I think the Victorian public deserve to understand what requirements have been put in place by government on the cost of the system.

The DEPUTY PRESIDENT: Ms Crozier, as you know, I cannot instruct the minister how to answer the question. But this is an important process in the passing of this bill, and I think that everybody should take it as seriously as it should be taken.

Lizzie BLANDTHORN: As I have said – and I think the questions are already getting a little repetitive – we are here today to talk about the aspects of the legislation itself, not to announce funding decisions. There has obviously been a business case developed for this project, and funding decisions will continue to be made and announced in the usual fashion of government.

Georgie CROZIER: So in the business case that you have just referred to, Minister, there must be some financial aspect. That is the normal process for a business case. So what has been provided to government in relation to the business case and the funding required?

The DEPUTY PRESIDENT: Before I call the minister, I remind all members to wait until you have the call. This is going to be, I would expect, a long and quite contested committee stage, so just wait for the call before we start, okay?

Lizzie BLANDTHORN: As I said, a business case has been developed, and it will continue to go through the processes of the government, as is appropriate, and decisions in relation to funding will continue to be made. I look forward to further conversations in relation to the actual bill itself.

Georgie CROZIER: So I take it from that we have got a half-baked business case that has been put to government or is in the process of being developed. There is not a full business case that has been put to government. There is one; it is still a work in progress. Is that correct, Minister?

Lizzie BLANDTHORN: They are your words, not mine.

Georgie CROZIER: You just said it was still being developed.

Lizzie BLANDTHORN: Ms Crozier, what I –

The DEPUTY PRESIDENT: Ms Crozier, just let the minister answer your question.

Lizzie BLANDTHORN: Without interruption I would appreciate it, given clearly my voice is in a difficult state. It is very difficult to have an adverse conversation. I am trying to be as helpful as I possibly can. There has been a business case developed, that is known, and decisions in relation to the funding of that will continue to go through the usual appropriate processes of government decision-making in relation to funding. What we are here to talk about are the clauses of the bill, and I am happy to answer questions in relation to the clauses of the bill.

Georgie CROZIER: Deputy President, I know that you have already made a ruling in relation to how you cannot direct the minister on how she should answer questions, and I understand the minister is new to this house – she has been in the Assembly, where often members and ministers do not understand what we do up here – but I have every right, from clause 1, to ask questions relating to what this means on behalf of Victorians. I will continue to ask – and I am sorry that you have got a failing voice, Minister, but you might need to get another minister to help you if that is the case – because these questions are important. If you are saying that there is a business case in place and that funding and budgetary aspects are still to be considered, I would then ask: in that business case, what are the time lines that have been proposed for the information-sharing system to be fully implemented?

Lizzie BLANDTHORN: I do not appreciate the assertion that because I come from the Assembly I do not understand what happens in this place or indeed in committee of the whole. I have probably, even as a backbencher, had far more experience with committee of the whole already than perhaps many of the members sitting in this place, so the assertion is a little unnecessary. In relation to the reference to my voice, I was simply saying I would rather not have an argumentative conversation and I am trying to be as helpful as possible. But if we keep asking the same question, then we are going to get the same answer, which is that a business case is being developed and the funding decisions will be made through government in the usual fashion.

Georgie CROZIER: The minister just confirmed that the business case is being developed. Can I have that assurance?

Lizzie BLANDTHORN: A business case has been developed.

Georgie CROZIER: I am sorry to have to go back and forward, but you just said in the previous answer that it was being developed.

Lizzie BLANDTHORN: My apologies. That may have been my expression. There is a business case, and it will be considered in the appropriate fashion.

Georgie Crozier interjected.

The DEPUTY PRESIDENT: Sorry, can we just wait until people have the call. It is not a conversation; it is a committee stage.

Georgie CROZIER: I apologise, Deputy President. Minister, I appreciate where you are coming from, but what I am trying to ascertain is: is the business case fully complete or is the business case still being developed, because on a couple of occasions you have asserted both and I am trying to establish where that business case is at.

Lizzie BLANDTHORN: My understanding is the business case has been developed and is being considered for funding, but I will consult with the box.

The business case has been developed and is being considered.

Sarah MANSFIELD: I have a question on a related subject. Will the government ensure that health services are supported with respect to compliance with this legislation, including additional IT and administrative costs?

Lizzie BLANDTHORN: Yes, we will be supporting health services to comply.

The DEPUTY PRESIDENT: Minister, if you just speak into the microphone rather than to the person, then everyone will get it.

Lizzie BLANDTHORN: Sorry. The answer to the question is yes. We will be as a government supporting health services to comply.

Georgie CROZIER: Following on from Dr Mansfield’s question, how long will health services have to comply?

Lizzie BLANDTHORN: The plan is that there will be 12 months from the passing of the bill, with an end date in 2024. There will be opportunity for extension as is necessary.

Georgie CROZIER: Just on those time frames, I am trying to work out: there is a business case that is still being developed and we are still telling health services that they will get assistance in the transition of this system, but you are saying that they need to comply by the end of 2024. That is less than two years away, so are you saying that the system will be in place, fully operational, by the end of 2024?

Lizzie BLANDTHORN: Ms Crozier, I did confirm for you that the business case has been developed, and I apologise if my expression of that earlier caused confusion. As I said, the plan is 12 months from now for the program to be put in place and that by 2024 it will be complete.

Georgie CROZIER: Thank you, Minister, for that clarification. Minister, we know that Labor governments have got a poor record on IT systems, and I refer to the HealthSMART debacle back in 2013. The then Auditor-General had a report, Clinical ICT Systems in the Victorian Public Health Sector, and it found that the Department of Health:

… significantly underestimated project scope, costs and time lines, as well as the required clinical and other workflow redesign and change management efforts.

So based on previous history of Labor governments in rolling out health IT systems, and with your assurance to the house now that this will be rolled out and complete by 2024, which is less than two years away, can you guarantee that this system will be delivered within that time frame? We do not know what the budget is; I suppose we have to wait for the budget in May. But based on that history, can you guarantee that what you are telling the committee will be delivered to the health services?

Lizzie BLANDTHORN: Obviously, significant consultation on this bill has taken place, and there has been continued engagement in order to ready the sector for these changes. The legislation is timed to ensure that the framework can protect the privacy and any legislative implications that are known well in advance, and the lead time of the bill will also enable the Department of Health to ensure that consumers, patients and the health services are also well aware of the new information-sharing provisions ahead of time. So it is well and truly anticipated that this will be ready in February 2024.

Georgie CROZIER: Ready in February 2024 – actually I thought it was the end of 2024, so –

Lizzie BLANDTHORN: I said in 2024.

Georgie CROZIER: I beg your pardon. Minister, that is my mistake, because I thought you meant the end of 2024. So you are saying within 12 months this will be rolled out?

Lizzie BLANDTHORN: I did say within 12 months from now – February 2024.

Georgie CROZIER: Minister, the Auditor-General’s report that I referred to in my previous question went on to say that the HealthSMART system ‘is not well suited to the specialist needs of some hospitals’. You just said that significant consultation had taken place. Has that consultation taken into consideration the findings of the previous Auditor-General’s report, understanding that specific hospitals need systems that meet the needs of the health services that they deliver?

Lizzie BLANDTHORN: The recommendations of auditors-general are always taken very seriously and taken into consideration when government is considering further objectives, and I am sure they have been in this case.

Georgie CROZIER: That is an opinion. I just need to know whether that actual consultation with those particular hospitals actually has taken place. I do not want your opinion, I want to understand whether the government has actually done the work.

Lizzie BLANDTHORN: I will consult with the box as to whether there is anything further to add on consultation.

I am advised that the health services continue to be deeply engaged in all of the planning around this.

Georgie CROZIER: Thank you for that response, Minister. Minister, in addition, the Auditor-General found that health services had implemented other clinical IT systems rather than the HealthSMART system that the government put forward. In fact it was Premier Andrews who was the health minister at the time; it is his watch that this debacle happened under – just one of many. It was a huge cost, and those health services went it alone and put in their own IT health systems. So based on what has happened today with an attack on Eastern Health, can you provide to the committee whether that was a cyber attack or whether that was some other IT malfunction that occurred?

Lizzie BLANDTHORN: My advice is that Eastern Health experienced computer and phone system issues which were caused by a critical core switch outage.

Georgie CROZIER: Thank you very much for that response, Minister. In relation to the issue around health services that have gone it alone with their IT system, how much money has been spent by those health services putting in their own IT systems? You might need to take this on notice. I think it is an important question to ask, because obviously these are health services that utilise taxpayer money. The question is: how much has already been spent by public health on implementing their own electronic management records?

Lizzie BLANDTHORN: I will just consult on that matter. We are happy to take that on notice and provide some further detailed information, but we have been consulting and working with services and the values are comparable with other states.

Georgie CROZIER: I would appreciate if we could have that information prior to the end of the committee stage, Minister, because I know when I speak to large health services – for one health service, for instance, it is in the vicinity of $100 million. That was some years ago. These are very expensive platforms that have already been expended by the public health system in many instances, so I think it is important for the committee to understand just how much has already been spent on those systems.

My next question goes to the fact that we have a national My Health Record, and it looks at the interoperability between what the government is proposing and that record. What work has been done on that aspect?

Lizzie BLANDTHORN: My Health Record obviously contains important information. However, it is not designed to do what we are proposing to do here, which would be a comprehensive record of information relevant to patients’ day-to-day clinical care. Importantly, it will ensure that the records can work with each other, if you like, to ensure that information can be shared.

Georgie CROZIER: Right. Again, I go to the point about us having cross-border communities. We have hospitals such as the Albury Wodonga Health service, which sits on the New South Wales–Victoria border. We have a New South Wales facility run by Victorian health, and New South Wales have their own system. So what aspects of compatibility – I did ask this in the briefing, I think – will be required for that health service to be able to operate, understanding that it caters for both patients in New South Wales and patients in Victoria?

Lizzie BLANDTHORN: My understanding and my advice is that the systems have been designed to complement each other. I will consult with the box in relation to any other specifics around compatibility.

I am advised that there is funded work underway in order to ensure that in particular in relation to the Albury-Wodonga hospital, which you referred to, the systems are compatible. That work is underway and progressing well.

Business interrupted pursuant to standing orders.