Australia patient portal

My Health Record

My Health Record is an online electronic summary of a person’s health information. The Australian Government invested $1.15 billion in the development of the system and other digital health infrastructure between 2012 and 2016. In the 2017–18 Budget, the government allocated a further $374.2 million to continue operating the system and expand its use by making it an opt-out model. Nine out of every ten Australians now has a My Health Record.

The Department of Health established the My Health Record system in 2012 and administers the My Health Records Act 2012on behalf of the Minister for Health. In July 2016, the Australian Digital Health Agency (ADHA) was prescribed as the System Operator for My Health Record.

My Health Record potentially impacts all Australians as it collates electronic summaries of individuals’ health information so it can be accessed by different healthcare professionals involved in a person’s care (as well as by the individual themselves).

The system is intended to generate personal benefits for individuals and economic benefits for the health system but achieving this requires a balance between increasing access to information and managing privacy and cyber security risks. The system has also generated parliamentary and public interest in relation to privacy and cyber security risks.

The audit objective was to assess the effectiveness of the implementation of the My Health Record system under the opt-out model. The audit adopted the following criteria:

• implementation of the My Health Record system promotes achievement of its purposes
• My Health Record system risks are appropriately assessed, managed and monitored
• monitoring and evaluation arrangements for the My Health Record system are effective

The audit did not examine the decisions to create the My Health Record system or adopt the opt-out model or consider the framework for secondary use of My Health Record data. No individual My Health Records were examined.

Implementation of the My Health Record system was largely effective.

Implementation planning for and delivery of My Health Record under the opt-out model was effective in promoting achievement of its purposes. Implementation planning and execution was appropriate and was supported by appropriate governance arrangements. Communication activities were appropriate to inform healthcare recipients and providers.

Risk management for the My Health Record expansion program was partially appropriate. Risks relating to privacy and the IT system core infrastructure were largely well managed and were informed by several privacy risk assessments and the implementation of key cyber security measures. 

Management of shared cyber security risks was not appropriate and should be improved with respect to those risks that are shared with third party software vendors and healthcare provider organisations.

The monitoring and evaluation arrangements for My Health Record are largely appropriate.  There are appropriate mechanisms to improve the quality of information entered into the system. Some benefits measurement activities are underway, but they are not yet organised in a research delivery and evaluation plan setting out milestones, timeframes and sequencing of activities over forward years.

What is included in your My Health Record?

My Health Record brings together health information from you, your healthcare providers and Medicare.

Healthcare providers can add clinical documents about your health to your record. This includes:

• an overview of your health uploaded by your doctor, called a Shared Health Summary. This is a useful reference for new doctors or other healthcare providers that you visit
• hospital discharge summaries
• reports from test and scans, like blood tests
• medications that your doctor has prescribed to you
• referral letters from your doctor(s)

Medicare data can be added to your record. This includes:

• Medicare and Pharmaceutical Benefits Scheme (PBS) information stored by the Department of Human Services
• Medicare and Repatriation Schedule of Pharmaceutical Benefits (RPBS) information stored by the Department of Veterans’ Affairs
• organ donation decisions
• immunisations that are included in the Australian Immunisation Register

You, or someone authorised to represent you, can share additional information in your record that may be important for your healthcare providers to know about you. This includes:

• contact numbers and emergency contact details
• current medications
• allergy information and any previous adverse reactions
• Indigenous status
• Veterans’ or Australian Defence Force status
• your Advance Care Plan or contact details of your custodian

Child’s records

The My Health Record has specific rules regarding record ownership and access for parents and legal guardians.

• Parents or legal guardians will control their children’s record from 0 to 14 years (referred to in the My Health Record system as an Authorised Representative).
• After a child turns 14, they will be able to choose whether they wish to manage their own My Health Record. If a child chooses not to take control of their My Health Record between 14 and 17, their Authorised Representative (which may or may not be a parent) can continue to manage the child’s record until they turn 18. Authorised Representatives will not be able to view the medical benefits scheme (MBS), pharmaceutical benefits scheme (PBS) or immunisation register details of children aged over 14.
• Once an individual turns 18, any representatives (Authorised Representative or Nominated Representative) are automatically removed from the individuals My Health Record. If an individual still wants their parent or guardian to view information in their My Health Record after they turn 18, they will need to set them up as a Nominated Representative.