Positive Life NSW Blog

What now with My Health Record (MHR)?

Posted by on in Communications

IMAGE: A hand reaches out towards a touch screen. One icon on the touch screen lights up.

What's been happening with the My Health Record (MHR): An update!

By now, all Australians who are eligible for Medicare, including people living with HIV (PLHIV) have a My Health Record (MHR). This online record has been automatically created by the Australian Digital Health Agency (ADHA), unless you opted out before the 31 January 2019. Your personal medical information can now be shared between you and your healthcare providers like doctors, specialists and hospital staff. 

Controversy, Criticism and Changes

Setting up the system has been a controversial one. Concerns about the system saw the opt-out deadline changed three times, multiple website crashes, and jammed phone lines. Regular news reports of Australian and global breaches of health data, highlighted concerns remained around misuse, security, access, privacy and system design. The government responded to PLHIV and community concerns and submissions with constructive changes to the legislation through the My Health Records Amendment (Strengthening Privacy) Bill 2018.

One of the system loopholes allowed domestic violence abusers to track their children’s whereabouts. Other Strengthening Privacy Bill amendments prevent police and government agencies from accessing MHR data without a warrant or specific court order. Likewise, insurance companies and employers are not permitted to access MHR information, unless you specifically request it is released to them. MHR data cannot be used for commercial interests unless it can be demonstrated it is likely to be ‘in the public interest’ consistent with ‘research and public health purposes’. This Bill increased the penalties for the misuse of MHR data up to five years' jail, instead of two, and the maximum fine has more than doubled to $315,000. The big change as a result of this Bill means you will be able to permanently cancel your MHR, resulting in the record being completely deleted from the system.

One of the main criticisms of the MHR was ambiguity around the ‘secondary use’ of your data. ‘Primary use’ is when information is used for the purpose it was collected for. Examples are uploading x-ray reports, discharge summaries and health information to use to take care of your health. ‘Secondary use’ of MHR data is when information is used for a purpose other than that for which it was originally collected. Examples include passing information to researchers involved in clinical trials.

Even so, if you have a MHR, your consent for secondary use is still implied. If you only want your health data to be used for the purpose of direct clinical care, you will need to press the ‘withdraw participation’ option on your MHR to stop your data going to any third party.

Benefits for a MHR

There remains MHR benefits for some PLHIV such as, all our health information is in one place and if you change doctors, all your test results and medical information is easily accessible to your new doctor without the hassle of transferring your file to a new practice. Eventually, you’ll be able to organise medication and prescription repeats online and have them sent to your local pharmacist without extra costly appointments for a simple refill.

Some PLHIV have concerns about confidentiality, access and control of our health data information. The digital health record has been designed with security settings in place, including options to restrict access to documents. That means that you have a level of control over what your doctors and specialists can see within your record. Many PLHIV and other people who are affected by HIV, such as sex workers, people who inject drugs (PWID), Aboriginal and Torres Strait Islanders, immigrants and refugees, and anyone receiving welfare payments, already encounter significant stigma and discrimination. Any database holding your personal information is a risk to your privacy even if the data is de-identified (the removal or change of information that could be used to identify an individual).  In December 2017, academics from the University of Melbourne showed how easy it was to take de-identified data and re-identify individuals through a process of relinking publicly known details. In this case the re-identified records included “potentially exposing if someone is on HIV medication, has terminated a pregnancy, or is seeing a psychologist.”

We’ve already seen health data being shared for purposes other than primary healthcare around the world. In 2018 in the UK, the National AIDS Trust along with the Parliament’s Health and Social Care Committee, called on NHS Digital (the equivalent of ADHA here) to stop sharing immigrants’ personal health information with the Immigration Department. Data sharing for immigration purposes scares people away from healthcare. These negative outcomes erode our trust in the health system and makes remaining engaged in health and Ending HIV a more difficult task.

Where to next?

Confidentiality and disclosure impact all of us who live with HIV differently, so each of us needs to make an informed decision about MHR. If you choose to have a MHR, know who can view your MHR, and where and why they might access it. Make sure you understand the privacy controls on your record and how they work so you can switch off access to certain information or restrict access to some parts of your MHR. Decide what level of risk you’re comfortable with, and the value of your personal health information, and proceed on that basis.

Positive Life still takes the position that PLHIV from vulnerable populations, such as sex workers, people who inject drugs (PWID), people who live with a criminal record or involved with the criminal justice system, people who are non-monogamous, polyamorous or single, and anyone who receives a STI diagnosis and treatment every 6-12 months could be better off to cancel or delete their MHR. The onus is on us individually to set the level of access we’re comfortable with across our record and understand the potential implications of the level of access we choose. Each of us will need to weigh up the benefits of having a MHR compared to the risks of having our health data online.

If you have any questions or concerns about My Health Record, call (02) 9206-2177 or freecall 1800 245 677 during business hours.

Last modified on


  • Guest
    D Wednesday, 07 August 2019

    While there have been many changes to MHR from a legal and privacy perspective, there remains a concern about how secure the system is. For example, are there weaknesses that would allow a hacker to access information?

    We should also be concerned that tracking of access is poor, so there is little accountability. For example, individual users are not tracked in what they access. Instead, an institurion is authorised, and anyone with access to a computer in that institution can access anyone’s record. So what is to prevent a cleaner at 3am looking up stuff for an insurance company?

    Reassurances are one thing. Basic design flaws are unacceptable.

Leave your comment

Guest Sunday, 05 July 2020

Givenow - make a secure online donation to Positive Life NSWLocation: Suite 5.2, Level 5, 414 Elizabeth Street, Surry Hills NSW 2010
Postal: PO Box 831, Darlinghurst NSW 1300

Telephone: 02 9206 2177 or 1800 245 677 (freecall)
TTY: 131 450    Fax: 02 9211 5672

proudly sponsored by    website design and build by

digialpac                            avernis

Images used are stock photos and do not imply any HIV status, sexuality or behaviours.