Malcolm Crompton says his cautions about an opt-out system were ignored by the government
Australia’s former privacy commissioner warned government officials about the dangers of an opt-out My Health Record system six years ago, but said his cautions were ignored.
Malcolm Crompton, now an adviser at one of Australia’s leading information privacy consultancies, has also warned digital health records will not be secure unless a widespread audit of every GP clinic in Australia is conducted.
“It may well be military-grade [security] on the central servers of the My Health Record system,” Crompton told Guardian Australia. “It’s demonstrably not military-grade for all of those 900,000 practitioners.
“Literally because nobody knows. Nobody has actually audited those 900,000 practitioners to make any statement of any sort on how secure they are.”
Last week Malcolm Turnbull pledged to address privacy concerns raised about the government’s My Health Record system. Healthcare and social security groups have expressed significant concern about the lack of privacy safeguards in the legislation governing the system, which could allow warrantless access by a broad range of government departments, including Centrelink, Medicare or the Australian Tax Office.
IT experts also say the system is prone to cyber threats, particularly because the records will be accessible by a vast range of people in the medical workforce, many of whom will have weak cyber security.
Health minister Greg Hunt has repeatedly stated the data will be secure and no access will be allowed without a court order.
Malcolm Crompton, now an adviser at one of Australia’s leading information privacy consultancies, has also warned digital health records will not be secure unless a widespread audit of every GP clinic in Australia is conducted.
“It may well be military-grade [security] on the central servers of the My Health Record system,” Crompton told Guardian Australia. “It’s demonstrably not military-grade for all of those 900,000 practitioners.
“Literally because nobody knows. Nobody has actually audited those 900,000 practitioners to make any statement of any sort on how secure they are.”
Last week Malcolm Turnbull pledged to address privacy concerns raised about the government’s My Health Record system. Healthcare and social security groups have expressed significant concern about the lack of privacy safeguards in the legislation governing the system, which could allow warrantless access by a broad range of government departments, including Centrelink, Medicare or the Australian Tax Office.
IT experts also say the system is prone to cyber threats, particularly because the records will be accessible by a vast range of people in the medical workforce, many of whom will have weak cyber security.
Health minister Greg Hunt has repeatedly stated the data will be secure and no access will be allowed without a court order.
“Others have issued similar warnings. So there are no surprises about any of these issues now being raised. The difference is that they were dismissed or not dealt with properly. They are still being raised and are being taken seriously, or at least seriously enough for Mr Hunt to be talking to the doctors.”
The Deeble Institute for Health Policy Research is among those who have also warned of the privacy and security risks of moving to an opt-out system.
In 2015, the institute published a report calling for a “comprehensive system security and privacy safeguard review” before the implementation of the opt-out system.
Following this review, the government would need to “implement a mix of technology, policy and process mechanisms aimed at strengthening security and privacy controls”, the report said.
It also recommended a major public education campaign before moving to opt-out, to demonstrate the privacy and security safeguards of the system.
A spokesman for Hunt said he would meet this week with the presidents of the Australian Medical Association and the Royal Australian College for General Practitioners to “work constructively” with them about their concerns.
He said Australians had a choice to opt-out if they wished, and could decide how their medical information was controlled.
“Labor brought in this legislation in 2012 and it has been operating for six years and just under six million Australians are already on the system,” the spokesman said.
“My Health Record is subject to some of the strongest legislation in the world to prevent unauthorised use and backed up by a world-leading cyber security team.”
Crompton, who has himself opted out, said he had little faith in the government’s ability to resolve the myriad of privacy and security issues.
“They will be pushed to make minimal change amid extreme noise,” he said.
Crompton said the Office of the Australian Information Commissioner is under-resourced to cope with such a vast scheme. He compared OAIC’s resourcing for audits with the kind of money corporations spent on financial auditing.
“The privacy commissioner is doing the commissioner’s darnedest to be as effective as possible with the budget they’ve been given,” he said.
“But somebody in the department of finance keeps on leaving off a couple of zeros before the decimal point. It’s not just under-resourced ... it’s criminally under-resourced.”
Yes, some of the more horrific aspects of the Trump presidency – the alleged collusion with Russian forces, for example – are absent, but from a policy sense there is little that would see Turnbull wishing to be separate from Trump.
Tax cuts that favour the wealthy? Hell yes. The Turnbull government’s key economic policy has been to bring in tax cuts which when fully completed will overwhelmingly favour the wealthy and which will exacerbate income inequality.
Tax cuts for corporations? Yes please! While the Turnbull government has been unable to get the bulk of its company tax cuts through, there are few doubts that they won’t occur. Pauline Hanson is expected to give the government her support once the Longman byelection is out of the way and she doesn’t have to explain to voters why she supported a policy most of them do not.
A willingness to hit the racial dog-whistle? Why certainly. The signs are already here that the next election is going to be a horror show of talk about migrants and crime and blaming immigration for everything from wages to housing prices to congestion, and all coated with a very thin veneer of racial anxiety.
Trump has spent much of the past year talking up fears of the MS-13 gangs to such an extent that despite no evidence of any growing activity, 85% of those who voted for Trump now believe the gang is a very serious or a somewhat serious “national threat”.
He might not be as vulgar as Trump, but Turnbull is just as willing to appeal to the lowest common denominator.
And what about thin-skinned responses to criticism? The ongoing attempts from the Turnbull government to discredit the ABC is only marginally less subtle than Trump’s railing against the “fake media”.
The Turnbull government is not content to merely seek to have the ABC remove content it finds displeasing. This week the health department sought to have the parliamentary library take down a post which highlighted just how weak are the privacy provisions surrounding the My Health Record.
I suspect that censoring those who are pointing out reasons the public should not trust a government service is not the best way to have the public believe they can trust that service – or their government.
And finally, how about a preference for big business?
As we have seen with the company tax cuts that is certainly evident, but a perfect example of where the Turnbull government’s priorities lie came this week with the announcement of Nine taking over Fairfax.
The deal is a terrible one for those who value a diverse media. I suggested on Twitter that talk the new company would have “plenty of Fairfax DNA” was like saying the Brisbane Lions have plenty of Fitzroy DNA. But as a few people pointed out to me, at least Brisbane kept the “Lion” name and also makes an effort to keep the Fitzroy legacy alive as best it can.
That the new company couldn’t even be bothered keeping “Fairfax” in a manner similar to “Seven West Media” or “Time Warner” shows how little care there is about what Fairfax represents, and does not bode well.
You can blame the Fairfax management – and it sure as heck deserves plenty – but this takeover would not have occurred had the Turnbull government not removed the cross-media ownership laws last year.
That legislation – made possible with the support of One Nation, Nick Xenophon and Derryn Hinch – was designed to provoke such takeovers. It is not about competition in the free market, it is not about greater diversity of media voices or giving media companies a better ability to hold governments and corporations to account.
It is about – as is inevitably all pro-business legislation – ensuring consolidation of power in the market.
In defending the legislation this week Turnbull stated that “all the media companies strongly supported these laws”. It was a view parroted by the communications minister, Mitch Fifeld, justifying the legislation because it was supported by “Nine, Seven, Ten, WIN, Prime, Southern Cross Austereo, News Limited, Fairfax, Free TV, Commercial Radio Australia and Fox”.
Yes, companies wanting to buy other companies and companies wanting to be bought by other companies liked the legislation. I am shocked.
It does highlight how the government will default to doing what business wants rather than what might be best for workers, or in this case our democratic society.
If business says it is what is needed, well then that is what is supplied, and that is how it is justified.
It all makes for a pretty awful mix. And while those in the US are wondering whether the changes wrought by the Trump presidency can ever be undone, here too the impact of the Turnbull government will be long lived.