My Health Record – an update webinar

MAHALA: Welcome to today's webinar ‘My Health Record: an update’ as part of our Practice essentials webinar series. If you have participated in our webinars last year, you may remember us as the eHealth webinar series. We will still be delivering webinars on the latest developments in eHealth, but will now cover a wide range of technology and practice management topics as well. My name is Mahala Boughton and I'm the senior project officer for the RACGP Practice Technology and Management team and I'll be your host for today. 

I'm joined by Dr. Rob Hosking, a GP based in Melbourne, and he'll deliver the presentation. 

Rob has been interested in eHealth since commencing practice in Bacchus Marsh in Victoria in 1990. He gained his graduate certificate in health informatics from Monash University in the year 2000. Rob has worked on a number of eHealth related committees at NPS MedicineWise and the Royal College of Pathologists of Australasia. Rob has been involved with the RACGP eHealth committee since 2008 and is currently the a of the RACGP Expert Committee - Practice Technology and Management. Rob, Welcome to the webinar.

ROB: Thanks Mahala, and welcome everybody. Don’t know what you’re all doing listening to us on a lovely Wednesday evening, but I hope we can keep you entertained. 

MAHALA: I'm sure we'll do our best Rob. So Rob myself and The RACGP would like to thank everyone today for taking time out of your busy schedules to participate tonight. And before we begin I'd like to make an Acknowledgement of Country. 

So I would like to acknowledge the traditional owners of the respective lands on which we are meeting here today and to pay my respects to Elders past and present. I would also like to acknowledge any Aboriginal and Torres Strait Islander people present with us this evening.

And just a quick note to mention that this webinar is presented in collaboration with the Australian Digital Health Agency. 

So Rob, with that I'll hand over to you to begin the presentation. 

ROB: Thanks Mahala.

So as usual with these sort of presentations we go through the process of what we're going to tell you about, and then we're going to tell you what we're going to tell you, and check out at the end to see if you heard what we told you about. 

So the outcomes here are as on the screen, but by the end we want you to be able to describe the role and current usage of the My Health Record, identify scenarios in which a GP or practice’s use of the My Health Record might assist in providing better patient care, learn and be able to explain access controls (which is not something we've shown before but it's been there all along), learn and be able to understand what the legislative requirements are when participating in My Health Record and make an informed decision about participation in My Health Record because it is still optional for GPs to participate. 

So the agenda - what we're going to do is a brief overview of the My Health Record and opt-out, current uptake and the benefits of My Health Record, some new features that have appeared in the last year and very recently, and the My Health Record audit which was undertaken by the Australian National Audit Office and the legislative requirements for participation in My Health Record. And hopefully we’ll have time for Q&A at the end. 

So what is the My Health Record? Hopefully those who attended [webinars] last year, and some of our face-to-face sessions as well, will know that My Health Record is Australia's national eHealth record system which has actually been around since 2012 when it was launched as the Personally Controlled Electronic Health Record. It's an online repository for documents and data with information about a patient's health care.

That can include

• MBS and PBS data for the last two years.
• Shared Health Summaries uploaded by you, the patient's nominated healthcare provider - which is usually their usual GP.
• Events summaries, which document detailing a specific episode of care that you think may be relevant, or somebody else might enter because they think it's relevant for somebody else further along to know what happened on that day with that episode of care.
• There's a medicines view that aggregates allergies, adverse reactions, medicine information from the most recent Shared Health Summaries and Discharge Summaries.
• The immunisation history or the Australian Immunisation Register, and that's going to be there provided that it's been entered into the Australian Immunisation Register. Which means it won't include some of the immunisations that have been provided at workplaces and also in particular some pharmacies that don't upload, or even some practices that don't upload to the Australia Immunisation Register.
• Hospital discharge summaries. Mostly. Sometimes, that's variable.
• Prescribing and dispensing information. Certainly that's pretty accurate because it happens automatically.
• Pharmacist Shared Medicines List, which is a new feature and I'll talk about that later in the presentation.
• The patient's personal health notes - Advanced Care Planning documents, emergency contacts - which are all added by the patient or the authorised representative. 
• Also, we're getting more and more pathology and imaging reports in some states where the providers are connected, and we'll talk about this soon as well.

So the information in My Health Record doesn't replace your local clinical files and it should be viewed as an additional source of information and it doesn't replace normal communication channels between GPs and other health care providers, like hospitals and specialists. It's an additional form of provision of information. So using My Health Record as a GP does not mean a patient has access to the notes in your record system.

It's important to note that even if you're not participating in My Health Record you will still be passively contributing to a patient's My Health Record. GPs might be generating information for My Health Record when using the billing of Medicare Services because Medicare data goes there, generating electronic prescriptions which have the barcode at the bottom that's usually uploaded by the pharmacy, requesting pathology and diagnostic imaging through participating laboratory - they may be putting it up there even if you're not involved in the My Health Record. And information that goes to government databases like we mentioned earlier, the Australian Immunisation Register (AIR). So if you're uploading to the AIR the Australian Immunisation Register then that will also be going into a patient's My Health Record if they have one.

So that's a brief introduction and overview of the My Health Record, which hopefully you already knew. With this webinar we're not going to get into the finer details of what the My Health Record is nor how to use it in your own clinical software. So this is more an overarching general view of My Health Record and some of the new functions which will be visible through each person's different clinical software, but because there are so many different versions of clinical software, we can't possibly show you all of those.

So the RACGP has developed a My Health Record guide and some short videos, which are a great introduction to the system if you haven't used it yet. And the Agency, that's the Australian Digital Health Agency, has developed instructional resources that show you how to use the My Health Record for your own records system. So they have video and step through demonstrations for things such as Medical Director, Best Practice and ZedMed etc.

So if you want any of that information, it'll be appearing in the chat box on your screen if you want to take up more options for looking at that information.

So what happened with the last year? So the My Health Record was introduced in 2012 as an opt-in service, however as part of the Australian Government 2017-18 Budget it was announced that the My Health Record would transition to opt-out. So people had until 31st of January 2019, so a year ago pretty much, to opt-out if they didn't want to be involved. And after that, all Australians known to Medicare or the Department of Veterans Affairs had a record created for them. If those that opted out actually want to opt-back in they can do so at any time in their life.

However, if they permanently deleted their records, which is what happens when you opt-out now, there's no backup of information being kept. So prior to this change, which was changed as a result of the Senate inquiry into the My Health Record in 2018, prior to this the record could be cancelled but not deleted and the health information would persist and be archived.

But now as we said, if you delete your record you lose it and it's all gone. But if you want to recreate your record, you start with a blank record and it'll have to be gradually filled up again.

If we go to the next slide, current uptake and usage, you'll see that quite a lot of people have a My Health Record.

We can see that 90% of GPs and pharmacies are registered. When it comes to GP practices, so GP organisations are what they're referred as, 73% are using the system but 90% are registered to use it. So it's interesting to see that there are a lot of practices registered but not using it at this stage and that's sort of represented in the in the poll we just had.

So a large number of people have got a record, but only about half of them have data in them. However, this record is only activated when a health professional goes to view it for the first time, or if the patient goes to view it, and then they have an active record. So when they have an active record then stuff will start getting uploaded to it.

And that'll be things like pathology, discharge summaries, Medicare data, all of that. So it suggests that if half of them have been activated at the moment probably because the Medicare data would go straight in there. And that would then be a document that has data in it.

You'll see that there's a large number of public and a smaller number of private hospitals percentage-wise that are using the My Health Record. That's quite variable from state to state too, as to what it what actually means by that - these are registered to use it. But whether they're uploading information or using it to access information… it is not clearly known. However, one of the interesting things is, and I'm doing it now and I know some of my colleagues who are in this space, when they get phone calls from hospitals outpatient emergency department saying “can you please fax through a summary” I’m starting to say no. And saying look on the My Health Record because we've got to push people to see there's stuff there and they just haven't bothered looking. And faxing and printing stuff out and so on by our reception staff and by ourselves is just a duplication of effort if we've already uploaded a summary. So I think you know we can drive this a little bit by pushing or encouraging our colleagues to view the record. However, you might want to think again about that when you're talking to other specialists other than GPs because there are very few of those who are using it.

And pathology and diagnostic imaging providers, as you can see there, they're connected and some are uploading, and some are not. And I think you've got to be aware that some public providers and some private labs still haven't yet got the ability to send stuff up. And with the private providers, such as Clinical Labs and Sonic, they're only uploading when they receive an eRequest, known as an eOrder. So if you're wondering why the requests that you have sent haven't been uploaded, perhaps it's time to start talking to your lab about whether you should you be using an eOrder. Which we found in Victoria, has only just started at one of our colleagues Dr. Nathan Pinskier’s practices because he's liaised with the Sonic group in Victoria, which is Melbourne Pathology, and they’re now doing eRequesting and as far as we're told the eRequesting is no different to writing a prescription that's transferred electronically. Now, you just don't notice a difference. It's all exactly the same as far as you're concerned. You just have to get it turned on and connected and then the pathology will start flowing into the My Health Record as well. If you wish it to, or if you don't wish it to, then you tick the box that says “do not upload to My Health Record” and it may actually not be your decision, it’s the patient's decision whether they want it to go [to their My Health Record].

And the other thing that we haven't got on this chart is what percentage of patients are actually looking at their record. Straw polls that I do in my practice is disappointingly low, and that's supposed to be one of the draw cards for the My Health Record, which is that patient's will view their My Health Record and participate more in their healthcare.

Unfortunately, my personal experience on that has been quite low. I'd be interested to see what other people find if they were to do likewise, ask their patients if they have accessed their My Health Record. 

So what are the potential benefits of the My Health Record? Now the intention behind the My Health Record is that it will help doctors spend more time with patients and less time searching for clinically relevant information. And proponents of the My Health Record hope that as it grows doctors will find that they are able to access helpful information that they don't already have in your local records.

As a criticism of the system some GPs and patients say that there's nothing there or nothing of relevance in the records, which is certainly the case for around half the people with a record at the moment, as we just said. But figures released by The Agency (the Australian Digital Health Agency) showed that there is an increase in people using the system and documents uploaded month-by-month are increasing, which may be more useful if the documents are easily found.

There might be particular benefits in using My Health Record to gather relevant information in certain situations like in a medical emergency. So if somebody was to present to an emergency department or into your practice as an emergency and they're not usual patients of yours, you may be able to find information that you don't have on hand. It may be also useful when the patient's traveling and needs to seek care from somebody else who's unknown in advance. Particularly the “grey nomad” people traveling interstate for holidays. If they get sick unexpectedly and they go to a practice or an emergency department that has access to the My Health Record they hopefully will have an up-to-date Health Summary that will provide useful support for the patient and support our colleagues, and perhaps ourselves, if we're treating patients if we practice in a tourist area. I'm sure that we would be appreciative of our other colleagues, who as the usual GP, had uploaded a Shared Health Summary. 

Also, it may be useful when the patient has many health care providers because they've got chronic or multiple conditions. So it's often difficult to get communication happening to everybody, and as we get more and more people connected, hopefully there’ll be another source of information on the My Health Record.

So in all of the above sorts of situations that I've just talked about, the healthcare providers, or GPs, or other doctors who are providing care to the patient should still communicate with each other directly as they do currently. So it would be courteous if you're treating a patient from interstate to write a little note about what you did and to provide it with the patient to take it back, or send it electronically using the electronic systems secure messaging function, which are starting to become more connected this year. 

But if you were unable to do that or you didn't have contact details, you might consider putting an event summary in the My Health Record and telling the patient that you've done so, so that they can mention to their GP to have a look for the information in their My Health Record. And it's very easy - you can just incorporate your actual clinical notes for that consultation and upload it directly into the My Health Record under an Event Summary.

Other intended benefits of the My Health Record are to avoid adverse drug events. So if you knew what medications they were on and what potential adverse reactions they had to other medications, hopefully you could avoid those problems.

And as we've said the idea to enhance patient self-management or get them more engaged in their care, and again, we can encourage patients to keep looking at their records. They might be interested, particularly if they have a chronic disease like diabetes, to look at their HbA1c results as they appear, or their cholesterol results, or their renal function etc.

Improvements in patient outcomes is another intended benefit and that remains to be seen. We still need to have more research on that, it hasn't been around enough to know.

Reduce time gathering information, as we said, for ourselves and our staff and maybe also avoiding duplication of tests and services because we can find out that something's already been done that we intended to order.

Many of these sorts of benefits aren't immediate, they rely on broad adoption of the system by both clinicians and patients. And they rely on the uploading of information to My Health Record from our medical information systems like Best Practice or Medical Director etc. and they also involve support provided to clinicians and consumers or patients on how to access that information in My Health Record. And that's what we are trying to do today - to provide you with an overview and hopefully encourage you to go and look at the videos on the Australian Digital Health Agency website if you don't know how to do it already or encourage you to practice having a look at it. 

Just remember though that every time you view a patient's record there is an audit log that says that someone in the practice has looked at it and your practice will be able to tell who has looked at it within your practice. So don't just go snooping, that would be – well for one it's illegal and you can be severely punished for it, and two, it's unethical.

And you know, you can do it with patients who are with you because you're involved in their care at that time. And there's nothing illegal about having a look at their record or nothing unethical about it, in fact, it would be encouraged to have a look at their My Health Record and see what information you can find while you're there.

So what do GPs like about My Health Record? We recently surveyed our members of the RACGP and we've got a number of replies, you know, when you get all these surveys if you want to contribute, then do so. 

We asked GPs to describe positive outcomes they've had or what they liked about the system, and the most common responses were that they could get access to hospital discharge summaries they may not have had access to. Hopefully you're getting your discharge summaries directly to your inbox. 

Anyway, it's not expected that you go and look in My Health Record to chase up discharge summary. Unless you're seeing a patient that is not normally yours or they've been discharged and for some reason the system didn't get you a discharge summary. Maybe it was sent to the wrong GP because the hospital has out-of-date information.

So it's great to see GPs are seeing an improvement here and some states are better than others at this. And the other really interesting thing I think you should know is that you can download these discharge summaries and other documents directly into your systems into the document section. So if you see a discharge summary on the My Health Record that you don't have you can download it straight into your system. That's really simple, takes only one or two clicks and it's there, and then you don't have to go get your staff chasing it around the hospitals.

The other thing that doctors like was the medications history, particularly dosing information. And I found this myself, you know, you've seen a patient who has been prescribed something from another practice and it might be a dose of antibiotics and they need to have more and you don't know what dose they were on and they can't even remember exactly what it was.

So if you go to My Health Record, in the medicines view, even if the doctor hasn't put up a summary, it'll probably be there because the medicines will go directly up there when the chemist or pharmacist dispenses the medicine. 

So other times it might be useful is when you might be on an after-hours home visit and you don't have access to the record or you know, you're seeing a patient that's not usually yours.

So viewing, as I said, medication history of a completely new patient to your practice that might be just a blow-in on holiday, or they might be starting to come to your practice moving from somewhere else, and you haven't got any information yet from the other practice. But you might be able to populate some of that information from the My Health Record.

And some have also said that it's useful to identify patients that might be seeking drugs of dependence. But then again, this is not really the role of the My Health Record because people can opt-out. This is best done through real-time prescription monitoring systems like the SafeScript in Victoria, Dora in Tasmania and ACT, and very soon Queensland's going to follow Victoria and have their own version of SafeScript. They're going to call it qScript and it's going to be very, very, similar to what we've got in Victoria, which has revolutionised drug-seeking behaviour.

The other thing that GPs have commented that they liked about the My Health Record is having access to MBS and PBS data. For example, one GP said that being able to see when the last care plan or mental health items have been claimed has been helpful.

And also access to health information about a patient new to the practice. As I said, you can view a Shared Health Summary from their previous GP and download it straight into your system, or discharge summaries or pathology or imaging reports, and they can just be downloaded directly into your system.

So on the next slide, what could be improved? What the GPs don't like. A lot of GPs have complained about the functionality in the user interface that could be improved, and that it can be slow and difficult to use. They feel that they need more training in how to make the most of the different features. And the good news is that some of this has changed. We will talk about that later. 

The presentation of information, again, where a patient has a lot of information in the record, GPs said it can be hard to find the information they're looking for, particularly if there are a lot of test results uploaded by hospitals and they’re uploaded individually and you've got to search through it. But as we said, there have been improvements and we'll talk about that shortly.

Also, what could be improved is engagement with other specialists. GPs would like to see more of our colleagues, our other specialist colleagues, using the system to improve continuity of care. That's going to be a difficult thing when a lot of specialists are not even computerised. So maybe when they start to see some benefits in viewing the My Health Record they might start to see the benefits of uploading information as well, particularly specialist letters. And there is a capacity for that. It's just they're not feeling the love or the need to be involved in the system yet.

And also, you know, [respondents said] there's not enough pathology and diagnostic imaging providers uploading yet.

So what are the new features and improvements? So the new pathology reports overview. GPs have had issues with being able to find relevant pathology and diagnostic imaging results among all the reports that are uploaded to the My Health Record. In response to this, an update was made by the Australian Digital Health Agency to the My Health Record, and it's shows now that pathology and diagnostic imaging results are clearly differentiated from each other and within the groups.

So you get a group that has pathology and a group that has diagnostic imaging. You click on that, and you can go in there and you can see different headings for various results uploaded. No longer is it just document, document, document, which you have to look at each one before you knew what it was. It was just previously real disaster to look at but now it's actually quite useful. The results are now also grouped by date or by test name which makes it a lot easier to pinpoint the specific results you're looking for, and there's now an overview function which allows you to see multiple reports within a specified date range on a single page.

So if you want to look at that, there's more information on the link that's being sent to you in the chat box.

So the next slide we've got the Pharmacist Shared Medicines List. So this is another new document. What is it? It's basically the pharmacy equivalent of our shared Health Summary and with 90% of Pharmacists connected to the My Health Record, it's been a useful thing for them to be able to upload documents such as when they've done a home medications review, or Webster packaging, if they've made changes, they can upload what's called the Pharmacist Shared Medicines List.

So it's only been put in very recently and not a lot of pharmacies are uploading yet, but some are. It's a document that's created and uploaded by pharmacist which includes a list of all the medicines the patient is known to be taking. This is what they tell pharmacists they’re taking, we all know that they tell everybody different things. What really is the medicines list is what the patient's actually taking on that day. And as far as I know, there's no way of actually recording that list because people choose to take some things and not others.

But the you know, the pharmacists are good at getting lists of what patients are on, including over-the-counter and complementary medicines, that can also be included in this. So the benefits for the GP is the overview of the PSML (which is another acronym that we have to learn) the Pharmacist Shared Medicines List will enable them to make more informed prescribing and treatment decisions. And hopefully reduce risk and medication mishaps. The patients can also view these as well if they wanted to go into their My Health Record if they have that capacity.

Again, the Pharmacist Shared Medicines List may not be a complete or accurate medicines list if you view it quite some time after it's been created. Similar to our Shared Health Summaries – if our Shared Health Summaries are a year or six months out of date, things might have changed in that time and the same with the Pharmacist Shared Medicines List. So you've got to remember that it's accurate, hopefully, at the time that they've uploaded and it's just a another bit of information that you you'll have in your clinical information system or your medical records that may be useful in providing care. So, where do you find it? It'll be labelled as a PSML. I haven't yet seen one because they are very new and pharmacies in my area are not uploading it yet.

So the next thing we were going to talk about is patient access controls.

Now these features are new but perhaps not widely understood, and everybody was focusing on whether they should or shouldn't have one, as in a My Health Record before, and nobody really focused on [access controls]. Patients can control how we can view the record and what and who they want to share it with.

So the RAC, the Record Access Code - another TLA, another three letter acronym. It can be used if a patient wants to restrict access to their entire record. So basically, it's a pin, or a number, that they have that they have to provide to you if they want you to review the record. In a consultation they’ll need to give you this code in order to see their record. However, in an emergency situation you can use what's called the “break glass” function or the emergency access function which overrides any access controls or restrictions that the patient may have set.

Just remember though that every instance of emergency access is audited by the system operator (the Australian Digital Health Agency), and I've been involved in looking at reviews of all of the cases where people have broken the glass, so don't do it lightly. It is very important and taken as a very important access control and so for patient has a record access code and they choose not to give it to you… Well, that's just means that you haven't got access to their My Health Record. You still have access to your own records, of course.

Then there's a Limited Document Access Code, or LDAC - another acronym. So a Limited Document Access Code is when the patient has received restricted access to a specific document within their My Health Record, and you need a particular code to open or view that document. Once you've used Limited Document Access Code you are then automatically added to the patient's provider access list, which means you can keep accessing that document and you don't need it again.

However, if a document is restricted by Limited Document Access Code you as a treating doctor will not have any indication that there is a document there that's been removed from view.

So this is the thing that got a lot of doctors all up in arms when this first came out, and they're going “oh but they can hide the record and they can change things” well, of course they can. Patients choose to show us things now to let us know things, or hide things from us now, so this is no different. But I just want to point out that, to give you some perspective of the 23 million records there are there, only 33,000 people who have placed any kind of advanced access control on their records. So the likelihood that you'll come across something is very, very, low. You can still upload to a My Health Record regardless of any of the access controls they've put in place.

Another interesting thing is that the patient can also restrict which practices or organisations that can have access to their documents. So if a patient has a relative that works in a practice as a GP, or as a nurse, or as even a receptionist, and they have no intention of ever going to that practice, they can block that organisation or that practice from viewing their My Health Record completely.

Another access code that I don't think many know about, and I've got it [for my own My Health Record], I've put this code on, or access restriction, you can have an email or an SMS sent to you if someone looks at your record. And there's also an audit list and you can go and look in to the My Health Record and see who's actually looked at the record and put in a complaint if you think that it's unjustified. 

So, you know, if you want your own record as a GP and you're a bit worried about that, you can restrict practices by saying “I don't want those practices that I don't agree with having any view of it.” And they can't look at it anyway, unless they're involved in your care. And just to be sure you can have an email or SMS sent to you if somebody opens your record and then you can find out easily who it is and say “well, that's not right. I think that should be looked at by the system operator” and then you report it for the system operator and they'd look at it. And you can tell this to your patients as well. 

So access for minors is the next one we're going to look at. So at birth when a parent registers their newborn for Medicare, they can choose whether the newborn will get a My Health Record.

If they opt not to, they can still create a record at any time before the patient's 14th birthday. When a child turns 14, the parents are automatically removed as nominated representatives. And this is an important change that occurred as a result of the changes to the My Health Record Act in late 2018. The RACGP advocated for this change in its submission to the Senate inquiry to help protect vulnerable young people, and this change is consistent with the legal rights of a competent minor to seek medical care without the knowledge and consent of a parent or guardian.

However, if the parents believe that their child does not have the capacity to manage their own record, they can apply to the system administrator to regain access. A minor can also make their parents and nominated representative if they wish to. So if they're all playing happy families and they've got nothing to hide, and the young person wishes their parents to have access, they can do that. This also allows them to choose the level of access they have to documents in the record.

When a minor turns 18 they receive a letter notifying them that any nominated representatives no longer have access to their record. They can still later on make their own nominated representatives and that applies to elderly people too who can't manage their own record. They can authorise family members to manage their record for them.

So next we move on to the My Health Record implementation audit. So this was an audit done by the Australian National Audit Office, the ANAO. So this audit was conducted on how the My Health Record was implemented, and it was released in November last year. So it was done independently of the Australian Digital Health Agency by the Australian National Audit office.

This was undertaken because the My Health Record is a big piece of infrastructure that potentially affects all Australians and there has to be a balance between increasing access to information and managing privacy and security risks. The system also got a lot of parliamentary and public interest and over the potential risk to privacy and cybersecurity risk, so it did need that audit.

The report concluded that the implementation of My Health Record was largely effective including implementation planning and execution, the governance etcetera. It also found the monitoring and evaluation arrangements for My Health Record was largely appropriate, but there's still work to be done here. And finally the audit found that the risk management for the program was only partially appropriate. We'll talk about that on the next slide.

So where did the ANAO find that there was a problem? They said that the main thing was what they called shared cybersecurity risks. So they found that the IT system’s core infrastructure cybersecurity risks were well-managed. So that means the actual system itself where all the data is stored and how it’s accessed - but the management of the shared cybersecurity risks needs to be improved.

Now, this is shared cybersecurity risks are those that are shared with third party software vendors, such as your clinical information system Medical Director, Best Practice etc and healthcare provider organisations – us, our practices.

So the shared risk is shared between the IT systems core, our system’s information software that we use, and us as practices and practitioners and how we use My Health Record. So the report stated that the risk management could be improved by developing an assurance framework for third-party software connected to the My Health Record. And this is something that's being investigated by the Australian Digital Health Agency. And also to develop a strategy to monitor compliance with legislated security requirements by registered health care provider organisations, in other words monitoring our compliance.

So in other words, how are our practices, and our doctors, and our nurses adhering to the legislative security requirements. So there are ways that the security of My Health Record could be put at risk at the practice end, and examples of this might be leaving a computer unattended and logged into My Health Record whilst out of the room and a patient's there. Or sharing your login details with others, or leaving your login details somewhere accessible to others such as on a Post-It note stuck on the screen. And of course, there's the security threat caused by malicious software on a practice computer. So these aren't just risks to the My Health Record, these are information security risks in general and we've talked about this before, and those of you who've been to our webinars before will know we've had a whole webinar on information security. And you really should be aware of the RACGPs Information Security in General Practice. This is a document that provides guidance on malicious software and the security of your network and equipment. It also helps you meet the information security related indicators for the Standards for general practices, which is a requirement for accreditation. 

So, you know, we all need to be aware of this risk, perhaps you've all heard of the hospitals in Victoria that were attacked last year, and there are numerous GPs that have been attacked with ransomware and locked out of their systems, and we need to be very mindful that we try to avoid that in the first place. And then what do we do in the event of a breach.

Now, if you think there's been a breach of the My Health Record you must tell the system operator as soon as practical. If there's been a unauthorised collection, so use or disclosure of health information including the My Health Record that's not been authorised, or an event that may compromise the security or integrity of the My Health Record system. So perhaps your system has been hacked with malware you should notify the system operator soon as possible.

And depending on the severity of the situation the system operator can suspend the practices access to the My Health Record to limit potential harm. That might be if there is malware, obviously they're going to turn off access so that your system can’t access it. But one thing to note this is not the same as a data breach from your own system. A data breach from your own system, you don't notify the system operator in that case, you notify the Office of the Australia Information Commissioner. 

So if there's a data breach that affects the My Health Record, you must notify the system operator. If there's a breach that doesn't affect the My Health Record, but does affect your clinical information system, then you should notify the Office of the Australian Information Commissioner like other privacy breaches if it's significant. And we've done webinars on that to, and you might like to look at our data breach guide from the RACGP on that. 

So let's move on, the other thing then on the issues about shared risk was what are the legislative requirements, and we all need to be aware of that. Now we don't need to read the actual Acts, but you need to know that there are Acts that directly apply to the My Health Records and that's them there.

So if we go to the next slide, we'll see how we can meet the requirements for the My Health Record rules. The RACGP has developed a My Health Record policy template that addresses the requirements of Rule 42 of the My Health Record Rule of 2016.

And that is, you need to have a written policy that addresses a range of matters such as how staff are given access to the My Health Record, the training that will be provided by the practice, how requests to access the patient's record and manage physical information security are managed in the practice, and mitigation strategies to mitigate security risks. So this is a useful template and you can access that on the link that's in the chat box at the moment. 

Then there is the ePIP that is separate, and we have a checklist there that you can go through on how to qualify for the ePIP. 

Now the next thing is legislative changes associated with electronic prescribing. This is just to let you know that the Federal Government passed legislation to allow the Australian Digital Health Agency to support electronic prescriptions in October 2019. Now each state and territory is changing their rules, regulations, or legislation, if it has required, to recognise electronic prescriptions as an alternative to the paper prescriptions that we currently printout. Currently we print out ones that have a barcode that's transmits the information in it electronically, but the paper prescription is still the legal entity. Whereas in the new world that's coming soon, and we'll have something later in the year on electronic prescribing, there will be an electronic legal entity that can be used for non-paper prescribing. But how that's going to be implemented is still being worked out with the software vendors, and us, and the Department of Health, and the Agency. But it's an interesting area that we're moving towards.

So on the next slide, we've got the resources that the team have been developing, our Practice Technology and Management resources. Some are relevant now and particularly topical, the measles fact sheet and checklist.

You might want to have a look at that regarding the outbreaks that occurred in in New Zealand and Samoa and may come here if we're not careful. Reducing the impact of a general practice, the environmental impact, that may be of interest to some people and also the Guiding principles for managing requests for the secondary use of de-identified general practice data may also be useful if you're thinking of signing up to the various things such as, the PHN things to participate in the PIP QI.

Yeah on the next slide. We’ve got some webinars coming up soon, and that's the list of what's coming up. So we've pretty much finished now and I'll hand over back to Mahala and we'll see if we've got a few questions.

MAHALA: Thanks Rob. Thanks for that great presentation. So as you mentioned we've got some time for Q&A at the moment. So if you have any questions that are left unanswered, please send them through now and we will try our best to work through them in the time remaining. So the first question I have for you Rob is, PBS information doesn't usually have dosage listed in My Health Record. Do you know why that is?

ROB: Good question. I think it's because the PBS data is a claiming data, like our MBS data doesn't have any information about what the consultation was, it just tells you what the code and what the billing was. Likewise with the PBS data, it's just data from the pharmacist to the PBS to claim the medicine, so I'm assuming it's because of that.

So however there is other information, if pharmacist is using electronic transfer of prescriptions to download and then dispense the prescription, that will have the dosage data in there. That should have the frequency and the dose of the medication on it, but I don't think the PBS data does because it's a claiming system.

MAHALA: Thanks, Rob. And the next question here is do My Aged Care reports get uploaded to My Health Record. And will the clients My Aged Care number be available on My Health Record?

ROB: No, and no. Not at the moment, there's no capacity to upload that unless the patient themselves or their family representatives upload it. It is a bit of an area that could do with some work as with Advanced Care Directives also, it would be very useful if they were able to be uploaded. But at the moment there are only uploaded by the patient or their representative.

MAHALA: And will patients be able to see billing history?

ROB: Yes as they can now, they can't see what you billed if you billed a private consultation, that won't be there. But the MBS data will be there and they’ll be able to see whether you billed a level A, level B, or a level C or D consultation or mental health plan. So yes, the all of their Medicare billing information will be available. It's not just on My Health Record, though. That's actually available freely available to patients now through MBS online. They can access it through various apps and so on.

MAHALA: Thanks Rob, and can you upload PDFs or scanned documents up into someone's My Health Record?

ROB: That relates to what I said earlier. No, you can't as a GP or a health provider. There are only electronic documents, and the only electronic documents we can upload are the Shared Health Summary or an Event Summary. Now I believe some people have done workarounds where they've managed to attach those into an event summary, but then it's very hard to identify what it would be. Because it would just be labelled ‘Events Summary’ and you might have attached a document that's particularly useful such as an ECG. I mean, it would be fabulous if we could have ECG images uploaded to the My Health Record, we can't yet. And hopefully that will be developed when they keep improving it. As we've just said in this webinar, they have made improvements. And they put out a request for… it's like a request for tender, but the Agency has put out requests for people or organisations who are capable of perhaps re-redeveloping the infrastructure that is used for the My Health Record so that we can do these things like uploading images, uploading PDFs. These would all be useful. I suspect though, the database would need to be enormous when you start thinking about the number of documents that would be there. Unfortunately, pathology results are uploaded as PDFs at the moment, but we don't have the ability to do that.

MAHALA: Thanks, Rob. And I think that's a nice question to end on. I can see we do have a few questions sitting in there, so I apologise that we haven't been able to get to you and of course you can always email ehealth@racgp.org.au and we will get back to you outside of this webinar. But thank you Rob for a great webinar tonight. 

ROB: Thank you. And thanks to you ladies in the team, Mahala and those answering behind. And look at I do encourage you, if you do have questions, do email the team at the RACGP because they will answer your questions. I've seen them doing it, don't worry. They will.

MAHALA: Thanks Rob. Yes, we do answer a lot of questions, and we’re always here to help. So thank you again everyone. I hope you've enjoyed the presentation. Thank you and goodnight. 

ROB: Goodnight, everyone.