Safety and security

There are three types of safeguards to protect the security and privacy of My Health Record data.

Practice safeguards

• Policies and procedures which govern the use of My Health Record at level of the individual general practice. There are a number of specific requirements for this policy and the RACGP has developed a policy template for this purpose.
• Education for all practice staff involved in the use of My Health Record (initial and ongoing training)
• A culture of security among practice staff (a culture of keeping devices and passwords secure)
• Insurance to protect practice equipment
• Your personal medical indemnity coverage.

System safeguards

• Design principles which restrict access to authorised healthcare providers operating within an authorised healthcare organisation
• Data is stored in Australia on government servers
• Security vigilance with encryption and digital authentication, and access monitoring and penetration testing.

Regulatory safeguards

• Various Acts, Regulations and Rules protect My Health Record data and help ensure it is used safely
• Oversight by government agencies and departments such as the Office of the Australian Information Commissioner (OAIC).

The characteristics of a breach of health and personal information relating to the My Health Record system are outlined in the My Health Records Act 2012. According to this Act, a data breach involves:

• the unauthorised collection, use or disclosure of health information in an individual’s My Health Record”, or
• an event/circumstances that compromises, may compromise, have compromised, or may have compromised the security or integrity of the My Health Record system.

In the event of a potential/actual data breach involving My Health Record

As soon as you are aware that a data breach has (or might have) occurred, you must:

• Contact your medical defence organisation
• Advise the Australian Digital Health Agency so they can notify the people affected
• Advise the Office of the Australian Information Commissioner (OAIC)
• Take steps to prevent additional breaches