Amendments to My Health Record needed so vulnerable children are not exposed to potential harm
18 September 2018
The My Health Records of children could be accessed by parents who are subject to Apprehended Domestic Violence Orders, and the definition of 'parental responsibility' under the My Health Records Act should be amended, according to the Law Council.
The Law Council of Australia’s President, Morry Bailes, the Chair of the Privacy Law Committee, Business Law Section, Olga Ganopolsky, and the Chair of the Family Law Section, Wendy Kayler-Thomson, appeared before a Senate inquiry into the My Health Records system last night.
Mr Bailes said while he welcomed some additional privacy protections contained in the My Health Records Amendment (Strengthening Privacy) Bill 2018, concerns remained.
“The current definition of 'parental responsibility' under the Act exposes the health records of children to misuse. The legislation needs to protect the location and identity of victims of family violence from being shared with perpetrators,” Mr Bailes said.
“Currently an authorised representative of a healthcare participant includes a person with parental responsibility. The Law Council understands that either party who is an authorised representative can access, amend, or delete a child’s My Health Record. Yet the definition of parental responsibility under the My Health Records Act is very broad.
“The definition of parental responsibility includes a person who merely has an order that a child spend time with a person. But a parent can retain parental responsibility for a child even if subject to a parenting order preventing them from contact with the child, or requiring their contact with the child to occur only under supervised conditions.
“In fact, a parent who is subject to a State-based Apprehended Domestic Violence Order will still hold parental responsibility for a child under the Family Law Act and would therefore still be considered an authorised representative under the current My Health Record system.
“This means that they may be able to ascertain the residential address of the child and the other parent. This creates serious issues for children and parents who may be at risk of harm if their location was to be disclosed through My Health Record to the perpetrator of violence.
“The definition of parental responsibility under the Act should be amended so that a person must have a parenting order for the child to spend unsupervised time with that person. It should also be stipulated that a person does not have parental responsibility if the person has a restraining order or personal protection order preventing them from spending time with the child.”
The Law Council also recommended that a healthcare recipient should provide informed consent if their My Health Record data was to be used for medical research purposes.
“This consent can be readily sought and obtained through the user settings and communication channels facilitated by the My Health Record system between individuals and prospective researchers,” Mr Bailes said.
Patrick Pantano: Public Affairs
P. 02 6246 3715 E. Patrick.Pantano@lawcouncil.au
Sonia Byrnes: Communications
P. 0437 078 850 E. Sonia.Byrnes@lawcouncil.au