Police can access My Health Record without court order, parliamentary library warns

The health minister, Greg Hunt, was wrong to claim that patients’ My Health Record could only be accessed by police with a court order, according to advice from the parliamentary library.

The parliamentary library has warned the law governing MyHealth Records represents a “significant reduction” in safeguards on police getting medical records because the operator cannot routinely require them to get a warrant.

Hunt and the Australian Digital Health Agency have both said that the agency in charge of the medical records “will not release any documents without a court/coronial or similar order”.

My Health Records, a single unified patient record currently used by 6m Australians, have existed for six years but the number of patients in the system is expected to soar after changes that will automatically set up a record for every Australian unless they opt out by 15 October.

The backlash against the opt-out scheme has grown due to concerns that rule changes or insufficient safeguards could give third parties access to patients’ health information.

The parliamentary library advice by Nigel Brew, the director of foreign affairs defence and security, notes that under section 70 of the My Health Records Act 2012 ADHA can disclose health information when it “reasonably believes” it is necessary to investigate or prosecute a crime, to counter “seriously improper conduct” or to “protect the public revenue”.

“It is reasonable to assume that this might include investigations into potential fraud and other financial offences involving agencies such as Centrelink, Medicare, or the Australian Tax Office,” the advice said.

Brew noted that currently a patient’s consent was needed to release their medical records and “law enforcement agencies can only access a person’s records (via their doctor) with a warrant, subpoena or court order”.

The MyHealth Record legislation therefore “represents a significant reduction in the legal threshold for the release of private medical information to law enforcement”.

The ADHA has said that no government agencies have access to the My Health Record. “No documents have been released in the last six years and none will be released in the future without a court order/coronial or similar order,” it said in a statement.

The parliamentary library advice noted the legislation “does not mandate this and it does not appear that the ADHA’s operating policy is supported by any rule or regulation”.

“As legislation would normally take precedence over an agency’s operating policy, this means that unless the ADHA has deemed a request unreasonable, it cannot routinely require a law enforcement body to get a warrant, and its operating policy can be ignored or changed at any time.”

Brew said that Hunt’s claims that records could only be accessed with a court order “seem at odds with the legislation, which only requires a reasonable belief that disclosure of a person’s data is reasonably necessary” to investigate or prosecute a crime.

Brew noted that “uncertainty has left different advocacy groups concerned” including sex workers who fear it could lead to prosecution and fears records could be used to prosecute immigration offences, as was possible in the UK.

The Law Council has said that “information held on a healthcare recipient’s My Health Record is regarded by many individuals as highly sensitive and intimate”.

“Arguably, therefore, an alternative to the approach of the current scheme would be for medical records registered in the MHR system to be legally protected from access by law enforcement agencies to at least the same degree as records held by a doctor,” Brew said.

A spokesman for Hunt said that the ADHA had been “clear and categorical” about the fact it would not release documents without a court order, but did not cite a legal basis to refuse a request for medical information.

“This is the same position that applies to all other medical records anywhere in Australia,” he said.

On Tuesday the Labor leader, Bill Shorten, said he had not decided to opt out of the online record but warned the government was “jeopardising the My Health Record system”.

“The principle of being able to have information stored digitally is one which makes sense,” he said. But Shorten suggested the government “needs to slow down and get this right”, after Labor requested the opt-out period be extended by three months.

Shorten said it should “ring alarm bells for Australians” that even Liberal MP Tim Wilson has opted out and suggested the system should be opt-in only.

Guardian Australia contacted the ADHA for comment.