Thousands of pages of internal documents are still being created about a My Health Record technical glitch that the government said was minor and resolved years ago.
But the agency in charge of My Health Record wants to charge $14,000 to release details on the files through Australia’s freedom of information regime.
Guardian Australia revealed last month that a technical problem with the My Health Record system had hampered attempts by some doctors to upload clinical information about their patients to the system.
According to a leaked briefing, some doctors in clinics using older IT systems were left oblivious to the problem, leading them to believe patient information had been properly updated when it hadn’t. The briefing warned it created risks of “missing clinical information in a consumer’s My Health Record” and “amendments not uploading resulting in out-of-date or incorrect information”.
The Australian Digital Health Agency, which administers the system, said the error was minor and was quickly dealt with when it emerged in March 2016.
“To be absolutely clear, the agency rejects any assertion that there is any clinical risk to patient safety or longstanding problem unresolved since 2016,” a spokeswoman said.
Deakin University academic Joshua Badge subsequently filed a freedom of information request, asking for all documents related to the glitch that were created in 2018.
The agency identified 95 documents with 4,192 pages relevant to the request. But it said processing Badge’s request would cost $13,894.77, with a deposit of $3,473.69.
The agency is now declining to comment on the matter, either to explain why a minor issue resolved in 2016 is still generating voluminous records two years later, or to explain the $13,000 processing charge.
“The Australian Digital Health Agency (the agency) is unable to comment on ongoing Freedom Of Information (FOI) cases to third parties,” it said in a statement. “For all FOI requests, the agency abides by the fee schedules and guidelines set out by the Freedom of Information (Charges) Regulations 1982.”
Badge, who has previously written on My Health Record and privacy concerns, later refined his request to ask only for documents between mid-December and mid-February.
The agency identified 35 documents with 259 pages in that period, and asked Badge to pay $700 to process the request. He has again refined the FOI request to lower the cost.
But he said the sheer volume of documents casts doubt on claims the glitch had been fixed.
“This new information indicates that the ADHA has written thousands of pages of emails and reports relating to the digital signature issue in the last year,” Badge said. “The immediate question is why there would be so many documents about a ‘minor issue’ from several years ago.”
The glitch was caused by part of the digital signatures used to help secure and authenticate clinical records, according to the leaked briefing, which was signed off by senior ADHA staff. The issue was said to be so “significant” that it was escalated to the minister.
“When the digital signature issue emerged in 2016, its impact was so significant that it was escalated to the minister for health, and although the issue is being managed it is not completely resolved,” the briefing said.
Digital signatures contain a coded identifier, which start with a randomly generated character ranging between the letters A to F to nine numerical characters. International standards require that only letters be used to start the identifiers. An average of 62.5% of all records uploaded to the My Health Record system used numbers. This only became a problem in March 2016, when an update was released to the Microsoft framework used by the My Health Record system. It meant any digital signature using a number to start its identifier caused an error, which in some cases prevented documents from being uploaded.
The effectiveness of the system relies on it having accurate and up-to-date information.
The ADHA said the error affected less than 1% of records updated to the system. It said it acted quickly to alert software vendors responsible for the systems used by medical clinics.
“The matter you refer to accounts for less than 1% of attempted document uploads from clinicians,” a spokeswoman said last month. “The agency rejects any statement that the security or safety of the My Health Record system has been compromised.”