Implementation of the $1.5bn My Health Record system failed to appropriately manage cybersecurity risks, a review by the national audit office has found.
The review found implementation was “largely effective”, but revealed the government agency could not guarantee that all “emergency access” requests to view an individual’s record were legitimate, and that four privacy reviews funded since it became an “opt-out” system were never finished.
The Australian National Audit Office review said the cybersecurity and privacy risks were not properly managed or considered by the Australian Digital Health Agency, which oversees the national electronic heath records.
The database, which relies on doctors and medical practices to upload clinical information about patients, seeks to ensure continuity of care for patients with all medical information centralised. It was opt-in from 2012, but converted to opt-out this year.
Despite widespread privacy concerns and some revelations of software bugs, 90% of Australians now have a My Health record.
Less than a quarter of Australia’s healthcare provider organisations are using the system.
The audit office review, commissioned to review implementation under the “opt-out” model, found that the system had “largely appropriate” systems to manage cybersecurity risks within itself, but had failed to provide appropriate protections against shared risk with third-party sites and apps, and health provider organisations.
“Management of shared cybersecurity risks was not appropriate and should be improved with respect to those risks that are shared with third-party software vendors and healthcare provider organisations,” the report said.
The audit office said that at the time of writing the report the ADHA had not conducted an end-to-end privacy risk assessment of the system’s operation under the opt-out model. The most recent privacy impact assessment was in 2017, and the four privacy reviews between October 2017 and June 2019, which cost $3.6m, were not completed.
Registered healthcare providers and other participants can use an “emergency access” function to override user-set accesses and view someone’s records, but only if the circumstances involve “a serious threat to an individual’s life, health or safety, or a serious threat to public health or public safety”, the report said.
However, the audit office found the ADHA could not provide assurances that all instances of “emergency access” to an individual’s health record were not an interference with that person’s privacy. Monthly use of emergency accesses increased from 80 in July 2018 to 205 in March 2019.
The review found that only 8.2% of requests met guidelines.
The review said while the ADHA monitored emergency access and requesting responses from the accessing organisation, it had no procedure for what to do next. In a number of instances the ADHA received no response, and had not notified the information commissioner about any of the accesses.
In early 2016 the ADHA identified “nation states and criminal actors as the greatest threat to the My Health Record system, with hacktivists and trusted insiders posing a medium threat and cyberterrorists posing a low threat”.
The audit office also reported that not all Australian healthcare providers achieved minimum cybersecurity levels, and that the sector reported the most notifiable data breaches of any industry sector in 2018.
More than 40% of data breaches reported to the information commissioner from the private health service provider sector were due to “malicious or criminal attacks”, of which almost half were cyber-incidents, it said.
The review also found cybersecurity risk oversight could be stronger, as the ADHA board received dedicated briefings just four times between July 2016 and February 2019, and had not considered the updated cybersecurity five-year strategic plan, which was finalised last year. The role of the ADHA’s privacy and security advisory committee was also not clear.
The auditor recommended it needed to set up means to monitor compliance by third parties using My Health.
With Australian Associated Press