Fi FOI Fo Fum

4 min read October 19, 2018 at 11:48am

One of my (Scottish-born) work colleagues is a bit scathing about the Australian Outrage cycle - something is in the media, people howl at the moon about it, and then the media cycle moves on and yesterday's most terrible thing is forgotten in light of the new outrage.

He may have a point, because when was the last time you heard something about #myHealthRecord? And that's despite the fact the Senate reference committee report on the program was released yesterday with a substantial number of recommendations. Because I'm time poor (and to highlight the exception to the rule), this article by Stilgherrian at Zdnet is an excellent summary. To be fair, it may reflect how time-poor I've been these last couple of weeks, as I've just come across this fairly good article from Fairfax.

Well, because it never rains, it pours, a miracle has occurred and I have received a response to my Freedom of Information request.

 By way of background, quite a number of us (including me) were indeed outraged about s70 of the my Health Record Act, which allowed release of myHR data by ADHA to a broadly-defined group of law-enforcement bodies, without the need for a warrant.  You can see the background to this in my previous post here. 

The Health Minister, Greg Hunt repeated rather ad nauseum that the policy of the Digital Health Agency was not to release this information without a warrant, despite the fact that it wasn't actually what the legislation said, or the chorus of people calling out the bullshit.

"Right, then", I thought, "let's have a look at the policy, then". And so that's what I did - I put in what you thought would be a relatively simple Freedom of Information Request via RIghtToKnow.

It would be fair to say that ADHA didn't cover themselves with glory in their response; you can read the correspondence on RtK.

Replies included:

"We don't know what you mean"

"We still don't know what you mean"

"Can you please give us an email address so we can take this offline?"

When I sent my clarification through via email, they treated the clarification as the FOI request, and have subsequently completely bypassed RightToKnow altogether in replying to it. And even with their fudging of the FOI date by a week or so, they missed the response deadline, ignored my request for an internal review, and have today - finally - sent me a document in response to my request.

Because I like transparency, I'll upload it to RTK so you can read it yourself. Sadly, I'm having a number of minor technical issues with my file server at the moment, so you'll have to wait to see them until I can edit this post later on today.

However, it's worth noting that neither of the documents I received are in fact policies, procedures or work instructions as I requested, but are rather a discussion paper for a Board Meeting, and what appear to be the minutes of the same meeting.


Screengrab from a Digital Health Board agenda briefing paper for the June 18 meeting
(full document to be uploaded later)
Screengrab from the minutes of the June 18 ADHA Board meeting

So, this suggests a number of things to me:

  1. There is no official procedure, but just a position statement from the Board. This - depending on how charitable you are feeling would either directly contradict the Ministers repeated and emphatic statements that there was and it didn't allow the release of information; or at the very least mean that the interpretation of "policy" seems to be loose enough that "feelpinion from the board" now counts as a policy.
  2. That there may be a policy or procedure, but a diligent search has failed to turn it up, and that the documentation management of ADHA is pretty terrible.
  3. It's of significant concern to me that the Board is seeking advice as to ADHA's role as the System Operator.  Surely this should be a pretty fundamental issue for them to have some grasp of.

It also opens the avenue for some more adventures in FOI - which sadly I won't have the time for at the moment - in following up exactly what the briefings received by the Board were.

But overall, I think the interpretation of "the policy says no" is a bit of stretch, and I'll be watching carefully to make sure that the amendments to the my Health Record Act achieve the objectives of protecting access to patient data without judicial oversight.

Apologies for the somewhat superficial treatment I've given the issue, but I've got rather a lot on at the moment. I've flicked copies of the statements to Stilgherrian, who will no doubt be able to devote a bit more thorough analysis to it.

Image credit: Paper redaction by Restricted Data - via Flikr - CC-BY-2.0