7 ms·
Australia's new e-health platform crashes as people rush to opt-out
- TheSpiceIsLife 8y agoThe Australian government is paying doctors to upload patient records to a centralised government controlled database. The Australia government is incentivising doctors to sell client data to the government. What part of this is ok in any sense?
- ekianjo 8y agohow is that compatible with doctor patient confidentiality?
- Torwald 8y agoWho protects doctors from attacks, when they get attacked because they value patient confidentiality over conformity to such governmental programs and maybe peer pressure?
- vertex-four 8y agoIn my country, healthcare professionals form a union - so hopefully them?
- systoll 8y agoThe federal law says you can't upload data if the patient tells you not to. Max penalty for that seems to be 2 years imprisonment, though I doubt we'll see that. Some states have further restrictions which expand the scope of this -- for instance, in NSW, uploading anything about HIV would be illegal, even with patient consent. The Australian Medical Association has said that the interaction of the MHR system with their code of ethics implies that doctors must get positive consent from patients. In practice, your new patient registration forms are getting another checkbox.
- msamwald 8y agoIt seems overall okay if you accept the premises that A) A centralized health record system can do substantial good by improving effectiveness and transparency of healthcare processes, and enabling medical progress through data re-use. B) Doctors won't lift a finger to do extra work if they have no selfish incentive for doing so.
- TheSpiceIsLife 8y agoC) the database never gets hacked, or leaked, or otherwise exfiltrated
- jopsen 8y agoEven if there is a risk of this. It might be a risk worth taking. Edit: I don't know the specifics, but I sometimes wonder what good stats on more health records could do for future treatments.
- vertex-four 8y agoI wouldn’t intentionally place my health records out of my own control, because I have significant risk to my life if those records become public. Having certain illnesses and medical history is inherently political in 2018 - being trans can result in violence against you, talking to your doctor about STIs - even just prevention - can get you kicked out of your home, having medicated/treated schizophrenia will result in losing job/housing/etc opportunities. This isn’t going to change even if all those records become public in some way.
- pimmen 8y agoBut you also have a significant risk to your life if your doctor can't get to them and orders the wrong treatment. The risk of that happening to you is actually significantly higher than dying from a lot of pretty common illnesses.
- 8y ago
- Tharkun 8y agoAFAIK the same thing has happened in Belgium. There are several databases, allegedly controller by hospital networks, which you can access using government ID. There's supposedly an opt-in clause, but I've certainly never opted in and all my x-rays are on the interwebz. Must be nice to be a 21st century government, where you can access any data on anyone in your country.
- Insanity 8y agoThat is the case indeed. However the ehealth-ehub system (which I assume you are talking about) is not automatically in-sync with the data the hospitals have about you. When it is necessary to receive the data, the system will poll the hospital for the required data. Then we have "NexuzHealth" in Belgium, which is an app you can install that shows you which data the hospital has about you. It's a network of 20+ hospitals but you can only view your data if you are actually a patient at these hospitals, and the goal was to provide the _patients_ with the same information doctors can see about you. Something you would normally not know about. Source: I work in one of these hospitals (software engineer) but not directly related to the app nor the ehealth system, so this is my (limited) understanding of how it works from being around the people actually implementing this.
- deleted 8y ago[deleted]
- danieltillett 8y agoAnyone know who is the contractor running this fiasco?
- jpmoral 8y agoAccenture, AFAIK.
- stuaxo 8y agoNo wonder it doesn't work properly.
- bigiain 8y agoAccenture - with Oracle and Orion Health - according to this: https://www.itnews.com.au/news/my-health-record-replatforming-talks-begin-494467 https://www.itnews.com.au/news/my-health-record-replatformin... Hilariously, they've already let on they're not going to renew the Accenture deal - which no doubt will _highly_ motivate them to provide exemplary support and security over the next two years: "The Australian Digital Health Agency has begun talks to replatform the My Health Record system ahead of the 2020 expiry of its multi-million deal with national infrastructure provider Accenture."
- zinckiwi 8y agoWow. What do they expect the take-up rate to be with that kind of vote of no confidence from the people who commissioned it in the first place?
- skc 8y agoSerious question, has Accenture ever built a successful large scale system? Round these parts we call them "Accidenture". They are always involved in high profile project failures, though that are big enough that these might just unfairly publicized outliers
- megaman22 8y agoAre there any of them that actually are any good? You read these stories, and deal with a few different ones personally, and the whole sector quickly starts to look like a barely competent disorganized mess.
- auslander 8y agoIt works now, opted-out, got email confirmation. https://www.myhealthrecord.gov.au/for-you-your-family/opt-out-my-health-record https://www.myhealthrecord.gov.au/for-you-your-family/opt-ou...
- dav43 8y agoAs part of my work, I've had to read a fair amount of the legislation and reports coming out in this sector and also the "Consumer Data Rights" legislation (similar to the UK's open banking scheme. What I found was a massive difference in policy coming out from the same government but in two seperate streams of work. A) Consumer Data Right (legislation being built into Australia Privacy Act) focusing on banking, energy and then telecommunications: The user has complete control of their data. If a consumer asks a business to delete, they must do so (except for information that is legally required). B) MyHealthRecords: The government has complete control of your data. You cannot delete your account or your data. I'll add sources if I can, but its in the legislation.
- auslander 8y ago> ... focusing on banking... - yeah. Commonwealth Bank Privacy Policy: 5. Who do we share your information with? - Service providers — for example, mortgage insurers, loyalty program partners and our product distributors - Businesses who do some of our work for us — including direct marketing, statement production, debt recovery and IT - support - Organisations involved in our funding arrangements — like loan purchasers, investors, advisers, researchers, trustees - and rating agencies - Auditors, insurers and re-insurers - Current or previous employers — for example, to confirm your employment - Credit reporting bodies and credit providers https://www.commbank.com.au/security-privacy/general-security/privacy-policy-html-version.html?ei=gsa_generic_privacy https://www.commbank.com.au/security-privacy/general-securit...
- auslander 8y agoWhat's even more disturbing, is that Visa/MasterCard are possibly get itemised data from store transactions, like Milk BrandA, bread BrandB, Medicine Name, BrandC.
- TheSpiceIsLife 8y agoYeah, how would they delete data they’ve already sold?
- 8y ago
- ekianjo 8y agoThey even have a propaganda youtube channel https://www.youtube.com/channel/UC8UWg1-qaHAOKrzJA17EHLQ https://www.youtube.com/channel/UC8UWg1-qaHAOKrzJA17EHLQ
- deleted 8y ago[deleted]
- throawway 8y agoThe Australian government gets away with a lot more authoritarian BS than other comparable governments, and there seems to be less of an emphasis on individual rights. I wouldn't trust them with medical records.
- rjvbk 8y agoHaving a centralised system with health records is bad? I've had that since I was born in my country and I think it's useful and handy. Something happens to you, they know what could've been, if you're on meds, what things and meds you're allergic to, etc. I guess the outrage makes sense when looked from an American point of view where you distrust the government by principle?
- shakna 8y agoIts not the idea that Australians mistrust - its the implementation. No great technical project in the last couple decades has been successful. Under the current government we have the broken NBN, the fractured MyGov that has been repeatedly hacked, the falling over census website, other broken health care systems. We can't trust that they can build it safely.
- chopin 8y agoYou should mistrust the idea as well. Scope creep is a thing.
- auslander 8y agoAgree. AU Gov is failing in same way any big corporation fails. There is that strange notion that Managers know better than Engineers and can make technical Decisions. Good engineers, who love coding, can design a big system, are unlikely to rule over the Design. It'll be bad engineers, now Managers, with good political skills, that got promoted because its their only way to survive, being otherwise useless. It is totally upside-down, hence the mess.
- auslander 8y agoIf any AU Gov hot shot is here, I'll fix your mess, I'm good at it, did it few times before, drop a line at ausland@protonmail.com, I'll try to vet you :)) It will be AWS, no nonsense like kubernetes, possibly a dash of OpenBSD for public layer, least privilege IAM, Cloudformation everywhere. Solid. :) Open Sourcing it is an option too.
- 8y ago
- enturn 8y agoAs well as opting out, if you're concerned about privacy it might be good to contact your doctors directly to let them know that you don't give consent for your data to be uploaded in the first place.
- bigiain 8y agoAnything IBM can do (with the census) - Accenture can do better, huh? Waiting for the claims it's government sponsored Chinese hackers attacking the opt out website...
- lbriner 8y agoThere are problems with paper-based systems but they don't affect everyone to the same extent: * I visit another doctor when on holiday - they don't have my records * Certain treatments need the approval of my home doctor, it talkes longer than it should * Harder to collate statistics that are supposed to show the state of the nation's health But there are problems with an electronic system: * A single point of attack * No way to assure people it is ultimately secure, because it can never be * Fluffy exemptions to the protection offer - especially if they are more far-reaching than existing exemptions used for accessing your paper records * Creeping requirements mean that a few years later, the government might change what they can use it for. At the end of the day, neither system can be measured in terms of risk or reward in any meaningful way - many advantages are theoretical and risks are downplayed - so you pretty much have to accept the centralisation of the worlds systems or move to a Banana republic!
- Avamander 8y ago* A single point of attack Totally the same with your data in that one primary doctor's office or whatever * No way to assure people it is ultimately secure, because it can never be Totally same with your paper records, someone could walk in and steal your data, imagine that. * Creeping requirements mean that a few years later, the government might change what they can use it for. Just like paper records, you can't say what they will use them for in the future.
- TheSpiceIsLife 8y agoI believe you’ve misunderstood the concept of single point of attack. This means single point of attsck for everyone with an ehealth record. With paper records, or in-house digital records, a hacker / thief, or malicious government, or what have you, has to compromise many systems. The same applies to your paper record comment.
- Avamander 8y ago> I believe you’ve misunderstood the concept of single point of attack. Single point in who's perspective though, OP worded it more like (s)he cares about his/her data not everyone else's (e.g. "I visit another doctor when on holiday - they don't have my records"). But yes, you are right about it being in general a higher risk endeavour. The question now is though, when other commenters here describe how their life and career could get in danger when someone steals their data, which do you think is going to be much harder to breach, your local doctor's office or a central database that's guarded by armed guards and experts?
- deevus 8y agoThis is a problem every time the government launches a new service. They always have "an unexpected amount of traffic". The last time we had a census the "census night" was totally bust since the majority of Australian internet users tried to use the online form and hardly anyone succeeded. They tried to blame it on "hackers". Leading up to census night there were threats of fines if you didn't submit on time, but due to the shitstorm with their online failures people were still submitting their census data months later.
- lucb1e 8y agoThere are plenty of projects that don't have this issue. It's not "always", just the big ones so it seems like it's all of them if you don't know about the others.
- SyneRyder 8y agoThe census fiasco was a truly special kind of incompetence. The best inside analysis was from the folks behind the Risky Business infosec podcast: https://risky.biz/censusfail/ https://risky.biz/censusfail/ Summary: The project was outsourced to IBM (that alone probably says it all), who didn't purchase any DDoS protection. A small attack crashed the first firewall, and the backup firewall didn't have rules loaded. That caused IBM's monitoring tools to flag system logs as exfiltration, so they called in the Australian Signals Directorate (ie national security) and turned everything off until intelligence agencies completed an investigation of the false positive.
- Namidairo 8y agoAll the marketing calling it "Census night" and encouraging people to do it on the same evening instead of over the week probably didn't help spreading the load out.
- halchion 8y agoFurthermore, although it's true that IBM didn't purchase DDOS protection, neither did the government pay them to purchase it. IBM is incompetent but in this particular case I can't blame them for attempting to make a meager profit out of the pittance the Australian government chose to spend on their first act of digital governance.
- mb_72 8y agoI will be curious to see how this pans out - I have dual Australian and Estonian citizenship, and in the latter case I can tell you it's extremely useful to have centralised medical records, prescriptions etc. For my Australian medical records in MyHealth or whatever it's called, I have a couple of pages uploaded by my then cardiac doctor (after I had a suspected heart attack last November that ended up 'only' being something related to medication), and I've already used these pages with a related consultation here in Estonia. So, for me at least, this system has been quite useful already. I guess time will tell in terms of security and other important factors.
- TheBeardKing 8y agoI get that there's benefit to a centralized health database if you're in a country with socialized medicine, but if dealing with private doctors, why not let the market provide this capability? My primary GP uses one version [1], and I get that there would be several competing others until some convergence happens. But at least with these private providers, if one fails or falls out of trust, patients and doctors can move to another - your data isn't permanently locked with an untrustworthy government. [1] https://healow.com/ https://healow.com/
- RichEO 8y agoYou haven’t established that the government is less trustworthy than the private providers?
- TheBeardKing 8y agoI meant that as a hypothetical, as in if the government proves itself untrustworthy (or technically incompetent, as is the case of Australia judging by these comments), you can't legally switch to a new system, whereas you could if it were private.
- amelius 8y ago> When citizens rush to opt out of an Australian government service, it says something about their levels of trust. When the system falls over under heavy load, it proves them right. What a stupid conclusion.
- ekimekim 8y agoThe context is that there's a lack of trust about the system being stable and implemented properly. Hence why it falling over proves them right.