I saw the following video article on ABC news and took issue with it misrepresenting the security of the Australian Government’s new Personally Controlled Electronic Health Record (PCEHR) and so gave some written feedback to the ABC, which I’m posting here.
ABC Video “Experts question eHealth security”
My feedback to the ABC is as follows:
To whom it may concern,
I believe the video article “Experts question eHealth security” was misleading
of the extensive community consultation the Australian Government has
undergone to introduce an online system that is robust security wise and
increases the transparency and utility of medical records for all Australians.
For full disclosure I am a former employee of the Department of Health and
Ageing, but I’ve never worked on the Personally Controlled Electronic Health
Record (PCEHR).
The video made three main points, all of which I’ll refute: one, the security
on the system is poor; two, the government is rushing to get the system in
place instead of properly testing it; and three, there are potential means for
inaccurate information.
The video implied that security concerns had been identified, but never
identified why the people interviewed were qualified to comment on the
security concerns. The major reason cited for the security concerns weren’t
technology related, but user-behaviour related, suggesting that the
information was inherently insecure because “it will be up to patients to make
sure their information remains secure”. While this remains true of any
information system, it misrepresents the lengths the Government has gone to,
to provide multiple points of security.
In relation to end users of the electronic health record, the main point where
security is needed is at the point of access. Authentication to the system is
in accordance with the government’s security framework, the National
eAuthentication Framework (NeAF) and uses a range of safeguards for sensitive
transactions including: reminding users of the importance of security, using
challenge-response questions for sensitive transactions and keeping an audit
trail of access times and unsuccessful access attempts.
Rather than rushing to implement this system as the video implied, the
Government has taken the time to extensively consult with the public. It
released the “Draft Concept of Operations of the PCEHR” over a year ago. It
took submissions from many organisations and individuals including health
organisations, government departments, privacy bodies and security
organisations. It then responded to those submissions, in detail, with an
analysis of the key themes of the feedback. It also consulted on the
accompanying legislation, posting the legislation for feedback and made
changes to its concept of operations as a result.
AusCERT, the company interviewed in relation to security, have never made any
submissions on the public exposure draft of the PCEHR. If AusCERT has such
serious, constructive concerns, then it should have taken the time to comment
as an organisation when the opportunity was available.
The article also made the point that there was a potential for medications to
be recorded inaccurately or for allergies to be missed. This belies the fact
that the PCEHR is doctor-centric. Rather than it being a record that
unqualified individuals may make changes to haphazardly, the system is
designed so than individual works together with their nominated provider—
generally their family GP—so that togetherthey can fill out their shared
health summary. For example someone may have high blood pressure, identified
during a test several years ago before PCEHR was rolled out. By working with
their nominated provider, an individual can have this information updated in
their PCEHR. By using a nominated provider, clinically relevant information
can be verified as it is entered, providing assurance to other medical
practitioners as to its relevance and authenticity.
A simple search of the ABC website has revealed few articles on the way the
PCEHR will work. I think that so far the articles are unfairly biased and
tend toward fear mongering on the security, rather than provide a balanced
view on what will ultimately increase the openness and interoperability of
health information.
Yours sincerely,
Anthony Draffin
Senior Business Analyst
