[BreachExchange] My Health Record had 42 data breaches in 2017-18 but no 'malicious' attacks: ADHA

[Destry Winant]

https://www.zdnet.com/article/my-health-record-had-42-data-breaches-in-2017-18-but-no-malicious-attacks-adha/

Australia's troubled My Health Record recorded 42 data breaches
between July 1, 2017 and June 30, 2018, the Australian Digital Health
Agency (ADHA) has said in its 2017-18 annual report [PDF].

Three of the breaches were reported to the Office of the Australian
Information Commissioner (OAIC) and involved one breach of
unauthorised access due to an incorrect Parental Authorised
Representative being assigned to a child, and two breaches due to
suspected Medicare fraud that resulted in the potential fraudster
seeing records without authority.

ADHA also said 17 breaches were found from the Department of Human
Services identifying intertwined records where two or more people have
been using the same Medicare record, and 22 breaches from attempted
Medicare fraud where unauthorised claims appeared incorrectly in the
My Health Record of affected users.

"There have been no purposeful or malicious attacks compromising the
integrity or security of the My Health Record system," ADHA said.

The Department of Human Services had corrected the records in all
instances, ADHA said.

The My Health Record operator said as of July 27, 2018, almost one
quarter of Australians had a record.

"In 2017–18 the Agency, as System Operator, registered 935,206 people
for a My Health Record," it said. "There were a total of 42,877
cancelled registrations during the year."

ADHA said 221,580,930 documents were uploaded to the system in
2017-18, and 798,000 people accessed their records through its portal
in that time frame.

As of June, ADHA reported connecting 178 of the country's 208 private
hospitals to My Health Record, and 815 of Australia's 1,108 public
hospitals to the system.

Australians have until January 31 to opt-out of the national health
record system or they will have a record created for them if they do
not already have one.

By October 19, 1.147 million had removed themselves from the system,
but ADHA said it was happy with the result.

In the wake of the annual report, Labor has reiterated its call for
OAIC to review the system, and hit out at the AU$20 million deficit
that ADHA reported.

"After spending 2018 focused on tearing down his own Prime Minister,
Minister Hunt must now focus on delivering a My Health Record that is
secure and on budget," Shadow Health Minister Catherine King said in a
statement.

ADHA said in its annual report that it had created a privacy team to
"embed privacy within the functions and culture of the agency".

"Maintaining community trust in the privacy and security of the My
Health Record system is imperative to the success of the program,"
ADHA wrote. "The privacy team takes a proactive, privacy by design
approach to managing the development and operation of the My Health
Record system."

It was reported in November that its director of privacy had resigned
over privacy concerns.

The same month, the government announced it would increase the maximum
penalties for improper use of My Health Record data.

Under the changes, the maximum jail term will increase from two to
five years, the maximum fine for individuals will jump from AU$126,000
to AU$315,000, and private health insurers will not be able to access
health or de-identified data.

Employers will also not be able to use health information or
de-identified data to discriminate against employees or potential
employees.

"Importantly, employers or insurers cannot simply avoid the
prohibition by asking the individuals to share their My Health Record
information with them," Health Minister Greg Hunt said at the time.

Parents who have restricted access to a child, or are a potential risk
to a child or person associated with the child, will not be allowed to
become an authorised representative.