My Health Record – are you prepared?

Over 90% of Australians now have a My Health Record (MHR).

What is an MHR?

It is a collection of patient health information accessible online by authorised users. It’s not a ‘complete’ health record and doesn’t replace a doctor’s own medical records. It can include Medicare and PBS data, immunisation records, organ donor status, discharge summaries, pathology and diagnostic imaging reports, referrals, advance care plans and emergency contact details.

It may also include a Shared Health Summary (overview usually created by the patient’s regular GP) and Event Summaries (significant information that may be useful for future treatment, which can be created by any authorised provider).

The Australian Digital Health Agency (ADHA) is the MHR system operator.

What control and access do patients have?

Patients can:

• access their MHR through their myGov account or an authorised mobile app
• cancel their MHR at any time or opt back in
• ask healthcare providers not to add particular information to their MHR
• remove documents from view (but can’t edit documents)
• add personal health information, advance care plans and emergency contact details
• choose to give access to another person (nominated representative)
• restrict access to specific documents (access is still available in an emergency)
• restrict access to their entire MHR so particular healthcare organisations can’t access it (access limits apply to organisations, not individual staff )
• obtain SMS or email alerts to notify the first time a healthcare provider accesses their record, and other notifications
• access the history of their record at any time.

Carers or authorised representatives can access and/or control the MHR of someone in their care (parents or guardians of children are automatically authorised representatives if they’re on the same Medicare card).

When a child turns 14, the carer or nominated representative can no longer access the child’s record. A young person aged 14-17 years can elect to control the MHR themselves – they will need to set up a myGov account¹ or authorise a nominated representative.

How do I access a patient’s MHR?

• Practices must register to be part of the system and obtain a Healthcare Provider Organisation Identifier (HPI-O).²
• Individual providers must also register, using their HPI-I number issued by AHPRA ( you can find this on your AHPRA account).³
• Access can be via clinical software that meets MHR requirements or via a Provider Portal (which is read-only).
• Anyone who is registered can access an MHR for the purpose of providing health care.
• You can download documents from the MHR into the patient’s records on your practice’s system.

Must I access a patient’s MHR?

• You’re not compelled to open a patient’s MHR as a matter of routine – you should decide whether this would be clinically useful.
• There’s no legal obligation for individual doctors to participate in the MHR system.

Do I need patient consent to upload documents?

• You’re not legally required to get patient consent to add a document to their MHR.
• If the patient is with you or the information is sensitive, it may be best to get verbal consent.
• You must not upload information that a patient has explicitly requested not to be uploaded. To prevent a prescription being uploaded, uncheck the ‘consent to send to My Health Record’ flag on an e-prescription.For pathology and radiology reports you can check ‘Do not send to My Health Record’ in the clinical software or the paper referral form, or handwrite the instruction on the form.
• You must not upload information you know to be inaccurate, out of date, misleading or defamatory. 

Can I bill Medicare?

• There are no MBS item numbers for uploading to an MHR.
• The time taken to prepare documents for uploading counts toward consultation time for billing the MBS, as long as the document preparation was part of providing a clinical service and the patient was present.

What about privacy breaches?

• Unauthorised access to the MHR carries significant civil and criminal penalties.
• Unauthorised “collection, use or disclosure” of information in an MHR or compromised security of the MHR system must be reported to the ADHA, the OAIC, and possibly affected patients. Failing to report carries significant penalties.

How can practices prepare for MHR?

• Check whether your practice software is ‘MHR conformant’.⁴
• General practices who meet particular requirements can receive incentive payments.⁵
• Train yourself and your clinical and non-clinical staff in the use of MHR. The ADHA has a number of training resources.⁶
• Establish team members’ roles and responsibilities, e.g. designate a Responsible Officer and an Organisation Maintenance Officer.
• Create an MHR policy – this is a legal requirement for participating practices. The policy must include staff training, how staff are authorised to access MHR, how individuals’ access to MHR is communicated to the system operator, physical and information security measures, and how security risks are identified and acted upon.
• Visit the RACGP website’s ‘My Health Record resources’ section for useful information including a template policy for general practices.

 

More resources

Visit the ADHA website for more information on MHR for healthcare professionals. 

Patients can access more information on MHR from the OAIC website.

Karen Stephens
Risk Adviser, MDA National