Freezing out the folks: default My Health Record settings don't protect teens' privacy

As the opt-out period for the My Health Record continues, so too does the debate surrounding issues of confidentiality. While possible data breaches have generated widespread concern, for one group – teenagers – it may not just be hackers they want to keep out. It may be their parents.

Consider this scenario:

Katy is 16 years old and, after a couple of months of dating another 16-year-old, Tom, they start having sex. Katy’s regular GP has looked after her asthma since she was six but she feels awkward seeing him. Katy visits a GP that her school friend recommends to ask about contraception and to get a pregnancy test. The GP offers and does a chlamydia test, as recommended by the Australian guidelines for STI testing. She really doesn’t want to discuss this with her mother just yet.

There are options for 14 to 18-year-olds like Katy to keep their medical records private under the My Health Record scheme, but teens must be proactive and change their settings or ask their health providers not to upload this data.

Remind me, what is a My Health Record?

My Health Record stores and manages each individual’s health information – such as blood tests, prescriptions, diagnoses, vaccinations and allergies – online. Every Australian will have a My Health Record generated unless they choose to opt out before October 15.

Parents may opt out their children, and those aged over 14 are able to opt out themselves.

Read more: My Health Record: the case for opting in

Some information will be automatically uploaded as soon as a My Health Record is created. This includes Medicare claims for things like GP visits, and Pharmaceutical Benefits Scheme (PBS) claims for subsidised medications.

Other My Health Record information such as what is recorded by a GP when you see them, or letters from specialists to your GP, could be uploaded by them. Any test results and X-ray reports might get uploaded by the laboratories and X-ray centres directly, rather than through your GP.

Medicare and PBS claim information will not be visible on the record to parents of teenagers aged 14 and over, even if they are on the family Medicare card. It has long been the case in Australia that parents cannot see Medicare information for children aged 14 and over, and this recognises the rights of young people to confidentiality as they become more independent.

Read more: My Health Record: the case for opting out

But this is not currently the case with other information on the My Health Record. Parents or legal guardians act as authorised representatives of their under-18 child’s record.

The parent can see other documents such as the health summary, medications prescribed, any test results, and specialist’s letters. At 18, parents’ access to the young person’s record is cancelled.

However, if you are between 14 and 18 years old you can choose to take control of your own My Health Record.

How teens can protect their confidentiality

Teenagers can have control over what is uploaded onto their My Health Record. They can ask their doctor and any other health professional they see not to upload the information about their health visit they wish to keep confidential.

Teens can also ask the doctor to tick the “MHR opt out” box on pathology requests and prescriptions so these are not uploaded. Or they can ask the pharmacist not to upload medication dispensing information.

Doctors, pharmacists and other health professionals should also remember to ask all young people whether they want their test results, prescriptions or health summaries uploaded or not.

If either party doesn’t request an opt-out, pathology tests and prescriptions will be automatically uploaded.

Problems with this system

Young Australians have the legal right to confidential health care. This means they can visit a health professional on their own, and the information shared must be kept confidential unless there is a risk of suicide or if the young person is under 16 and being abused.

Confidentiality has been shown to improve young people’s willingness to seek help early and thereby prevent unwanted consequences of behaviours or mental health issues. Katy, for example, has obtained an STI test and contraception which will help prevent unwanted sexual health issues.

Read more: Sex, drugs and illness: why teens need medical confidentiality

This current system for protecting the confidentiality of teenagers’ information on their My Health Record has obvious flaws. It relies on busy health professionals – some of whom may not be experienced in the My Health Record – remembering to ask every teenager whether they want information uploaded or not.

It also places the onus on teenagers, who in many cases may not be fully versed in the health care system. It relies on them to remember, and have the confidence, to ask for information not to be uploaded.

Let’s go back to Katy again. In Katy’s situation, the information she shares with her friend’s GP must legally be kept confidential. Because Katy is under 18, the doctor must decide whether she is mature enough to consent to treatment, such as contraception, on her own.

Katy had a My Health Record created for her when she was 13 and didn’t take much notice of the laws around this at the time. She doesn’t know that she can take control of her own record and even if she did, she would be worried about offending her mother. Katy doesn’t ask this GP not to upload today’s visit information and the GP, who isn’t her usual GP, doesn’t remember to ask her.

The My Health Record default settings won’t permit her mother to access her Medicare and Pharmaceutical Benefits Scheme data, so the record of her pregnancy test and visit to the GP isn’t visible to her mother. But the doctor’s summary that mentions a prescription for contraception and an STI screen is. If Katy’s mother decides to check her My Health Record, Katy’s confidentiality will be breached.

Teen-friendly My Health Records

The overwhelming concern is that young people will forgo important and timely health care because of concerns about confidentiality. We should be progressing the confidence of young people to take charge of their health, not driving them back.

At the same time, young people may not have the benefits that accrue with an electronic health record if they continuously choose not to have health events uploaded for fear that others will find out.

The Australian Digital Health Agency must urgently redesign the My Health Record program to respect young people’s right to autonomy and confidential health care.

The My Health Record must be automatically shifted to the control of the young person once they turn 14, with no obligation for parental access.

The uploading of pathology tests and prescriptions should be opt-in, not opt-out. This would mean health care providers must ask each time whether information gets uploaded.

An official communication campaign is needed for young people aged 14 to 18 to explain what the My Health Record will mean for them and how they can have the benefits of a record, without losing their rights to confidential health care. Communications must be targeted at young people and designed in collaboration with young people.

These important steps will enable young people to feel secure in managing their own health care and their My Health Record.

The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.