eHealth records

6.80       The following section discusses the Personally Controlled Electronic Health Records Act 2012 (PCEHR Act), which contains provisions dealing with decision-making concerning the collection, use and disclosure of personally controlled electronic health records—referred to as ‘eHealth records’.

6.81       An eHealth record is an electronic summary of a person’s health records, which the individual consumer and their healthcare providers can access online when needed. The eHealth record system was implemented nationally in July 2012, allowing people seeking healthcare in Australia to register for an eHealth record. Healthcare Provider Organisations can also register to participate in the eHealth record system, and authorise their employees to access the eHealth record system.

6.82       As the system develops over time, having an eHealth record will give healthcare providers access to a summary of key health information, as long as the person gives consent in confirming access settings for the eHealth record. This will include information such as medications, hospital discharge summaries, allergies and immunisations.[76]

Individual decision-making and eHealth records

6.83       Under the legislative framework for eHealth, there are protections against the mishandling of information.[77] Individuals can control their own eHealth record by choosing to restrict which healthcare provider organisations can access it and what information is included through exercising ‘access controls’.[78] Unauthorised collection, use or disclosure of eHealth record information is both a contravention of the PECHR Act and an interference with privacy under the Privacy Act 1988 (Cth).[79]

6.84       The Office of the Australian Information Commissioner (OAIC) is the privacy regulator for the PECHR Act. The OAIC regulates the handling of personal information in the eHealth system by individuals, Australian Government agencies, private sector organisations and some state and territory agencies (in particular circumstances).[80]

6.85       The PCEHR Act contains detailed schemes for ‘nominated representatives’ and ‘authorised representatives’. In the terminology used by the ALRC, the former are analogous to ‘supporters’ and the latter to ‘representatives’.

‘Nominated representatives’

6.86       The nominated representative provisions are intended to support the involvement of people other than healthcare professionals in assisting consumers in managing their healthcare. Nominated representatives may be family members, carers, neighbours or any other person nominated by a consumer.[81]

6.87       For a person to be a nominated representative, there must be an agreement between the consumer and the proposed nominated representative. This agreement does not have to be in writing. The consumer must also notify the System Operator that the other person is her or his nominated representative.[82]

6.88       Consumers remain able to access and control their eHealth records themselves, and access by a nominated representative is subject to any access controls set by the consumer.

6.89       For example, in some cases a nominated representative may have ‘read-only’ access to a consumer’s eHealth record. In other cases, a consumer may allow a nominated representative to do anything the consumer can do, including setting access controls, and granting access to healthcare provider organisations.

This flexibility in setting access controls is designed to take into account the many circumstances where a person may not be able to, or may not wish to, manage their own [eHealth record] but where they do not have a formal legally recognised representative to act on their behalf.[83]

6.90       A nominated representative must always act in the ‘best interests’ of the consumer, subject to the consumer’s directions.[84] A consumer may have more than one nominated representative.[85]

‘Authorised representatives’

6.91       People who may have impaired decision-making ability are able to have an eHealth record. To facilitate this, an authorised representative is able to register a consumer for an eHealth record and manage the access controls on behalf of the consumer.

6.92       A person may be an authorised representative of a person over 18 years old if the System Operator is satisfied that a consumer is not capable of making decisions for themselves, and that another person is authorised by an Australian law, or by a decision of an Australian court or tribunal, to act on behalf of the consumer.[86]

6.93       If there is no such person, the System Operator may appoint someone else if satisfied that the person is an appropriate person to be the authorised representative.[87] This provision is said to allow the System Operator, in making appointments, to ‘take into account a range of other circumstances for people without capacity, or with only limited capacity’.[88]

6.94       For the purposes of the PCEHR Act and the eHealth system, an authorised representative is treated as if they were the consumer. That is, the authorised representative can do anything authorised or required of the consumer, and anything done by an authorised representative in relation to the system is taken as if it were done by the consumer.[89]

6.95       An authorised representative must always act in the best interests of the consumer, having regard to any directions from the consumer expressed when they had capacity to act on their own behalf.[90] A consumer may have more than one authorised representative.[91]

The Commonwealth model and eHealth records

Recommendation 6–3               The Personally Controlled Electronic Health Records Act 2012 (Cth) should be amended to include provisions dealing with supporters and representatives consistent with the Commonwealth decision-making model.

6.96       The existing scheme for authorised and nominated representatives contained in the PCEHR Act is detailed and tailored to the operation of the voluntary national system for the provision of access to electronic health information.

6.97       The scheme is designed, among other things, to ensure that people who have impaired decision-making ability are able to have an eHealth record, and to enable people to share their health information with those who need it. For example, an older person may want their son or daughter to be able to view key health information, such as currently prescribed medications and test results, in order to provide care and assistance to them.

6.98       The ALRC does not prescribe any comprehensive new decision-making scheme for the PCEHR Act. Individual decision-making under the PCEHR Act is relatively limited—being confined to decisions about the collection, use and disclosure of health information. This is more confined than, for example, decision-making under the Aged Care Act, which often involves significant decisions about the provision of residential and home care services and the entering of contractual arrangements.

6.99       However, the existing PCEHR Act provisions concerning nominated and authorised representatives should be reviewed and amended in the light of the National Decision-Making Principles and the Commonwealth decision-making model.

6.100   Broadly, nominated representatives under the PCEHR Act are analogous to ‘supporters’ in the Commonwealth decision-making model. They are nominated by the person concerned, and are subject to directions by the consumer, who may also continue to make decisions under the PCEHR Act.

6.101   Apart from adopting consistent terminology, changes to these nominated representatives provisions should include providing that, in making decisions, supporters have obligations to:

  • consider the will, preferences and rights of the person represented (rather than the current best interests test);
  • consult with existing appointees, family members, carers and other significant people;
  • perform the role diligently and in good faith.

6.102   Authorised representatives provide substitute decision-making concerning eHealth records and, therefore, perform a role analogous to that of ‘representatives’ in the Commonwealth decision-making model. Changes to these PCEHR Act provisions should include incorporating the ‘will, preferences and rights’ approach to decision-making; the recommended guidelines for determining decision-making ability; and the recommended factors for determining whether a person or organisation is suitable for appointment.

6.103   There are arguments that no change to existing provisions of the PCEHR Act is necessary because the system already strikes a balance between safeguards for the privacy and related rights of the person and allows authorised representatives to be appointed without undue administrative complexity. The NSW Council for Intellectual Disability (NSWCID), for example, cautioned that if a decision-making system is not easy to understand and use,

service agencies and health professionals will tend to either ignore the system or deny access to services to people with disability. For example, doctors are much less likely to embrace the system of eHealth records with their patients who have intellectual disability if the system for supported or representative decision making is complex. Similarly, complex decision making systems can unduly delay important exchange of information in relation to a person so that the person suffers detriment.[92]

6.104   There should be a balance between safeguards and avoiding undue administrative complexity so that mechanisms are

proportionate to the situation. For example, there should be a straightforward process for a close family member to become the representative of a person for processes like Centrelink and eHealth records.[93]

6.105   The OAIC expressed concern that adopting the ‘supporter’ and ‘representative’ terminology in place of the current terminology could ‘create confusion and additional complexities within the PCEHR system’ because authorised and nominated representatives perform functions under the PCEHR Act that are not necessarily equivalent to the roles of supporters and representatives under the Commonwealth decision-making model.[94]

6.106   In the ALRC’s view, it is important to encourage the implementation of supported decision-making in this area of Commonwealth responsibility but unnecessary formality should be avoided. Decisions under the PCEHR Act involve only the handling of personal information. Therefore, there may be a case for provisions that are more minimal than those recommended in the Commonwealth decision-making model.

6.107   The ALRC concludes that it would be better if the same terminology were used as in the NDIS scheme and social security, notwithstanding the more limited role of supporters and representatives under the PCEHR Act. The main objective is to ensure that consistent obligations are imposed, especially to consider the will, preferences and rights of the person being supported.

6.108   The ALRC understands that at present, authorised representatives are generally the parents of persons under the age of 18, who wish their child to opt-in to the system. In this context, a review of the PCEHR has recommended transition to an ‘opt-out’ model for the PCEHR scheme.[95] Issues concerning the availability and obligations of representatives will take on a different character, if a representative is needed in order for someone to be able to opt-out of the scheme.