Apologies, there is a typo in my request;

Please read: "which applies to release of myHealthRecord data held by Digital Health Australia as the myHealthRecord Act in response to a request from an enforcement body under section 70(1) of the myHealthRecord Act"

as:

"which applies to release of myHealthRecord data held by Digital Health Australia in its role as the System Operator of myHealthRecord Act; in response to a request from an enforcement body under section 70(1) of the myHealthRecord Act"

Rather disappointing that the Digital Health Authority wanted to take its communications offline from Right to Know when clearly there was no personal information aspect of the request (which is the only valid reason to take an FOI offline from Right to Know). It comes across as the agency wanting to be opaque about the handling of this FOI.

Also, there seems to be some feigned obtuseness in the latest response from the Authority to this request. I note some unscrupulous agencies have taken to this tactic, often used by politicians in media interviews, of simply pretending to not understand the question.

It is pretty clear what the scope of the request is, which isn’t for an already publicly available information sheet, but for a copy of internal ADHA policy or instruction on the handling of requests for disclosure of the contents of a My Health Record by third parties. If there is any issue, it is that it may be that the scope will exceed the free processing period, and charges may apply, and/or that their may be exemption challenges ahead.

It would be better if the Digital Health Agency just got on with it, instead of playing unhelpful games.

Dear Trent,

Just an FYI - note that annotations made to a Right to Know request are *not* sent to the agency, so they wouldn’t have necessarily seen your earlier revision of scope that you made (to correct a typo).

If you want an agency to see your message, you have to use the reply function, not the annotation function.

Kind Regards

Verity

Sent via email tonight, including my contact details.
---

Dear FOI team

I refer to your correspondence to me in regards to my FOI request, reference 40837, lodged via Right To Know

https://www.righttoknow.org.au/request/p...

As discussed in my most recent reply, my request is as follows:

I seek access to a copy of ADHA's internal policy on how to manage requests for access to myHealthRecord data received from an enforcement body under s70 of the my Health Records Act 2012.

I seek access to the version of this policy that was in force on the date of my initial request, 25th July 2018.

In reference to my clarification today, 2nd August 2018 via Right To Know, I request that my request of 25th July be treated as a Freedom of Information request.

I request that that in view of the significant public interest surrounding this issue and multiple articles in the media and repeated statements by the Health Minister relating to this policy, FOI processing fees be waived in the public interest.

I request an electronic copy of the document (for example a PDF or Word document). I further request that this be sent to me via Right to Know,

I am happy for your staff to contact me by email or by phone to clarify the scope of this request further if that is required.

Yours faithfully,

Trent Yarwood.

Received today via email

OFFICIAL

Dear Mr Yarwood

Australian Digital Health Agency acknowledges receipt of your FOI Request made pursuant to section 15 of the Freedom of Information Act 1982 (Cth) (FOI Act). We understand your FOI Request in the email below is asking for:

A copy of ADHA's internal policy on how to manage requests from an enforcement body for access to My Health Record data under s70 of the my Health Records Act 2012, specifically an electronic copy of the version of this policy that was in force on 25 July 2018.

Your valid FOI Request was received on 2 August 2018. The Agency is required, subject to any extensions of time provided for under the FOI Act, to search for relevant documents that may exist and notify you of a decision on the request as soon as practicable but in any case not later than the end of the period of 30 days after the day on which the request is received. This means you should expect to hear from the Agency by 1 September 2018.

Further information about Freedom of Information at the Agency is available at https://www.digitalhealth.gov.au/about-t... and using the contact details below.

Kind regards

FOI Team

The original request was a valid request under s 15 http://www8.austlii.edu.au/cgi-bin/viewd... of the Act.

ADHA didn't say it was a non-compliant request, and anyway has a duty to assist with making a compliant request under s 15 (3). They were given the option to respond in a less formal way, and have chosen not to, so the clock started when the request was first made.

The agency is committing a breach of FOI legislation by resetting the FOI statutory processing period clock from 26 July 2018, which was the day following the date the FOI request from made (while the requester provided the agency the opportunity to divert the FOI request to administrative release, the requester was clear that the application was to be treated as an FOI application if administrative access was not agreed to by the agency), to 2 August 2018 (a week later).

The obligation on an agency or minister to notify an applicant that a request has been received, and to make and notify a decision on the request within the statutory timeframe, commences upon receipt of a request that meets the formal requirements for an FOI.

Those formal requirements do not exceed that:
* The application is in writing
• The application states that it is a request for the purposes of the FOI Act but agencies and ministers should nevertheless take a flexible approach when assessing whether an applicant has met this requirement. If an applicant’s intention is not clear the agency or minister should contact them to confirm whether the request was intended to be made under the FOI Act (which the applicant has)..
• The request provides such information as is reasonably necessary to enable a responsible officer of the agency or the minister to identify the document that is requested (which the applicant did)
* The application gives details of how notices under the FOI Act may be sent to the applicant (which he did but the agency has deliberately tried to take its responses offline from RtK in breach)
• The application was sent to the agency or minister via its specified addresses

It is fraudulent of the agency to make out it did not receive a valid FOI until the 2nd August.

Sent via email just now (as well as Friday's reply via rtk)

Dear FOI Team,

I am writing to you to formally complain about the lack of communication with regards to this FOI request. I refer you to my original FOI submission of 25th July available on righttoknow.org, my email to this address of 2nd August and my follow-up via right to know on 29th August (https://www.righttoknow.org.au/request/p...)

As mentioned in my correspondence via right to know, I believe this should be a straight-forward request; the Health Minister categorically stated that such a policy existed. I have not had any correspondence from you relating to your progress on this request.

Please contact my (preferably via right to know, but email to this address or via phone would also be acceptable) to update me on the progress of this request.

I have cc'ed the Office of the Australian Information Commissioner, as I wish to lodge this as a formal complaint as there has been no communication since your acknowledgement of receipt.

Yours faithfully

Trent Yarwood
Future Wise Australia.

There seems to be a lot of improper conduct going on over at the ADHA, with respect to its FOI management, which the OAIC appears content to let continue.

I therefore wish you luck.

It’s pretty clear if the ADHA doesn’t want to release a document, it won’t, regardless of its legal obligations.

Given the very low volume of FOI requests made to the ADHA (less than a handful here on Right to Know and the same listed in its FOI disclosure log), it’s inexplicable the delays the ADHA create.

I’d say consider IC Review, but with the OAIC breaching its own FOI Directives of late, and essentially enabling the ADHA in this impugned conduct, it’d be rather pointless.

Interesting!

The only evidence of any internal ADHA policy on how to manage requests from an enforcement body for access to My Health Record data under s70 of the my Health Records Act 2012 comes from minutes of the Board, and it appears their request to the Department of Health for further guidance hadn’t been answered yet as at 2 August 2018 (when the agency started the clock on the FOI).

In summary, it appears an issue the ADHA only considered quite late in the piece, well after universal Opt Out was decided, given it was only considered by the Executive Board in June 2018 (which explains the lack of a formal policy document).

See also this tweet linking to the myHR privacy policy. https://twitter.com/Stevie_Easton/status...

But I agree, it's all a bit weak.

I agree; I can see the point the journalist is trying to make, but it also needs to be viewed in the context that a privacy policy is a notice to individuals about what an APP entity collects, uses and discloses from them (an APP 2 notice).

In that context, it’s not intended for internal use by an organisation, and it’s status is of an advisory document.

Given the media statements made by ADHA and the Minister, there was an implied contention that this was a long held and well documented position and process, but this doesn’t appear supported by the evidence (rather it seems a question that only recently arose in the minds of the ADHA Executive Board).

But well done on getting a relevant document out of ADHA - I’m still waiting for mine.