Procedure for release of myHealthRecord data under s70(1) of myHealthRecords Act
Dear Australian Digital Health Agency,
Please treat this request if possible as an operational request. If not possible, please consider an informal request and failing this, consider this to be a request under the Freedom of Information Act 1982.
I request a copy of any documents (for example a work instruction or procedure) which applies to release of myHealthRecord data held by Digital Health Australia as the myHealthRecord Act in response to a request from an enforcement body under section 70(1) of the myHealthRecord Act. I request the final version of the document, which is in effect today, 25th July 2018. I believe that this meets the definition of unpublished Operational information under s8A and s10 of the FOI Act.
I request the document be provided in electronic form.
Given the significant media attention surrounding this issue, I further request that processing fees for this request be waived in the public interest.
I am happy to discuss this request further by phone or email if it will assist.
Yours faithfully,
Trent Yarwood
Dear Trent Yarwood,
Thank you for your enquiry titled: Freedom of Information request -
Procedure for release of myHealthRecord data under s70(1) of
myHealthRecords Act [SEC=No Protective Marking].
Your request has been created with ID 40837. An Australian Digital Health
Agency representative will be in contact with you shortly.
If you have any questions or require further information please don’t
hesitate to contact us at [1][email address] or on 1300 901 001.
Kind regards,
Digital Health Help Centre
Australian Digital Health Agency
Level 25, 56 Pitt St
Sydney NSW 2000
Phone: 1300 901 001
Fax: 1300 909 115
[2][email address]
[3]www.digitalhealth.gov.au
Any personal information you provide to the Agency will be used by the
Agency to assist us with responding to your enquiry. If we cannot resolve
your enquiry, we may need to pass your information on to the Department of
Human Services or Department of Health. If you do not wish your enquiry to
be transferred to another entity, please let us know. For more
information on the ways the Agency handle your personal information, how
you can access and seek correction of the information, how privacy
complaints can be made and how the Agency deals with such complaints,
please see the [4]Agency Privacy Policy.
Important: This transmission is intended only for the use of the addressee
and may contain confidential or legally privileged information. If you are
not the intended recipient, you are notified that any use or dissemination
of this communication is strictly prohibited. If you receive this
transmission in error please notify the author immediately and delete all
copies of this transmission.
References
Visible links
1. mailto:[email address]
2. mailto:[email address]
3. http://www.digitalhealth.gov.au/
4. https://www.digitalhealth.gov.au/privacy
Dear Trent
Could you please confirm our understanding that you seek administrative
release of documents and are not making an FOI request?
Do you have alternative details for the Agency to reply directly to you?
We assume that if you reply by continuing to use the Right to Know
website, your message (including any contact details in the message) will
be published there. Instead, you can provide your details directly to the
Agency by sending an email from your email account to
[1][email address]
Please note there is operational information about My Health Record and
the Australian Digital Health Agency at:
My Health Record website
[2]https://www.myhealthrecord.gov.au/
Australian Digital Health Agency website
[3]https://www.digitalhealth.gov.au/
Information about how to make a Freedom of Information request for
specific documents which may be held by the Australian Digital Health
Agency is available at:
[4]https://www.digitalhealth.gov.au/about-t...
Please note this email address is not for FOI requests.
Kind regards,
Digital Health Help Centre
Australian Digital Health Agency
The Australian Digital Health Agency acknowledges the traditional owners
of country throughout Australia, and their continuing connection to land,
sea and community. We pay our respects to them and their cultures,and to
Elders both past and present.
On 25/07/2018 10:16 AM the following request was opened for Trent Yarwood.
Dear Australian Digital Health Agency,
Please treat this request if possible as an operational request. If not
possible, please consider an informal request and failing this, consider
this to be a request under the Freedom of Information Act 1982.
I request a copy of any documents (for example a work instruction or
procedure) which applies to release of myHealthRecord data held by Digital
Health Australia as the myHealthRecord Act in response to a request from
an enforcement body under section 70(1) of the myHealthRecord Act. I
request the final version of the document, which is in effect today, 25th
July 2018. I believe that this meets the definition of unpublished
Operational information under s8A and s10 of the FOI Act.
I request the document be provided in electronic form.
Given the significant media attention surrounding this issue, I further
request that processing fees for this request be waived in the public
interest.
I am happy to discuss this request further by phone or email if it will
assist.
Yours faithfully,
Trent Yarwood
-------------------------------------------------------------------
Please use this email address for all replies to this request:
[FOI #4712 email]
Is [email address] the wrong address for Freedom of Information
requests to Australian Digital Health Agency? If so, please contact us
using this form:
https://www.righttoknow.org.au/change_re...
This request has been made by an individual using Right to Know. This
message and any reply that you make will be published on the internet.
More information on how Right to Know works can be found at:
https://www.righttoknow.org.au/help/offi...
If you find this service useful as an FOI officer, please ask your web
manager to link to us from your organisation's FOI page.
-------------------------------------------------------------------
Important: This transmission is intended only for the use of the addressee
and may contain confidential or legally privileged information. If you are
not the intended recipient, you are notified that any use or dissemination
of this communication is strictly prohibited. If you receive this
transmission in error please notify the author immediately and delete all
copies of this transmission.
References
Visible links
1. mailto:[email address]
2. https://www.myhealthrecord.gov.au/
3. https://www.digitalhealth.gov.au/
4. https://www.digitalhealth.gov.au/about-t...
Dear [email address],
Hello and thanks for the reply.
I am happy for the responses to continue being published here.
My preference would be for the request to be handled as an operational request if this is at all possible.
Only if this is not possible, then I would request it be handled as a request under the FOI act.
Yours sincerely,
Trent Yarwood
Dear Trent,
It is still unclear what request you are making.
If all you request is a policy statement or operational information on the topic
of s70 of the My Health Records Act 2012, please see Agency websites, including:
Fact sheet: Police access to My Health Record (21 July 2018)
[1]https://www.myhealthrecord.gov.au/news-a...
If you are requesting administrative access to something else, we need to
clarify this with you. We have requested your personal contact details to
discuss this with you.
If you wish to make a Freedom of Information (FOI) request for specific
documents which may be held by the Australian Digital Health Agency, we have
also provided a link to information on how to do this, in accordance with the
Freedom of Information Act 1982:
[2]https://www.digitalhealth.gov.au/about-t...
Please note the Agency email address you are using to contact us is not
for FOI requests.
Kind regards,
Digital Health Help Centre
Australian Digital Health Agency
Important: This transmission is intended only for the use of the addressee
and may contain confidential or legally privileged information. If you are
not the intended recipient, you are notified that any use or dissemination
of this communication is strictly prohibited. If you receive this
transmission in error please notify the author immediately and delete all
copies of this transmission.
References
Visible links
1. https://www.myhealthrecord.gov.au/news-a...
2. https://www.digitalhealth.gov.au/about-t...
Verity Pane left an annotation ()
Rather disappointing that the Digital Health Authority wanted to take its communications offline from Right to Know when clearly there was no personal information aspect of the request (which is the only valid reason to take an FOI offline from Right to Know). It comes across as the agency wanting to be opaque about the handling of this FOI.
Also, there seems to be some feigned obtuseness in the latest response from the Authority to this request. I note some unscrupulous agencies have taken to this tactic, often used by politicians in media interviews, of simply pretending to not understand the question.
It is pretty clear what the scope of the request is, which isn’t for an already publicly available information sheet, but for a copy of internal ADHA policy or instruction on the handling of requests for disclosure of the contents of a My Health Record by third parties. If there is any issue, it is that it may be that the scope will exceed the free processing period, and charges may apply, and/or that their may be exemption challenges ahead.
It would be better if the Digital Health Agency just got on with it, instead of playing unhelpful games.
Verity Pane left an annotation ()
Dear Trent,
Just an FYI - note that annotations made to a Right to Know request are *not* sent to the agency, so they wouldn’t have necessarily seen your earlier revision of scope that you made (to correct a typo).
If you want an agency to see your message, you have to use the reply function, not the annotation function.
Kind Regards
Verity
Dear [email address],
Thank you for attempting to clarify my request.
I seek an electronic copy of ADHA's internal policy or procedure relating to requests for access to myHealthRecord data by external agencies.
Prior to the announcement of planned legislative change to s70 of the my Health Records Act, Health Minister Hunt made repeated assurances that the policy of ADHA was not to release these records without a court order:
“This policy requires a court order to release any My Health Record information without consent." (from this article: https://www.theguardian.com/australia-ne...)
I would like to see a copy of the policy to which the Minister was referring, as it was current on 25th July. My intention is to confirm that the ADHA policy in effect at the time did indeed include a requirement for a court order, as it was not required by the legislation.
To help reduce any further ambiguity in my request, I ask that you consider this a formal request under the Freedom of Information Act and not as an administrative request.
Yours sincerely,
Trent Yarwood
Trent Yarwood left an annotation ()
Sent via email tonight, including my contact details.
---
Dear FOI team
I refer to your correspondence to me in regards to my FOI request, reference 40837, lodged via Right To Know
https://www.righttoknow.org.au/request/p...
As discussed in my most recent reply, my request is as follows:
I seek access to a copy of ADHA's internal policy on how to manage requests for access to myHealthRecord data received from an enforcement body under s70 of the my Health Records Act 2012.
I seek access to the version of this policy that was in force on the date of my initial request, 25th July 2018.
In reference to my clarification today, 2nd August 2018 via Right To Know, I request that my request of 25th July be treated as a Freedom of Information request.
I request that that in view of the significant public interest surrounding this issue and multiple articles in the media and repeated statements by the Health Minister relating to this policy, FOI processing fees be waived in the public interest.
I request an electronic copy of the document (for example a PDF or Word document). I further request that this be sent to me via Right to Know,
I am happy for your staff to contact me by email or by phone to clarify the scope of this request further if that is required.
Yours faithfully,
Trent Yarwood.
Trent Yarwood left an annotation ()
Received today via email
OFFICIAL
Dear Mr Yarwood
Australian Digital Health Agency acknowledges receipt of your FOI Request made pursuant to section 15 of the Freedom of Information Act 1982 (Cth) (FOI Act). We understand your FOI Request in the email below is asking for:
A copy of ADHA's internal policy on how to manage requests from an enforcement body for access to My Health Record data under s70 of the my Health Records Act 2012, specifically an electronic copy of the version of this policy that was in force on 25 July 2018.
Your valid FOI Request was received on 2 August 2018. The Agency is required, subject to any extensions of time provided for under the FOI Act, to search for relevant documents that may exist and notify you of a decision on the request as soon as practicable but in any case not later than the end of the period of 30 days after the day on which the request is received. This means you should expect to hear from the Agency by 1 September 2018.
Further information about Freedom of Information at the Agency is available at https://www.digitalhealth.gov.au/about-t... and using the contact details below.
Kind regards
FOI Team
Justin Warren left an annotation ()
The original request was a valid request under s 15 http://www8.austlii.edu.au/cgi-bin/viewd... of the Act.
ADHA didn't say it was a non-compliant request, and anyway has a duty to assist with making a compliant request under s 15 (3). They were given the option to respond in a less formal way, and have chosen not to, so the clock started when the request was first made.
Verity Pane left an annotation ()
The agency is committing a breach of FOI legislation by resetting the FOI statutory processing period clock from 26 July 2018, which was the day following the date the FOI request from made (while the requester provided the agency the opportunity to divert the FOI request to administrative release, the requester was clear that the application was to be treated as an FOI application if administrative access was not agreed to by the agency), to 2 August 2018 (a week later).
The obligation on an agency or minister to notify an applicant that a request has been received, and to make and notify a decision on the request within the statutory timeframe, commences upon receipt of a request that meets the formal requirements for an FOI.
Those formal requirements do not exceed that:
* The application is in writing
• The application states that it is a request for the purposes of the FOI Act but agencies and ministers should nevertheless take a flexible approach when assessing whether an applicant has met this requirement. If an applicant’s intention is not clear the agency or minister should contact them to confirm whether the request was intended to be made under the FOI Act (which the applicant has)..
• The request provides such information as is reasonably necessary to enable a responsible officer of the agency or the minister to identify the document that is requested (which the applicant did)
* The application gives details of how notices under the FOI Act may be sent to the applicant (which he did but the agency has deliberately tried to take its responses offline from RtK in breach)
• The application was sent to the agency or minister via its specified addresses
It is fraudulent of the agency to make out it did not receive a valid FOI until the 2nd August.
Dear [email address],
I am writing to you regarding the status of this request, dated 25th July, my original submission of the question, which was a valid FOI request, and therefore should be now past due.
I note during the clarification here, and via email that your agency considers the submission date to be 2nd August and therefore the due date to be this Saturday 1st September.
While I believe this to be incorrect, I am happy for you to arrange delivery of the electronic version of the document to me (preferably via righttoknow) by Saturday.
I believe this is a relatively straight forward request, so if it seems that you will be unable to provide this document, I would appreciate some details on why this is the case.
I look forward to hearing from you with regards this request.
Yours sincerely,
Trent Yarwood
Trent Yarwood left an annotation ()
Sent via email just now (as well as Friday's reply via rtk)
Dear FOI Team,
I am writing to you to formally complain about the lack of communication with regards to this FOI request. I refer you to my original FOI submission of 25th July available on righttoknow.org, my email to this address of 2nd August and my follow-up via right to know on 29th August (https://www.righttoknow.org.au/request/p...)
As mentioned in my correspondence via right to know, I believe this should be a straight-forward request; the Health Minister categorically stated that such a policy existed. I have not had any correspondence from you relating to your progress on this request.
Please contact my (preferably via right to know, but email to this address or via phone would also be acceptable) to update me on the progress of this request.
I have cc'ed the Office of the Australian Information Commissioner, as I wish to lodge this as a formal complaint as there has been no communication since your acknowledgement of receipt.
Yours faithfully
Trent Yarwood
Future Wise Australia.
Dear [email address],
I would like to request an internal review on the handling of my Freedom of Information request ID 1807015.
This request is now substantially overdue. I would like to formally request that this be addressed prior to the end of the opt-out period.
I look forward to you correspondence relating to this request. Again, I request that this occur via Right To Know rather than via my email.
Yours sincerely,
Trent Yarwood
Dear Trent Yarwood,
Thank you for your enquiry titled: Internal review of Freedom of
Information request - Procedure for release of myHealthRecord data under
s70(1) of myHealthRecords Act.
Your request has been created with ID 44152. An Australian Digital Health
Agency representative will be in contact with you shortly.
If you have any questions or require further information please don’t
hesitate to contact us at [1][email address] or on 1300 901 001.
Kind regards,
Digital Health Help Centre
Australian Digital Health Agency
Level 25, 56 Pitt St
Sydney NSW 2000
Phone: 1300 901 001
Fax: 1300 909 115
[2][email address]
[3]www.digitalhealth.gov.au
Any personal information you provide to the Agency will be used by the
Agency to assist us with responding to your enquiry. If we cannot resolve
your enquiry, we may need to pass your information on to the Department of
Human Services or Department of Health. If you do not wish your enquiry to
be transferred to another entity, please let us know. For more
information on the ways the Agency handle your personal information, how
you can access and seek correction of the information, how privacy
complaints can be made and how the Agency deals with such complaints,
please see the [4]Agency Privacy Policy.
Important: This transmission is intended only for the use of the addressee
and may contain confidential or legally privileged information. If you are
not the intended recipient, you are notified that any use or dissemination
of this communication is strictly prohibited. If you receive this
transmission in error please notify the author immediately and delete all
copies of this transmission.
References
Visible links
1. mailto:[email address]
2. mailto:[email address]
3. http://www.digitalhealth.gov.au/
4. https://www.digitalhealth.gov.au/privacy
Verity Pane left an annotation ()
There seems to be a lot of improper conduct going on over at the ADHA, with respect to its FOI management, which the OAIC appears content to let continue.
I therefore wish you luck.
It’s pretty clear if the ADHA doesn’t want to release a document, it won’t, regardless of its legal obligations.
Given the very low volume of FOI requests made to the ADHA (less than a handful here on Right to Know and the same listed in its FOI disclosure log), it’s inexplicable the delays the ADHA create.
I’d say consider IC Review, but with the OAIC breaching its own FOI Directives of late, and essentially enabling the ADHA in this impugned conduct, it’d be rather pointless.
OFFICIAL
Dr Trent Yarwood
Senior Health Policy Advisor
Future Wise
By email: [1][FOI #4712 email]
Dear Dr Yarwood
This email is to say that we have received in this office on 27 September
2018 your application for an internal review for access to documents under
the Freedom of Information Act 1982.
We will contact you again to formally acknowledge your application.
In the meantime if you have any questions, please email us at
[2][ADHA request email] or phone the FOI Team on 02 6151 8653.
Regards
FOI Team
Governance and Performance Reporting Services
Governance, Reporting and Secretariat Services Branch
Organisational Capability and Change Management Division
[3]cid:image003.png@01D42F47.442054A0
Australian Digital Health Agency
Scarborough House, Level 7, 1 Atlantic Street, Woden ACT 2606
Phone 02 6151 8653
Email [4][ADHA request email]
Web [5]www.digitalhealth.gov.au
Important: This transmission is intended only for the use of the addressee
and may contain confidential or legally privileged information. If you are
not the intended recipient, you are notified that any use or dissemination
of this communication is strictly prohibited. If you receive this
transmission in error please notify the author immediately and delete all
copies of this transmission.
References
Visible links
1. mailto:[FOI #4712 email]
2. mailto:[ADHA request email]
4. mailto:[ADHA request email]
5. http://www.digitalhealth.gov.au/
The attached documents are part of a response that the applicant has
provided to us.
We have decided to upload them as we had the wrong email account for the
ADHA.
—
Ben Fairless
[1]OpenAustralia Foundation
[2]openaustralia | [3]planningalerts | [4]electionleaflets | [5]righttoknow | [6]theyvoteforyou | [7]morph
References
Visible links
1. http://openaustraliafoundation.org.au/
2. https://openaustralia.org.au/
3. https://planningalerts.org.au/
4. https://electionleaflets.org.au/
5. https://righttoknow.org.au/
6. https://theyvoteforyou.org.au/
7. https://morph.io/
Verity Pane left an annotation ()
Interesting!
The only evidence of any internal ADHA policy on how to manage requests from an enforcement body for access to My Health Record data under s70 of the my Health Records Act 2012 comes from minutes of the Board, and it appears their request to the Department of Health for further guidance hadn’t been answered yet as at 2 August 2018 (when the agency started the clock on the FOI).
In summary, it appears an issue the ADHA only considered quite late in the piece, well after universal Opt Out was decided, given it was only considered by the Executive Board in June 2018 (which explains the lack of a formal policy document).
Trent Yarwood left an annotation ()
See also this tweet linking to the myHR privacy policy. https://twitter.com/Stevie_Easton/status...
But I agree, it's all a bit weak.
Verity Pane left an annotation ()
I agree; I can see the point the journalist is trying to make, but it also needs to be viewed in the context that a privacy policy is a notice to individuals about what an APP entity collects, uses and discloses from them (an APP 2 notice).
In that context, it’s not intended for internal use by an organisation, and it’s status is of an advisory document.
Given the media statements made by ADHA and the Minister, there was an implied contention that this was a long held and well documented position and process, but this doesn’t appear supported by the evidence (rather it seems a question that only recently arose in the minds of the ADHA Executive Board).
But well done on getting a relevant document out of ADHA - I’m still waiting for mine.
Trent Yarwood left an annotation ()
Apologies, there is a typo in my request;
Please read: "which applies to release of myHealthRecord data held by Digital Health Australia as the myHealthRecord Act in response to a request from an enforcement body under section 70(1) of the myHealthRecord Act"
as:
"which applies to release of myHealthRecord data held by Digital Health Australia in its role as the System Operator of myHealthRecord Act; in response to a request from an enforcement body under section 70(1) of the myHealthRecord Act"