Are your health records safer in paper than online?

While the discussion about opting out of MyHealth record at a Federal level centres on issues relating to cybersecurity, a reported data breach in NSW last week indicates that paper health records may not be more secure.

The ABC reported that more than 1,000 confidential medical records had been found in a derelict former aged care facility near Helensburgh. Photos posted with the report indicated graffiti in the facility which was dated 2015 and records strewn about.

A reproduced but de-identified patient record published as part of the report indicated that the records included pain, incontinence charts, social worker reports, doctor's referrals and hospital admission forms.

While it has not been confirmed, NSW Health has stated that the building was illegally accessed and, even if that is the case, the photos in the report indicate via the tag on the graffiti that it has been illegally accessed since 2015. If the records strewn about the floor have the potential to contain personal information then that it is a long time for NSW Health to have failed to take action to secure the records.

It is reported that the NSW Health Minister, Brad Hazzard, has instructed an audit of archived medical records. He has also expressed apologies to families whose relatives may have had records in the relevant facilities.

If the reported facts are true, the situation is a breach of the Health Records and Information Privacy Act 2002 (NSW) and Health Privacy Principle 5 which requires that an organisation that holds health information must ensure that "the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse" and then that "the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information".

This publication does not deal with every important topic or change in law and is not intended to be relied upon as a substitute for legal or other advice that may be relevant to the reader's specific circumstances. If you have found this publication of interest and would like to know more or wish to obtain legal advice relevant to your circumstances please contact one of the named individuals listed.