Securing personal information: Australian Digital Health Agency

Part 1: Executive Summary

1.1 This report outlines the findings of the Office of the Australian Information Commissioner’s (OAIC’s) privacy assessment of the My Health Record[3] (MHR) system, as operated by the Australian Digital Health Agency (ADHA, as the System Operator) and Accenture (as the contracted National Infrastructure Operator – NIO).

1.2 The purpose of this assessment was to establish whether the ADHA was taking reasonable steps to secure personal information in accordance with Australian Privacy Principle (APP) 11 and the relevant provisions in the My Health Records Act 2012 (Cth). More specifically, this assessment considered whether the ADHA had sufficiently documented its information handling policies, procedures, governance and training.

1.3 The OAIC engaged Lockstep Consulting, a privacy consulting firm, to undertake the privacy assessment jointly with OAIC staff, and to provide analysis of the information security arrangements deployed in the MHR system. The assessment was conducted in June 2018.

1.4 The scope of this assessment included a review of the information security arrangements deployed in the MHR system, in particular a review of System Operator and NIO’s policies, procedures, governance and training applicable to the storage and security of personal information contained in the NRS, as well as the ADHA’s and the implementation of these policies and procedures.

1.5 The assessment did not include a physical review or testing of the technical capabilities of the ICT systems used by the System Operator or NIO, but considered past third-party reviews, which the assessors re-examined.

1.6 The assessment also considered the privacy and security measures put in place by the System Operator, following previous assessments and security reviews. The ADHA’s implementation of the policies and procedures and external reviews were assessed on the basis of staff interviews and review of documents.

1.7 This OAIC found that at the time of the assessment ADHA had taken a number of reasonable steps to secure personal information according to APP 11. However, the assessment also identified some issues relating to document quality, documentation processes, security organisation and management oversight. Establishing the state of security appeared harder than it should be, due to:

• incomplete and inconsistent documentation
• management complexities, such as multi-layered security and privacy committees, which seem to have delayed consideration and remediation of security review findings.

1.8 The assessment team considers that going forward mitigating privacy risks depends on improved visibility of security management, responsiveness to findings, and attention to detail.

1.9 The assessment team has made eight recommendations to address a number of medium level privacy risks and one high-level risk identified during the assessment. The recommendations, and ADHA’s responses, are outlined in Parts 4 and 5 respectively of this report.

Part 2: Description of the assessment

Background

2.1 This assessment is the third in a series of OAIC reviews of the MHR System Operator (SO). Previous OAIC assessments were conducted in 2014[4] and 2016[5] when the Department of Health was the System Operator for the Personally Controlled Electronic Health Record (PCEHR).

2.2 In addition to these assessments, an end-to-end security review was commissioned by the Department of Health in 2015 and completed in 2016.

2.3 A two-stage InfoSec Registered Assessors Program (IRAP) assessment commissioned by ADHA was also concluded in 2017.

2.4 The ADHA announced on 14 May 2018 that every Australian will be offered an MHR unless they choose not to have one during a three month opt-out period which initially ran from 16 July to 15 October 2018.[6] Subsequently, the Minister for Health extended the opt-out period which concluded on 31 January 2019.[7] The commencement of the opt-out period for My Health Record was a significant factor in undertaking this assessment. Considering that the SO must be in a position, from both a security and performance perspective to manage a significant increase in the number of health records in the MHR system by the end of 2018, it was timely to conduct a privacy assessment to ensure the security of personal information held in the system.

Objective and scope

2.5 The objective of this assessment was to consider whether ADHA was taking reasonable steps to secure personal information collected and retained under the My Health Record (MHR) system in accordance with APP 11 and relevant provisions of the My Health Records Act 2012 (Cth). APP 11 requires an entity to take reasonable steps to:

• protect personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure (APP 11.1)
• destroy or de-identify personal information (APP 11.2).

2.6 As part of its ongoing oversight role, the OAIC also sought to re-examine the privacy and security measures put in place by the System Operator, following previous assessments conducted in 2014 and 2016, and the end-to-end system security review of 2015. These assessments focused on the storage and security of personal information held in the National Repositories Service (NRS). The NRS is the database system operated by NIO which holds the key data sets which make a My Health Record (see paragraph 3.2 below).

2.7 The scope of this assessment included a review of the information security arrangements deployed in the MHR system, in particular a review of System Operator and NIO’s policies, procedures, governance and training applicable to the storage and security of personal information contained in the NRS and the implementation of these policies and procedures (see Figure 1 below which depicts system components that are within the scope of this assessment). The ADHA’s implementation of the policies and procedures and external reviews were assessed on the basis of staff interviews and review of documents.

2.8 This assessment was risk based. It focused on identifying privacy risks to the effective and secure handling of personal information in the MHR system, as informed by APP 11 and relevant provisions of the MHR Act by examining whether the ADHA had sufficiently documented policies, procedures and training in place.

2.9 DHS systems leveraged by (but not part of) the NRS were outside the scope of this assessment. These included the Access Management System, the Customer Relationship Management System, the Client Data Management System, the MyGov system, other DHS repositories, along with Department of Veterans’ Affairs (DVA) systems, which provide data to the MHR system as a trusted source.

Approach

2.10 The assessment was guided and informed by the OAIC’s Guide to securing personal information - ‘Reasonable steps’ to protect personal information. The Guide identifies operational aspects of relevance, including:

• governance, culture and training
• internal practices, procedures and systems
• ICT and access security
• third party providers
• data breaches
• destruction and de-identification
• information security standards.

Privacy risks

2.11 The OAIC makes recommendations to address ‘high’ and ‘medium’ privacy risks. For more information about these privacy risk ratings, see the OAIC’s ‘Privacy risk guidance’ at Appendix A. Further detail on this approach can be found in Chapter 7 of the OAIC’s Guide to privacy regulatory action.

2.12 OAIC assessments are conducted as a ‘point in time’ exercise. That is, our observations and analysis are only applicable to the time period during which the assessment was undertaken (June 2018).

Assessment methodology

2.13 The assessment team, comprising of staff from Lockstep Consulting and the OAIC, conducted a desk-top review of relevant security policy, design, operations documents and staff training materials.

2.14 Past security review reports were also examined to identify any risk control deficiencies relevant to this assessment and ensure they had been remedied

2.15 The assessment team also conducted in-depth interviews with key staff from the SO and NIO at ADHA’s Canberra office in June 2018.

2.16 The assessment did not include a physical review or testing of the technical capabilities of the ICT systems used by the SO or NIO but relied (in part) upon past third-party reviews, which the assessors re-examined.

2.17 The OAIC considered the findings and recommendations made by Lockstep Consulting in the process of writing this report.

Reporting

2.18 The OAIC publishes final assessment reports in full, or in an abridged version, on its website. All or part of an assessment report may be withheld from publication due to statutory secrecy provisions, privacy, confidentiality, security or privilege. This report has been published in full.

Part 3: Introduction

Overview of My Health Record

3.1 The My Health Record system is the Australian government’s digital health record system and provides a My Health Record for each consumer.[8] My Health Record is an online summary of a consumer’s key health information including details of their medical conditions and treatments, medicine, allergies, tests and scans. This information can be viewed online from anywhere at any time. Healthcare providers (such as doctors, specialists and hospital staff) are able to view and add information to a My Health Record, subject to access controls set by the consumer.

3.2 Consumers’ health records are either uploaded into the NRS or fetched as needed from participating repositories (Registered Repository Operators). The NRS holds the key data sets which make up a My Health Record, including:

• shared health summaries
• event and discharge summaries
• medical records (Medicare Benefits Schedule, Pharmaceutical Benefits Scheme)
• clinical documents
• specialist letters
• consumer entered notes and health summaries
• child development
• organ donor status
• prescription / medication information.

3.3 My Health Record was previously known as a Personally Controlled Electronic Health Record (PCEHR) or eHealth record.[9] The operational activities of the then PCEHR was managed by the Department of Health until the Australian Digital Health Agency (ADHA) became the My Health Record System Operator on 1 July 2016. The ADHA is a statutory authority reporting to State and Territory Health Ministers through the Council of Australian Governments (COAG) Health Council. It was established to improve health outcomes for Australians through the delivery of digital innovation, health systems and services.

3.4 The MHR system is regulated under the My Health Records Act 2012 (Cth), My Health Records Regulation 2012 (Cth), My Health Records Rule 2016 (Cth) and the My Health Records (Assisted Registration) Rule 2015 (Cth).

Participants in the MHR System

ADHA – the MHR System Operator

3.5 ADHA has a lead role in operating and developing Australia’s digital health foundations, the national infrastructure underpinning the delivery of digital health in Australia including:

• the My Health Record (MHR) system
• The Healthcare Identifiers (HI) Service[10]
• The National Authentication Service for Health[11] (NASH)
• Provider Digital Access[12] (PRODA)
• Secure Messaging[13]
• Supply Chain[14]
• Clinical Terminology[15]
• Clinical Document Specifications such as discharge summaries and electronic referrals.

Other participants in the MHR system

3.6 In addition to ADHA as System Operator, a number of other participants assist in the operation of MHR, in particular:

• Accenture Australia was contracted as the National Infrastructure Operator (NIO) of the system, responsible for providing and managing the system on behalf of the SO including managing MHR’s security. The NIO has a subcontractor, Nippon Telegraph and Telephone (NTT), which provides data centre services for the system
• the Department of Human Services (DHS) assists with consumer and provider registration. It also provides access to Medicare and Department of Veterans’ Affairs (DVA) data, which can be included in consumers’ MHR records with their consent.

3.7 Healthcare providers participate in the MHR system as end-point users. Consumer healthcare information contained in provider records are uploaded into the NRS via clinical software or a national provider portal.

3.8 Individual health records are automatically created for consumers (unless they choose to opt out of the MHR system). Consumers can change their privacy and security settings to control which healthcare providers can access their health information. Consumers can also add their own information such as personal notes, review the information on their record, and set up notifications to monitor which healthcare provider has accessed their record.

Summary

3.9 Figure 1 below provides a high-level summary of the different participants in the MHR system and how they interact. It also depicts the system components that are within the scope of this assessment.

Part 4: Findings

Governance, culture and training

Management, oversight and accountability

Observations

4.1 The requirements for the ADHA’s governance framework are set out in the Public Governance, Performance and Accountability (Establishing the Australian Digital Health Agency) Rule 2016 (Cth). The Agency Rule established the Board, Advisory Committees and the position of the CEO, and defined their roles and responsibilities.

4.2 Established in 2016-17, the 11-member ADHA Board is the accountable authority for the agency. It sets the agency’s strategic direction and is responsible for its operations. The Board is supported by independent advisory committees:

• Clinical and Technical Advisory Committee
• Jurisdictional Advisory Committee
• Consumer Advisory Committee
• Privacy and Security Advisory Committee (PSAC)
• Digital Health Safety and Quality Governance Committee[16]), and
• Audit and Risk Committee (compulsory under the Public Governance, Performance and Accountability Act 2013 (Cth)).

4.3 As outlined in Division 5, Section 51 of the Agency Rule, the PSAC’s functions are to:

• examine legal issues in relation to digital health systems, including copyright, data privacy issues, confidentiality issues, data security and legal liability
• to make recommendations to the Board about the long-term legal framework of digital health systems
• to monitor privacy and security issues in relation to digital health systems and to provide advice to the Board on resolution of any problems arising from such issues;
• to provide advice and recommendations to the Board in relation to standards (including compliance with standards) relating to privacy and security in relation to digital health systems
• to provide advice to the Board about privacy and security issues encountered by users of digital health systems.

4.4 The 2016 OAIC assessment recommended that ‘the role and operation of the PSWG [Privacy and Security Working Group, within the Department of Health as the then SO] is reviewed to ensure that it has an effective role as a focal point for strategic and significant privacy advice and solutions’. Assessors were advised that following the establishment of ADHA, the PSWG ceased to operate.

4.5 In relation to executive management, the ADHA CEO was supported by an executive leadership team comprising five Executive General Managers (Division heads) and a Chief Medical Adviser. The team meets weekly with the CEO and is involved in the implementation of the governance framework through strategic and financial planning, consideration of ongoing and emerging risks, review of controls, and monitoring the delivery of performance outcomes. It is the primary forum for operational decision making in the agency. When the assessment was undertaken (June 2018), the executive structure was as follows[17]

4.6 A range of internal committees also support ADHA leadership and its ability to deliver on strategic priorities. The assessment team observed that there is no dedicated internal privacy or security committee. Assessors were advised that internal operational arrangements between the risk, security and privacy teams, in addition to reporting mechanisms to PSAC and Board, aim to ensure that security and privacy are effectively managed. The internal committees are outlined below:

4.7 The assessment team observed that ADHA has an experienced and active Chief Information Security Officer who operates as such for MHR.

4.8 Nevertheless, assessors noted through the desk-top review that recommendations for a Privacy Impact Assessment (PIA) of the Incident Management System (IMS) had passed with little or no action across several external audits. PIAs, as part of risk management arrangements more generally, are separately discussed from paragraph 4.21.

4.9 The assessment team was provided with a copy of the SO’s recently released ‘Guide to Undertaking a Privacy Impact Assessment’ (PIA Guide). Assessors observed that while it provides useful guidance as to if, when and how a PIA should be undertaken, it provides little information on how the outcomes of any PIA would be addressed by ADHA.

4.10 In this regard the assessment team also considered the introduction of the Australian Government Agencies Privacy Code on 1 July 2018, which at the time of fieldwork had not yet commenced. The Code impacts on how AHDA manages its obligations under the Privacy Act, in particular the requirement to appoint a senior official as a Privacy Champion. While the SO’s PIA Guide refers to the new Code, assessors observed that its focus is on the role of the Privacy team and makes no reference to a Privacy Champion. Privacy management and governance requirements under APP 1.2, and specifically the Code, may be considered in a future OAIC assessment.

4.11 The assessment team understands the NIO’s security management to include:

• Production Operations team, which is onshore and responsible for the production environment
• Offshore team, requiring no access to production data, and responsible for development and testing against non-production environments (with fabricated data)
• Security Operations team, responsible for handling security and privacy incidents, as well as patch and vulnerability management, security monitoring, and threat & risk assessments
• Service Management team, the central liaison point for the NIO, providing regular reports to the SO and other MHR stakeholders on incidents and system performance, and responsible for day to day production issues, incident management and internal incidents as well as errors and failures
• Change Management team controls the implementation of changes to the system and is responsible for testing vendor software.

Analysis

4.12 ‘Reasonable steps’ under APP 11 include establishing clear procedures for oversight, accountability and lines of authority for decisions regarding personal information security. This could involve having a body or designated individual(s) who is aware of what, where and how personal information is held, and is responsible for ensuring that it is held securely. This role could include defining information security measures and implementing, maintaining and evaluating those measures. The role should be overseen by, and accountable to, senior management.

4.13 The governance arrangements established by the SO, while still maturing, appear adequate. However, assessors note that consideration of certain security and privacy matters raised by external reviews have been delayed. There is a medium risk that delays can negatively impact the proper handling of sensitive personal information, in particular where timely management attention is expected in response to identified and emerging issues. In the assessors’ view, operational matters are dealt with quickly and effectively by a day-to-day manager in a dedicated role with direct exposure to the operational environment.

4.14 Given that the SO is a relatively new agency, the OAIC would expect that its governance arrangements for privacy and information security are reviewed regularly so that they remain relevant and responsive to emerging issues.

Risk management

Observations

4.15 MHR risk management practices were acknowledged by the SO as being relatively immature, considering the young age of the agency. The ADHA was benchmarked in 2017 as part of the Comcover Risk Management Benchmarking Survey and rated as ‘Developed’[19]. While a relatively low rating, the agency is establishing more robust risk management policies and practices and is expected to rate more highly in subsequent benchmarking exercises. Following this assessment, the OAIC was advised that the ADHA was benchmarked again in 2018 and 2019 as part of the same methodology, and was rated as ‘Advanced’.

4.16 The SO maintains an overarching risk framework. It has established an integrated risk register and conducts security risk management exercises in relation to each new release. The risk register is reviewed with each new release to ensure that relevant (and new) risks are adequately captured and addressed. The SO is aware of the need to more tightly manage the risk register and develop improved traceability between strategic, system and operational risks. Close collaboration is required with the NIO in this regard.

4.17 Furthermore, in the context of findings and recommendations regarding security documentation (discussed below from paragraph 4.43), it will be important for the SO to ensure traceability of decision making processes in response to external assessment (such as IRAP assessments, Threat & Risk Assessments (TRAs) and OAIC assessments).

4.18 In the assessors’ view there remains some work to be done to enhance the relationship between the Audit and Risk Committee and the Privacy and Security Advisory Committee, in terms of responsibilities and transparency of activities. Assessors were advised that a risk toolkit to enhance and streamline the agency’s risk management practices will be implemented in the near future.

Analysis

4.19 Noting the relative immaturity of the SO’s risk management practices, the assessment team considers that it is to be expected that planned improvements will enhance the agency’s risk posture.

4.20 With the exception of PIAs (discussed below), the assessment team did not identify any serious privacy risks in relation to the SO’s overall risk management and therefore makes no recommendations.

Privacy impact assessments

Observations

4.21 The System Operator has conducted several PIAs on the MHR system since 2015:

• May 2015 – PIA analysed flows of personal information and potential privacy risks and impacts of an opt-out model
• March 2016 – PIA assessed the design of the participation trials
• October 2016 – PIA assessed proposals for third party mobile applications to access the My Health Record system
• December 2016 – PIA assessed the proposed bulk transfer of records to the contracted National Infrastructure Operator for record creation as part of the opt-out process
• July 2017 – PIA further examined privacy risks and impacts of the proposed implementation of the opt-out process

4.22 ADHA has developed its own PIA guide in line with the new Australian Government Agencies Privacy Code which commenced on 1 July 2018.

4.23 The 2016 OAIC assessment recommended[20] that a PIA should be undertaken on the SO’s Incident Management System (IMS). The assessment team was advised that all information is stored in an encrypted form in the IMS. A review of the information in the IMS is underway in advance of the intended implementation of a new cloud-based, fit for purpose IMS system to address security concerns. The cloud provider is accredited by ASD to the PROTECTED security classification. It was not clear to assessors if the review and new IMS will be informed by a PIA.

4.24 Assessors note the fact that recommendations raised in the 2016 OAIC assessment report related to the Department of Health as the then SO and that, while the recommendations have been addressed in the establishment of ADHA as the new SO and in its current work to develop the MHR system, no further action is intended in response to those recommendations.

Analysis

4.25 PIAs are the cornerstone of privacy management and should be part of the overall risk management and planning processes of organisations. PIAs help organisations assess security risks to personal information by identifying the privacy impacts of changes that may have privacy implications. These changes may include a changing regulatory environment such as new legislation, the implementation of new or amended systems or databases, or changes to how information is stored. PIAs make recommendations for managing, minimising or eliminating those privacy impacts.

4.26 PIAs help to identify and mitigate against emerging privacy risks. Without recent PIAs, the concerns raised in the 2016 OAIC assessment as to whether reasonable steps have been taken to protect personal information held on the IMS remain. In this context, it is reasonable to seek assurances from the SO that previously identified and emerging privacy and security concerns are being addressed.

4.27 The OAIC notes that under the Australian Government Agencies Privacy Code, from 1 July 2018 it is mandatory for agencies to undertake PIAs for all high privacy risk projects. While acknowledging that this assessment took place prior to the Code’s commencement, for the purposes of this report it is worth noting that the SO will be subject to a mandatory requirement in relation to PIAs.

4.28 In addition to the new, mandatory requirement to conduct PIAs, the assessment team considers that, in the context of upcoming development of a new IMS, it is reasonable under APP 11 to conduct an independent PIA to systematically assess the new IMS.

4.29 PIAs assist in demonstrating good personal information handling practices and engender public trust and confidence.

Training

Observations

4.30 The assessment team reviewed three MHR staff training packages:

• security awareness training for new joiners
• working with sensitive data
• security awareness training.

4.31 Assessors found a number of references in the NIO’s training materials that were inconsistent with Australian privacy legislation. For example, a foreign definition of Personal Information is used (i.e. ‘Personally Identifiable Information’) and the NIO’s use of the term ‘Sensitive Information’ is at odds with the Privacy Act. Further, the term ‘Technically Sensitive Information’ is introduced and covers such data as IP addresses.

4.32 Assessors note that use of non-standard definitions was a finding of the 2014 OAIC assessment. It is not clear why definitional errors have persisted.

4.33 The issue of data classification and handling processes was also raised. The NIO advised that, notwithstanding general issues with staff correctly identifying data and applying appropriate Australian government data classifications, all information that is contained in the MHR production database is regarded as ‘sensitive’ (in keeping with Australian legislation) and treated accordingly. Staff are also trained accordingly.

4.34 Security training for new NIO staff (including contractors) focuses on:

• improving security awareness
• providing background information about MHR
• security expectations for MHR
• staff responsibilities for security of MHR
• tools/measures available to fulfil them
• consequences of breaches or compromises.

4.35 NIO security training is heavily focused on operational security considerations, including:

• use of Accenture issued equipment only
• security at the client’s premises
• access to MHR assets and documents
• physical security including Clean Room access controls
• data protection and information classification / protective markings
• use of Accenture offshore based systems
• social media.

4.36 The NIO also provides six monthly refresher training on security and privacy for all employees that work in the clean room[21] with access to production data. Training for other staff is less frequent.

4.37 The SO conducts annual training for all staff. As the agency grows, these training programs are being run on a monthly basis. The SO also runs training tailored to specific areas of the agency on an as needs basis in relation to data breach notification. It has also developed a privacy e-learning module for staff to use (accessible via the intranet). Security training presentations focus on issues such as:

• password security and ISM standards for complexity
• email security (phishing etc)
• malicious macros
• surfing the web and social media
• remote access
• information classification
• physical security (clean desk, passes etc)
• personnel security (vetting)
• incident reporting.

Analysis

4.38 The assessment team considers that the training arrangements established by the SO and NIO are adequate, except for the issue that erroneous privacy definitions have persisted for some years in security documents[22].

4.39 The use of foreign terms and definitions can negatively impact on staff awareness of their obligations under Australian privacy legislation. For example, there is a medium risk that:

• training new staff to use inappropriate foreign terms is likely to confuse and hinder their compliance with the Privacy Act
• when implementing critical de-identification procedures, using foreign definitions can lead to inadequate de-identification of patient information that would be treated as ‘Personal Information’ in Australia
• MHR designers and operators can misjudge privacy risks, especially as they put into effect de-identification and data sanitisation.

4.40 Moreover, the concept of ‘Technically Sensitive Information’ is not necessary given the Australian legislated concepts of Personal Information and Sensitive Information, and because it is novel, may be an unnecessary distraction.

4.41 The fact that incorrect definitions have persisted in NIO documentation raises the possibility that Accenture, as ADHA’s client, is not scrutinising training materials as closely as it should with regards to legal compliance. A more rigorous review process would guard against other similar types of governance errors appearing in future.

4.42 ‘Reasonable steps’ under APP 11 include ensuring that all staff (including new starters, contractors and temporary staff) are aware of their privacy and security obligations. As staff awareness is commensurate with quality of training, it is reasonable to expect that training materials should accurately reflect Australian legislation. This ensures that staff are trained appropriately to handle personal information in accordance with the Privacy Act.

4.43 The SO should improve the ongoing quality of training materials in respect of definitions and data classifications, particularly in light of intended changes to the classification system in the Protective Security Policy Framework.

Internal practices, procedures and systems

Security documentation

Observations

4.44 Documents provided for assessment by the System Operator (SO) and National Infrastructure Operator (NIO) covered a range of security and privacy management policies and procedures, including[23]:

• system security plans
• risk management frameworks
• key management plans
• data breach policies
• threat & risk assessments
• business continuity plans.

4.45 It was the assessment team’s expectation that the SO and NIO would maintain and provide a complete and up-to-date suite of security documentation. In the assessors’ view, the desk-top review process was complicated by the following:

• the documents were provided to the assessment team in three tranches
• many documents were outdated (some dating back to 2015), and some were in draft form
• there were some inconsistencies within and between documents provided (e.g. between the Commonwealth Data Protection Protocol and the System Security Plan relating to back-ups of the Incident Management System), indicating possible lack of coordination across MHR system participants.

4.46 The assessment team therefore observed that the documents did not stand alone to present a cohesive view of the SO’s approach to managing the security of the MHR system. However, this concern was mitigated as a result of fieldwork interviews conducted with SO and NIO staff. These interviews provided a more complete explanation of the SO’s security policies and procedures, as well as the opportunity to review more up to date documentation.

4.47 It was evident from the interviews that security risks identified in the available documentation had either been or were in the process of being addressed. Particular examples include the SO’s response to findings and recommendations from the most recent independent TRA exercises, and its response to the recommendations contained in the 2017 IRAP report. While security considerations mean specific issues cannot be recorded in this unclassified report, assessors were advised that controls were being introduced to address each of the findings.

4.48 The assessment team also notes that, in general, the 2017 IRAP assessment was reassuring, indicating a strong security management position.

4.49 Based on the nature of the documents and subsequent interview discussions, the assessment team considers that the state of the security documentation has likely resulted from several factors:

• the relative immaturity of the SO as a new agency (it was evident that it is still bedding down its policies and procedures)
• the high percentage of contractors in the agency (over 50%) who, in the assessors’ experience, are not generally engaged as document writers
• the relatively new governance arrangements that have been implemented and which are still being matured
• the pressure to deliver a secure and robust system solution within very short timeframes including what may be described as a fast-track program of new product releases.

4.50 The assessment team found that the SO has placed a greater importance on product delivery, and that documentation has been viewed largely as a compliance-related activity. A similar inference was drawn by the IRAP assessor in 2017.

Analysis

4.51 Deficiencies in documented security and privacy management policies and procedures have the potential to affect privacy and security practices if left unaddressed.

4.52 Documentation is the main way that the state of a project is communicated to external stakeholders, assessors, new hires, contractors and so on.

4.53 ‘Reasonable steps’ under APP 11 involve documenting the internal practices, procedures and systems used to protect personal information. Documentation should be regularly reviewed and updated to ensure it reflects current practices. Clear documentation is important as a design tool, for communicating to designers the details of requirements, and recording development decisions. Documentation guides designers as they work over typically long periods of time on complex systems.

4.54 Without clear, consistent and up to date documentation, there is a medium risk that complex system security requirements could be poorly communicated to internal staff and external stakeholders. In the assessors’ view, good documentation is key, and a reasonable step under APP 11, to ensure system security over time.

4.55 These documentation issues were raised with and acknowledged by SO and NIO officials over the course of the fieldwork interviews.

Documentation of decision making

Observations

4.56 During the course of fieldwork interviews, the assessment team observed relatively poor documentation of internal decision making. The SO was unable to provide documentary evidence of the processes involved where the SO/NIO analysed the findings, determined the most appropriate response and obtained management agreement to implement the required measures. While such steps are probably taken in practice, it was not evident to the assessors that they were being followed systematically.

Analysis

4.57 ‘Reasonable steps’ under APP 11 involve documenting decisions made about security decisions to protect personal information, such as why certain measures have or have not been adopted.[24]

4.58 The apparent lack of documentation of decisions by the SO means that documentation will always lag behind systems development. This creates gaps in relation to the management of privacy and security risks.

4.59 Given the operational scale of the MHR system and relative complexity of decisions about security and privacy controls, it is reasonable to ensure that decisions are traceable and transparent. Without appropriate documentation procedures in place, there is a medium risk that decisions about privacy and information security are made without proper scrutiny and decision rationales remain undocumented.

4.60 The SO should document decision making processes to ensure transparency and accountability.

ICT and access security

Observations

4.61 Information was sought about external security assessments and the ADHA’s implementation of the recommendations relevant to the scope of this assessment.

4.62 The assessment team was advised that the Australian Signals Directorate’s Essential 8[25] ISM controls (including the mandatory Top 4) have been implemented and that a successful two-stage IRAP assessment was completed in 2017 with 97% compliance.

4.63 The 2017 IRAP report identified some concerns with respect to the SO’s ability to protect against Advanced Persistent Threats.[26] Assessors were advised that end-point protection[27] is a major consideration and that a range of security measures have been introduced in response to the IRAP report and other external reviews, including:

• intrusion detection/prevention
• data encryption both at rest and in transit (using ASD approved cryptographic algorithms)
• whitelisting across the front end and back end systems[28]
• improved vulnerability management.

4.64 The SO and NIO also employ a variety of security measures, including data encryption (at rest and in transit), personnel vetting, and physical access controls to the data centre, clean room and production data. Analytics are being increasingly used to analyse data logs to enhance system security.

4.65 The Department of Health’s end-to-end security review of 2015 also highlighted end-point security as a key risk to the MHR system. The assessment team was advised that this review was tabled with the Privacy and Security Advisory Committee at its first meeting and that the recommendations contained in that report have been considered as part of further system development.

4.66 ADHA established the Digital Health Cyber Security Centre[29] to strengthen the security of the digital health system overall and promote increased security awareness and maturity across the digital health sector. The SO has produced a range of educational material to assist healthcare providers meet their security obligations. It also audits provider systems to ensure security standards are met and providers comply with security requirements under MHR legislation, specifically MHR Rule 42 which requires an access control policy for MHR participants/healthcare providers. The SO also maintains close relationships with peak industry bodies such as the RACGP to help providers maintain these security and privacy standards.

4.67 End-point security remains a high risk for the system and is being actively addressed by the SO and NIO on a number of fronts. In addition to producing educational material and carrying out audits, several TRAs were conducted with respect to key endpoints to the system including call centres, mobile gateway, and administration and provider portals. Continued monitoring and appropriate governance around the identification and mitigation of privacy risks (see Recommendation 1) will assist the SO to manage the challenge of a system with a significant number of end-points. For example, while approval processes are in place to sign up provider organisations to the MHR system, they represent a vulnerability that will need to be monitored.

4.68 Further potential threats exist in relation to registration and authentication of both consumers and healthcare providers. While acknowledged by the SO, which advised that they are being actively managed, these threats were not explored in detail as they are the operational responsibility of DHS.

Analysis

4.69 The decentralised nature of end-point users presents unique challenges for a central system operator who is several steps removed from directly managing end-point security vulnerabilities. This is an ongoing risk for the MHR system. If end-point security is not managed effectively by healthcare providers and other agencies responsible for user registration and authentication, there is a high risk that the integrity of the MHR system can be compromised.

4.70 The SO must take ‘reasonable steps’ under APP 11 to address the risks and mitigation strategies identified by external security assessments, including providing assistance to healthcare providers, by:

• continuing to proactively engage with end-point users through educational and audit initiatives
• staying up to date with the real state of end-point security at healthcare practices
• providing timely and effective guidance to health practitioners, as and when tangible security issues are identified.

Third party providers

Observations

4.71 Two principal third party providers support the operation of the NRS:

• Accenture as the National Infrastructure Operator (NIO)
• Nippon Telegraph and Telephone (NTT) as the data centre provider.

4.72 Both Accenture and NTT have strong contractual commitments in relation to managing the security of the MHR system. NTT’s data centres have been subject to IRAP assessments and are rated to PROTECTED. The assessment team was advised that physical and logical access controls at NTT and the NIO ensure that only authorised personnel have access to the MHR system.

Analysis

4.73 The assessment team did not identify any serious privacy risks in relation to third party providers and therefore makes no recommendations.

Data breaches

Observations

4.74 Under the MHR Act it is mandatory for the SO to notify the OAIC of data breaches relating to unauthorised collection, use or disclosure of health information, or relating to issues that affect the security or integrity of the system. Between 2016 and 2018 the agency notified 11 data breaches to the OAIC.[30]

4.75 The SO maintains a Data Breach Response Plan that outlines staff roles and responsibilities in managing actual and suspected data-related incidents. Complementing this plan are comprehensive incident management plans and procedures (for both privacy and security incidents), as well as incident identification and prioritisation procedures. The Incident Management System is discussed in detail under Privacy Impact Assessments from paragraph 4.21.

4.76 The SO has and continues to implement measures to protect the MHR system from data breaches, including:

• sourcing new health-sector specific threat intelligence to assist the agency in early identification of threats
• improving information sharing nationally and internationally with health sector CERTs
• improving vulnerability management techniques and active penetration testing at each new release.

Analysis

4.77 The assessment team did not identify any privacy risks in relation to the SO’s management of data breaches and therefore makes no recommendations.

Destruction and de-identification

Observations

4.78 At the time of the assessment the SO was obliged under the MHR Act to maintain individual health records for 30 years after the verified death of an individual (or 130 years in the event that a person’s death cannot be verified).[31] At the time of the assessment, if an individual chose to cancel their MHR record, the data contained in that record was neither de-identified nor destroyed; rather, the record was marked as inactive and stored in encrypted form by the system, inaccessible to either the individual or any healthcare practitioner.

4.79 Based on the SO’s obligations under the MHR Act at the time of the assessment, the assessment team considers that the requirements of APP 11.2 (relating to data de-identification and destruction) do not apply while a person’s health information is retained within MHR.

Analysis

4.80 In future, it will be necessary for the SO to develop and document a destruction procedure for MHR records to be deleted post-mortem. At the time of this assessment, there was no urgency for this, given that the earliest destruction was still 24 years away.[32] As time goes by and the MHR system evolves (together with the legislative and e-health landscape), the data destruction procedure can be reviewed.

4.81 Following this assessment, on 26 November 2018, the Australian Parliament passed the My Health Records Amendment (Strengthening Privacy) Bill 2018 which introduced a number of changes to the MHR system. Under these changes, a person can permanently delete their MHR at any time in their life, with no archived copy or back up kept. Any destruction procedures developed in response to these changes could also be applied to MHR records that will be deleted post-mortem.

4.82 The assessment team did not identify any privacy risks in relation to destruction and de-identification of personal information and therefore makes no recommendations.

Information security standards

Observations

4.83 As a government agency the SO must meet the security requirements set out in the Protective Security Policy Framework and Information Security Manual. These policies reference accepted international standards for risk management (ISO 31000) and information security (ISO 27000).

4.84 The assessors’ desk-top document review confirmed these policies and standards are implemented across the SO, NIO and NTT.

Analysis

4.85 The assessment team did not identify any privacy risks in relation to information security standards and therefore makes no recommendations.