ADHA pins My Health Record opt-out issues on users with incorrect information

The Australian Digital Health Authority (ADHA), which operates the My Health Record system, has rejected claims that their online systems were overloaded on Monday, the first day of the three-month window before digital health records are to be created automatically.

"The My Health Record consumer opt-out portal is operating normally and has continued to do so throughout the opt out process," an ADHA spokesperson told ZDNet on Tuesday evening.

"There have been some human error issues, with consumers not having the right information to correctly opt out which has slowed down the process for some people. In these instances, people are encouraged to call the My Health Record call centre on 1800 723 471."

A spokesperson for human services minister Michael Keenan told ZDNet that the myGov single sign-on portal was also working through the day, saying that they had "complete visibility" of system performance and they were not overloaded.

While some people had reported call waiting times of more than two hours on Monday, those times now appear to be significantly reduced. ADHA is now posting help line wait times. As at 10:00am on Wednesday they were sitting at three minutes for opt-out enquiries, and 39 minutes for "complex enquiries". The latter includes cancelling an existing My Health Record, assistance in verifying identity, and opting out people not listed on the caller's Medicare card.

Some callers had been told that the call centre's internal systems had failed, but ADHA said that outage was brief.

"There was a minor internal connection issue yesterday [Monday] in an Agency call centre which was compounded by the high level of callers on the first day who did not have the correct information to opt out. This issue was resolved quickly and the call centre resumed normal operations on Monday afternoon," the spokesperson said.

During the million-person trial of My Health Record, less than 2 percent opted out. The ADHA had therefore projected that around 500,000 Australians would opt out during the current three-month window.

On Tuesday, Prime Minister Malcolm Turnbull said that 20,000 had opted out on Monday. ZDNet asked ADHA how many opt-outs had been predicted.

"The Agency has no target for the number of Australians who will have a My Health Record created for them and is not providing a report on people choosing not to have a My Health Record created during the opt-out period," they replied.

"Following the end of the three month opt-out window, there will be a 30-day reconciliation period for the processing of paper forms arriving by mail. Records will then be created for Australians who have not opted out of having a My Health Record. These records must be created by the end of 2018 and further statistics will be available then."

Responding to concerns by some that their website used Google's reCAPTCHA, which works by sending data offshore for analysis, potentially including personal data, ADHA simply said: "No personal or health information is provided through the Google tool."

Security consultant Liam O tweeted his own reassurance on Monday. "The reCAPTCHA in the #MyHealthRecord opt-out form does not send any of your private information (drivers license, Medicare details etc) to Google. There are a lot of legitimate concerns with the rollout of MyHealthRecord, but this isn't one of them," he said.

"It's just a regular old reCAPTCHA. The data is all encoded and I cbf tracing the js [JavaScript], so it's hard to hand-on-heart swear there's no personal data, but the payloads look identical to every other reCAPTCHA I've ever seen."

The security consultant also noted that if your threat model is "Google might inject malicious code that steals my data", then "all bets are off" once you're past a page that includes Google JavaScript.

Previous My Health Record Coverage

My Health Record systems collapse under more opt-outs than expected

When citizens rush to opt out of an Australian government service, it says something about their levels of trust. When the system falls over under heavy load, it proves them right.

Tens of thousands opt out of My Health Record, but can Immigration and local councils view the rest?

The ADHA says it'll refuse access to medical records without a court order or warrant. But the law allows that policy to change at any time.

Cancelled My Health Record data to be kept in limbo

Those choosing to opt-out of the My Health Record service will still have their data visible if they reactivate their account.

Less than 2 percent of My Health Record trial users opted out

Perhaps more worryingly, the use of privacy controls is sitting under the 0.1 percent mark.

My Health Record stands up cybersecurity centre to monitor access

Those who choose to keep their My Health Record will also have a real-time log of who has accessed their information.

My Health Record opt-out period from July 16 to October 15, 2018

The window for Australians to opt out of an electronic health record has been announced by the government.