Agencies fail My Health privacy audit

Most of the emergency access requests made by third parties to Australians' digital health records were unjustified, the national auditor has found.

The Australian National Audit Office said government agencies overseeing Australians' digital health records didn't properly manage or consider the cyber security and privacy risks.

The auditor made a number of recommendations in relation to improve privacy and cyber security in its report released Monday.

It recommended agencies develop shared privacy and security risks frameworks for the My Health Record system, pointing to the fact only 8.2 per cent of requests by third parties to get "emergency access" to a patients' records met guidelines.

The private health sector also reported the highest amount of data breaches, with 40 per cent in 2018 due to malicious or criminal attacks.

"Management of shared cyber security risks was not appropriate and should be improved with respect to those risks that are shared with third party software vendors and healthcare provider organisations," the report says.

The agency directly involved in managing My Health, the Australian Digital Health Agency, needed better oversight of the system.

The auditor recommended it needed to set up means to monitor compliance by third parties using My Health.

Not all healthcare providers achieved the minimum of cyber security levels, the report said.

The digital health agency also did not properly check if third party software providers to healthcare agencies complied with the government's cybersecurity framework.

Outside of cyber security, the auditor-general recommended the ADHA should be setting time frames and benchmarks for My Health.

The agency agreed with all of the audit recommendations.