The government created a health record for every Australian who didn't say no within 90 days. When people learned police could access their records without a warrant, 2.5 million opted out — the largest privacy protest in Australian history. "You're in control" meant "you had three months to notice.". The government had to amend the law to stop police reading your health records without a warrant — but they left a loophole wide enough to drive through. "Serious threat to life" is vaguely defined and police can still invoke it. Your mental health diagnoses, STI tests, and prescription history are one "serious threat" determination away from a detective's desk.
What they claim: My Health Record legislation includes safeguards to prevent unauthorised access to health records
What we found: The original My Health Record Act allowed law enforcement to access records without a warrant or patient consent. After public outcry, the government amended the act — but exemptions remained for "serious threats to life or health" which police and courts can invoke. Employers cannot directly access records, but insurers and government agencies can request data through approved channels.
What they claim: My Health Record promoted as giving Australians control over their health information
What we found: In 2018, the government switched My Health Record from opt-in to opt-out, automatically creating records for all Australians who did not actively refuse within a three-month window. 2.5 million Australians opted out — the largest privacy opt-out in Australian history — after media coverage revealed police could access records without a warrant.
What they claim: My Health Record claims world-class security for sensitive health data
What we found: Between 2019 and 2022, 42 data breaches were reported involving My Health Record, including unauthorised access by healthcare workers viewing patient records without clinical justification. The OAIC found that the system's access logging was insufficient to detect inappropriate access in real time, with some breaches only discovered months after they occurred.
What they claim: My Health Record positioned as an efficient digital health infrastructure investment
What we found: My Health Record has cost over $2 billion since inception. The largest contract — $746 million to Accenture — was criticised by the ANAO for limited competitive tendering. A 2019 AMA survey found 70% of GPs said the system was not clinically useful, with doctors describing records as "incomplete, unreliable, and a liability risk."