Media Release: Independent review of health providers' accessibility to Medicare card numbers

10 July 2017

The Hon Alan Tudge MP

Minister for Human Services

The Hon Greg Hunt MP

Minister for Health

The Turnbull Government has commissioned a review of the accessibility by health providers of Medicare card numbers.

An online system was introduced in 2009, to further assist GPs, hospitals and other health providers to acquire a Medicare card number when a person presents without a card.  In 2010 an enhanced lookup function was also added. The system allows the health provider to acquire a card number on the basis of a name and date of birth. Currently, Health Professionals Online Services (HPOS) is utilised 45,000 times each day.

They can access it through a secure online system or over the existing telephone network.

The system was introduced as a way of ensuring that people in an emergency situation could get treatment immediately even if they did not have their card with them. This was particularly important for vulnerable Australians. The system has had, and continues to have the strong support of the AMA and GPs due to its convenience and ability to provide immediate patient care.  It provides an alternative avenue to the existing telephone network for a health professional to identify a patient’s eligibility for Medicare benefits. 

The Government wants to ensure that there is increased security in a system which is important to both patients and doctors.

The system, which has not been significantly altered since being brought in 8 years ago, has to be both convenient and utterly secure. The Review team will examine this balance to determine its adequacy in today’s context. 

The Review will be led by Professor Peter Shergold. The President of the Australian Medical Association and the President of the Royal Australian College of General Practitioners will also be members of the Review Team. The review will also be supported by a secretariat from the Department of Human Services, Department of Health and Attorney General’s Department. It will consult broadly with stakeholders.

The review follows recent public discussion about an alleged breach related to a small number of Medicare card numbers.

An investigation by the Australia Federal Police is underway.

We re-emphasise that a Medicare card number alone does not provide access to any medical or clinical records.

Medicare cards and Medicare numbers have always been sought by criminals. This review will identify options to improve the security of Medicare numbers while continuing to support the accessibility of medical care.

The review will commence immediately and will report by 30 September, 2017.

It is paramount the public has access to the health care they need, when they need it. The Australian Government has a binding contract with the community to deliver this through the Medicare system.


Terms of Reference for the Review of Accessibility by Health Providers to Medicare numbers

Background

The Government is commissioning a review of health professional access to Medicare card numbers via the Health Professional Online Services (HPOS) system and the telephone channel.

HPOS offers health providers a single secure web portal giving real-time access to a number of online services provided by the Department of Human Services, including looking up or verifying a patient’s Medicare number.

HPOS was introduced in 2009, and supports the accessibility of medical care in cases where a patient may not have their Medicare card with them. HPOS provides an alternative avenue to the existing telephone channel for a health professional to identify a patient’s eligibility for Medicare benefits. 

The Medicare number is a central component of Australia’s Health system. It provides all Australian’s with timely access to healthcare regardless of their location.  The Medicare number has also, in recent times, become an important component of Australia’s proof of identity processes.

This Review follows recent public discussion about an alleged privacy breach related to Medicare numbers.

Scope of Review
The Review will consider the balance between appropriate access to a patient’s Medicare number for health professionals to confirm Medicare eligibility, with the security of patients’ Medicare card numbers.

The Review will examine and advise on:

  • The type of identifying information that a person should be required to produce to access Medicare treatment in both urgent and non-urgent medical situations
  • The effectiveness of controls over registration and authentication processes at the health provider's premises to access Medicare card numbers. 
  • Security risks and controls surrounding the provision of Medicare numbers across the telephone channel, and the online connection between external medical software providers and HPOS.
  • The sufficiency of control by patients and the appropriateness of patient notification regarding access to their Medicare number.
  • The adequacy of compliance systems to identify any potential inappropriate access to a patient’s Medicare number.
  • Any other identified area of potential weakness associated with policy, process, procedures and systems in relation to accessibility of Medicare numbers.


Based on the examination of the issues above, the Review will make recommendations for immediate practical improvements to the security of Medicare numbers while continuing to ensure people have access to the health care they need in a timely manner.

The Review may also provide recommendations for medium to longer term changes (or at least the identification of areas that require further examination) to ensure the security of the system and protection of information of Australians.

The Review will work closely with relevant stakeholders including the Australian and State and Territory Governments and peak industry bodies (including the Australian Medical Association, the Royal Australian College of General Practitioners, the Australian Association of Practice Managers, and the Consumer Health Forum).

Timing and resources
The Review will be supported by a secretariat comprised of officials from the Australian Government Departments’ of Human Services, Health, and Attorney-General’s.

The Review will commence immediately, provide an interim report by 18 August, and a final report by no later than 30 September 2017.