Can my health records be used for medical research?

A group of Australian veterans is suing the Australian government over claims the Department of Veterans’ Affairs passed their medical data on to a university for research, without their permission.

The case relates to a 20-year research program called MATES, which used veterans’ medical data. It was closed in 2024 due to privacy concerns.

This came after an earlier investigation by the Office of the Australian Information Commissioner, which found the department sent a veteran’s personal information (including name and medications) to university-based researchers, and then on to medical professionals involved in their care. This was done without their consent.

The commissioner found the department had interfered with the veteran’s privacy.

Other veterans have now launched a class action against the department for “mass and routine sharing” of their medical records over 20 years.

So, was this an outlier? Or are we all facing similar privacy threats?

Who has our health information?

Our health records aren’t just kept in our doctor’s locked filing cabinet: they’re almost always stored in electronic medical records.

Medical record information includes identifiers such as name, address, date of birth and phone number, as well as health history, medications, test and imaging results, and vaccinations.

This information held by our treating doctors is uploaded to the national My Health Record system, unless we’ve opted out.

Our personal information is also collected by government agencies, such as to process Pharmaceutical Benefits Scheme and Medicare claims. Agencies must follow rules established by the Information Commissioner when they handle this information.

Why are researchers interested?

Researchers can be interested in our health data for research and statistical purposes. Having access to large data collections enables researchers to uncover vital new connections and insights.

A good example is the GenV study, based in Victoria. This research uses the health and educational data of around 120,000 children and parents who have given consent. It also gathers extra information from participants, using surveys and physical samples. The dataset is expected to yield insights that could address obesity, improve vaccine safety, prevent and treat asthma, and answer other major health questions.

The My Health Record system has been designed to enable people’s data to be used for research, although this hasn’t yet started. It’s expected that a data governance board will oversee research access to the dataset, with rules in place to protect people’s data.

How might researchers access our health data?

Health data is given special protection as “sensitive” data under Australian law. This means there are limited ways researchers can obtain access to this type of data.

One avenue for researchers to access and use our health data is by gaining our consent. That means we’re told about how our information is proposed to be handled, and agree to it in advance.

But the way “consent” operates can be tricky. In the commissioner’s previous investigation, the Department of Veterans’ Affairs argued it had the patient’s consent for information to be sent to researchers.

The Information Commissioner disagreed. It said the patient’s consent only covered the department’s collection of information in order to assess and manage billing claims. Consent didn’t cover the additional step of sharing the person’s data with researchers.

There are other legal gateways researchers sometimes use when they want to obtain people’s health data.

One way is if the research is “directly related” to the particular purpose the information was collected for in the first place, and the person would “reasonably expect” that research use.

For example, a cancer centre might assess outcomes from its prostate cancer patients to compare the effects of different drug regimes.

Another way is if the collection or use of information is necessary for research relevant to public health or public safety, and obtaining consent is impracticable.

In these circumstances though, the data is still protected by human research ethics committee oversight, and people might be given the chance to opt-out.

Finally, properly de-identified health data might be used for research without consent, since de-identification takes it outside legal protection.

However, the Information Commissioner’s office emphasises the use of de-identified data is not risk-free, and that privacy protection is still important in this context.

Strengthening protections for veterans’ data

All of these legal requirements apply to health information held by the Department of Veterans’ Affairs.

The department’s own research strategy has highlighted the need for compliance with ethical requirements and the importance of maintaining trust with veterans.

The department’s current ethics procedures – updated since the MATES study was paused – also requires potential research participants to be told that their existing or future entitlements will not be affected by their research involvement.

Lawyers acting for the veterans in the class action will seek compensation for past breaches, with a court date yet to be set.

Having a say in how your data is used

A great deal of good can come from researchers using our health information. But it’s important researchers and ethics committees take care to comply both with legal requirements and with people’s reasonable expectations about their privacy.

Our health information is inherently sensitive. There are valid reasons that people might prefer not to have that information used by researchers, even if that research could ultimately benefit society.

People concerned about the research use of their health data might choose to opt-out from the secondary use of My Health Record data that is planned to start in the future.

But in other instances, preventing further use of our health data requires reading the fine print, and asking questions about where the data is going. And sometimes, people might not be given that option.