Following revelations in The Saturday Paper that Veterans’ Affairs shared personal medical records without consent with a university research project, the department has admitted to misleading the Information Commissioner about the extent of the breach. By Rick Morton.

Veterans’ Affairs admits it misled Information Commissioner over medical records breach

Soldiers march with swords in hand.
Soldiers march during the 2023 Anzac Day parade in Adelaide.
Credit: Russell Mountford / Alamy

The Department of Veterans’ Affairs has conceded it misled the Information Commissioner about the extent of data transfers in a program that shared the personal medical details of 300,000 service men, women and their families without their express consent. The data provision was for university research and is now the subject of multiple investigations, including for serious ethics violations.

In July last year, The Saturday Paper revealed the Office of the Australian Information Commissioner (OAIC) had ordered the department pay $5000 in compensation to a veteran for refusing their request from six years earlier to stop sharing their data with the University of South Australia as part of the Veterans’ Medicines Advice and Therapeutics Education Services (MATES) program.

The article that appeared in the July 29 edition uncovered a series of half-truths and misstatements that have yet to be resolved.

At the time, UniSA told this newspaper the university and its researchers had all the necessary approvals in place to conduct their studies, which used the data provided by the Department of Veterans’ Affairs (DVA) to run interventions designed to achieve “better prescribing” of drugs to veterans. The researchers also declared their compliance in articles they had published in various scientific journals using the data set, which included veterans’ names, dates of birth, family status, pregnancy terminations, sexual health treatments, alcohol and drug addiction treatments and details of involuntary mental health treatment, along with pharmacy, medical and allied health records.

“We can inform you that the Veteran MATES program is conducted in accordance with UniSA’s policies and procedures, the contractual arrangements with the DVA and ethics approvals from the UniSA and DVA Human Research Ethics Committees,” a spokesperson said in a statement on July 27.

This was not correct.

The Saturday Paper can now reveal a senior University of South Australia leader wrote to DVA secretary Alison Frame with an ultimatum, almost three weeks after the story appeared.

“Given the importance of complying with the privacy requirements, the university seeks confirmation from DVA that it has all appropriate privacy consents to enable the data to be disclosed to the university and used by the university for the delivery of the program,” says the letter, which is dated August 17, 2023.

“Unless and until the DVA confirms that it has the appropriate consents as outlined above, the university will not have any option but to suspend the program until the matter of consent is resolved.”

Although the department claims it had suspended the program in response to privacy concerns raised in The Saturday Paper’s reporting, the program was not actually halted until the day after the letter from the University of South Australia’s executive threatened to pause work.

Almost six months later, the MATES program remains suspended and the university has not received the assurances it sought.

Documents released under freedom of information show the Departments of Defence and Veterans’ Affairs Human Research Ethics Committee (DDVA HREC) met in mid-October last year and threatened to suspend ethics approval.

According to minutes from the meeting: “The Committee noted that due to recent media coverage and multiple emails from individuals regarding the release of personal data to third parties, a review of the project file was undertaken by the Secretariat.”

“The outcome was discrepancies between the approved data and that provided by DVA to the researchers were identified, there was reference to surveys being conducted and tailored over time however no requests for amendment to reflect changes to surveys have been received [and] the complaint that was referred to in the newspaper article was not reported to the DDVA HREC.”

Chair of the committee Dr Tony Cotton wrote to both the university researchers and the DVA, requesting an explanation about the precise data fields that were transferred, and information regarding the complaint published by The Saturday Paper that resulted in a finding of privacy breach from the OAIC.

“The University of South Australia and DVA have both provided a response however these have not addressed the requests for further information and provide contradictory information,” the minutes say.

“Members were advised that 33 individuals have contacted the HREC and have raised concerns about the release of their personal information to the University of South Australia.”

The committee also noted the OAIC decision six months earlier should have been sent to members as an “adverse event”, in accordance with conditions of approval, and was not.

“Members discussed the matter at length and agreed … it is unclear what data is being provided for provision of targeted health care and what is being provided for research purposes.

“No further analysis of the existing data should occur until the matters are resolved. If the matter remains unresolved by the next meeting, ethical approval will be suspended until it is able to be addressed.”

Not only has the matter not been resolved, in the past few months the behaviour of the Department of Veterans’ Affairs has been further called into question. During the OAIC investigation into the privacy breach of the personal information of the veteran identified as ADJ, and in response to compulsory orders, the department insisted there had been only one instance of the veteran’s data being transferred to the University of South Australia. Last month, and almost a year since the OAIC began its investigation, DVA deputy secretary Andrew Kefford wrote to the OAIC deputy commissioner, Elizabeth Hampton, to advise this was wrong.

“As a result of investigations and further analysis of data transfers undertaken … DVA has identified other instances where the veteran’s data was transferred by DVA to the University of South Australia after 27 February 2016,” Kefford wrote, referring to the date the veteran cited as their first attempt to opt out of the MATES program.

“This occurred as part of the regular data feed to the University of South Australia.”

Under the program, data was sent to the university every month. During the same determination process, the department maintained it always had appropriate consent from veterans to scrape their billing data – collected using DVA-funded health cards – and provide it to third parties. But these notices never mentioned university research, nor that the data would be sent in identified format. Before the OAIC decision on March 14 last year, but after the veteran ADJ asked the Information Commissioner for evidence of the department’s privacy notice, the department quietly updated its website to include a privacy collection notice for the first time.

“I wish to also apologise to the Commissioner that these additional transfers were not brought by DVA, to the OAIC’s attention, or the veteran’s attention, during the process of ADJ,” Kefford wrote.

In response to questions from The Saturday Paper, a spokesperson for the OAIC said the agency was “considering the new information provided by the department and the appropriate course of action”.

“The OAIC has received further privacy complaints about the department’s practices in relation to the MATES program including a representative complaint which is under consideration,” the statement says.

In her final report, robodebt royal commissioner Catherine Holmes found the OAIC was lethargic in its response to significant privacy concerns that had been raised publicly and internally and, when it did respond, was too soft.

“The Commission’s findings about the possible breaches of the Australian Privacy Principles in the Privacy Act … are significant and arise in the context of repeated and voluminous exchanges of personal information and data matches conducted by the Department of Human Services and the ATO under the scheme,” the report says.

“With the benefit of hindsight, it is apparent now that the OAIC approach, particularly in light of the substantial media attention and criticism around the Scheme, was too muted to meet the circumstances.”

MATES is, by most accounts, a valuable program. It is nothing like robodebt. But the wholesale provision of data belonging to Australians, and the stewardship of that data, has increasingly become a point of contention across government.

The former privacy commissioner, Timothy Pilgrim, told The Mandarin in 2017 the government needed a social licence to use the data it collected, and the only way to achieve that was by being transparent.

Pilgrim declined an invitation from the royal commission to give evidence.

Veterans who discussed the matter with The Saturday Paper found this explanation hard to believe.

“It is inconceivable that they suddenly found this extra data just lying around but didn’t find it when they were meant to be searching for it at the request of the Information Commissioner,” said one veteran, who asked not to be identified.

“And it was inconceivable that they argued so forcefully everything was above board and then quietly slipped a privacy collection notice online six years after concerns were raised formally. They are in a position of trust and they have abused it.”

In the MATES program, DVA deputy secretary Kefford told the OAIC the “submissions made by DVA in June 2020 were prepared by officers who no longer work for DVA”.

“Our internal inquiries did not identify any records that would indicate that the team that prepared those submissions was aware of any additional transfers of the veteran’s personal information to the University of South Australia.”

Academics at the UniSA’s Quality Use of Medicines and Pharmacy Research Centre receive a suite of personal data from the DVA, which both institutions say is immediately de-identified on arrival at the university and only spliced back together to match data with names and addresses when an intervention requires correspondence with a veteran’s treating health professional.

This happens about 300,000 times for each “intervention” and there are four each year. Researchers say their work has avoided hospital admissions, prevented falls and fractures due to inappropriate prescribing of drugs and improved the quality of life of veterans. The program’s page on the university website features an endorsement from the former principal medical adviser to the DVA, Dr Graeme Killer.

“We created a truly exemplar program that resulted in profound improvements in veterans’ health outcomes, cost efficiencies and behavioural change in healthcare provision,” Dr Killer writes.

“The national public learning from this highly successful program for veterans has been far-reaching across the wider health system, as well as being acclaimed globally.”

In its ethics approval, the university submitted that steps would not be taken to de-identify data prior to or following collection because “identified data are required to enable direct patient-related feedback on prescribing”.

“Consent is obtained for the data to be used for improving healthcare,” it says.

“The long-term goals of the program are … to change behaviour of the prescribers not only in the intervention period but also in the future as new patients present to that GP.

“A cost consequence approach will be used for the economic evaluation … appropriate adjustment for potential selection bias acting on the intervention is likely to result in more accurate effect estimates and therefore more accurate estimates of potential savings achieved by the implementation of the Veterans’ MATES interventions.”

The DVA said in a statement the Veterans’ MATES scheme was “internationally recognised as a program that provides significant health benefits for Australia’s veteran community”.

“Before the program recommences, DVA will communicate with veterans to provide reassurance that the program is being conducted in a way that continues to deliver quality health outcomes for veterans while also providing veterans with confidence their personal information is appropriately handled.

“This includes a commitment to the highest standards of transparency in our communication with veterans.”

A spokesperson for the University of South Australia said it was “committed to supporting the recognition of veterans in health services provision.”

“It is continuing to seek assurances and information to advance its responses to individual requests,” the spokesperson said.

When asked why the university declared it was operating within approvals in July last year, weeks before writing to DVA to first seek those urgent assurances, the spokesperson said: “As new information has come to light, the university is seeking to update responses to ensure accuracy.”

DVA said ethics approval for MATES remained in place and it would brief the human research ethics committee on changes to the program before it recommenced.

This article was first published in the print edition of The Saturday Paper on February 3, 2024 as "Veterans cover-up".

For almost a decade, The Saturday Paper has published Australia’s leading writers and thinkers. We have pursued stories that are ignored elsewhere, covering them with sensitivity and depth. We have done this on refugee policy, on government integrity, on robo-debt, on aged care, on climate change, on the pandemic.

All our journalism is fiercely independent. It relies on the support of readers. By subscribing to The Saturday Paper, you are ensuring that we can continue to produce essential, issue-defining coverage, to dig out stories that take time, to doggedly hold to account politicians and the political class.

There are very few titles that have the freedom and the space to produce journalism like this. In a country with a concentration of media ownership unlike anything else in the world, it is vitally important. Your subscription helps make it possible.

Select your digital subscription

Month selector

Use your Google account to create your subscription