in terms of what is supposed to happen

• there is the concept of 'medical in confidence' applied to the data which means organisations should protect your data must be given an equal level of protection unless otherwise classified (e.g., if it were also part of a national security matter)
• Health Information Privacy requires organisations to

   

  • take "Reasonable" steps to protect the data
  • only collect the data they need
  • only use if for what they say they will use it for
  • securely dispose of the data when no longer needed - this one is tricky for health portals like MMH because consumers are wanting to access their health records, so there is the incentive to keep all the data available to the portal.