Anchored to outdated risk and governance paradigms, a bold Australian plan to create a world beating national health data network is in danger of missing healthcare's AI window of opportunity all together
Australia is quietly building one of the most ambitious national health data projects in the world.
It has the legislation and the system architecture in place or coming soon, we have a committed set of smart public servants beavering away on a well laid out comprehensive plan and we have, arguably, the best raw material of any country on the planet – a unified national health identifier, and 24 million citizens in a pre-linked digital health record (the My Health Record) to pull the plan off.
But we have a big problem. One that is almost impossible for anyone in any of the project teams building out this new asset to air publicly.
We are moving as if AI hasn’t significantly altered our timelines and the playing field.
As if AI and the radical new paradigms of care that are on offer will wait for us and our now outdated systems of review, governance, risk management and procurement.
It isn’t.
What we are thinking might take at least three to five years to get up and running, the Mayo group in the US has up and running already in that country and many others.
Our government doers are caught trying to run a truly transformational idea within the constraints of old healthcare system dynamics – in particular risk, compliance and procurement dynamics.
No one has the leeway or the cover to step out of line in the manner needed to embrace the massive transformational opportunity of our plan and get it done in a timeframe consistent with the speed of AI.
Our key project leaders are mired in a system framework that is very clearly no longer fit for purpose.
If anyone does step up in the manner needed they risk being told to walk the plank at a career ending senate estimates hearing, where the pace of change and need for creativity is not understood, or, just being told by a risk adverse boss, “you broke the rules, see you later”.
The question senior leadership in health needs to be asking today is how can they run the right cover on our project teams to make sure they don’t fail given the age of AI and all the new dynamics in play.
Because as good as these plans seem to be and as our teams are, they are going to miss the boat if they aren’t enabled to shift gears rapidly and drastically.
Some in government are telling themselves we need to stick to a good plan, get the component parts in place and this is just going to take time.
But in this scary new data on steroids AI world, too slow can end up more risky for patient well being than too fast.
The situation reminds me of one of our greatest rugby league wingers of the modern era, First Nation player Selwyn Cobbo, who on a podcast said the following, not realising the furore he would unleash:
“Yeah, Kevvy’s a great bloke… shit coach though.”
Kevin Walters, Cobbo’s coach at the time, who had taken the Brisbane Broncos to a grand final the year prior, had, in the face of some nasty board politics, failed to run cover on his players.
As a result he lost the changeroom (the players trust), that year’s club premiership chances, and, ultimately, his job.
The stakes are much much higher for our healthcare coaches out there. They should know who they are.
What Australia is actually building
We have a serious, well-considered, methodically constructed plan.
What was once called the National Integrated Health Service Information Asset – now more sensibly renamed the Health Data Hub – is being designed to bring together My Health Record data with Commonwealth and state datasets in a de-identified, longitudinally organised form that can be used for research, preventative algorithm development, new therapies, preventive diagnostics and more.
The My Health Record is “pre-linked” to patients pathology, radiology, immunisations and medications so they don’t need to be matched from disparate system sources as they are in many other countries.
Five to six million reports are flowing into the system weekly and three million Australians actively review their results each month.
The legislative foundations for deidentified data consent are nearly in place.
The Australian Institute of Health and Welfare has been established as national data custodian under the My Health Records Act.
The National Health Reform Agreement clause H32, commits the Commonwealth and states to shared data capacity. Eighty million dollars has been allocated to help states build healthcare identifiers into their systems – described by those working on it as a genuine game changer.
The ambition is to set up Australia as one of the world’s leading healthcare systems for translating patient data into research and system transformation via innovation leading to more efficient clinical practice.
We know that the potential of such ambition exists for a dataset like this because the idea is being proving out already in different ways in different jurisdictions. The Mayo platform in the US is one key example.
Breakthroughs in diagnostics, preventative algorthms and treatments, genomics and even new drugs, that have been taking over 15 years are being achieved in just weeks and months.
But Australia’s plan is currently on a timetable of around three to five years to just get started.
That, frankly, is not good enough for Australian patients and our strained system now.
It’s especially bad given what we are seeing in some overseas deployments of the same ideas and technology, even though the data assets most of these jurisdictions are working with are inferior to what we plan to have.
Currently no one is doing the risk vs reward equation of moving differently and faster because no one has to.
No one is prepared to challenge the rules of an old system that don’t apply to a world of AI and data.
Or at least no one is prepared to run cover on our most talented thinkers and players to take risks that now need to be taken.
The coach – our healthcare leaders – need to step up.
What is happening elsewhere
In 2019, the Mayo Clinic began doing something that sounds, in description, almost identical to what Australia is planning.
It took the deidentified birth-to-death data of 10 million patients – structured records, unstructured clinical notes, pathology images, genomics, telemetry, waveform data – organised it longitudinally in cloud containers, and opened it to a federated global network of innovators, researchers, hospitals and pharmaceutical companies who could query the data without ever moving or owning it.
The results, published in February this year in the Nature Partner Journal Health Systems, demonstrate what Mayo Platform leader Dr John Halamka calls “data under glass” producing real-world clinical breakthroughs: a pancreatic cancer algorithm that detects the disease three years before any human clinician can see it, at stage zero when it is curable; a breast cancer prediction model that can tell a patient without the disease today that she has a high probability of developing it within five years; an agentic AI system in a Catholic health network of 15 million additional patients, already writing preventive prescriptions for patients trending toward diabetes complications.
The Mayo Clinic Platform now works with 60 to 65 healthcare provider organisations around the world. It has incubated 180 startup companies, several of which – Open Evidence, AI Doc, K Health – are now worth billions of dollars.
Its chief medical officer recently ran emulated versions of every study published in the New England Journal of Medicine in 2025. She replicated a full year of the world’s most influential medical journal in a single weekend. All but two studies were validated.
The cost of curating the world’s data across seven years? Approximately $75 million.
How much did the Australian Digital Health Agency and the My Health Record cost us last year? About $350 million. How much was St Vincent’s recently awarded in a government tender to develop a low acuity national mental health app and program — $400 million. How much do we splay sideways on PHNs each year – some high performing, some wasting large chunks of money on ill concieved, sometimes duplicated pilots – $1.9 billion.
A lot of this is necessary old system investment. But how much and how long would it take Australia to import and pilot the Mayo platform, starting now, not in three to five years’ time?
For an individual hospital with a couple of million patients, Dr Halamka estimates engagement costs between US$1-2 million, with a nine-month lead time from initiation to functioning analytics.
Nine months.
And remember, the Mayo platform comes with all the IP ready to use including all the pre innovated diagnostic, predictive and therapy breakthroughs, derived from overseas data, some of which will be applicable to Australian healthcare situations.
The question Australia doesn’t seem to be asking
Australia has not called Mayo yet.
When asked directly this week whether anyone from Australia’s national health data program had been in contact, Dr Halamka confirmed they had not.
He was a keynote speaker at Davos earlier this year talking about the platform. He has approvals for countrywide data partnerships in Singapore, South Korea and Kenya. He is actively expanding into the Middle East, sub-Saharan Africa, and – when policy frameworks allow – Europe.
Dr Halamka has been a long term a friend and collaborator of Grahame Grieve our enigmatic founder of the FHIR movement. Both worked together under the Obama government on the revolutionary US 21st Century Cures Act FHIR led interoperability program..
Does it feel like history might be repeating itself a little here? Once Grieve was effectively fired from the Australian Digital Health Agency because, as one of our most talented and creative digital health innovators, no one in Australia was prepared to take a risk and run cover on his genius.
He left to work in the US and has been a major contributor to the massive transformation and innovation in that system.
Why has Australia, with its unique health identifier, its pre-linked national health record, its committed federal government and its extraordinary population-level data, not been part of the Mayo conversation?
Australia has had a framework to guide the secondary use of My Health Record data since 2018. It establishes the data custodian, the governance board, the access principles, and the rule that data cannot leave Australia, while analyses and reports produced from it can be shared internationally.
That is pretty much the model the Mayo Clinic Platform already operates.
Health Services Daily has called around a bit to try to understand why, with so much in common, including people and relationships such as that Grieve has, the idea of talking to Mayo doesn’t seem to have been seriouly contemplated.
In our calls the platform was almost always acknowledged, occasionally with interest, but generally with a variation of: “we’re doing our own thing”, “we’re different”, and ,worryingly, “when we’re done what we are doing will be world-leading.
Mayo is not a commercial operation – it is a not-for-profit. The platform’s model explicitly prohibits purely commercial use of data. Mayo also seems to share an almost identical philosophical foundation to our plan: data used only for public benefit, applicants assessed on the merit of the use rather than the identity of the user, all results published openly.
Are we being NIMBYs in preference to being NIMBLE? That would be failing to realise that AI is significantly compressing timelines that once took years into months, and that our current project timeline now risks Australia falling quickly behind the rest of the world rather than ending up as world leaders.
Our system is working against itself
To understand why a such a good idea can take so long to incubate under a well-intentioned government, look not much further than how procurement works in Australian public health and how the political environment shapes every decision made within it.
Consider the replatforming of My Health Record. That process took three years to get to market.
The contracts involved run into the hundreds of millions of dollars, and the procurement process itself – with all its panels, probity requirements, and ministerial sign-offs – consumed enormous resources before a single line of code was written.
In fact, no one knows if a single line has been written yet by Telstra Health, who won the contract earlier this year.
This tedious process is well intended. It is meant to ensure taxpayer money is spent fairly and prevent the kind of favours-for-mates contracting that has occasionally embarrassed Australian governments in the past.
But it is a process for an old healthcare system, not the turbo-charged AI and data system that we are faced with today.
If the Mayo platform’s proposition – that a motivated Australian organisation could be up and running in nine months for US$1-2 million – was brought to an agency currently mid-way through a billion-dollar replatforming contract, the institutional response is going to be predictable.
“We’ve committed to a process” – an expensive one. “The contract is signed … the ship is already under sail … pivoting now would be foolhardy.”
A new idea, however compelling, becomes a complication. A risk.
Our political ecosystem compounds this problem.
Senate estimates hearings have a long memory and a sharp eye for experiments that didn’t work.
A bureaucrat who backs a pilot that fails publicly – even one that was well-designed, called early, and ultimately instructive – learns a career lesson that tends to stick.
The rational response, for anyone who has watched colleagues dispatched to estimates over a procurement gone wrong, is to never be that person. Never do anything that could be characterised, in a Senate chamber, as a risk.
The concept of “fail fast, fail early”, accepted as a basic operating principle in any technology company worth its while, has no institutional home inside Australian public sector health.
There is, functionally, near zero tolerance for public failure, even when the alternative is slow, invisible, and ultimately far more costly (even deadly) stagnation.
This problem is at the heart of the AI and data debate, because the risk calculus being applied is being badly miscalibrated at present by our healthcare leadership.
The question government and agencies are focusing on is: what is the risk of moving too quickly?
But question they should really be asking themselves is: what is the risk now (that AI is here) of moving too slowly?
Every year that passes without a functioning secondary-use environment for My Health Record data is a year in which preventable conditions go undetected, in which algorithms that could identify cancer at stage zero remain undeveloped, in which the 17-year average translation time from research to clinical practice continues to kill people who didn’t need to die.
Slow is not safe.
Slow has a body count.
The compliance trap
There is a structural problem with how Australia is approaching regulation of AI in health that goes beyond procurement culture, and a recent article in Nature Medicine framed it with unusual clarity.
The analogy the article uses is autonomous vehicles.
When driverless car technology emerged, the existing safety standards for road vehicles were built on a single foundational assumption: that a human driver was in control.
Every standard, every compliance requirement, every liability framework assumed a person behind the wheel. When that assumption was removed, the existing standards didn’t bend, they broke.
Regulators trying to apply driver-era standards to driverless cars found themselves asking questions that had no sensible answer, demanding guarantees that could not be given, and in doing so nearly strangling a technology that has since proven substantially safer than human driving.
The solution, eventually, was to go back to first principles.
Not “is there a driver?” but “what are the components of safe driving, and how do we set standards around each of them independently?”
That reframe unlocked progress. It started with industry guidelines, moved to sector-wide standards, and has progressively become regulatory framework.
The same dynamic is playing out in Australian health AI right now.
The TGA’s Software as a Medical Device framework was designed for a world in which a discrete software product made a discrete clinical claim that could be validated to a fixed standard.
It was not designed for a world in which a large language model gives health information to 28 million people via a consumer app, in which the model’s outputs are probabilistic rather than deterministic, and in which the alternative to imperfect AI-assisted care is not perfect human care but the unregulated, unsupervised AI that people are already using.
The result is a compliance trap.
A responsible organisation that wants to make AI health tools safer – that wants to integrate trusted health information into consumer AI products, that wants to add guardrails and clinical oversight to something people are doing anyway – finds itself held to standards designed for a different technology, while the unregulated version continues to operate without scrutiny.
The incentive structure punishes the responsible actor and rewards the reckless one.
An example: will HealthDirect be given enough leeway to work effectively with the LLMs so that we can seamlessly offer all the Australians using these new platforms a nurse triage when their query obviously should suggest one, a diversion to a GP with a booking the next day, an after hours virtual care service, or, an ambulance?
Or will with put the vital safety and system navigation IP offered by this vital government agency in a compliance straight jacket and let the LLMs do what they will, because that will mean we can’t be blamed for anything going wrong?
This is not an argument for no regulation. It is an argument for regulation designed for the technology that actually exists and that our patients are starting to use en masse.
The question isn’t “could this AI system ever give wrong advice?” It could, as could any clinician, any textbook, any search engine or any unqualified online health influencer.
The question is “is what we try safer than the realistic rapidly evolving alternative?”
If an AI-assisted triage tool is twice as accurate as an unassisted Google search, or a ChatGPT conversation, which is what most people are currently using, then blocking it to prevent the risk of error is not protecting patients. It is protecting the system (the government) from accountability.
Let’s talk
The government’s position that building foundations right the first time will ultimately save money and make the system extensible is not wrong.
The instinct to not rush public trust around health data, hard-won after years of My Health Record adoption struggles, is sound.
These things are genuinely hard to scale at a national level, and countries that have moved fast without foundations have sometimes moved fast in the wrong direction.
But there is a difference between building carefully and not engaging with people who have already solved the problems you are still working through and not engaging where your patients are.
Dr Halamka’s suggestion, when pressed, was characteristically direct: find one highly motivated part of Australia – a university, a primary health network, a hospital with a couple of million patients – and do this together to de-risk it.
Show the possibilities. Fast followers will come. The cost is manageable. The timeline is nine months or less, not years.
That is not a replacement for the national program. It is a proof of concept that could accelerate a national program.
The federated model that Mayo uses means Australian data would stay in Australian cloud infrastructure, under Australian governance, in compliance with Australian law.
Nothing leaves the country. But Australian researchers would gain access to queries across a global network of data that currently spans 10s of millions of patients across four continents.
There are, right now, two senior figures in Australia’s health system who are separately approaching Dr Halamka, both a little worried they are going to get themselves into trouble just discussing the idea of a Mayo pilot.
Why are creative and intelligent healthcare leaders scared to be seen to even be talking to Dr Halamka?
Under this dynamic whatever these two leaders end up doing individually, will be working in isolation from the centre. This risks being seen as unsanctioned and potentially being shut down by the very federal and state bodies whose cooperation would eventually be needed to scale it.
That is the same old fragmentation problem that has defined Australian health reform for a generation, playing out yet again.
Related
The window question
Dr Halamka said something at this week’s Health Services Daily (and Wild Health) Prevention Summit in Canberra that is worth airing here for everyone working on health data policy in this country.
He said the window for health systems to shift from sickness to wellness using data and AI at population scale is open now.
Southeast Asia is moving fast. The Middle East is moving fast. Sub-Saharan Africa, with far less infrastructure than Australia, is moving fast. Europe, mired in policy fragmentation not unlike Australia’s federal-state problem, is falling behind.
Australia has almost everything it needs to be at the leading edge of building a revolutionary national health data network. We have a single health identifier, good legislation, the data ready to go, and government intent with talented teams.
What we lack is urgency and courage – an acceptance that AI is moving much faster than we can so we have to iterate and innovate much faster – and a willingness to at least try to learn from the people already knee deep in the work.
We have a great plan and talented committed people. We need the coaches who are going to run cover on and guide our team to a winning proposition.
We asked the AIHW to comment on the proposition put in this article including the situation with the Mayo Clinic and they provided the following background material and comment, which we think is useful:
- Australia already has foundational national data infrastructure in place.
- The AIHW plays a central role in integrating national health and welfare data through the National Health Data Hub (NHDH), securely bringing together data assets from across jurisdictions and sectors to support linked, national datasets.
- The NHDH is already enabling the kinds of insights that can help identify risks earlier and support more preventative approaches to health and wellbeing.
- The ABS’s Person Level Integrated Data Asset (PLIDA) is another key platform, enabling secure linkage across health, social and economic data to provide whole‑of‑population insights.
- Together, these platforms reflect a nationally coordinated approach to data integration, aligned to Australia’s governance, legislative and health system context.
- The Public Health Research Network (PHRN) provides an important coordinating function regarding national research infrastructures, advancing innovation through the secure linkage, management and use of high-quality health and human services data.
- The AIHW continues to facilitate discussions with a range of partners to enhance data integration and identify opportunities for innovative use of data for population health insights, prevention, service planning, quality improvement, and research.
An AIHW spokesperson said:
“The AIHW is actively working with partners across government and the sector to strengthen how Australia’s health data is brought together and used.
“Australia already has significant national infrastructure in place – including the AIHW’s National Health Data Hub and the ABS’s Person Level Integrated Data Asset – providing the kind of longitudinal, person‑level insights that underpin earlier intervention and more preventative approaches to health and wellbeing.
“The priority now is building on these foundations to drive innovation in how data is used and continue delivering meaningful, nationally consistent insights.”