Australia is building one of the most ambitious health data projects on earth. The people running it are talented, well-intentioned and trapped between the past and the future.
We have the legislation. We have the architecture. We have 24 million citizens already enrolled in a national digital health record — the My Health Record — pre-linked to their pathology, radiology, immunisations and medications. We have a single national health identifier that most countries would kill for. We have committed public servants working a genuinely world-class plan.
And we are in danger of blowing it.
Not through incompetence. Not through lack of intent.
It’s something insidious but obvious when you think about it: a failure to reckon honestly with the speed of what’s happening around us with AI and data and an outdated institutional architecture that makes it almost impossible for even our most talented people in government to respond the right way and with speed.
Slow is no longer safe.
Slow has a body count.
What we’re actually building — and how long it’s taking
The Health Data Hub is designed to bring together My Health Record data with Commonwealth and state datasets in de-identified, longitudinally organised form.
The plan is to use it for research, preventive algorithm development, new diagnostics and therapies. Five to six million reports flow into My Health Record weekly. Three million Australians actively check their results each month. Eighty million dollars has been allocated to help states build health identifiers into their systems.
The ambition is right. We know because of the amazing results coming from other overseas attempts at the same idea – the most notably being the May Platform out of the US.
Our timeline is not right.
Three to five years – conservatively – just to get going live.
In AI terms, that’s geological time: not so much a roadmap as a retirement plan.
And somewhere between the plan and the outcome, patients who could have been saved won’t be.
We also miss a window in this country to do something meaningful about transitioning our system to prevention.
Consider as an example of the old world the replatforming of My Health Record. That process took three years just to get to market.
The contracts involved run into the hundreds of millions of dollars, and the procurement process itself – with all its panels, probity requirements, and ministerial sign-offs – consumed enormous resources before a single line of code was written.
This tedious process is well intended. It is meant to ensure taxpayer money is spent fairly and prevent the kind of favours-for-mates contracting that has occasionally embarrassed Australian governments in the past.
But it is a process for an old healthcare system, not healthcare at the speed of AI.
In 14 years’ time our aged care system needs to double to meet a horrible truth…our inescapable demographic is that we need to double our aged care capacity to deal with something that we know is coming.
We can’t do that.
And don’t even start to talk about GP and nurse workforces, and hospital expenditure.
We need a better plan
That’s frustrating because we thought we had a great one. But we don’t anymore.
Meanwhile, in Minnesota
In 2019, the Mayo Clinic did something almost identical to what Australia is planning. It took the de-identified birth-to-death records of 10 million patients – structured records, clinical notes, pathology images, genomics, waveform data – organised it longitudinally in cloud containers, then opened it to a federated global network of researchers and hospitals who could query the data without ever moving or owning it.
The results, published this year in the Nature partner journal Health Systems, are not incremental. A pancreatic cancer algorithm that detects the disease three years before any human clinician can, at stage zero, when it’s curable.
A breast cancer model that predicts development five years before onset. An agentic AI system already writing preventive prescriptions for patients trending toward diabetes complications across a network of 15 million people.
Total cost over seven years of the Mayo Platform? Approximately $75 million. Australia spent $350 million running the Australian Digital Health Agency and My Health Record last year alone.
Mayo is not a blueprint for replacing Australia’s national program. It is, however, a compelling proof of concept – and a possible accelerant.
Dr John Halamka, Mayo’s platform president, suggests the model for a motivated partner organisation: a university, a hospital with a couple of million patients, a primary health network. Nine months. US$1–2 million (about AUD$1.4 million to $AUD2.9 million).
Australian data stays in Australian cloud infrastructure, under Australian law, going nowhere. But Australian researchers gain query access across tens of millions of patients on four continents.
Nine months, not five years. That gap deserves some attention.
You might be surprised to learn that Australia has not called Mayo yet.
When asked directly last week, Dr Halamka confirmed no one from Australia’s national health data program has been in touch.
Two senior Australian health figures are apparently now approaching him independently – and both are reportedly nervous about getting themselves into trouble simply by having the conversation.
This should alarm everyone. But it also tells you something important about the straitjacket that our government and agencies find themselves in.
Related
The straitjacket
It would be convenient to frame Australia’s slow pace as bureaucratic laziness or political timidity. The reality is much more complicated and, in some ways, more sympathetic.
Our project leaders are operating inside a system that was not built for the speed of AI.
Procurement frameworks, ministerial sign-off requirements, probity rules, risk committees – these were designed, with good reason, to prevent the kind of favours-for-mates contracting that has occasionally embarrassed Australian governments.
They were not designed for a world in which a competitor nation can prototype a functioning national health AI platform in nine months.
Senate estimates hearings have a long memory and a sharp eye for experiments that go wrong. A bureaucrat who backs a pilot that fails publicly – even one that was well-designed, called early, and ultimately instructive – learns a career lesson that sticks.
The concept of “fail fast, fail early,” accepted as a basic operating principle in any technology organisation worth its while, has no institutional home inside Australian public health. There is near-zero tolerance for public failure, even when the alternative is slow, invisible, and far more costly stagnation.
No one will lose their job for moving too slowly. But people will lose their livelihoods – and their lives – if the opportunity of our national health data network plan is lost.
There is the fundamental miscalibration going on.
The risk calculus being applied is being applied backwards.
The question being asked is: what is the risk of moving too quickly?
The question that should be asked is: what is the risk, now that AI is here, of moving too slowly?
The compliance trap
The structural problem extends beyond procurement culture into regulation.
A recent Nature Digital Medicine article framed the challenge through the lens of autonomous vehicles.
When driverless cars emerged, every safety standard assumed a human behind the wheel. When that assumption was removed, the standards didn’t bend — they broke.
Regulators applying driver-era frameworks to driverless technology found themselves demanding guarantees that couldn’t be given, and in doing so nearly strangled a technology that has since proven substantially safer than human driving.
The eventual solution was to go back to first principles: not “is there a driver?” but “what are the components of safe travel, and how do we build standards around each one independently?” That reframe unlocked progress.
The same dynamic is playing out in Australian health AI.
The TGA’s Software as a Medical Device framework was designed for discrete software making discrete clinical claims. It was not designed for a large language model delivering health information to 28 million people via consumer apps – where the outputs are probabilistic, not deterministic, and where the realistic alternative to imperfect AI-assisted care is not perfect human care, but the completely unregulated AI people are already using on their phones right now.
The result is a compliance trap that punishes the responsible actor and rewards the reckless one.
HealthDirect – a vital government asset with genuine clinical IP – should be seamlessly woven into the LLMs Australians are already using, triaging queries, booking GP appointments, diverting people to after-hours care or summoning ambulances.
Instead, it risks being left in a regulatory holding pattern while ChatGPT dispenses unfiltered health advice to millions, consequence-free, because no government body signed off on it.
This is not an argument against regulation. It is an argument for regulation designed around the technology that actually exists, and that our patients are already using.
The public trust problem – and its limits
There is a dimension to this debate that is understandably sensitive for government: public trust.
The My Health Record rollout was bruising. Opt-out was politically contentious.
Consumer advocates, led by organisations like the Consumers Health Forum of Australia, have long argued that Australians want control over their health data – to be asked, not assumed.
A CHF survey found that 90% of Australians believe they should be asked for permission before either a government department or private organisation uses their data. “Nothing about us without us” is the principle, and it is not a trivial one.
It is also, in the context of AI-era health data transformation, increasingly impossible to operationalise literally.
Ninety per cent of Australians say they want to be consulted. That same research shows that 90% are also willing to share de-identified data for medical research if it improves health outcomes.
The apparent contradiction resolves when you understand what people actually want: they want to feel respected, informed and protected.
They want to know their data isn’t being sold, commercialised or used against them. They do not, in most cases, want a granular veto over every research application, every algorithm, every federated query.
Government has used “nothing about us without us” as a principle worth honouring. But it has also, at times, used it as cover – possibly subconsciously – as a reason to consult endlessly, pilot cautiously, and avoid the bold call.
In a world where AI is compressing decade-long research timelines into months, the political safety of perpetual consultation carries its own cost in lives not saved.
In a fast-moving AI environment, government cannot get public permission for everything before it does it.
The social media landscape is too volatile, the misinformation risk too high, the political weather too unpredictable.
There will be moments when the right call is to act, demonstrate, and ask for understanding rather than permission.
The autonomous vehicle analogy applies here too: the public didn’t vote on driverless cars before regulators began developing frameworks. They were shown the safety evidence and given time to build trust in a technology that was already proving itself.
What smart and courageous might look like
Anyone who suggests the above is an argument for recklessness is missing the point.
It is an argument for a new kind of leadership in healthcare in this country.
Is running a well-delineated Mayo pilot – through one motivated university, hospital or health network – that is explicitly designed to stress-test and accelerate the national Health Data Hub program a smart and low risk addition to what we are doing today?
It looks like a low cost and reasonably trouble-free proof-of-concept for our grander plans. And we already know we have some high level coal face healthcare leaders champing at the bit to give it a go.
Keep the data in Australian infrastructure. Publish everything. See if the trial makes an argument for going faster that makes trust less of problem.
What might courageous look like?
Senior healthcare leaders running cover on the project teams doing the creative work – protecting them from the career-ending senate estimates hearing, from the risk-averse boss who says, “you broke the rules, see you later”.
Courageous is pulling Mark Butler into a room deep inside the Department of Health Disability and Aged Care and backgrounding him on the realities of what is going on here, so he, a pretty smart minister, understands what is going on and where he has to juggle the politics of a transformation.
Courageous also looks like accepting that public trust, while vital to build, cannot always be the precondition for action.
Often you earn trust through demonstrated outcomes, not through consultation.
No one asked for a mobile smart phone.
The ask-for-forgiveness model is not always reckless – it is the only model available in a world moving faster than democratic deliberation can follow.
The key condition is this: the thing you’re doing has to actually be good for patients, transparently governed, and genuinely de-risked. If government and its agency follow these three pillars even if they fail the public will understand.
A well-structured Mayo trial feels like it meets this bar by the way.
Every year without a functioning secondary-use environment for Australia’s health data is a year in which cancers go undetected, algorithms that could save lives remain unbuilt, and the 17-year average from research to clinical practice continues killing people who didn’t need to die.
Our healthcare leaders won’t lose their jobs for going too slowly. But patients will lose their lives and their quality of life.
This article is an updated version of a longer piece (a rant) first published in Health Services Daily HERE.