DXC Technology helps My Health Record transition to the cloud

The Australian Digital Health Agency has successfully completed one of the largest-ever data migration projects in Australian history, moving the My Health Record database from a fixed server environment to the cloud.

The transition of more than 2.5 petabytes of data took place between January and July 2022 through IT services company DXC Technology, and after a period of design work before that. The migration project was delivered from DXC’s 700-seat, government-certified delivery hub in Adelaide.

The whole project was driven by a directive from the government that its assets needed to be moved out of ageing data centres in line with a whole-of-government hosting strategy.

In a company statement, DXC’s general manager of federal health and social services Brad McKendry said: “With many years’ experience working closely with the public sector, we were able to demonstrate our significant government footprint and successful track record in running critical government systems.”

The Australian Digital Health Agency’s chief technology officer, Professor Malcolm Thatcher, told Region, “We awarded that contract to DXC, and they assisted us with the build sheets in the Microsoft Azure [cloud computing] environment.

“Probably the most important driver for us was that government has made a commitment to modernise the My Health Record system,” he said.

“What that means is we’re looking to expand the agency’s support of digital health through other technologies, not just the My Health Record database.

“We recognised that cloud computing allows the agility of infrastructure that we need in order to move forward to start to unpack the technology stack that we’ve been using for 10 years and be able to do that in a reasonable amount of time.”

With data as sensitive as health records, security and sovereignty are key.

“The sovereignty of data is dealt with under the Digital Transformation Agency (DTA) certification process, so we could only procure DTA-certified cloud services,” Professor Thatcher explained.

“Security is fundamental to the agency’s function so, under the Information Security Manual, which is the government’s guidance around information sensitivity, the My Health Record is classified and protected to the highest level.”

Professor Thatcher said most of the security controls are already embedded in the design of the system.

“For example, the data is already encrypted at rest, so even if a threat actor was somehow able to make its way into the system, they wouldn’t be able to do anything with the data.

“We think it’s an important control. And then the firewall controls we have throughout the different layers of software were over-specified. It’s almost like a babushka doll. We put protections around every component in there.”

DXC and Microsoft are critical to the operation of the Azure environment, and they’re assisting the agency with ongoing monitoring of it.

“That’s not just about performance and availability, but obviously the cyber security aspects we hold very dearly,” he said.

“We’ve got a multi-partner model where we integrate our security monitoring and we integrate our security management. It’s definitely not a set-and-forget.”

Despite DXC and Microsoft having international parentage, the Australian Digital Health Agency said it was important that the data be handled and secured by Australians.

“It was really clear that the resources we were utilising needed to be Australian-based,” Professor Thatcher said.

“Having said that, these companies have a global team that they can call upon if anything tricky comes up.

“This is one of the government’s largest holdings of citizen data, and I want to emphasise how seriously we take the privacy and protection of that data.

“I think one of the genuine benefits of the My Health Record Act is that it provides citizens with protections and control that are embedded in the design of the software and the way it operates. The move to the cloud doesn’t in any way impede those protections.”

Professor Thatcher said the lessons learned from the My Health Record migration are being passed on to other agencies.

“We have been having discussions with other government agencies because the Australian Digital Health Agency is a member of the Digital Leadership Committee across government,” he said.

“The thing about cloud engineering is it’s got to be perceived as an ongoing journey of maturation. The Australian Digital Health Agency over-specified everything and, even though we had great partners with lots of depth of expertise, as an organisation with the accountability to run that environment, we were rightly conservative.

“Now we’re learning to optimise the performance, cost and resilience of that environment. All organisations moving to the cloud, whether they’re government or not, have to be prepared for that journey.”