Australians could be handed greater control over who can access their Medicare card details amid fears the information can be too easily obtained.
An independent report, released on Saturday, has suggested tighter security following a review ordered by the federal government in July after a small batch of card numbers were sold on the dark web.
It noted that while there had been no risk to patients' health records as a result of the sale, Medicare card numbers are susceptible to theft for identity fraud and other "illicit activities".
Illegally obtained Medicare details can also be used to fraudulently make claims and access taxpayer-funded health services.
The report has recommended that doctors and other health professionals be required to get consent from patients - either in writing or verbally - before accessing their Medicare numbers.
"In addition to providing patients with more control, this would also increase consumer awareness about how their Medicare information is used and shared," it said.
The federal government is also being urged to phase out the ability to access Medicare numbers over the phone.
Roughly 580,000 calls are made to the Department of Human Services requesting card access, but security checks aren't as robust as the online portal.
"The information required in the provider security check to access a Medicare card number could be accessible by someone other than the provider," the report found.
While the review panel didn't see any evidence of fraudulent requests for Medicare numbers over the phone, it "remains concerned about the potential risks presented by the channels".
It recommends that, while phasing it out, conditions for the release or confirmation of card information by phone should be strengthened with additional security questions to whoever is calling in the request.
The panel - led by Peter Shergold, former secretary of the Department of Prime Minister and Cabinet - stopped short of calling for mandatory identity checks whenever someone uses their Medicare card, but suggested health professionals be required to take "reasonable steps" to confirm a patient's identity when they are first treated.
It has also recommended that Australians be able to request an audit log of people who have sought access to their card number through the online portal, and that batch requests for numbers over the web be limited to 50 numbers at a time day - a dramatic reduction in the existing 500 record limit.
Last financial year, about 10.2 million searches for Medicare card numbers were made via the online service.
Human Services Minister Alan Tudge and Health Minister Greg Hunt welcomed the report and promised the government will respond by the end of the year.
