'Flawed' privacy in Queensland Health's electronic medical record, expert says