Australia’s biggest online doctor-booking service HealthEngine announced in early July 2018 « major changes » in its business following revelations it shared medical information of users of its platform with plaintiff law firm Slater and Gordon and other third parties.
The company said it will stop sharing personal data and will remove advertising from its website. The goal is to restore trust in the company, said its CEO, Marcus Tan.
In late June, Australia’s leading source of information the ABC revealed that the company had funneled hundreds of users’ health data to the Australian multinational law firm Slater and Gordon and boasted to advertisers that it could target users with a marketing based on their symptoms and medical conditions.
Australian Health Minister Greg Hunt has ordered the country’s Information Commissioner to investigate the company and asked the Australian Digital Health Agency (ADHA) to conduct an « urgent review » of its relationship with HealthEngine, with whom it has partnered.
Slater and Gordon had a referral relationship with HealthEngine
HealthEngine’s relationship with third parties was revealed in secret documents obtained by the ABC showing that Slater and Gordon had a referral relationship with the service in 2017.
As part of its pilot program, the digital health group provided the firm with a daily list of prospective clients, based on their personal health information. It passed on details of an average of 200 users a month to Slater and Gordon between March and August last year. In total, 40 people would have become clients of the firm, yielding a projected AU$500,000 (€317,000; US$372,000) worth of legal fees.
The law firm has declined to comment to ABC about its relationship with HealthEngine.
HealthEngine is under review from the medical profession
Several doctors in the country have canceled their subscriptions to the platform
This announcement comes as HealthEngine is under scrutiny from the medical profession over its handling of patients’ sensitive medical information.
Several doctors in the country have canceled their subscriptions to the platform following these revelations.
Users have complained
ABC’s information was supported by the testimony of Australian complainants who said they have been contacted by law firms after using the HealthEngine app, encouraging them to pursue personal or workplace injury claims.
None of the users of the application the ABC spoke to said they were aware their information would be given to third parties.
The company said it had transmitted data only with the « express consent » of users
- The Perth-based company, which is partly owned by Australia’s leading telecommunications group Telstra and SevenWest Media, country’s biggest integrated media companies, has maintained that it has only ever passed on personal medical information with « express consent » of users (source: Abc.net.au). Therefore, its CEO Marcus Tan admitted the company had provided information to lawyers, but did not specify when they ceased that arrangement.
- The company insisted that its data usage policy is clearly explained to users via a simple pop-up form available on the app.
- It also has a data-sharing arrangement with the Federal Government’s My Health Record digital medical record system, managed by the Australian Digital Health Agency (ADHA). However, it said it was not able to directly access patient data held by My Health Record or the ADHA.
Action: HealthEngine announces changes in business model
Changes to restore trust in the company
HealthEngine, however, has recently announced that the company will stop sharing users’ data and will remove advertising from its website.
Dr. Tan said in a statement that these changes were aimed to rebuild trust in the company .
HealthEngine’s relationships with third parties were only a part of its business model
Marcus Tan emphasized that HealthEngine’s relationships with third parties only ever accounted for a portion of its broader business model. « Our core business remains centred around [sic] connecting patients and practitioners and helping Australians access health care more easily. This will not change, and will enable us to continue to be successful. »
As part of its online booking appointments system with general practitioners, dentists, physiotherapists and other medical practitioners, HealthEngine asks its users to provide details about their symptoms and medical conditions, including information on whether they have suffered a workplace injury or been in a traffic accident.
Under the changes to its business model, the company will:
- permanently remove reviews of clinics from its website, following an investigation made by the largest media companies in Australia and New Zealand Fairfax that revealed earlier in June that the firm had been tampering with negative patient reviews to make them appear positive (company has since apologized and removed the reviews from its service);
- set up an advisory group to work with health providers, consumer groups and regulators to « ensure [its] future products and services are informed by consulting more widely. »
Interviewed by the ABC, IT analyst Justin Warren believes that the company had no choice but to make changes after facing a backlash from both users and doctors. « They have been adamant that they’ve done nothing wrong, and I can’t see why they would have changed their business model unless this reaction was starting to affect that business model. »
Health Minister has ordered investigation
The Australian Medical Association backed the Minister’s decision
The Australian Medical Association (AMA) last week backed the Health Minister’s decision to order the Privacy Commission investigation. « We look forward to seeing the [Information Commissioner’s] report on HealthEngine and we will work closely with the minister and the government to ensure that patient privacy is protected, » said AMA president Tony Bartone. « There is also the serious matter of the potential of third parties to profit from having access to confidential and private patient information. »