A government probe into the HealthEngine booking service will sharpen focus on the issues of privacy and consent
HealthEngine, the medical booking service under investigation for sharing patient details, has pledged to make “substantial changes” to its advertising and referrals policies despite denying any wrongdoing.
The company says media reports have created a false impression that patient information was being “widely shared with third parties without their knowledge”.
“This simply isn’t the case,” HealthEngine’s CEO, Dr Marcus Tan, said in a communiqué to clients late last week.
Australia’s biggest online GP booking service is under fire from all sides after revelations that it has been sharing patients’ details with third parties.
HealthEngine is also being accused of undermining public trust in electronic health systems, just weeks before the July 16 start of the My Health Record opt-out phase.
The outcry stems from an ABC News investigation which reported that HealthEngine had passed on patients’ information to other parties, including law firms trawling for potential clients in injury and accident cases.
Federal Health Minister Greg Hunt has asked the Office of the Australian Information Commissioner to investigate.
The AMA said it was looking forward to that report, emphasising its concern about threats to patients’ privacy, consent and ethics. AMA President Dr Tony Bartone said the HealthEngine case aroused concern about trust in the medical profession and public confidence in electronic health initiatives.
“There is also the serious matter of the potential of third parties to profit from having access to confidential and private patient information,” he said.
“The AMA’s concerns extend beyond HealthEngine to other apps, websites, and services, currently being promoted by commercial entities and health-sector bodies, which raise similar questions about privacy and ethics.”
The government probe is likely to go to the question of whether medical clients of the booking service were aware of HealthEngine’s business model.
“Terms like ‘express consent’ have been bandied around in past few days. Where was the express consent of
the medical centre in all of this?” an industry observer told The Medical Republic.
“Were they told their patients might be exposed to these kinds of campaigns? Was it in the terms of service? I think if doctors truly understood what they were signing up for, they might not have made that decision.”
Angry customers have deluged HealthEngine with complaints on social media, and several doctors have declared they were cutting ties with the service.
Dr Ines Rio, a Melbourne GP, said she was appalled to learn of HealthEngine’s data-sharing and had asked immediately to be removed from its system.
In its defence, the Perth-based company points to a statement attached to its terms and conditions; users tick a box to accept the conditions to complete the booking.
“Under no circumstances do I believe that was informed consent,” Dr Rio told The Medical Republic.
“There is an important and necessary exchange of information to improve patient pathways and quality care. However, it is imperative that GP, patient and community trust is not lost.”
A patient advocacy group said HealthEngine’s conduct raised “disturbing questions about the potential hazards surrounding the privacy and security of online medical information”.
Consumers Health Forum CEO Leanne Wells said it was unacceptable that a medical booking service should have failed to declare clearly the potential use of patient data.
“It should also be a responsibility of doctors who contract with HealthEngine to ensure that patients are protected from unrelated business overtures,” she added.
Ms Wells asked why a booking service needed to gather information about whether a patient had been involved in an accident or workplace injury to make a medical appointment. If patients had given consent, she added, why were they so outraged?
In his communiqué, Dr Tan said: “We have referral and advertising arrangements in place with a range of industry partners, including government, not for profit, medical research, private health insurance and other health service providers.
“Referrals do not occur without the express consent of the user.”
But he said media coverage had damaged trust in the company among users, customers and industry partners.
“In order to restore their confidence in our management of user information, we have decided to make substantial changes to HealthEngine’s business model around advertising and referrals.”
The changes should be in place “within a week”.
The scandal comes just weeks after HealthEngine was exposed by Fairfax Media for selectively editing patients’ reviews of doctors’ practices on its website to remove negative comments.
