Pharmacies on the Medmate platform

Relationship, role, and lifecycle

Pharmacies are a vital part of the Medmate ecosystem – coupled with the telehealth and repeat script service, they round out the end-to-end prescribing value and supply chain. In return, pharmacies gain an advanced digital capability (filling scripts, ecommerce), and a new source of customers.

Some pharmacy brands active in the Medmate ecosystem.

The lifecycle of a pharmacy on the Medmate platform is —onboard, maintain, offboard. We will explore each in greater detail below as outlined in the Business Process Map.

Figure 4: The high-level lifecycle of a pharmacy.

---

---

Close

Medmate’s relationships with pharmacies are longstanding—most pharmacies onboarded have used the platform for a long time, owing to the mutually beneficial nature of the relationship alongside Medmate’s standard of relationship management. This relationship is formalised by a contract.

This contract formalises Medmate’s basic expectations of a pharmacy over its lifecycle, namely:

• Obligations as a business

  • The pharmacy is a licensed pharmacy and will maintain all necessary registrations to operate for the duration of the agreement.

  • The pharmacy is not / has not been subject to an insolvency event.

  • The pharmacy has a valid ABN.

  • The pharmacy is registered for GST, if required.

• Use of the Medmate platform

  • The pharmacy is responsible for how its personnel use the platform.

  • The pharmacy and its personnel cannot use the platform to break the law, interfere with supply of Medmate’s services, and generally has the rights to provide Medmate access to their intellectual property (e.g. product specifications).

  • Medmate is not a party to any agreement between a customer and a pharmacy, nor any contract of sale of products stemming from use of the platform.

In What is the process for onboarding pharmacies? We will explore the expectations placed on each pharmacy in greater detail.

How do pharmacies use and benefit from Medmate?

Pharmacies can use the Medmate platform in a variety of configurations, namely:

1. Script filling only: under this model, the pharmacy simply uses Medmate as a “lead generator” wherein they receive scripts to fill, and nothing more.

2. E-commerce mode: the above, plus all the pharmacies stock is made available through POS integration, and a patient/customer can purchase via:

   1. A Medmate-operated user interface (UI): Medmate owns and operates a UI on behalf the pharmacy and is responsible for its upkeep. In practical terms, this may be the whole website, or may be a widget embedded into an existing pharmacy website; the functionality and supporting backend is essentially identical.

   2. A pharmacy-operated UI: The pharmacy uses the integration capability made available to them by Medmate to build their own user experience which can take many forms. In this case, the pharmacy bears the burden of development and maintenance.

For the discussion at hand and the scope of this review, we will be focussing on the script filling capability provided by Medmate which is common across all the above configurations.

Whilst most pharmacies would be setup to receive electronic prescriptions, many would be doing so via QR code tokens presented and scanned in person. Pharmacies also have a natural desire to acquire more customers, and the Medmate platform addresses this in two ways:

1. Convenience of uploading a script, leading to a better customer experience: patients can upload fill their script online, and get it delivered/click-and-collect in the manner most convenient to them—mire efficient than walking in and waiting in line for your script to be filled.

2. Additional lead source: many patients may not even find the pharmacy if it were not recommended during their use of the Medmate platform, serving as an additional lead generator for the pharmacy.

In doing so, they pay Medmate an ongoing monthly fee and Medmate shares in a percentage of the transaction value; some pharmacies may opt to increase prices of items offered through Medmate to cover these costs.

Pharmacies interact with the Medmate platform through the Medmate Order Management System (OMS). Each pharmacist is provided login details, and once in the OMS, they’ll see baskets of orders (containing scripts and/or e-commerce items) relevant only to their pharmacy in various stages of fulfillment. These details are pushed into the OMS by Medmate via their website or the pharmacy’s website; only scripts validated against the national exchange can be uploaded and therefore only valid scripts will appear in OMS.

Pharmacies accept and order and move to fulfillment. For scripts, this includes a Push to MedView Flow button, which is how the data moves the OMS into the pharmacy’s dispense system. For more detail, see How does Medmate move data between its system and a pharmacy’s dispense systems?

Under this model, there’s very little technical change required of a pharmacy. Instead, the pharmacy simply must remember to regularly check the OMS (or be alerted); Medmate operational staff follow each order as a failsafe. The lack of complex and lengthy integration works is another significant benefit to the pharmacy.

What is the process for onboarding pharmacies?

As best practice, we suggest the following documented information is appropriate for the management of the lifecycle of a pharmacy’s relationship with Medmate:

The last two items are discussed in Once onboarded, how are pharmacies managed whilst live on Medmate? and How are pharmacies offboarded from Medmate?, as our focus here is on the onboarding stage of the pharmacy lifecycle.

There is no supporting policy that puts forward Medmate’s position on which pharmacies are suitable to partner with Medmate, nor clearly outlines the roles/responsibilities and ongoing expectations of each party. This is partially supported by a contract, but this isn’t an appropriate mechanism as a) contracts are exchanged well into the development of a pharmacy’s relationship with Medmate and b) contracts can naturally vary over time or by deal, therefore aren’t able to communicate Medmate’s actual position on pharmacy relationships.

At the time of writing, Medmate’s sole focus was the onboarding of pharmacies within the Sigma Healthcare network under their pre-existing agreement. Medmate advised us that commercial deals were in the works for further pharmacy networks of a similar nature. They indicated that this would likely be the preferred model for the near future.

Operating under this model does make commercial sense for Medmate but necessitates us to divide the discussion here into two parts: Sigma pharmacies, and independent pharmacy onboarding.

Onboarding of network pharmacies

By focusing on network pharmacies (e.g. Sigma’s Amcal and Discount Drug Store) first and foremost, Medmate are able to more rapidly expand their pharmacy footprint, owing to a) already established commercial arrangements, b) clearly defined delineation of responsibility between Sigma resources (business development manager, franchisee, etc.) and Medmate, and c) minimal bespoke onboarding requirements given relatively well-known environments.

Figure 5: The process to onboard a pharmacy in the Sigma network.

---

---

Close

While the onboarding process is defined for such Sigma pharmacies, the procedure to support the process was informal, albeit supported with spreadsheet-based trackers that serve as a pseudo-procedure. Medmate is reliant on skilled staff understanding and entering information in their various systems, rather than following a documented procedure; we’re unable to comment on the quality of this execution, as there is no verifiable/quality assurance data available.

Let’s review this arrangement in the context of Medmate’s operating environment.

Firstly, Medmate has a long-standing agreement with Sigma to deliver these services. Sigma, being a large and publicly listed company itself, would have ongoing monitoring, risk management and quality assurance frameworks used to manage their pharmacy franchisees. By extension, one could make the argument that Sigma has “pre-vetted” these pharmacies for Medmate, and therefore it’s appropriate for Medmate to bring on any Sigma pharmacy without a detailed vetting process of their own. This is a reasonable position but isn’t aligned with best practice.

Medmate is also not onboarding vast amounts of pharmacies and operates with a small and skilful team; with fewer onboardings in flight at any one time, it’s more likely Medmate staff would notice a red flag—but still not wouldn’t be as thorough as referencing documented information and collecting data throughout to support a proper quality assurance program.

Furthermore, the service that Medmate offers a pharmacy is relatively benign—Medmate offers pharmacies an e-commerce/order management platform, and a connection through to eRx Script Exchange (which the pharmacy likely already has). Pharmacies operate in a reasonably well-controlled regulatory environment, notwithstanding recent concerns with compounding pharmacies etc. which is out of scope for this discussion. Medmate is essentially a top-of-funnel or “lead generator” that connects these services. From a pure legal standpoint, there is arguably little additional risk exposure here. However, there is significant reputational risk, should “perceived misuse” of the platform be exposed – refer to the discussion in Key theory and concepts.

Each pharmacy goes through an independent know-your-customer screening process with Medmate’s primary payment gateway provider, Adyen. As required by payment industry regulation, Adyen independently screens each pharmacy against anti-money laundering and combatting terrorist financing requirements—elements like the nature of the products they sell, the ownership of the pharmacy, verifying the pharmacies Source of Wealth/Source of Funds (is their turnover legitimate), and general risk exposure for a pharmacy. It would be rare for a legitimate pharmacy to fail this check. Adyen’s onboarding process serves as a legitimate checkpoint in the onboarding process for potential financial risk but does not cover operational risk—Medmate should be screening for this.

With many of the pharmacies on Medmate’s platform using this as their sole online presence for e-commerce, business continuity is vital. Pharmacist turnover is natural—as it is with any business—but the management of access to those portals was not aligned with information security best practice. While cybersecurity is not in scope for this discussion, we are flagging the following for future investigation:

• Pharmacies encouraged to write down login URLs and details; we believe pharmacy staff are likely sharing login details.

• Medmate staff seemingly knowing the login details of pharmacists; we believe pharmacy staff are not compelled to change passwords.

The risks with this include:

1. With shared logins, auditability/chain of custody is compromised – we can no longer guarantee if a specific pharmacist (or indeed Medmate) completed an action as opposed to someone else using their details.

2. Offboarded pharmacists may retain their access to the system and may be able to undertake nefarious actions if connected to a dispense system.

3. Plain-text passwords may exist in onboarding material, meaning anyone with access to that onboarding material may be able to gain access to the system.

For avoidance of doubt, we did not directly sight any of the above behaviours, but they were implied during our interviews.

By developing the recommended appropriate documented information, Medmate could mitigate risk exposure that would arise from future:

• Broader/high-volume acquisition of pharmacies, Sigma or otherwise

• Re-introduction of onboarding independent or non-Sigma pharmacies

• Key person risk/insider threat management, wherein a key person in Medmate can decide the fate of a pharmacy and therefore is vulnerable to compromise.

• Pharmacies with a longstanding relationship with Medmate achieving nefarious things in a blind spot whilst Medmate’s focus was elsewhere.

Onboarding of independent (non-Sigma) pharmacies

As a result of Medmate’s present focus on existing pharmacy networks, the above items were either underdeveloped or non-existent. For example, we were unable to sight a “pharmacy onboarding process” suitable for use with an independent/non-Sigma pharmacy—only one suitable for Sigma pharmacies.

Medmate does have a checklist of information required from an independent pharmacy, however this is more operational information (contact information, license numbers etc) than vetting. Given there are already some independent pharmacies active on the Medmate platform, there’s clearly an undocumented/anecdotal process that exists to facilitate this.

We have pieced together what this process would likely look like, using interviews and some documentation as a basis; red ? indicates items that have not been confirmed to exist. For the avoidance of doubt, this is not an adopted process at Medmate but simply serves as an indication of the likely process pieced together from discussions and other documents, should such onboarding events happen again.

Figure 6: The process to onboard an independent pharmacy to the Medmate platform.

---

---

Close

All the same points raised for the onboarding of Sigma customers apply here, but without the ability to rely on Sigma’s risk management activity, Medmate must take responsibility on assessing a pharmacy’s suitability to join the platform.

Once onboarded, how are pharmacies managed whilst live on Medmate?

Pharmacies active on the Medmate platform are only formally managed by exception—either the pharmacy raises a support query (e.g. requests a change to their configuration), or a patient complains. Beyond the basic contractual requirements, there aren’t set measurable SLAs placed on a pharmacy by Medmate.

Figure 7: How pharmacies are maintained on the Medmate platform.

---

---

Close

Once a complaint is received by Medmate, an investigation process commences with a strong focus on retaining the pharmacy on the platform through remediation actions (coaching, etc.). We will discuss this in How are complaints against a pharmacy handled? below.

Without a complaint, the management of a pharmacy is an informal affair; Medmate staff monitor every order that goes through the platform—from order placed, to accepted by the pharmacy, to dispatched and delivered. Such close monitoring of each order means Medmate notices many instances of poor customer experience but—as this a human-reliant process—naturally cannot keep across every single data point in the way that a structured reporting process could. Furthermore, pharmacies are not given clear, measurable SLAs but instead guidelines on Medmate’s expectations regarding timeframes, customer experience etc.

Without these clear and measurable SLAs, and as Medmate scales the number of pharmacies they engage, we believe there is significant risk of a reduction in customer experience, and a potential risk for misuses of the platform to go unnoticed as a result.

In the event of any misuse, Medmate is protected by the reasonably broad contractual terms with a pharmacy, including:

• a requirement for the pharmacy to fix any breaches within 10 business days.

• a requirement for pharmacies to adjust their use of the platform in accordance with a request from Medmate in accordance with the contract.

• a clause regarding reasons outside of Medmate’s control affecting their ability to deliver the services.

In all the above instances, Medmate can terminate the contract with the pharmacy and stop rendering services.

How are complaints against a pharmacy handled?

Complaints against a pharmacy follow the below process. Medmate places great emphasis on maintaining the relationship with pharmacies and indicated that there would be many informal opportunities to address issues before a formal mechanism (e.g. contract breach) would be considered by Medmate.

This is a standard complaint resolution process, so there isn’t much to comment on in relation to the steps of the process.

Figure 8: How underperforming pharmacies are managed when complaints are raised.

---

---

Close

As Medmate continues to scale, the ability to respond to every customer complaint in this manner will become more difficult and/or resource intensive. Medmate may wish to explore other mechanisms for detecting poor customer experience, including:

• Alerting based on set thresholds e.g. order turnaround time.

• Integration of other data sources e.g. post-purchase surveys.

• Systems/reporting to further support and analyse the end-to-end pharmacy process beyond tracking each order by hand.

This is tightly coupled with the above discussion on setting SLAs on the performance of a pharmacy; with set SLAs, all parties can clearly understand their performance under the terms of the contract, and act accordingly.

How are pharmacies offboarded from Medmate?

Medmate has not yet had the need to formally offboard a pharmacy from their platform, and therefore there isn’t documented information relating to this stage of the lifecycle. At any time, the configuration of a pharmacy on the Medmate portal can be changed including:

• Switching a pharmacy to only allow click-and-collect orders.

• Switching a pharmacy to “offline” or “archived” mode, where no orders can be placed through the Medmate platform.

These changes effectively amount to “offboarding” of a pharmacy in the operational sense, are quickly actioned, and reportedly happen somewhat regularly so we are comfortable in Medmate’s ability to immediately suspend pharmacy should this be required (e.g. in the event of gross misconduct). This serves as an effective response mechanism and risk treatment, and we believe is suitable for the size of Medmate’s current operation.

As Medmate continues to grow, it’s does become increasingly likely that a formal offboarding requirement will arise. This would cover elements like retention of data for compliance/regulatory/legal reasons, security of that data, the legal ramifications of termination from the platform (which is subject to the contract between the pharmacy and Medmate), and the roles within Medmate that execute these important steps. It’s important to note that these elements pose little to no risk exposure for Healthylife, particularly as the “immediate suspension” mechanism serves as an effective device for protecting Healthylife’s interests.

How does Medmate move data between its system and a pharmacy’s dispense systems?

Medmate offloads integration between its Order Management System (OMS) and a pharmacy’s dispense system using MedView Flow as a middleware. This software is integrated with most common dispense systems in use across Australian pharmacies.

To see how this data arrives in the OMS in the first place, see How do patients upload scripts for fulfilment?

Figure 9: Conceptual flow of data between the systems used in the prescription fulfilment workflow.

---

---

Close

MedView Flow is developed by Fred IT Group – the same group who operate the eRx Script Exchange. Five licenses are made available for free to all Australian pharmacies to encourage electronic prescribing adoption. As a result, uptake has been widespread with 3,700+ pharmacies in the MedView Flow network and pharmacy groups already using, or have committed to onboarding MedView Flow including Priceline, Amcal, Guardian, Discount Drug Stores, Advantage and Ventura Health¹. MedView can be safely viewed as a de-facto standard. Fred IT Group would hold the responsibility for the availability, security and performance of both MedView and the eRx Script Exchange—not Medmate.

On the topic of widespread uptake within pharmacies, it’s important to note that Medmate is essentially integrating into MedView Flow network, rather than repeated individual integrations with each pharmacy. The difference being there’s no customisation for each pharmacy—and reduced risk. This is aligned with how the broader MedView Flow and eRx Script Exchange products operate. Medmate holds no responsibility for the security and risk posture of MedView Flow itself—their liability would extend only to their integration with MedView Flow.

To further explore this point, let’s imagine a scenario where Medmate’s integration malfunctions or is compromised (e.g. via an insider threat²). It is theoretically possible that access to sensitive prescription and/or associated clinical data could be accessed or delivered to the wrong party as a result. This would primarily be a PII/PHI leak concern, as the checks and balances built into the eRx exchange and pharmacy process in general are intended to combat such misuse for nefarious purposes (e.g. sensitive drug access) including the checking of a script token as valid and active against the national exchange. One could also argue that bad actors would have an “easier” time elsewhere than targeting such highly secured and regulated environments, including direct compromise of a pharmacies own systems (generalising, but often of a lower security posture) or the human actors involved in the process along the way (managed via an Insider Risk Management Program). The integration with MedView Flow brings minimal additional risk exposure but provides Medmate with substantial cost and resource efficiency improvement.

Medmate’s integrated systems are conformant under the Australian Digital Health Agency’s (ADHA) conformance requirements for Mobile Intermediary Systems and Mobile Applications. These requirements are broad and seek to ensure all parties operating or interacting with the e-prescribing model meet a minimum standard of security and interoperability. It is reasonably safe to take this conformance at face value but could be considered for a cybersecurity deep dive in future.

Does Medmate use compounding pharmacies?

No, Medmate doesn’t currently engage with compounding pharmacies to facilitate its weight management program (e.g. compounded Ozempic) and doesn’t intend to do so.