Description: Formalise the existing onboarding documentation and adapt to align with the policy set in REC02. This includes aligning the existing training materials and support services to address the key risks identified during the lifecycle (built using many of the existing quality resources available), and the development/introduction of formal SLAs/performance metrics for pharmacies with appropriate enforcement mechanisms included in contracts.

Rationale: By formalising the documentation that supports onboarding, Medmate reduces risk at a vital stage in a pharmacy's lifecycle within the ecosystem. It does this by ensuring pharmacies are appropriately competent and compliant (as defined in the policy set in REC02) before being activated on the system and therefore reduces risk exposure substantially. Further, this is measurable and allows for quality assurance over the existing ad-hoc processes, ensuring Medmate monitors and upholds its service/compliance standards and more quickly identifies areas of concern.

Evidence: Some pharmacy onboarding documents exist, however aren't aligned with any supporting policy, and don't clearly specify specific roles/responsibilities. Further, pharmacy contracts have only basic performance expectations mostly related to compliance.

Description: Formally define Medmate's expectations of a pharmacy, including their minimum performance criteria, compliance criteria, and acceptable additional risk exposure. This then informs how additional recommended controls are constructed, including the recommended "Formalise onboarding documentation for pharmacies" control, and more. See REC01 and REC03.

Rationale: By developed a formal and accepted policy, Medmate clearly communicates it's position on managing the pharmacy over their whole lifecycle. In doing so, Medmate can ensure all supporting controls (related policy, process, procedure etc.) directly align with the adopted position, ultimately closing the loop on pharmacy management and reducing risk arising from ambiguity for all parties.

Evidence: No formal policy available specifying Medmate's position on pharmacies. Some supporting documentation does exist, but needs work e.g. delineation of responsibilities between staff members within Medmate and pharmacy is unclear in onboarding processes, and controls through that process are minimally documented.

Description: Develop a rigorous approach to the offboarding of pharmacies and/or their staff members to ensure that appropriate access is maintained at all times. Similarly, develop a contractually enforced requirement for pharmacies to secure access to their OMS instance, including managing access for their staff (access reviews/offboarding, requiring secure passwords, mandating no sharing of accounts or writing down of passwords). This is essentially aligning Medmate's adopted ISM with how a pharmacy executes it.

Rationale: This ensures a structured and fair approach to ending partnerships, safeguarding Medmate’s interests and maintaining accountability in compliance matters. This will reduce the risk arising from e.g. a disgruntled terminated pharmacist accessing their former employee's OMS and the sensitive data within. Further, this serves as an inherent control to ensure Medmate understand each pharmacy's own approach to information security management and therefore can assess their level of maturity against Medmate's documented risk appetite (per REC02).

Evidence: While it's been shown that disabling a pharmacists' access to OMS is a straightforward, there's little evidence that this happens every time its required (e.g. how long does it take for a pharmacy to inform Medmate of a terminated employee etc). We also implied evidence of poor info-sec practices (e.g. encouraging writing down of passwords, and therefore likely sharing of accounts within OMS).

Description: In line with expectations set in documentation arising from REC02, establish the various mechanisms and schedules under which Medmate will manage the end-to-end lifecycle of a pharmacy through various controls. For example, develop mechanisms to regularly monitor performance against SLAs as defined in contracts (once added); develop ongoing mitigation of cyber risk through coordinating access reviews and password management for pharmacies on the platform. Some of this will be covered under REC01 (onboarding) and REC03 (offboarding), but additional mechanisms should be used to assure the policy set in REC02 is maintained during service delivery.

Rationale: Establishing a comprehensive audit framework serves as a vital mechanism for monitoring and evaluating the adherence of pharmacies to established regulations and policies stated in agreements between Medmate and the pharmacies. Moreover, a structured audit process not only helps in identifying potential instances of "repeat offenders" but also facilitates proactive measures to rectify any shortcomings detected, ultimately better protecting Medmate and it's partners like Healthylife from the misdeeds of a pharmacy.

Evidence: null

Description: Implement a regular and structured feedback mechanism between doctors and Medmate, converting elements like whether existing processes are seen as reasonable, whether remuneration is viewed as fair, whether the software works etc. This gives Medmate a clear and transparent view on the relationship it actually holds with these key stakeholders (in comparison to a perceived understanding of the relationship).

Rationale: By understanding and mapping the value exchange—the value that Medmate provides its doctors—on a regular basis and over time, Medmate can better understand the relationship and avoid “blind spots” from creeping in. By understanding these elements better and ensuring the value exchange is fair, Medmate can avoid contempt from impacting on quality care for patients and commercial outcomes.

Evidence: No supporting documentation to state this happens; likely occurs only informally.

Description: More formalised assessment measurements during doctor onboarding process to document assurance around doctor competency, compliance and indemnity, and align with outcomes of REC07; enforce these outcomes under REC08.

Rationale: Clearly defining the minimum indemnity insurance requirements, AHPRA registrations and position on AHPRA conditions, etc. expected of a doctor will better communicate accepted risk to all interested parties, ensuring this directly feeds downstream processes to check these are still valid under the maintenance phase of a doctor’s lifecycle. This would also the onboarding process to be streamlined in future (e.g. via automation) without compromising on the quality of these controls.

Evidence: Some minimum requirements exist (e.g. must have good standing with AHPRA, must have indemnity); specifics on ongoing requirements and measurability are main concern here.

Description: Doctors undergo key events in their lifecycle with Medmate, spanning the obvious initial onboarding, ongoing maintenance, and offboarding, but also encompasses other ad-hoc events like taking extended leave, being suspended for compliance issues, delivering poor patient care, starting Quitmate appointments etc. While many of these key events do have some controls in place, there isn't a clear link between these controls across all the phases of the lifecycle. For example, are the "re-onboarding" requirements for a doctor suspended for a compliance issue the same as a brand new doctor? What about for an AHPRA condition? Medmate currently checks for these elements on a semi-regular basis, but doing this purely based on a calendar schedule doesn't reflect the different levels of risk exposure arising at each step in the lifecycle. Medmate should instead adopt formal Acceptable Quality Limits or similar to formalise the level of accepted risk across the various stages.

Rationale: By defining these key events and the thresholds for each, Medmate could align existing and new maintenance efforts to more effectively treat risk over the lifecycle—the resource investment will better match the level of risk exposure.

Evidence: Multiple controls in place to monitor a doctor, but no evidence sighted of an overarching policy/framework that supports when/why these controls are undertaken.

Description: Develop a performance framework that reflects both the roles of doctors in the Medmate Ecosystem, as well as how they impact Medmate's own service offering (and self-set SLAs), in line with the performance expectations (including compliance, service delivery performance, etc) established in REC06. The performance framework for the system should be reflected in the contracts between the various parties. For example, a doctor's performance targets (X minutes to undertake an appointment) should be referenced and agreed/included in the doctor's contract. While basic expectations exist--meeting shifts requirements, pricing and clinical compliance--this framework should reflect elements like ongoing compliance, operational performance, meeting reputational/CX expectations, assessment of clinical decision-making alignment with the Medmate guidelines etc. For example, specifying standards of service and customer satisfaction.

Rationale: By formalising how Medmate will manage the performance of doctors, the management activities and related risk treatments will become more effective (and likely more comprehensive).

Evidence: It was unclear whether there was a regular performance reporting output to show that service delivery expectations are being met. For example, despite Medmate guaranteeing 60-minute turnaround for patients, there is no commensurate throughput requirement in the contract with a doctor. Current contractual requirements serve only to address rostering/availability/compliance e.g. clinical standards and registration with AHPRA etc but should reflect performance.

Description: Explore the implementation of automated processes for governance practices such as automated checking of AHPRA registrations before every shift or automating the routing of appointments to appropriately skilled doctors; this should be focussed on the high-value and high-risk controls first.

Rationale: Not only is this a more efficient use of resources, its a) less likely to introduce human error into these critical controls, b) ensures direct alignment between stated policy position and the execution of the supporting process, and c) generates demonstrable evidence of the control's effectiveness over time. The culmination of this is a more effective reduction in risk as compared to the existing controls.

Evidence: Current process of monthly manual audit of doctors was confirmed verbally; Medmate indicated aspirations to automate many of these compliance checks (on the roadmap).

Description: Regular auditing process to monitor assignment of Quitmate appointments to Quitmate-trained doctors etc and alert if incorrectly assigned; monitor the quality of these assignments over time against the minimum performance expectation set during the program initialisation phase. Further, given these programs are inherently more risky than the ordinary telehealth activities, the ongoing maintenance controls (as defined in REC08 and REC07) should reflect this e.g. increased sampling rate of Quitmate appointments.

Rationale: While controls are in place to e.g. appropriately train Quitmate doctors, high-risk steps still exist in the program e.g. manual allocation of doctors to Quitmate appointments. Given the more risky nature of such programs, it'd be appropriate to recognise and treat this risk with a formal audit process based on that from REC08 (but upweighted), ensuring ongoing delivery of these programs is in line with Medmate's expectations.

Evidence: No structured audit process sited. Confirmed verbally that there is reliance on appropriate allocation of appointments to doctors (done manually). Confirmed verbally there are existing random screening checks, coupled with complete audit of drugs prescribed daily.

Description: Implement reporting procedures to ensure that Medmate's service offering and performance expectations are being met by delivery partners.

Rationale: This ensures that accountability mechanisms are in place and facilitates effective communication channels for addressing any issues or concerns that may arise during the delivery process by specifically reporting on agreed metrics and levels of service specified to delivery partners

Evidence: null

Description: Establish clear delineation of roles, responsibilities, and ownership of risk between Medmate and delivery partners. This includes defining each party's specific contributions and obligations.

Rationale: Clear delineation of roles, responsibilities and ownership will ensure efficient and accountable delivery operations. Clarification of these responsibilities and metrics should be specified in formal agreements between parties.

Evidence: No formal policy available specifying Medmate's position or existing relationship with delivery partners.

Description: Alongside the existing stated Information Security Management Program, develop and implement the supporting processes to ensure this program's desired outcomes are actually achieved. This includes more tactical activities like aligning the authentication process of doctors working remotely (e.g. MFA or risk-based logins), implementing mobile device management (under the existing BYOD model), undertaking vulnerability scans etc, to the strategic pieces like adopting an ISO27001-led software development lifecycle.

Rationale: In dealing with highly sensitive personal health data with a) in-house software systems, b) 3rd-party software systems and c) external contractors, Medmate is inherently exposed to risk; information security management is and always will be an existential risk therefore there is always an opportunity to further efforts in this space.

Evidence: While the ISM program exists and does clearly inform some decision making, we haven't seen this to be comprehensive across all parts of Medmate, nor are there clearly structured monitoring and auditing processes to determine the effectiveness of these controls in treating risk.

Description: Establish and maintain clear delineation of roles, responsibilities, ownership of risk, and value realisation among Medmate, pharmacies, and delivery partners across the entire service delivery process. This includes defining each party's specific contributions and obligations to ensure efficient and accountable prescription, dispensing and delivery requirements. This is mostly fulfilled through the documentation arising from REC13, REC06 and REC02, but is further contextualised alongside the broader business/managerial context. For example, this can take the format of a simple diagram showing the exchange of risk, exchange of value, definition of roles etc. and then how each element will support (or hinder) Medmate's 5-year strategic goal.

Rationale: This will ensure that the appropriate risk, performance and compliance obligations are reflected in contracts, policy, governance, performance and reporting throughout everything Medmate does. Further, when introducing a new Actor into the ecosystem (e.g. a critical 3rd party, or a new venture), it will contextualise how their introduction may impact/interact with other parties, and highlight new risk exposures.

Evidence: Some supporting documentation does exist in a piecemeal fashion, but doesn't clearly align all actors in the ecosystem e.g. responsibilities between staff members within Medmate, Pharmacies and Delivery Partners was not sighted

Description: A formal quality management program, such as ISO9001, would enhance Medmate's processes and ensure consistent delivery of high-quality products and services. This program will involve documenting and standardising processes across all relevant departments, conducting regular audits to assess compliance, and continuously improving operations based on feedback and data analysis. Most importantly for Healthylife, such a program requires Medmate to explicitly consider and address the needs of it's interested parties.

Rationale: For Medmate, this provides numerous benefits, including increased efficiency, reduced errors, and enhanced 3rd party relationship. Medmate would more effectively identify areas for improvement and mitigate risks. Furthermore, adherence to internationally recognised quality standards clearly communicates their approach to such concerns.

Evidence: No program in place.

Description: Adoption of a formal information security management program, such as ISO27001 or SOC2, ensures the protection of sensitive data and aligns Medmate's software development lifecycle with international best practices. This initiative involves implementing robust security measures, conducting regular risk assessments, and obtaining relevant certifications to demonstrate compliance. Additionally, the software development lifecycle will be aligned with security principles, integrating security controls at every stage to mitigate potential risks effectively and ensure the integrity of Medmate's systems and applications from end-to-end.

Rationale: With the increasing prevalence of cyber threats coupled with the sensitive nature of Medmate's business, it's imperative information is upheld.

Evidence: No program in place.

Description: Related to, but separate from, the outcomes of exercises in REC02/REC06/REC13 (setting the performance frameworks), Medmate could better utilise the data made available to them to support compliance and quality efforts. For example, as part of the efforts to monitor a doctor's performance and compliance, the "prescriptions per hundred patients" could be measured against the comparable case average; efforts to monitor a pharmacies turnaround time could be compared against comparable baskets. Additionally, data could be used as controls against potential "doctor shopping"/"frequently flyer" behaviours, and support decision making on where finite manual/spot-checking efforts are concentrated.

Rationale: This could augment the lifecycle management recommendations made in REC04 (pharmacy), REC07 (doctor), and REC21 (patient).

Evidence: Some informal reporting programs in place.

Description: This could involve real-time monitoring of patient interactions and activities, identification of risky behaviours such as repeat visits or unusual behaviour during a consult, and timely interventions. Alongside REC20, data analytics could be used to detect patterns and trends indicative of risky behaviour, enabling proactive risk mitigation strategies.

Rationale: Medmate can identify and address potential risks before they escalate, reducing the likelihood of adverse events and therefore it's exposure to risk. Further, this demonstrates it's efforts in delivering compliant, quality care to it's interested parties like Healthylife.

Evidence: Some informal practices in place, but no comprehensive program.

Description: While we have not reviewed the relationship between Medmate and Healthylife directly, if Healthylife wants to see the risks in this register addressed, then it needs an effective mechanism to ensure this happens. This could take many forms: a seat at the board, contractual mechanisms, SLAs, etc. which would be for the two entities to agree on.

Rationale: Whilst Healthylife may not be legally liable for many of the risks outlined in this register, the perceived connection between the brands exposes Healthylife to significant reputational risk. Healthylife's risk appetite is unlikely to natural align with Medmate's, and so to protect Healthylife's interest, such a mechanism would allow closer alignment.

Evidence: No sighted evidence as out of scope (may already exist); unlikely to be consistently implemented given no formal management system (REC16)

Description: As Medmate scales, it's statistically likely that the quantity of complaints will increase, and therefore the likelihood of serious allegations being made. While existing complaints management processes to exist (e.g. for complaints received against a pharmacy), Medmate may wish to consider an augmented approach that better protects itself and it's 3rd parties. For example, a tiered complaint system where complaints are managed at a low level before being escalated, documentation of required representatives and case file data, and inclusion of appropriate independent representatives (e.g. 3rd party mediator). Escalation policies could include informing Healthylife and other 3rd parties (e.g. insurance) of such complaints.

Rationale: Complaints may escalate and cause significant risk exposure from a medicolegal standpoint. Such strengthened processes would reduce the likelihood that a complaint makes it to TGA/AHPRA/Coroner etc, and if so, improves Medmate's standing as they can refer to their structured approach to resolving the complaint and collected evidence to support their standing.

Evidence: Some existing complaint management exists e.g. for pharmacies; stronger approach could be considered for adoption.

Description: For consideration, development of a clear and digestible "code of conduct" may better align Medmate's existing and new policy positions into a format more effectively communicated to the system's actors. For example, it could more clearly communicate to patients that doctors are bound to this code of conduct, and that they're trained to identify drug-seeking behaviour etc.

Rationale: Many policies are internal-only (due to commercial sensitivities etc) which is fine, but the need to effectively communicate Medmate's position on critical risk elements to other actors in the system still exists.

Evidence: No code of conduct sighted; mostly refers to external bodies' codes of conduct.

Description: Setting an acceptable level of fatigue for a doctor working a Medmate shift would serve to reduce the risk of adverse patient outcomes arising from this fatigue. There are many mechanisms through which this could be achieved, including placing a policy on doctors to self-manage under strict guidelines, integration with other data sources, or a more manual review process.

Rationale: With many doctors on the Medmate platform working multiple jobs, the likelihood of fatigue impacting their decision making is exponentially higher than an ordinary clinic.

Evidence: No fatigue management approach sighted.

Description: While comprehensive, it's beyond the scope of this report to verify the effectiveness of existing controls beyond taking them at face value. Further deep-dives into the true residual risk and undiscovered risk should be considered by Healthylife as part of their broader risk management program. This would include a top-down review from management right through to the day-to-day data entry tasks -- reviewing quality of risk treatment throughout.

Rationale: Many controls can seem effective at face value, but by more deeply analysing how they're implemented and their outcomes, we can form a more accurate view of the true residual risk and make more detailed recommendations on augmented/additional risk treatments.

Evidence: Not applicable.

Description: Evaluate Healthylife's approach to managing third-party engagements, particularly within the context of its partnership with Medmate and similar 3rd parties. This review would assess Healthylife's processes and controls for selecting, contracting, and overseeing third-party vendors involved in the delivery of healthcare services or the management of patient data. Key areas of focus include vendor risk assessment, contract management, performance monitoring, and compliance with regulatory requirements.

Rationale: The focus of our review has primarily been on Medmate's governance approach, rather than Healthylife's. However, it's important to recognise that risks may exist in the space between Healthylife and Medmate, as well as with other third parties working with Healthylife. By conducting a separate review of Healthylife's approach to managing third-party relationships, we can uncover any additional risks or gaps. This will provide valuable insights into the broader risk landscape and ensure appropriate governance measures are in place across all stakeholders involved in Healthylife's operations. Further, it would ensure mechanisms like REC22 are consistently implemented across all 3rd parties.

Evidence: Not reviewed as part of scope.

Description: As detailed in RSK28, it appears offshore staff play some role in the broader Medmate ecosystem beyond the scope of this review. It's encourage to determine and define the role of these offshore staff members, and set appropriate boundaries/risk treatments to avoid e.g. data breaches.

Rationale: Offshore staff accessing any data, particularly PII/PHI (if this is the case) is much higher risk than the exact same activities completed onshore, owing to protections afforded by things like the Privacy Act and Privacy Principles.

Evidence: Sighted offshore staff listing Medmate as employer on LinkedIn; no discussion of staff during consultation or in documentation review.