Heidi’s long-term spat with the nation’s most powerful general practice EMR, Best Practice, went nuclear yesterday, with BP sending a Level 1 Critical Alert to all its customers on Heidi II use.
Heidi’s enigmatic founder Dr Tom Kelly leads a pretty wild life at the moment.
Talk to anyone in the room at The Medical Republic and Health Service Daily’s AI hospital summit yesterday and he’s either a really nice bloke who is a bit out of his depth at times and oblivious to the havoc he wreaks on the incumbent medical software market with his at-times outrageous statements and claims, or he’s a highly intelligent genius full of hubris manipulating everyone – the Sam Altman (CEO of OpenAI, the company behind ChatGPT) of our local medical software market.
The truth almost certainly lies somewhere in the middle.
No matter. As we say in the media trade, he “gives good quote”.
For anyone wondering just how much preparation and thought he puts into his process, at yesterday’s summit in Melbourne he was practising either peak naivety or genius – it’s a bit hard to tell which one.
He was on stage drawing oohs and aahs from the audience by saying directly to the Oracle Cerner representative sitting next to him on his panel that the global EMR behemoth was too slow and old to keep up, had woeful AI technology expertise and would end up using Heidi’s technology one way or another.
“Oracle’s tools will be built with our underlying tech. That’s what’s going to happen.”
Oh, okay. The look on the face of the Oracle representative, a consummate and very polite industry professional, sitting right next to him was somewhat symbolic of what is going on.
Dr Kelly’s in-your-face approach isn’t exactly standard etiquette in the medical software industry, and given just how powerful Oracle Cerner is in the global hospital EMR world, it’s not how they are used to being treated.
But we’re in Tom’s world now, which is a mix of disruption, planning, intent and chaos.
Anyway, unbeknown to Dr Kelly, me, the lovely Oracle representative and the audience, who were quite enjoying the chaos just initiated on stage, the CEO of Best Practice was (eerily), at just about the same time, hitting send on a confidential email to all his customers titled “Level 1 Critical Alert” – has the ring of Thunderbirds about it, don’t you think? – regarding Heidi II.
After a few weeks pondering the launch of Heidi II – which among quite a few cool new things provides licence owners of Best Practice the capability to direct Heidi II AI agents to autonomously interrogate the EMR and extract all the longitudinal patient data they need for any upcoming consult – the minders at BP decided to act on their view that this was an egregious breach of the Ts and Cs of their user licence.
We predicted this story a few weeks ago HERE the day after Heidi II’s launch in Melbourne.
In that article we suggested that BP needed to be careful in how it responded for a few reasons:
- The Heidi II technology to interrogate BP is pretty old, clunky and slow, and once pricing became part of the equation, would likely be cost-prohibitive;
- If BP did object they would be putting their own business model up for scrutiny – specifically, why they have been deliberately obstructive to a full integration with Heidi over the years and whether that was in their commercial interests rather than the interests of their customers.
On the basis of the last point we proffered that Heidi might well be deliberately baiting BP and even laying a trap.
If they were, then BP just charged full throttle into that trap yesterday.
By the time Dr Kelly was finishing his next panel appearance, we knew of the BP email and we guessed so did he, so as he hurried off stage we intercepted him and asked him if he could take a bit of time to talk about what had happened.
For all the Tom cynics out there, make of the following what you will.
He was obviously a bit hassled and in a rush. Yes, he knew about the email and he did have to get back to the office – we guess to whiteboard a reaction and strategy with his investor friends.
So what did Tom do when I asked for a few minutes?
He smiled and said in a calm and ever so slightly resigned manner: “Sure, no problem.”
I can assure you that is not your average CEO reaction to an event like this literally minutes after learning about it. Most would be polite but run for the hills from the media and the media would understand that.
The minute Tom stopped outside to talk to me he got approached by someone pitching him for a big new potential Heidi partnership.
I listened in and it wasn’t actually a big new opportunity, but Tom was polite and listened patiently and gave the person his personal email to contact him later with the details and someone else in the organisation he could talk to.
I was about to start and someone else pushed in. Same thing. This time Tom politely told the second suitor that he’d promised me a quick interview so he’d be a minute.
If you asked me if that was all an act for the media, I’d say it didn’t feel like it at all. It all seemed pretty genuine and unique.
I’d say Dr Kelly in this encounter was a lot more quirky than calculated, possibly a bit naïve, ensconced as he is in a form of personal crusade to pull doctors out of decades of being tied up in computers and paperwork.
He’s obviously got some ego and hubris about him, but if he didn’t he’d have been squashed ages ago by the investment and start-up community and Heidi wouldn’t have ever seen the light of day – it’s not actually much fun being a start-up founder, even at a company as seemingly successful so far as Heidi.
That said, I’ve never been a great judge of character.
Anyway, I started the interview by asking Tom if he’d seen the letter.
No, not yet.
“Would you like to read it before you comment?”
Smile … yes, thanks, at which point I got it up on my phone and handed it over for him to read.
He spent quite a bit of time reading it and thinking.
To start with, he seemed a bit perplexed, which I thought was an unusual reaction. No frowns, no expressions of discomfort or angst at all really. A bit like … I’m not sure what to say to this.
But he was next to me and obviously committed to saying something so eventually he started, albeit a little awkwardly.
“I’m not entirely surprised …”
“The records [vendors] can do what they like with their end users, I think it’s within their rights to limit the use of products,” he said.
“I wish that there was a constructive engagement with innovators in the space, and I think their priority should be – it’s not their data ultimately – so their priority should be giving read and write [access] into different systems.
“We’ve been trying to integrate with Best Practice for three years, and they’ve not made any attempt to give us actual reasonable access.
“Also, we don’t have access to real decision makers, they create a fairly opaque process for partners to actually work with them. And I reject some of the implicit and explicit claims in the email.”
Ouch.
Yep, Best Practice walked right into all of that.
Was it premeditated in the sense that they’d war-gamed the RPA autonomous agent functionality deliberately to go around all of the above “blocking” that Best Practice obviously seemed to be practising on Heidi?
It feels like it may have been. But there was no premeditation in this response. He was just on the run and giving me a comment as he’d promised.
As fun and neat as the technology is to skirt Best Practice’s best efforts at blocking access to its longitudinal patient records, it’s slow, clunky and expensive. It’s hard to see it ever really catching on.
So, if it was bait, BP bit … hard.
And, as you would expect, the reasons for the Level 1 Thunderbirds Are Go alert were all to do with customer risk and safety. The three key elements of the email were that using Heidi II was:
- A risk to the clinical integrity of their data and a patient risk;
- A high-level privacy and security risk; and
- Possibly a breach of TGA medical device regulations.
Customer first, like always, then … something BP has built its reputation on? All with good intention on the part of the customers?
Nothing to see here, like for instance … “oh shit, there goes both our monopoly and business model”.
Dr Kelly outed the reason for the email surgically. In his view, BP has been trying to keep them out for years, because they realise its utility for their customers is better than what they can currently offer. They want to own that utility, not have a third party own it, for business reasons, so they are going to blank said innovative third party and hope it just goes away long enough for them to at least catch up.
They certainly aren’t going to integrate with them and let all their delighted Heidi I customers access the cool new agentic functionality on offer in Heidi II.
The big problem for BP is that Dr Kelly’s point of view is hard to argue against.
It’s very simple for a customer of both products.
There’s another big problem with Best Practice’s stance. The patient data does not belong to Best Practice. It belongs to the practice, the doctor and the patient.
Clearly in this case BP is trying to protect its business model, by picking and choosing who can use the data for what through its terms and conditions.
But shouldn’t it be the doctor, the practice and the patient who get to decide how to use the data the way they see fit?
If Heidi II was really a patient data security, compliance and regulation risk, then BP could solve that for their customers easily by allowing Heidi to integrate properly via a decent API, as they do for a few chosen partners (Lyrebird is their AI partner and Lyrebird does get the access Heidi II would like).
In any case, Dr Kelly points out that Heidi’s security is better than BP’s anyway (it probably is) and that he entirely accepts that Heidi might be a medical device as the TGA may end up defining one in the context of scribes and AI, but given they are an approved medical device in the UK, which has far stricter and more advanced AI regulatory requirements than Australia so far, that’s very probably not going to represent a problem for anyone.
Which all comes back to hook, line and sinker.
Why did BP take the bait?
Dr Kelly is right. He knows it, BP knows it and so do a lot of increasingly frustrated BP and Heidi I customers: BP has a business model pickle because it’s based on not freely sharing any of their data but gatekeeping access for money and control of the market.
Short side note here though.
BP is and has been a great company for Australian GPs. It’s always been very customer-centric, it’s been run by a GP almost always with the betterment of general practice in mind and not particularly making a lot of money, and it’s done that for over two decades now, and a decade prior in its previous incarnation as Medical Director.
BP is in many ways an accidental monopoly. A victim of its own very good product and service (and more than just a little business nous on the part of Lorraine and Frank Pyefinch).
Heidi is no angel of a company in terms of being ruthless about its intent and strategy. It’s constantly hiding behind the mission of a better life for all clinicians, when you know it’s run by big money now, so everyone beware.
But none of this is a defence now for how BP is acting because this event exposes clearly what is happening in the market.
BP has gone on the defensive and isn’t being upfront with its users when it says why it’s not allowing Heidi to integrate properly with it.
It’s not about user experience, utility, safety, security or compliance. It’s about business model and money.
BP is perfectly entitled to act in this manner by the way. It’s a business. It’s entitled to defend its business in any which way, so long as it’s legal.
But saying that not integrating Heidi is about safety, security and compliance is bollocks.
I’d hate to be in BP’s position.
If Heidi did whiteboard all this and lay the trap in the RPA functionality of version II, then, well … that turns out to be a bit of evil genius.
But BP taking the bait is likely a sign of how frazzled they are at the moment.
They could have kept playing the “nothing to see here” card and most of its customers would be none the wiser for quite a bit longer. That may have given them time to get their act together on their now creaking EMR offering and compete better.
It’s not the BP everyone has come to know and love in this particular episode of medical software history.
It’s a BP that for the first time in decades finds itself in a corner where it’s being genuinely threatened by an innovative, cheeky, disruptive and in-your-face, do-or-die competitor.
BP is a good company with lots of good people in there and enough of a competitive moat and working capital to retreat from this particular battle, lick its wounds and rethink its strategy on the new AI disruptors.
Heidi is a genuine competitor for part of the clinical workflow layer, something that BP hasn’t had to face off against for quite a few years now.
Hopefully the new competition dynamic is going to be good for both companies, the market, our doctors, practices, and the system.
