The country’s most-used GP practice management software vendor says it has ‘formed serious concerns’ about Heidi Health’s new AI-powered product.
After weeks of speculation, Best Practice Software has written to users this afternoon confirming that using Heidi II with Bp Premier would constitute a breach of the End User Licence Agreement.
In other words: the two products cannot be used together.
“Given the significant number of queries we have received from practitioners since its launch, I am writing to you personally to clarify Best Practice’s position on the new Heidi II product,” Best Practice CEO Craig Hodges wrote in an email.
“Best Practice supports responsible innovation that helps you and your patients.
“However, after careful consideration of Heidi II we have formed serious concerns about aspects of the product and how it interacts with Bp Premier.”
But Heidi CEO Dr Tom Kelly has pushed back, accusing the market-leading software provider of stifling innovation and failing to provide reasonable access to its systems.
Speaking to TMR today, Dr Kelly said he was “not entirely surprised” at Best Practice’s decision.
“The records can do what they like with their end users, I think it’s within their rights to limit the use of products,” he said.
“I wish that there was a constructive engagement with innovators in the space, and I think their priority should be – it’s not their data ultimately – so their priority should be giving read and write [access] into different systems.
“We’ve been trying to integrate with Best Practice for three years, and they’ve not made any attempt to give us actual reasonable access.
“Also, we don’t have access to real decision makers, they create a fairly opaque process for partners to actually work with them. And I reject some of the implicit and explicit claims in in the email.”
The Best Practice email singled out three concerns: integrity of clinical information and patient safety, patient data security and privacy and regulatory and compliance considerations.
“Under the terms of the End User Licence Agreement, you are prohibited from allowing any third party to access, use, or modify the Software or Database without Best Practice’s prior written consent,” Mr Hodges wrote.
“Best Practice has not given that consent for Heidi II, and Best Practice considers that using Heidi II with Bp Premier would constitute a breach of the End User Licence Agreement.
“To avoid any confusion, we are updating the End User Licence Agreement with the Oxford SP2 program update to Bp Premier to make clearer that the use of bots, scraping tools, and robotic process automation is not permitted with Best Practice Software.
“We therefore request, in the interests of patient safety, privacy, and good governance, you comply with the terms of the End User Licence Agreement.”
A Best Practice spokesperson told The Medical Republic that it had considered its three big concerns collectively.
“The decision reflects our governance obligations and our commitment to ensuring products integrated with Best Practice Software meet the privacy, security, and regulatory standards, particularly where patient information and clinical workflows are concerned,” they said.
Heidi II, which was unveiled in late September, will move beyond the traditional capacity of an AI scribe in that it offers AI agents which can navigate electronic medical records and other clinical software without direct integration.
“So basically, Heidi can take the keyboard and the mouse,” Heidi CEO Dr Thomas Kelly told The Medical Republic at the time.
“It’s heavily guard-railed, so it’s built specifically for healthcare. We can’t take any write actions, we can’t take any TGA-limiting actions. So, things like investigation, diagnosis, and management [are out], but we can navigate systems.
“We can read, navigate through different patients. The agent will basically use the UI [user interface] like a doctor might, and then create a summary for the clinician.”
Ultimately, Dr Kelly told TMR, it should be on clinicians to decide what their privacy and security policies are with their patients.
In the weeks since Heidi II was announced, the TGA finalised its investigation of 12 AI scribes used in Australia, concluding that eight of them had functions that were likely to require medical device regulation.
It did not reveal which of the scribes that it investigated – which included Heidi – had been flagged.
“The TGA’s recent review of digital scribes found that tools that analyse information or generate clinical conclusions are likely to meet the definition of a ‘medical device’,” Mr Hodges wrote in the email to Best Practice users.
“While we express no view on how Heidi II should be classified, we are concerned that Heidi II’s functionality goes well beyond traditional digital scribing.”
A spokesperson for BP confirmed with TMR that its “consideration of these matters was already underway prior to the TGA publishing the outcomes of its digital scribe review”.
Related
In relation to patient data security, Mr Hodges noted that Heidi II can potentially access sensitive patient data.
“Using Heidi II without patient consent seriously risks breaching the Privacy Act,” he said.
“It is also unclear what use Heidi II is making of this sensitive patient data.”
This was one of the claims that Dr Kelly specifically refuted.
“It’s not unclear,” he said.
“We have a privacy policy that we engage in with our customers, [as well as] compliance and audit that we are subjected to.
“Heidi II meets all those requirements in the same way that the scribe does, and it’s supervised by the clinicians in … taking any action on their behalf, and we’re comfortable with the guardrails we’ve done.
“The TGA is evolving how they think about the space, but we’ve had proactive engagement with them on Heidi II.
“We’ve showed them the caveats. We’ve shown how it asks for approval, how it will reference the clinical information where it’s likely to impact patient care.”
Best Practice currently leads the country in terms of GP practice software vendor market share.
Dr Kelly speculated that Best Practice saw Heidi as a potential threat to its market dominance.
“They’re trying to protect their market position,” he said.
“I don’t think they actually care about patient privacy, safety, or like that the access to data is clearly going to enable the whole health system.”
A spokesperson for Heidi said that it continued to remain engaged with relevant sector bodies and continued to seek to work with Best Practice on integration.
“Australian clinicians deserve the freedom to choose the tools that help them care for their patients,” the spokesperson said.
“Best Practice’s position restricts that choice and holds back innovation that gives clinicians more time with patients. Heidi stands for interoperability.”
A spokesperson for Best Practice, meanwhile, told TMR that it takes its responsibilities to customers seriously and that “strong governance, clinical safety and the integrity and appropriate handling of data are fundamental considerations in our approach to third-party integrations”.
