The startup is currently locked in a public stalemate with Best Practice over whether its AI agents should be able to access the practice management system.
There’s been a new twist in the Heidi Health vs Best Practice saga today, after GP Dr Max Mollenkopf pointed out an obscure term hidden in Heidi’s terms of service.
Last week, Best Practice advised its users – comprising the majority of Australian GPs – that it would consider the use of Heidi’s new agentic AI product, Heidi II, to be a breach of its end user licence agreement.
Specifically, Best Practice’s agreement prohibits the user from allowing any third party to access, use, or modify the software or database without the software vendor’s written consent.
Heidi II will be able to use the practice management software interface in the same way that a doctor might, by using the keyboard and mouse to navigate.
In his email to customers, Best Practice CEO Craig Hodges said the company was concerned about the integrity of clinical information, patient data security and privacy, and regulatory and compliance considerations.
Heidi has not taken the blow lying down.
CEO Dr Thomas Kelly was quick to refute the criticisms levelled by Best Practice.
“They’re trying to protect their market position,” he told The Medical Republic last week.
“I don’t think they actually care about patient privacy, safety, or, like, that the access to data is clearly going to enable the whole health system.”
Heidi’s chief medical officer, Dr Simon Kos, took to LinkedIn to compare Best Practice’s statement to his car manufacturer telling him where he could and couldn’t drive.
“I believe the GP decides,” he wrote.
“You carry the clinical, ethical and legal responsibility for your patients’ information.
“You answer to the Privacy Act, to AHPRA, to College and to the patient in front of you.
“A software vendor holds none of that accountability, so it shouldn’t hold a veto over the tools you choose.
“A vendor that uses its licence terms to dictate which tools you can use is putting its commercial position ahead of your professional judgement.”
It was slightly awkward, then, when Newcastle GP Dr Max Mollenkopf pointed out clause 7.2.9 in Heidi’s master services agreement, which prohibits Heidi users from using “any automated means (including bots, scrapers, or scripts) to access the Platform, except through APIs expressly made available by Heidi for that purpose”.
Dr Kelly and Dr Kos admitted that it was a “good catch” and a “fair call out”, respectively.
“Clause 7.2.9 is a pretty standard term on cloud platforms used to protect the capacity of a shared service but as it’s currently worded doesn’t capture the nuance we have so we will update in the next round of updates,” Dr Kos wrote in reply to Dr Mollenkopf.
“We have not asked customers to comply with it the way BP has.
“We would act on [it] only when someone uses automation for an ulterior purpose, such as getting around our security or putting an unreasonable load on our platform.”
Dr Kelly said the clause would be updated in due course.
Do not, under any circumstances, let your AI agent send story tips to Holly@medicalrepublic.com.au.
