Patients using the Hola Health platform

Estimated 9 min read

Relationship, role, and lifecycle

Patients are the primary consumer of the Hola Health system—without patient’s, the ecosystem stops.

Patients are unique in that, alongside Hola Health, they interact with every other actor in the ecosystem and are therefore uniquely exposed to the experience delivered by each actor.

It’s a fair assessment to say patients are at the frontline when it comes to any of those actors underperforming—whether that’s a Doctor delivering poor care, a Pharmacy packing an order incorrectly, or a Delivery Partner not meeting their Service Level Agreement (SLA).

Figure 14: The lifecycle of a patient in the Hola Health ecosystem.

---

---

Close

In a similar fashion, Hola Health’s ongoing maintenance of a patient is distinct to those other actors, in that there isn’t performance management per se—how do you set performance criteria for a patient?.

Instead, Hola Health’s interests with a patient are in generating further sales from that patient, which they achieve through a) good service and b) marketing. There is an angle wherein Hola ought to ensure a patient’s ongoing use of the platform is appropriate (i.e. they’re using it for interim healthcare needs, they’re not doctor shopping, etc). Some mechanisms do exist in to this end; to access Hola’s prescription services, an account must be made and the patient’s identity must be verified. We’ll explore this in more detail later.

Additionally, patients don’t have—and really don’t immediately require—a formal offboarding process as it currently stands. Like most comparable platforms, these accounts would just sit there until either a) a retention policy kicks in or b) the customer explicitly requests deletion.

Figure 15: The end-to-end process of a patient on a prescription journey within the Hola Health ecosystem.

---

---

Close

How do patients benefit from using Hola Health?

Hola Health provides patients convenient access to telehealth, including repeat prescriptions, medical certificates, or express consultations—all via a phone or video call with an Australian registered doctor. This service addresses accessibility issues of primary healthcare in Australia, whether that be due to remoteness, access after-hours or the availability of one’s regular General Practitioner (GP). Hola Health explicitly positions themselves as a transient part of a patient’s healthcare; they don’t aim to replace a regular GP.

In addition to telehealth, Hola Health closes the loop by also offering prescription drug access and other pharmacy products to be ordered online, and optionally delivered to a patient’s doorstep via a third-party delivery service. Compare this to most pharmacies in Australia which operate under a traditional bricks-and-mortar operation.

Primarily, a patient benefits using Hola Health as follows:

• Convenience & accessibility: A patient may undertake an online doctor consultation from anywhere, even outside of Australia. This eliminates the need to travel to a physical GP clinic, an Emergency Department (in very limited cases), specialist after-hours GPs, or a pharmacy which saves both time and effort. It also plugs the gap when a patient’s usual GP is unavailable due to capacity or leave.

• Cost-effectiveness: Hola Health telehealth appointments may be cheaper for patients than visiting a GP on a regular basis for repeat prescriptions.

• Timeliness: Hola Health provides a quick and convenient alternative to requesting and receiving prescription medicines. A patient may save time by not having to visit a physical GP clinic or pharmacy, instead utilising Hola Health’s telehealth and prescription delivery services.

These aspects arguably also combine to improve the level of patient care available; no longer does a patient have to go without vital prescription drugs while they await an appointment with their usual GP.

How do patients get a script renewal?

Patients can request a renewal of an existing script through the Online Prescriptions pathway of the Hola Health website, but is otherwise just the same process as the above journey; online scripts still involve a telehealth consult with a doctor.

In this path, they enter the name of the medication (if supported), then enter identity and Medicare details, and answer some questions about what the medication is treating (see below). If basically suitable, a patient pays and is sent the link to consultation, and will receive via Electronic Prescription (eRx).

Figure 10: Questions asked during an online script renewal, intended to ensure early screening of non-renewals, and directing the customer back to their GP for ongoing care. Without correct answers selected, a patient can't proceed.

---

---

Close

The doctor is still required to assess the information (both the questions and during the consult) before issuing the script, with the intention being this service is for renewals only (brand new scripts are only via telehealth consult, and as discussed as limited).

How do patients get scripts filled?

Patients with an electronic prescription token—either issued by Hola Health’s telehealth doctors, or from elsewhere—can choose to have that script filled wherever they see fit.

There are two primary methods where this happens via Hola Health:

• Uploading via the Hola Meds website at meds.hola.health
• Uploading via the Hola app.

Both methods share the same process and backend, so no further distinction will be made here.

Upon uploading the script token, the script is validated against the eRx Script Exchange, and if is a valid script, then will be assigned to the the selected pharmacy (within 5-10 kms) for fulfilment.

Hola Health collect payment from the patient once the pharmacy confirms the cost/availability, and the pharmacy begins fulfilling the script as outlined in How does Hola Health move data between its system and a pharmacy’s dispense systems?

Figure 8: Conceptual flow of data between the systems used in the prescription fulfilment workflow.

---

---

Close

In contrast to filling a script by walking into a pharmacy and transacting directly, a patient does need to provide Personally Identifiable Information (PII) to Hola, which is governed under Hola’s Privacy Policy, and payment details online which are secured by using PCI-DSS compliant payment gateways (namely, Stripe and Paypal).

This does marginally the risk exposure of Hola Health in collecting and storing PII of patients, but only very marginally given there is already PII collected during the script renewal process (as would be the case if they visited their usual GP), and Protected Health Information (PHI) collected via telehealth.

How does Hola Health manage the customer experience?

Hola Health’s current main management method for customer experience is their self-set timeframe SLA’s, being:

• See a doctor within 15 minutes
• Get Over The Counter (OTC) items within 30 minutes
• Get prescription medication within 2 hours

Hola monitors these on an ongoing basis, and more formally during weekly review meetings within the respective teams.

In addition, Hola does collect and monitor customer feedback (generally, complaints) where a customer reaches out.

Hola has indicated that there is an imminent shift in this space, with post-consult surveys and post-delivery mechanisms being implemented to better understand the customer experience and to identify areas for improvement.

It was noted during our discussions that many complaints stem from doctors rightfully rejecting drug-seeking behaviour, which is a positive sign of the doctor’s integrity and the platform’s commitment to responsible prescribing. However, we recognise this makes purely “data-driven” metrics on performance less useful, as a doctor who rejects a patient’s request for a script may be seen as “underperforming” by a metric driven by customer feedback. Regardless, one would think rates of these complaints would be similar amongst a population of GPs, and so reviewing these metrics in comparison to their peers would be useful.

How does Hola Health prevent misuse of the platform by a patient?

As with any health service, patients may attempt to use the platform for nefarious reasons e.g. accessing drugs of dependence. Hola Health is no different.

Hola Health’s primary controls to protect against this are:

• Only scripts validated against the eRx Script Exchange, or physical paper scripts (rare), can be filled via Hola Meds.
• Only allowing script renewals via the Online Prescriptions pathway, and requiring a full telehealth consult for limited issuing of new scripts.
• Prescriptions made elsewhere are subject to a doctor’s existing obligations to provide appropriate care.
• Requirements to check against SafeScript should pick up on some drug-seeking behaviour; however, this is not a requirement for all scripts nor is it directly integrated into the platform.

  REC020: Consider integration with SafeScript programs for real-time prescription monitoring

  Nature: Operational

  Party: Hola Health

  Expand details View in Register

  Related Risks:

  RSK008

  RSK009

• Policy restricting prescription of S4/S8/several other drugs.

These controls are effective in treating most of the potential attack surface area. Predominantly, the risk exposure here is no different to that of a traditional doctor prescription pathway.

As doctors are effectively randomly assigned to patients—which is considered appropriate given Hola Health fulfils a transient role in patient’s healthcare—there is potential for “doctor shopping” to occur. With most drugs of dependence restricted, one may question if this happens though.

To further reduce misuse and risk of harm via this mechanism, Hola Health could explore risk treatments for:

• Abnormally-high use: if a patient is using the platform more than expected—for example, having multiple telehealth consults per month—this may be an potential marker of harm as the patient could be shopping for the answer they want. Monitoring patients who books more than a reasonable average could serve as a useful control. Further, closely monitoring the top 20 individual users could enable Hola Health to identify high-risk behaviour not already captured elsewhere.
• Flagging of unusual requests: if a patient makes an unusual or suspicious request, a process to report, record and analyse these requests would also serve as a useful control to identify potential risky behaviour.

How does Hola Health use patient data?

Hola Health’s collection and use of patient data is clearly stepped out in their Privacy Policy made available on the website and to all patients. This is a well-structured policy, and is generally aligned with the processes and systems we saw implemented at Hola Health.

As an Australian country collecting data on Australians, Hola Health is subject to the Privacy Act and the Australian Privacy Principles. This sets the foundation for how Hola Health can use a patient’s data, and is reflected in Hola’s Privacy Policy which is reasonably and transparently written.

Of key consideration for our risk analysis is the use of two categories of data:

• PII: contact information, primarily
• PHI: data about a health condition or prescriptions etc, a very relevant type of ‘sensitive information’

It should be noted that whenever this data is used, collected and/or stored for any purpose, risk is created—and it is simply impossible to reduce this risk to zero. Given these are required for Hola Health to operate, then we must accept some level of residual risk.

The use and management of PII is a reasonably standard affair; it’s used for operational reasons, and for marketing where Hola Health has consent to do so. Securing access to PII is an important factor. Our high-level review leaves us comfortable with the systems managing this PII, but we must note that this is out of scope—a comprehensive data usage and cybersecurity review would answer this more thoroughly.

The use and management of PHI is inherently more risky than that of PII. Hola Health had advised they don’t actively use PHI for the purposes of targeting marketing material to customers but do use PII to this effect.