Description: Hola should consider ( (and as we understand, is in the process of) implementing a system to automatically gather feedback on it's doctors and pharmacies. For a pharmacy, the quality of the service provided by the pharmacy, including things like whether special instructions were followed, the service quality, and the correctness of the order's packing etc. would all be useful metrics. For a doctor, the quality of the consultation, their doctor's 'bedside' manners, and the ability to resolve their issue (noting limitations with this e.g. drug-seeking behaviour) would also be useful. This will help ensure that the service provided by these actors are of high quality, and that any issues can be addressed quickly; it'll unlock a raft of reporting that can bring greater confidence in the service provided.

Rationale: This will help ensure that the service provided by these actors are of high quality, and that any issues can be addressed quickly; it'll unlock a raft of reporting that can bring greater confidence in the service provided.

Evidence: Only ad-hoc systems for managing complaints in place, coupled with close (manual) observation of orders and consults by the support team.

Description: While Hola has a reasonable privacy policy dictating how it uses patient's data, Hola Health should also consider implementing an internal policy that sets out appropriate use of sensitive data from non-patient third-parties (e.g. pharmacy's commercial data).

Rationale: This will help to ensure that the data is only used for purposes aligned with Hola Health's intention, and clarifies the intent between the parties when they provide data.

Evidence: Restricting data usage ensures compliance with privacy standards, maintains customer trust, and reduces the risk of data breaches.

Description: Hola Health should consider implementing a more robust assessment process for pharmacies that includes consideration of the customer service experience and alignment with brand values.

Rationale: This will help to ensure that the customer experience remains high quality and that Hola Health’s reputation is protected.

Evidence: Ensuring alignment with brand values and customer service standards reduces the risk of reputational damage and ensures a consistent service experience.

Description: Hola Health should consider documenting the offboarding process for pharmacies, including criteria for deactivation, communication protocols, and reactivation conditions. This will ensure that the process is consistent, transparent, and aligned with contractual obligations.

Rationale: Having a formalised process will help ensure consistent handling of non-compliant pharmacies and provide a reference for future audits or legal queries.

Evidence: Documenting critical operational processes reduces the risk of inconsistency, legal exposure, and operational inefficiencies.

Description: Hola Health should consider further detailing the roles and responsibilities of the individuals or teams involved in the doctor onboarding process, ensuring that each step is clearly assigned to a responsible party (e.g. through the use of swimlanes).

Rationale: Although the doctor onboarding process is robust and commendable, adding more clarity around responsibilities will improve accountability and ensure the process runs smoothly as the program scales.

Evidence: Process exists and is detailed, but doesn't consistently specify who is responsible for executing each step.

Description: Hola Health should consider whether the vetting process for evaluating a doctor’s suitability to join the platform can be more quantified beyond just being registered, especially as the program scales. If this is not feasible during the vetting stage, implementing a closer monitoring period during the doctor’s first X shifts could serve as an adequate control.

Rationale: As the program scales, a more quantifiable vetting process or initial close monitoring period will help ensure doctors meet platform standards and minimise the risk of onboarding unsuitable candidates. This in turn will reduce potential issues and maintain service quality.

Evidence: Current onboarding process mostly looks at doctor's registration and likely some (informal) assessment during the trial calls.

Description: Hola Health should consider adopting a process to maintain a central list of medical indemnity insurance policies known to cover telehealth services and provide this information to doctors during the onboarding process. This would help ensure that doctors are aware of potential carve outs, particularly for asynchronous services, and can verify their coverage accordingly. While Hola would need to be careful to avoid taking on additional liability, this would assist Hola in understanding which of their doctors may not be as well covered as they should be.

Rationale: By providing doctors with a list of telehealth-compliant policies, Hola Health can help reduce the risk of doctors inadvertently lacking appropriate coverage, ensuring alignment with the Code of Conduct and safeguarding against potential claims.

Evidence: Doctors are required to hold their own medical indemnity insurance, and carve outs for telehealth services are explicitly mentioned in the Code of Conduct. Hola currently relies on doctors to verify their coverage.

Description: Hola Health should consider seeking further advice from a qualified insurance broker or lawyer to ensure they are adequately protected in the event of a claim against a doctor, as the company currently does not hold any 'backup' medical indemnity insurance.

Rationale: Obtaining professional advice will help Hola Health ensure they have the appropriate level of insurance protection, mitigating potential financial or legal risks from claims.

Evidence: No backup medical indemnity insurance held at a company level.

Description: Hola Health should consider expanding its clinical governance structure to include a dedicated clinical governance committee, in addition to the Chief Medical Officer (CMO). This would help distribute the responsibilities of overseeing clinical governance, ensuring that the platform continues to meet its high standards as it grows, and providing additional oversight to maintain compliance with the evolving Code of Conduct and industry regulations.

Rationale: The CMO may not have the capacity to fully manage clinical governance responsibilities alone, particularly as the platform scales. A clinical governance committee would provide shared oversight and ensure that all necessary duties are addressed, maintaining the quality of care and compliance with legal and professional standards.

Evidence: The current Code of Conduct designates the CMO as responsible for clinical governance, but expanding this responsibility to a committee would support a more sustainable and comprehensive approach.

Description: Hola Health should consider implementing stronger monitoring and enforcement mechanisms for the Code of Conduct to ensure that all requirements are consistently upheld. While certain obligations, such as restrictions on prescribing specific medications, are well enforced, others, such as proper note-taking and ongoing professional development, are not monitored at scale (instead mostly monitored after a complaint, or at unspecified random schedules). Strengthening monitoring in these areas will help control the risks that the Code of Conduct seeks to address.

Rationale: Ensuring consistent enforcement of all requirements within the Code of Conduct will help reduce the risk of non-compliance, improve the quality of care, and align Hola Health’s operations with professional standards. This will also help maintain a high standard of care across all doctors on the platform.

Evidence: Monitoring is inconsistent, with certain requirements (e.g. medication restrictions) enforced, while others (e.g. proper note-taking, ongoing professional development) are mostly by exception or at unspecified random times.

Description: Hola Health should consider expanding its Clinical Governance Policy to incorporate elements of the NSQHS Standard 1 (Clinical Governance). This will provide a more comprehensive framework for governance, covering areas such as performance management, evidence-based practice, risk management, and ongoing measurement. While the current policy is likely sufficient for now, adopting these additional standards will help Hola scale its governance practices as the company grows and services become more complex.

Rationale: Incorporating NSQHS Standard 1 will ensure that Hola Health is prepared to manage more complex clinical governance issues as its operations expand, helping to mitigate risks and maintain a high standard of care and compliance.

Evidence: Current policy is based on RACGP standards and, while sufficient for now, lacks the comprehensive elements of NSQHS Standard 1.

Description: Hola Health should enhance its clinical governance framework by introducing a gold standard process that includes hypercare periods for newly onboarded doctors, those returning from extended breaks, or those on performance management plans. This should involve increased monitoring and support, such as frequent reviews of performance, clinical notes, and prescribing habits. Additionally, Hola Health should establish an Acceptable Quality Level (AQL) and a structured sampling approach rather than purely random sampling. Define and monitor high-risk events systematically to ensure comprehensive oversight and improve patient safety. This structured approach will help identify and address potential issues proactively and demonstrate a robust monitoring process to Healthylife.

Rationale: Structured monitoring tailored to different risk profiles and systematic oversight of high-risk events will enhance the quality of care, ensure safety, and address performance issues more effectively. This approach will also provide clear evidence of Hola Health's commitment to robust clinical governance.

Evidence: Current monitoring practices lack structured approaches for different risk profiles and do not include defined sampling or high-risk event criteria.

Description: Hola Health should consider implementing Mobile Device Management (MDM) and/or Mobile Application Management (MAM) solutions to enhance security for BYOD devices used by doctors. These solutions can enforce security policies, such as encryption, remote wipe capabilities, and secure access controls, to protect sensitive PII/PHI. Additionally, MAM can manage and secure applications used on these devices, ensuring that only compliant apps are allowed (e.g. no recording or non-corporate messaging apps) and that data is protected from unauthorised transfer.

Rationale: MDM and MAM solutions will provide better control over security and compliance for BYOD devices, reducing the risk of data breaches and unauthorized access to sensitive information.

Evidence: Current BYOD practices lack robust management and security controls, increasing the risk of data exposure and breaches.

Description: To mitigate the risks associated with BYOD, Hola Health should mandate that all clinical work is conducted on Hola-owned and managed devices. This will ensure that all devices used for accessing clinical systems are subject to consistent security controls and compliance standards, reducing the risk of data breaches and unauthorized access. By controlling the devices used, Hola Health can better manage security, enforce policies, and ensure that sensitive information is protected. We recognise that this is a significant financial investment for Hola Health and may not be a feasible short-term solution, but it is a strong long-term goal.

Rationale: Using Hola-owned and managed devices will provide greater control over security measures and compliance, reducing the risk associated with BYOD and ensuring that sensitive data is handled appropriately.

Evidence: Current use of BYOD devices introduces security vulnerabilities that could be mitigated by standardising on managed devices.

Description: Hola Health should better utilise available data for monitoring patient usage patterns, doctor usage patterns, and identification of potential misuse of the platform and/or medications. This includes creating metrics to track patient engagement levels (average time between visits, for example), detect signs of overuse (given Hola is an interim care provider), and identify anomalies in drug prescriptions (sudden spike in prescribing X drug). Other data sources can be used for security monitoring e.g. via a SIEM (Security information and event management) tool for breach detection and response. By leveraging such tools to establish benchmarks and identify deviations, Hola Health can proactively address potential issues, optimise patient care, and ensure appropriate use of the platform and medications--at scale.

Rationale: Utilising available data to monitor usage patterns and detect misuse will improve oversight and enable timely intervention, ensuring better patient outcomes and adherence to platform and medication guidelines.

Evidence: Currently, there is a lack of comprehensive data-driven measures to monitor and address potential misuse of the platform and drugs, which could lead to undetected issues and inefficiencies.

Description: Hola Health should consider integrating with the Practitioner Information Exchange (PIE) system to receive real-time updates on a doctor's AHPRA registration status. If integration is not feasible, a more frequent manual check (e.g. monthly or quarterly) should be implemented. This will help to promptly identify and address any changes in a doctor's registration, ensuring compliance and mitigating the risks of allowing unregistered doctors to continue practising on the platform.

Rationale: Regular monitoring of AHPRA registration helps protect against risks associated with doctors practising under sanctions or with cancelled registrations, which would pose legal and reputational risks for Hola Health.

Evidence: Currently, Hola Health advised they conduct annual AHPRA registration checks, creating a potential gap in monitoring for mid-year changes in a doctor's registration status.

Description: Currently, Hola Health manually monitors the progression of a courier delivery. While this has been proven to work, a more scalable solution would see data pulled from the courier directly, and therefore automatically tracked against set benchmarks--automatically flagging exceptions for review by support staff.

Rationale: As Hola continues to scale, more delivery orders will require more monitoring, and therefore support staff. Automating this process not only reduces the requirement to onboard/manage/pay support staff, but likely improves the end result for the customer.

Evidence: Hola Health advised us that they manually monitor courier-based deliveries.

Description: Doctors prescribing controlled substances are legally required to check against against the the SafeScript database in the state of the patient to identify potential overprescribing. Integration with SafeScript could provide immediate alerts for high-risk prescribing patterns and enforce that doctors check SafeScript before proceeding, enabling timely intervention and reducing the risk of harm to patients. This proactive approach will help Hola Health maintain compliance with regulatory requirements and safeguard patient safety.

Rationale: Integrating with SafeScript will allow Hola Health to enforce monitoring of controlled substance prescriptions, improve compliance with regulatory requirements, and protect patients from potential harm due to overprescribing.

Evidence: Currently, Hola Health does not have an integration in place to monitor controlled substance prescriptions against the SafeScript database, but instead relies on doctors to manually check (as they are legally compelled to do so).

Description: This could involve real-time monitoring of patient interactions and activities, identification of risky behaviours such as repeat visits or unusual behaviour during a consult, and timely interventions. Alongside REC021, data analytics could be used to detect patterns and trends indicative of risky behaviour, enabling proactive risk mitigation strategies.

Rationale: Hola Health could identify and address potential risks before they escalate, reducing the likelihood of adverse events and therefore it's exposure to risk. Further, this demonstrates it's efforts in delivering compliant, quality care to it's interested parties like Healthylife.

Evidence: Some informal practices in place, but no comprehensive program.

Description: To achieve a gold standard, Hola should document how they would handle repeated or gross violations of the SLA between Hola and a pharmacy, up to and including removal from the platform. This would ensure that all staff are aware of the process, and that it is consistently applied across all pharmacies. Particularly as this is a rare event, it is important that the process is well understood and repeatable to protect against any undue claims. The process could broadly include: thresholds being hit via metrics that trigger a review of the pharmacy's performance, or gross violations that trigger immediate action; starting a case and reviewing past performance; escalating to the pharmacy for a response within X days; pharmacy providing a written rectification plan within Y days; and Hola monitoring the implementation of the rectification plan to make a decision on the pharmacy's future on the platform.

Rationale: This ensures all staff are aware of the process, and that it is consistently applied across all pharmacies, contributing to overall service quality.

Evidence: No formal documentation exists on the process for handling repeated or gross violations of the SLA with pharmacies.

Description: To align with best practices and mitigate the risk of non-compliance with Medical Board guidelines, Hola Health should consider transitioning from asynchronous issuance of medical certificates to synchronous consultations. This would ensure that all medical documents, including 1-day medical certificates, are issued following real-time interactions between doctors and patients. While the current practice may not face legal challenges due to the limits placed (e.g., refusal to sign WorkCover claims), this change would further align with best practices and provide an added layer of compliance and assurance.

Rationale: Transitioning to synchronous consultations for medical certificates will better align Hola Health's practices with industry best practices and mitigate potential risks related to non-compliance or legal challenges.

Evidence: Medical Board's code of conduct and updated telehealth guidelines suggest that real-time consultations are generally best practice for issuing medical certificates.

Description: While the current structure of Hola Health is suitable for the tasks at hand, it would be beneficial to establish a clear delineation between 'operational' and 'medical' functions to ensure that clinical governance is not compromised by operational decisions. This separation would allow operational decisions to focus on business efficiency while ensuring that medical decisions remain aligned with best clinical practices and are overseen by appropriate medical personnel.

Rationale: A clear separation between operational and medical functions ensures that clinical governance is maintained, and medical decisions are not influenced by non-clinical priorities, thus safeguarding patient care and compliance with medical standards.

Evidence: No formal separation between operational and medical functions, increasing the potential for overlap and misalignment in decision-making.

Description: While Hola Health is actively pursuing ISO27001 accreditation, which demonstrates a commitment to data security and management, we recommend the implementation of a comprehensive Quality Management System (QMS) to ensure that the business fully recognises and addresses the needs of its third parties (e.g., patients, doctors, pharmacies, Healthylife). A QMS, such as ISO9001, would help align business operations with the interests of these stakeholders and ensure that key KPIs are consistently met. Real-time monitoring of SLAs in weekly management meetings, combined with a formal QMS, would significantly improve business operations and stakeholder satisfaction.

Rationale: A comprehensive QMS would ensure that the business consistently meets the needs of its third-party stakeholders, enhancing operational effectiveness and alignment with best practices.

Evidence: No externally recognised QMS is currently in place, though ISO27001 accreditation is being pursued, and KPIs are reviewed in weekly management meetings.

Description: Although Hola Health is currently focused on scaling its existing business model without expanding into new ventures, it is important to recognise that new features introduced to the platform could expose the business to unforeseen risks. We recommend developing a formal risk assessment framework to evaluate these new features before they are implemented. This framework would ensure that the risks associated with new platform functionalities are carefully considered and mitigated, even as the business continues to operate within its current model. As the business grows and evolves, this framework will become increasingly important for managing risk in a structured manner.

Rationale: Implementing a risk assessment framework for new platform features will help Hola mitigate potential risks that may arise as the platform evolves, ensuring that new functionalities are carefully considered before implementation.

Evidence: No current framework exists for assessing risks related to new platform features, but Hola is focused on scaling its existing business model rather than expanding into new ventures.

Description: While we have not reviewed the relationship between Hola Health and Healthylife directly, if Healthylife wants to see the risks in this register addressed, then it needs an effective mechanism to ensure this happens. This could take many forms: a seat at the board, contractual mechanisms, SLAs, etc. which would be for the two entities to agree on.

Rationale: Whilst Healthylife may not be legally liable for many of the risks outlined in this register, the perceived connection between the brands exposes Healthylife to significant reputational risk. Healthylife's risk appetite is unlikely to natural align with Hola Health's, and so to protect Healthylife's interest, such a mechanism would allow closer alignment.

Evidence: No sighted evidence as out of scope for this review (i.e. may already exist); unlikely to be consistently implemented given no formal management system to support new business ventured (REC028).

Description: We recommend Hola Health formalise its existing informal requirements into a clear policy for selecting and managing delivery partners. This policy should outline the criteria for assessing courier partners, particularly for prescription medications, ensuring that critical standards like secure delivery, recipient identity verification, and signature upon delivery are consistently applied. For over-the-counter (OTC) goods, the policy can retain flexibility but should provide guidance on minimum standards particularly on brand reputation. A formalised policy will ensure consistent application of delivery standards, provide clarity to all stakeholders, and reduce the risk of compliance issues or operational inconsistencies. Importantly, the policy should also set out how this is to be managed on an ongoing basis, potentially supported by additional processes etc.

Rationale: Formalising a policy for delivery partners will ensure that Hola Health's delivery standards, particularly for prescription medication, are consistently applied, reducing the risk of non-compliance and operational inconsistencies. This will provide ongoing assurance to stakeholders and partners.

Evidence: Currently, delivery partners are selected and managed on a case-by-case basis without a formal policy, but existing informal requirements are embedded in the organisation's operations.

Description: Hola currently defers to a doctor's judgement to determine if a script is a renewal or not. Hola could implement guidance e.g. having a patient hold up the box on a camera. This would set a minimum standard and reduce the risk of misuse of the platform.

Rationale: Some patients may misuse the platform to obtain medications inappropriately. Providing guidance to doctors on how to verify a script is a renewal will help reduce the risk of inappropriate prescribing and misuse of the platform.

Evidence: Discussed with Hola Health, who advised that they currently rely on the doctor's judgement to determine if a script is a renewal.

Description: Hola Health should continue to invest in platform security to protect patient data, maintain system integrity, and safeguard against cyber threats. This includes regular security audits, penetration testing, and compliance with industry standards and best practices. Much of this will form part of the existing ISO27001 project. By prioritising platform security, Hola Health can reduce the risk of data breaches, protect patient privacy, and maintain trust with stakeholders.

Rationale: Investing in platform security is essential to protect patient data, maintain system integrity, and mitigate the risk of cyber threats. By prioritising security measures, Hola Health can enhance data protection and build trust with stakeholders.

Evidence: Hola Health is actively pursuing ISO27001 accreditation, demonstrating a commitment to data security and management, but ultimately remains responsible for the security of its platform at all times.