Risk Register | Vaxa - Hola Health Review

ID	Title	Detail	Category	Likel/Sev (1-5)	Rating (1-25)	Recommendations
RSK007	Lack of clinical governance team may lead to gaps in oversight	Relying solely on the Chief Medical Officer (CMO) for clinical governance may lead to gaps in oversight as the Hola Health platform scales. Without additional support, the CMO may not have the capacity to fully manage all responsibilities, which could result in delayed decision-making, reduced quality control, or failure to address clinical governance issues in a timely manner. This could expose Hola Health to compliance risks and affect the quality of care provided on the platform. View RSK007: Lack of clinical governance team may lead to gaps in oversight Severity [4] Likelihood [4] Rating [16] Description Relying solely on the Chief Medical Officer (CMO) for clinical governance may lead to gaps in oversight as the Hola Health platform scales. Without additional support, the CMO may not have the capacity to fully manage all responsibilities, which could result in delayed decision-making, reduced quality control, or failure to address clinical governance issues in a timely manner. This could expose Hola Health to compliance risks and affect the quality of care provided on the platform. Related Recommendations: REC011 REC012 REC013 REC014 REC025	Compliance Hola	4 4	16	REC011 REC012 REC013 REC014 REC025
RSK011	Doctors using unmanaged BYOD devices	The use of unmanaged Bring Your Own Device (BYOD) by doctors introduces several risks related to the security of sensitive patient information. Compromised BYOD devices could allow bad actors to screenshot or interact with sensitive PII/PHI within clinical systems or record video calls showing sensitive areas. Additionally, if a doctor takes photos of sensitive clinical data with their phone or works from an insecure location, there is a risk that third parties could access the systems or data. While doctors would be risking their own professional license and Hola forbids these actions per the agreed Code of Conduct, these risks still pose significant threats to data security; should this ever occur and be publicised, it would raise significant questions from the public about Hola Health's inability to foresee and control such risks effectively--a significant reputational risk. View RSK011: Doctors using unmanaged BYOD devices Severity [4] Likelihood [4] Rating [16] Description The use of unmanaged Bring Your Own Device (BYOD) by doctors introduces several risks related to the security of sensitive patient information. Compromised BYOD devices could allow bad actors to screenshot or interact with sensitive PII/PHI within clinical systems or record video calls showing sensitive areas. Additionally, if a doctor takes photos of sensitive clinical data with their phone or works from an insecure location, there is a risk that third parties could access the systems or data. While doctors would be risking their own professional license and Hola forbids these actions per the agreed Code of Conduct, these risks still pose significant threats to data security; should this ever occur and be publicised, it would raise significant questions from the public about Hola Health's inability to foresee and control such risks effectively--a significant reputational risk. Related Recommendations: REC015 REC016 REC031	Compliance Doctor	4 4	16	REC015 REC016 REC031
RSK021	Lack of comprehensive and structured risk identification process	Hola treats most identified risk reasonably well, but doesn't appear to have a structured program to regularly review and identify risks from the perspective of each of it's interested parties. This could lead to unidentified risks that could have been mitigated, and a lack of understanding of the risk profile of the business. This is particularly important as Hola scales and the risk profile adapts. View RSK021: Lack of comprehensive and structured risk identification process Severity [4] Likelihood [4] Rating [16] Description Hola treats most identified risk reasonably well, but doesn't appear to have a structured program to regularly review and identify risks from the perspective of each of it's interested parties. This could lead to unidentified risks that could have been mitigated, and a lack of understanding of the risk profile of the business. This is particularly important as Hola scales and the risk profile adapts. Related Recommendations: REC026 REC027 REC028	Compliance Hola	4 4	16	REC026 REC027 REC028
RSK013	Limited/no medical history available to doctors for consults	The nature of the business that Hola Health undertakes means they have limited or no access to a patient's prior medical history, notwithstanding anything available in MyHealthRecord. Therefore the doctor's decision to prescribe drugs is on the basis of the virtual consultation only--not a full medical history. Arguably, this is no different to an in-person clinic but with the ability to more easily access one or many Hola Health's doctors, the surface area for potential misconduct is increased albeit managed through controls including not prescribing drugs of dependence. While doctors are independent contractors making independent decisions, Hola Health by association wears some of the reputational risk should a doctor make a bad decision based on little medical history. View RSK013: Limited/no medical history available to doctors for consults Severity [3] Likelihood [5] Rating [15] Description The nature of the business that Hola Health undertakes means they have limited or no access to a patient's prior medical history, notwithstanding anything available in MyHealthRecord. Therefore the doctor's decision to prescribe drugs is on the basis of the virtual consultation only--not a full medical history. Arguably, this is no different to an in-person clinic but with the ability to more easily access one or many Hola Health's doctors, the surface area for potential misconduct is increased albeit managed through controls including not prescribing drugs of dependence. While doctors are independent contractors making independent decisions, Hola Health by association wears some of the reputational risk should a doctor make a bad decision based on little medical history. Related Recommendations: REC030	Operational Doctor	5 3	15	REC030
RSK022	Collection of PHI	In collecting, managing or storing PHI, there is inherent residual risk that remains regardless of any and all controls applied to treat the risk. As Hola collects substantial quantities of PHI in the course of doing business, the same is true here. View RSK022: Collection of PHI Severity [3] Likelihood [5] Rating [15] Description In collecting, managing or storing PHI, there is inherent residual risk that remains regardless of any and all controls applied to treat the risk. As Hola collects substantial quantities of PHI in the course of doing business, the same is true here. Related Recommendations: REC031	Compliance Hola	5 3	15	REC031
RSK023	Collection of PII	In collecting, managing or storing PII, there is inherent residual risk that remains regardless of any and all controls applied to treat the risk. As Hola collects substantial quantities of PII in the course of doing business, the same is true here. View RSK023: Collection of PII Severity [3] Likelihood [5] Rating [15] Description In collecting, managing or storing PII, there is inherent residual risk that remains regardless of any and all controls applied to treat the risk. As Hola collects substantial quantities of PII in the course of doing business, the same is true here. Related Recommendations: REC031	Compliance Hola	5 3	15	REC031
RSK001	Pharmacies access control to Pharmacy Portal is questionable	The shared login for all staff at each pharmacy is a security risk, as it means that any staff member can access the portal and potentially alter data. This is a particular concern in the event of a pharmacist leaving the business, but retaining access to the Pharmacy Portal and the PII/PHI within. We do appreciate that a per-user login would likely be a significant hindrance to workflow, and one may argue it's no worse than what already occurs with the dispensing software. Regardless, we must recognise this as a risk, given we undeniable lose audit ability at this point in the chain (instead relying on cross-referencing up dispense system records, should the need ever arise). View RSK001: Pharmacies access control to Pharmacy Portal is questionable Severity [3] Likelihood [4] Rating [12] Description The shared login for all staff at each pharmacy is a security risk, as it means that any staff member can access the portal and potentially alter data. This is a particular concern in the event of a pharmacist leaving the business, but retaining access to the Pharmacy Portal and the PII/PHI within. We do appreciate that a per-user login would likely be a significant hindrance to workflow, and one may argue it's no worse than what already occurs with the dispensing software. Regardless, we must recognise this as a risk, given we undeniable lose audit ability at this point in the chain (instead relying on cross-referencing up dispense system records, should the need ever arise). Related Recommendations: REC015 REC016 REC006	Operational Pharmacy	4 3	12	REC015 REC016 REC006
RSK004	No documented requirements for pharmacy onboarding beyond legal standards	Hola Health does not have any documented requirements for pharmacies beyond the basic legal and regulatory requirements. This could lead to pharmacies being onboarded that do not align with Hola Health’s brand values, potentially damaging Hola Health’s reputation. View RSK004: No documented requirements for pharmacy onboarding beyond legal standards Severity [3] Likelihood [4] Rating [12] Description Hola Health does not have any documented requirements for pharmacies beyond the basic legal and regulatory requirements. This could lead to pharmacies being onboarded that do not align with Hola Health’s brand values, potentially damaging Hola Health’s reputation. Related Recommendations: REC005 REC023 REC012	Operational Pharmacy	4 3	12	REC005 REC023 REC012
RSK008	Inconsistent enforcement of Code of Conduct requirements	Hola Health’s current approach to monitoring compliance with the Code of Conduct is inconsistent, with certain obligations (e.g. medication restrictions) being well enforced while others (e.g. proper note-taking, ongoing professional development) are not. This inconsistency increases the risk of non-compliance by doctors, which could result in poor patient outcomes, legal liabilities, or reputational damage. Without stronger oversight, there may be gaps in the quality of care provided on the platform. View RSK008: Inconsistent enforcement of Code of Conduct requirements Severity [4] Likelihood [3] Rating [12] Description Hola Health’s current approach to monitoring compliance with the Code of Conduct is inconsistent, with certain obligations (e.g. medication restrictions) being well enforced while others (e.g. proper note-taking, ongoing professional development) are not. This inconsistency increases the risk of non-compliance by doctors, which could result in poor patient outcomes, legal liabilities, or reputational damage. Without stronger oversight, there may be gaps in the quality of care provided on the platform. Related Recommendations: REC011 REC012 REC013 REC017 REC020 REC023 REC007 REC008	Compliance Doctor	3 4	12	REC011 REC012 REC013 REC017 REC020 REC023 REC007 REC008
RSK009	Clinical governance framework may not scale as services expand	Hola Health’s current Clinical Governance Policy, while suitable for its current operations, is based largely on RACGP standards and lacks the comprehensive framework offered by the NSQHS Standard 1. As the company grows and services become more complex, the existing policy may not adequately address broader governance issues such as performance management, evidence-based practice, and risk management. This may lead to gaps in clinical governance, increasing risks related to patient safety, compliance, and operational effectiveness. View RSK009: Clinical governance framework may not scale as services expand Severity [3] Likelihood [4] Rating [12] Description Hola Health’s current Clinical Governance Policy, while suitable for its current operations, is based largely on RACGP standards and lacks the comprehensive framework offered by the NSQHS Standard 1. As the company grows and services become more complex, the existing policy may not adequately address broader governance issues such as performance management, evidence-based practice, and risk management. This may lead to gaps in clinical governance, increasing risks related to patient safety, compliance, and operational effectiveness. Related Recommendations: REC011 REC012 REC013 REC017 REC025 REC026 REC020	Compliance Doctor	4 3	12	REC011 REC012 REC013 REC017 REC025 REC026 REC020
RSK010	Inadequate recognition of doctors' variable risk profiles throughout their lifecycle	Without a structured approach to monitoring doctors based on their lifecycle with Hola Health, the varying risk profiles throughout the lifecycle aren't adequately addressed. Specifically, new doctors, those returning from extended breaks, or those under performance management may not receive the increased scrutiny and support required while they come up to speed with Hola (at least, not in a structured way). Additionally, a lack of structured random sampling and undefined high-risk events could lead to insufficient oversight and failure to identify or address performance issues, potentially compromising patient safety and care quality. View RSK010: Inadequate recognition of doctors' variable risk profiles throughout their lifecycle Severity [3] Likelihood [4] Rating [12] Description Without a structured approach to monitoring doctors based on their lifecycle with Hola Health, the varying risk profiles throughout the lifecycle aren't adequately addressed. Specifically, new doctors, those returning from extended breaks, or those under performance management may not receive the increased scrutiny and support required while they come up to speed with Hola (at least, not in a structured way). Additionally, a lack of structured random sampling and undefined high-risk events could lead to insufficient oversight and failure to identify or address performance issues, potentially compromising patient safety and care quality. Related Recommendations: REC014 REC026 REC003 REC008 REC017 REC022	Compliance Doctor	4 3	12	REC014 REC026 REC003 REC008 REC017 REC022
RSK014	Monitoring of patient usage and over-usage of the platform	While controls are in place to mitigate risks arising from prescribing drugs of dependence, there is no scheme in place to manage patients using the platform in an anomalistic manner. Recall that Hola Health (like most telehealth providers of their ilk) primarily exists as a transient part of a patient's healthcare--not as a primary measure. Over-usage of the platform could serve as a useful marker of harm or misuse of the platform. Implementation of a measure to compare each patients usage with the average usage, alongside a measure to monitor the top X patients, would serve to a) protect each individual patient from potential harm, and b) allow Hola Health to identify potential misuse of the platform earlier than ad-hoc methods would permit. View RSK014: Monitoring of patient usage and over-usage of the platform Severity [3] Likelihood [4] Rating [12] Description While controls are in place to mitigate risks arising from prescribing drugs of dependence, there is no scheme in place to manage patients using the platform in an anomalistic manner. Recall that Hola Health (like most telehealth providers of their ilk) primarily exists as a transient part of a patient's healthcare--not as a primary measure. Over-usage of the platform could serve as a useful marker of harm or misuse of the platform. Implementation of a measure to compare each patients usage with the average usage, alongside a measure to monitor the top X patients, would serve to a) protect each individual patient from potential harm, and b) allow Hola Health to identify potential misuse of the platform earlier than ad-hoc methods would permit. Related Recommendations: REC017 REC022	Operational Patient	4 3	12	REC017 REC022
RSK020	Limited visibility for Healthylife when Hola engages 3rd parties	Use of 3rd parties is likely not something that Healthylife would have clear visibility over without a specific mechanism for this. Any change in 3rd parties processing data involves additional risk--both during the changeover period, and during the operational phase. Without visibility into these changes (e.g. via regular risk reviews, or contractual mechanisms), Healthylife will struggle to understand the ongoing risk exposure from it's relationship with Hola. View RSK020: Limited visibility for Healthylife when Hola engages 3rd parties Severity [4] Likelihood [3] Rating [12] Description Use of 3rd parties is likely not something that Healthylife would have clear visibility over without a specific mechanism for this. Any change in 3rd parties processing data involves additional risk--both during the changeover period, and during the operational phase. Without visibility into these changes (e.g. via regular risk reviews, or contractual mechanisms), Healthylife will struggle to understand the ongoing risk exposure from it's relationship with Hola. Related Recommendations: REC028 REC018	Compliance Hola	3 4	12	REC028 REC018
RSK024	Limited recourse for Healthylife to control Hola's decision making	Healthylife may have little ability to mandate how Hola controls its approach to risk management (noting this may be addressed as part of the agreement terms). View RSK024: Limited recourse for Healthylife to control Hola's decision making Severity [4] Likelihood [3] Rating [12] Description Healthylife may have little ability to mandate how Hola controls its approach to risk management (noting this may be addressed as part of the agreement terms). Related Recommendations: REC028	Compliance Hola	3 4	12	REC028
RSK025	Fatigue exposure for doctors working for Hola alongside other jobs	With doctors potentially working multiple jobs whilst being expected to uphold certain (not yet quantified) quality and performance criteria, poor management of their fatigue levels increases the risk of poor outcomes. There was a recently approved settlement between NSW and Registrars related to fatigue management. View RSK025: Fatigue exposure for doctors working for Hola alongside other jobs Severity [3] Likelihood [4] Rating [12] Description With doctors potentially working multiple jobs whilst being expected to uphold certain (not yet quantified) quality and performance criteria, poor management of their fatigue levels increases the risk of poor outcomes. There was a recently approved settlement between NSW and Registrars related to fatigue management. Related Recommendations: REC017 REC014 REC013 REC007	Personnel Doctor	4 3	12	REC017 REC014 REC013 REC007
RSK017	Lack of formal policy for selecting and managing delivery partners	Hola Health does not have a formal policy for selecting and managing delivery partners. Instead, each delivery partner is assessed on a case-by-case basis. While Hola informally adopts requirements for the secure delivery of prescription medications, these standards should be formalised in a policy or standard. The absence of a formal policy could lead to inconsistencies in delivery standards, potentially resulting in compliance issues, operational inefficiencies, or reputational damage if expectations are not clearly defined and upheld. Additionally, the lack of a standard doesn't provide surety to partners like Healthylife regarding the standards they must meet. View RSK017: Lack of formal policy for selecting and managing delivery partners Severity [2] Likelihood [5] Rating [10] Description Hola Health does not have a formal policy for selecting and managing delivery partners. Instead, each delivery partner is assessed on a case-by-case basis. While Hola informally adopts requirements for the secure delivery of prescription medications, these standards should be formalised in a policy or standard. The absence of a formal policy could lead to inconsistencies in delivery standards, potentially resulting in compliance issues, operational inefficiencies, or reputational damage if expectations are not clearly defined and upheld. Additionally, the lack of a standard doesn't provide surety to partners like Healthylife regarding the standards they must meet. Related Recommendations: REC019 REC029	Operational Delivery Partner	5 2	10	REC019 REC029
RSK003	No clear position on use of 3rd party's data	Hola Health does not have a policy restricting the use of sensitive data from 3rd parties e.g. commercial/inventory data from pharmacies or patient health information. This could lead to the misuse of this data, potentially damaging Hola Health’s reputation. It's worth noting that the use of this data isn't technically prohibited provided the appropriate legal standing is in place; this policy would just set boundaries on how, when and who can use this data. View RSK003: No clear position on use of 3rd party's data Severity [3] Likelihood [3] Rating [9] Description Hola Health does not have a policy restricting the use of sensitive data from 3rd parties e.g. commercial/inventory data from pharmacies or patient health information. This could lead to the misuse of this data, potentially damaging Hola Health’s reputation. It's worth noting that the use of this data isn't technically prohibited provided the appropriate legal standing is in place; this policy would just set boundaries on how, when and who can use this data. Related Recommendations: REC004 REC017	Compliance Hola	3 3	9	REC004 REC017
RSK006	Data security risks when operating a custom platform	Developing and operating a proprietary platform introduces unique data security challenges compared to using an off-the-shelf product in a more protected environment. While a custom platform allows for greater flexibility and control over functionality, it also requires a robust and ongoing commitment to security. Hola Health may face challenges in maintaining compliance with security standards, safeguarding sensitive data, and mitigating potential vulnerabilities that could be exploited. However, the ability to tailor security protocols specific to the platform can offer advantages if managed effectively. For the avoidance of doubt, Hola Health is conformant with ADHA conformance profiles, but this doesn't necessarily guarantee infallible security of the platform. View RSK006: Data security risks when operating a custom platform Severity [3] Likelihood [3] Rating [9] Description Developing and operating a proprietary platform introduces unique data security challenges compared to using an off-the-shelf product in a more protected environment. While a custom platform allows for greater flexibility and control over functionality, it also requires a robust and ongoing commitment to security. Hola Health may face challenges in maintaining compliance with security standards, safeguarding sensitive data, and mitigating potential vulnerabilities that could be exploited. However, the ability to tailor security protocols specific to the platform can offer advantages if managed effectively. For the avoidance of doubt, Hola Health is conformant with ADHA conformance profiles, but this doesn't necessarily guarantee infallible security of the platform. Related Recommendations: REC031 REC015 REC016 REC017 REC026	Operational Hola	3 3	9	REC031 REC015 REC016 REC017 REC026
RSK018	Reliance on delivery partner's upholding SOPs	Hola sets SOPs for delivery partners to undertake secure delivery. However, we were unable to sight evidence that there is a structured program to ensure all elements of these SOPs are being met on a regular basis. We do acknowledge that the support team verifies delivery occurs, but the SOP includes things like verification of the order when picking up at the pharmacy. Without ongoing monitoring of SOPs in a structured formal, 'normalisation of deviation' can occur and eventually erode the risk treatment brought about the SOPs. View RSK018: Reliance on delivery partner's upholding SOPs Severity [3] Likelihood [3] Rating [9] Description Hola sets SOPs for delivery partners to undertake secure delivery. However, we were unable to sight evidence that there is a structured program to ensure all elements of these SOPs are being met on a regular basis. We do acknowledge that the support team verifies delivery occurs, but the SOP includes things like verification of the order when picking up at the pharmacy. Without ongoing monitoring of SOPs in a structured formal, 'normalisation of deviation' can occur and eventually erode the risk treatment brought about the SOPs. Related Recommendations: REC019 REC029	Operational Delivery Partner	3 3	9	REC019 REC029
RSK019	Outsized support requirements for pharmacies as Hola scales	The pharmacists who took part in the case study interviews noted that Hola sits very separate from their usual systems, and often 'fallback' to getting a call from Hola to process an order. If this continues to be the case, then Hola may require significant support resources to manage the pharmacies as Hola onboards more pharmacies. This could lead to increased costs, delays in processing orders, and potential reputational damage. Integration with a pharmacy's dispensing software/POS system could alleviate some of this, or alternative hardware solutions (e.g. a dedicated iPad for running the Pharmacy Portal). View RSK019: Outsized support requirements for pharmacies as Hola scales Severity [3] Likelihood [3] Rating [9] Description The pharmacists who took part in the case study interviews noted that Hola sits very separate from their usual systems, and often 'fallback' to getting a call from Hola to process an order. If this continues to be the case, then Hola may require significant support resources to manage the pharmacies as Hola onboards more pharmacies. This could lead to increased costs, delays in processing orders, and potential reputational damage. Integration with a pharmacy's dispensing software/POS system could alleviate some of this, or alternative hardware solutions (e.g. a dedicated iPad for running the Pharmacy Portal).	Operational Pharmacy	3 3	9
RSK026	Medical Board of Australia's powers to change telehealth and tele-prescribing rules	The Medical Board implemented changes effective September 2023 effectively banning the use of asynchronous prescribing (prescribing where the doctor doesn't have a real-time consultation over a phone or video call, instead relying on text-based questionnaires). While Hola does not partake in this style of consultation (bar the 1-day medical certificates), one must consider the sweeping authority of the Board to undertake future rule changes that may impact the viability of Hola's ability to provide services to Healthylife. However, it's likely this would apply to all telehealth providers. View RSK026: Medical Board of Australia's powers to change telehealth and tele-prescribing rules Severity [3] Likelihood [3] Rating [9] Description The Medical Board implemented changes effective September 2023 effectively banning the use of asynchronous prescribing (prescribing where the doctor doesn't have a real-time consultation over a phone or video call, instead relying on text-based questionnaires). While Hola does not partake in this style of consultation (bar the 1-day medical certificates), one must consider the sweeping authority of the Board to undertake future rule changes that may impact the viability of Hola's ability to provide services to Healthylife. However, it's likely this would apply to all telehealth providers.	Environment Hola	3 3	9
RSK026	Difficult to guarantee only script renewals vs new script	Without a complete medical history, it's difficult to guarantee scripts issued through the Script Renewal pathways are indeed renewals at all. In doing so, there is potential for misuse of the platform wherein a patient insists that a drug is a renewal when indeed it is not. Hola doesn't have an adopted policy on how this should be approached, instead deferring to the judgement of the doctor. View RSK026: Medical Board of Australia's powers to change telehealth and tele-prescribing rules Severity [3] Likelihood [3] Rating [9] Description The Medical Board implemented changes effective September 2023 effectively banning the use of asynchronous prescribing (prescribing where the doctor doesn't have a real-time consultation over a phone or video call, instead relying on text-based questionnaires). While Hola does not partake in this style of consultation (bar the 1-day medical certificates), one must consider the sweeping authority of the Board to undertake future rule changes that may impact the viability of Hola's ability to provide services to Healthylife. However, it's likely this would apply to all telehealth providers.	Operational Doctor	3 3	9	REC030
RSK002	Only ad-hoc feedback on pharmacy service quality & limited alignment back to pharmacy performance	Hola does not have a system to automatically gather feedback on the quality of the service provided by the pharmacy, including the effectiveness of special instructions provided by the doctor or patient. This could leads to a blind spot and potential negative customer experience. For the avoidance of doubt, order timeframes are tracked and monitored. Additionally Hola indicated that an automated method was in the works, and existing processes appropriately collect and action complaints. View RSK002: Only ad-hoc feedback on pharmacy service quality & limited alignment back to pharmacy performance Severity [2] Likelihood [4] Rating [8] Description Hola does not have a system to automatically gather feedback on the quality of the service provided by the pharmacy, including the effectiveness of special instructions provided by the doctor or patient. This could leads to a blind spot and potential negative customer experience. For the avoidance of doubt, order timeframes are tracked and monitored. Additionally Hola indicated that an automated method was in the works, and existing processes appropriately collect and action complaints. Related Recommendations: REC003 REC023 REC017 REC004 REC005 REC026	Operational Pharmacy	4 2	8	REC003 REC023 REC017 REC004 REC005 REC026
RSK015	Asynchronous medical certificate issuance conflicts with best practices	Hola Health allows doctors to issue 1-day medical certificates without a real-time consultation. While this is in line with the Medical Board's updated telehealth guidelines, which do not explicitly prohibit such practices, it conflicts with best practices that emphasize the importance of real-time consultations. The Medical Board's code of conduct stresses accuracy and honesty when signing medical documents, including certificates. Although Hola Health has controls in place (such as limiting the practice to 1-day certifications and not signing WorkCover claims), the practice could still pose a risk in terms of non-compliance with evolving standards or potential legal challenges. View RSK015: Asynchronous medical certificate issuance conflicts with best practices Severity [1] Likelihood [5] Rating [5] Description Hola Health allows doctors to issue 1-day medical certificates without a real-time consultation. While this is in line with the Medical Board's updated telehealth guidelines, which do not explicitly prohibit such practices, it conflicts with best practices that emphasize the importance of real-time consultations. The Medical Board's code of conduct stresses accuracy and honesty when signing medical documents, including certificates. Although Hola Health has controls in place (such as limiting the practice to 1-day certifications and not signing WorkCover claims), the practice could still pose a risk in terms of non-compliance with evolving standards or potential legal challenges. Related Recommendations: REC024 REC009 REC010	Operational Doctor	5 1	5	REC024 REC009 REC010
RSK012	Infrequent checks of doctor's AHPRA registration	Hola Health currently performs annual checks on a doctor's AHPRA registration status. This creates a risk that a doctor could face sanctions or cancellation of their registration during the year, and continue practising on the platform without Hola's awareness. Such an event could expose Hola to regulatory non-compliance, legal liability, and reputational damage, particularly if a doctor practices while unregistered or sanctioned. In fairness, we must note that this is would be quite rare, and other mechanisms (controls) do exist that are intended to catch this sooner than the annual period. View RSK012: Infrequent checks of doctor's AHPRA registration Severity [4] Likelihood [1] Rating [4] Description Hola Health currently performs annual checks on a doctor's AHPRA registration status. This creates a risk that a doctor could face sanctions or cancellation of their registration during the year, and continue practising on the platform without Hola's awareness. Such an event could expose Hola to regulatory non-compliance, legal liability, and reputational damage, particularly if a doctor practices while unregistered or sanctioned. In fairness, we must note that this is would be quite rare, and other mechanisms (controls) do exist that are intended to catch this sooner than the annual period. Related Recommendations: REC018	Compliance Doctor	1 4	4	REC018
RSK005	No formal documented process for pharmacy offboarding	Hola Health does not have a documented process for offboarding pharmacies that are non-compliant with contractual terms or that request to be removed from the platform. While this is a rare occurrence and the process is well-understood within the organization, the lack of formal documentation could lead to inconsistencies in handling such cases and might expose the organization to potential operational or legal risks. View RSK005: No formal documented process for pharmacy offboarding Severity [1] Likelihood [2] Rating [2] Description Hola Health does not have a documented process for offboarding pharmacies that are non-compliant with contractual terms or that request to be removed from the platform. While this is a rare occurrence and the process is well-understood within the organization, the lack of formal documentation could lead to inconsistencies in handling such cases and might expose the organization to potential operational or legal risks. Related Recommendations: REC006 REC023	Compliance Hola	2 1	2	REC006 REC023
RSK016	Upgrade to 3.0.1 conformance profile by July 2025 (and ongoing conformance thereafter)	Two of Hola Health's three products are conformant under an older ADHA standard, and are required to meet the new 3.0.1 standard by 30 June 2025. Hola must also remain conformant with the standard thereafter. View RSK016: Upgrade to 3.0.1 conformance profile by July 2025 (and ongoing conformance thereafter) Severity [2] Likelihood [1] Rating [2] Description Two of Hola Health's three products are conformant under an older ADHA standard, and are required to meet the new 3.0.1 standard by 30 June 2025. Hola must also remain conformant with the standard thereafter.	Compliance Hola	1 2	2