As a fast-growing organisation, we are constantly learning and making changes to our business practices. We have listened intently to the public, the media, to our valued customers and stakeholders.

Patients and healthcare practices remain at the heart of our business. Their trust in HealthEngine is our highest priority. We hope to rebuild this trust to allow us to continue to do more of the good work we have done in improving the healthcare experience of millions of Australians.

I want to assure everybody that we are making changes to the business that will deliver on our mission to create a connected healthcare ecosystem that empowers the world’s best care experiences. We have been conducting extensive reviews of our partnerships, processes and policies.

That’s why, today I am announcing a number of major changes at HealthEngine. These haven’t been easy decisions to make. But they’re the best decisions for our patients and our customers.

The changes we have already made include:

1. ceasing our third party referral service; and
2. ceasing the publication of user comments as part of our Practice Recognition System.

We will also be ceasing third party banner advertising on HealthEngine as of 31 July to create a more streamlined user experience.

In the coming weeks we will also:

1. Give users greater visibility and control over the way we manage their personal information.
2. Establish an advisory group to work closely with health providers, consumer peak bodies and regulators to ensure our future products and services are informed by consulting more widely.

We believe transforming healthcare experiences leads to better health outcomes. By making these changes I am confident we will improve the user experience on HealthEngine and provide even more value for our customers.

Kind Regards,

Dr. Marcus Tan
Founder, CEO & Medical Director

These reports have created the incorrect impression that the health and personal information of HealthEngine users is being widely shared with third parties without their knowledge.

This simply isn’t the case.

As an online health marketplace, we believe that users benefit from having the choice to receive relevant and timely information about certain products and services. Users may elect to have their details provided to third parties for referral purposes by an express opt in or verbal consent.

These value-added services aim to be helpful for users along their healthcare journey similar to those you may see when booking other services like travel.

We have referral and advertising arrangements in place with a range of industry partners, including government, not for profit, medical research, private health insurance and other health service providers.

Referrals do not occur without the express consent of the user.

Users can still use our booking services without agreeing to be referred to a third party service provider.

We at HealthEngine are devastated by the developments of recent weeks because we feel our mission of a connected healthcare ecosystem that empowers the world’s best care experiences and the cause of digital health in Australia as a whole has been set back.

We are passionate about improving the healthcare system and the role digital health can play in revolutionising the access and experience of healthcare which ultimately leads to better health outcomes.

As we have grown to serve millions of Australians every year and help them get better access to healthcare we have invested heavily to scale our systems, people and processes to accommodate our growth and recognise the impact we now have.

This is a large responsibility and one we don’t take lightly.

Nevertheless, we acknowledge that, despite being well intentioned and trying to innovate in health care, that recent media coverage has damaged the trust we have built up over many years with our users, customers and industry partners.

Health care is a sensitive area and we have heard the feedback we have received from our customers and users that they are concerned about data privacy.

In order to restore their confidence in our management of user information, we have decided to make substantial changes to HealthEngine’s business model around advertising and referrals.

We are finalising the arrangements underpinning these changes and are on track to make an announcement within the next week.

Moving forward, we will continue to consult with our users, customers, industry partners and relevant regulators to deliver better health outcomes.

We sincerely hope that by taking the steps we are about to take and by being open to more feedback and learning that we can regain that trust and continue to have the opportunity to deliver the value to the healthcare sector and millions of our users in better ways than we have done before.

Kind Regards,

Dr. Marcus Tan
Founder, CEO & Medical Director

Due to an error in the way the HealthEngine website operated, hidden patient feedback information within the code of the webpage was improperly accessed. This information is ordinarily not visible to users of the site.

Of the more than 59,600 patient feedback entries that may have been improperly accessed, approximately 75 entries contain identifying information.

HealthEngine has reported this breach to the Office of the Australian Information Commissioner, as is required under mandatory data breach reporting law, and has also notified the 75 individuals who had included identifying information in their feedback.

The information that may have been improperly accessed does not include any account details such as user names or passwords. Importantly, no information from the health practice, such as patient records, is held by HealthEngine.

No action is required to be taken by users of the site.

HealthEngine has worked around the clock to investigate how the information was improperly obtained, what patients might have been affected, and the steps required to address the matter.

We have removed all published patient feedback from our site while we review the HealthEngine Practice Recognition System, to ensure that hidden feedback information can no longer be accessed in this way.

We take data security very seriously, and acted swiftly and decisively when we became aware of the breach, to identify the error and shut down the published patient feedback function of the Patient Recognition System on the website.

The published patient feedback function will not be reinstated until we are confident the error has been corrected.

Kind Regards,

Dr. Marcus Tan
Founder, CEO & Medical Director

We respect the privacy of our users and appreciate the trust they place in us.

I would like to reassure users that HealthEngine does not provide any personal information to third parties without the express consent of the affected user or in those circumstances described in our privacy policy.

We do have referral arrangements in place with a range of industry partners including government, not for profit, medical research, private health insurance and other health service providers on a strictly opt-in basis.

These referrals do not occur without the express consent of the user.

Contrary to the ABC report’s suggestion, consent to these referrals is not hidden in our policies but obtained through a simple pop-up form as part of the booking process (see below) or provided verbally to a HealthEngine consultant. Consent to these referrals is entirely voluntary and opt-in, and we do not provide any personal information for the purposes of a referral without this consent.

This is a typical example of an opt-in pop-up which enables users to provide their consent to receive referral services. There’s no obligation on a user to complete or submit this form.

These referral services are provided as a value-add to our users who opt-in to the service, in order to help them access the services they request at relevant stages of their health journey.

Users are able to continue to use our booking services even if they do not provide their express consent to being contacted by a referral partner through the pop-up form.

HealthEngine has no referral arrangements in place with marketing agencies or law firms.

Under previous arrangements, HealthEngine provided referrals to law firms but only with the express consent of the user. Our referral partnerships remain constantly under review to ensure patient feedback is taken on board and patients are getting access to the services they request.

I want to make it clear that HealthEngine is unable to access patient data held by My Health Record or the Australian Digital Health Agency.

For more information on data privacy at HealthEngine please refer to our FAQ.

Media contact:
press@healthengine.com.au

Sincerely,

Dr. Marcus Tan
Founder, CEO & Medical Director

Practice Recognition System

Until recently, positive patient feedback on medical practices has been published on the HealthEngine website through the PRS.

The PRS was intended to operate as a positive, aspirational, recognition system, where only the practices rated highest by the practice’s own patients appeared.

Media reports have suggested that HealthEngine may have misled users by removing negative comments from patient feedback under the PRS.

We take these claims very seriously. The trust of our users and customers is important to us and we want to be sure that users clearly understand the information they obtain from our site and that the operation of our PRS complies with all of our regulatory obligations.

That is why we have removed the published feedback component of the PRS from our website pending robust internal and external reviews.

By way of background, the Health Practitioner Regulation National Law, as interpreted by the AHPRA Guidelines, prohibits the publication of any feedback containing reference to the identity of a specific health practitioner or patient or referring to the provision of clinical care services to the patient and that may represent a “testimonial”

Consistent with these aims, we edited some user feedback to seek to ensure that it complied with the National Law and AHPRA Guidelines and with our positive intentions for the PRS. While many of the edits were minor and required by law, it appears there were occasions when our editing went beyond what was required under our regulatory obligations.

In relation to published feedback, our process was to email all users to let them know that their feedback may have been edited. All the practice’s patient feedback, positive and negative, is provided back to the practice unedited.

Over the last three years, we have received very few complaints about the way we have edited published feedback.

Nevertheless, we are seeking to work with relevant regulators and will act decisively on the outcomes of the current reviews to ensure our processes meet best practice standards.

For more information on moderation of feedback at HealthEngine please refer to our FAQ.

Data privacy

We respect the privacy of our users and appreciate the trust they place in us.

HealthEngine does not provide any personal information to third parties without the express consent of the affected user or in those circumstances described in our privacy policy.

For more information on data privacy at HealthEngine please refer to our FAQ.

If you have any feedback on how we could improve our services, we'd love to hear from you at feedback@healthengine.com.au

Sincerely,

Dr. Marcus Tan
Founder, CEO & Medical Director