Board

Agenda Item 6.1

My Health Record Expansion Program

Meeting: 10 August 2017

For Official Use Only

RECOMMENDATIONs

That the Members:

1NOTEthe progress in Readiness planning, Cyber Security Plan and Infrastructure Scalability;

2AGREE the updated implementation plan and timeframes; and

3ADVISE the program on Agency risks that may impact the program.

PURPOSE

The purpose of the paper is toprovide assuranceto the Agency Board that the My Health Record Expansion program (previously known as the Return to GovernmentProgram) is being mobilised in response to the Budget announcement with Program Management and Governance structures established to facilitate program establishment. The paper seeks the Board’s view on the plan and mitigation of thethe core risks.

BACKGROUND

The FY 2017-2018 Budget release confirmed the adoption of an opt out arrangement for the My Health Record.

SUMMARY OF ISSUES

Digital Transformation Committee Reporting

The program reports quarterly to the Digital Transformation Committee. The program’s first report was submitted in July and successfully reviewed by the Committee. The report included the benefits measurement framework, emerging risks and mitigation strategies to engage consumers and promote effective use of My Health Record.

Future reports will include reporting of progress against key milestones and risks to security and public confidence in the My Health Record system.

Department of Finance and Gateway Review

The program is subject to the Department of Finance Gateway Review process. A Stage 0 / 1 Gateway review was completed in October 2016 in support of the Business case preparation. A Green / Amber delivery confidence assessment was assigned at this time. The next review, likely combined Stage 2 / 3 review, is scheduled for late October. The scope of the review will be agreed with the Department of Finance beforehand. The PMO will work closely with the Department of Finance to ensure alignment to the Gateway review process and criteria and that recommendations from the first report are addressed.

Critical Projects Meeting

The Program reports monthly to the Department of Health’s Critical Projects Meeting.

Key Milestones

The program continues to deliver against its milestones and of particular note for this reporting period are the following achievements:

  • The program has signed a contract with Healthdirect to procure consumer and provider facing contact centre services. The RFT was released to the Market on the 21st July 2017. This is the first major milestone under the DHS Transition work stream;
  • My Health Record Release 8 has gone live and delivers an important enhancement to My Health Record through the new Medication View. This enhancement is identified as one of the key enablers for the program, leading to increased usage by providers;
  • The Communications Work stream has appointed ORC International to undertake exploratory research to inform the consumer communication strategy;
  • Baselining of first iteration of the Program Implementation Plan;
  • Steering Group inaugural meeting held on 8 August 2017.

Virtual Command Centre

The program is developing a virtual command centre to manage the program. The command centre will showcase the project control tools and other mechanisms to assess the overall health of the program and progress against milestones. In particular the virtual command centre will show:

  • Current status of the Implementation Plan and schedule
  • Current state of readiness for each State and Territory
  • Current status of stakeholder engagements linking to live CRM and stakeholder engagement plan
  • Critical Path and progress of key program dependencies
  • Current status monitoring of program risks and issues
  • Cyber security monitoring and surveillance of the MHR ecosystem
  • Current status of consumer and provider communications materials, campaigns and key broadcast messages

Build capability within the work streams and program office

The Return to Government Business Case incorporated a Human Resource plan that identified the additional resources required to enable the delivery and operations of the My Health Record expansion program. The table below shows the number of FTE allocated in the business case (by work stream) and the number of FTEs recruited as at 26 July 2017.

Workstream / FY2017/18 Full Time Resources / FY2017/18 Positions Filled / FY2018/19 Full Time Resources / FY2019/20 Full Time Resources / FY2020/21 Full Time Resources
Programme Management / 5 / 4 / 5
Legislation, Policy and Hard to Service / 4 / 0 / 2
Communications / 21 / 6 / 14
Readiness / 34 / 8 / 32
Operations / 11 / 1 / 26 / 37 / 32
Cyber Security / 4 / 1 / 3 / 2 / 2
Total / 80 / 20 / 82 / 39 / 34

Program Implementation Plan

A Program Implementation Plan was endorsed as part of the Government’s approval of the Return to Government business case. Following the Budget announcement on 9th May, the Agency formally mobilised the program and commenced work to further refine the program scope and timeline.

The Implementation Plan now reflects the revised workstream structure and the inclusion of the Department of Human Services Support Services Transition within the program scope. The plan provides greater detail on the work stream scope and key timelines. Further key points to note include:

  • Incorporation of Stakeholder Engagement Management as a program level function;
  • Introduction of a dedicated work stream for Benefits management;
  • Inclusion of the finalised program governance model;
  • Transition of the National Infrastructure Operator (NIO) sourcing strategy to the Operations work stream; and
  • Revision to the program phasing to provide greater detail for tracking and alignment to work stream approaches.

The Implementation Plan is a living document that will evolve as further details are developed pertaining to delivery timeframes and release schedules. The program has baselined the delivery schedules as at 31 July 2017.

(Refer Item 6.1 Attachment A – My Health Record expansion Program Implementation Plan)

Readiness planning

The implementation of Opt Out arrangements will require changes in the level of knowledge, expertise, behaviour and work practices of users. Healthcare providers will need to become confident in using the My Health Record system and adjust how they use it, contributing and viewing My Health Record information as part of their daily clinical practice. The readiness activities including communication, education, training and support for healthcare providers will contribute to the effective implementation and benefits realisation of Opt Out arrangements. The program has identified key external delivery partners that are important to ensuring provider and consumer readiness.

PHN Readiness

PHNs are being engaged to deliver education and change management support. Their role will be to embed use of the My Health Record across the health system with an initial focus on the primary care workforce. PHNs are also being consulted to understand their ability to assist with consumer communication activities, either directly or through their healthcare provider relationships.

Initial readiness planning workshops with all PHNs have been completed. These workshops introduced the program in detail and described the core readiness functions that PHNs could deliver. The program has commenced individual planning discussions with each PHN to determine the actual activities and tasks they will undertake, and to commence negotiations for funding support. The program is targeting the end of September to have schedules in place with every PHN, to allow implementation tasks to commence from October.

Jurisdiction Readiness

The program is engaging with jurisdictions at multiple levels, through a coordinated engagement plan. A national jurisdictional workshop was held in Sydney in early June, where the program began to co-design approaches to national expansion and to understand each jurisdiction’s readiness to support a successful expansion by December 2018.

The outcome of the workshop was an agreement for the Agency to assist jurisdictions to commence detailed local readiness planning. Accordingly, the Agency will fund embedded project management and project coordination resources in each jurisdiction to manage the readiness planning process. Readiness planning will need to ensure involvement from local hospital regions and it is expected that drafts of the high level plans will be delivered by September.

The Jurisdictional Advisory Committee held on August 21, raised an issue in relation to an anticipated funding shortfall for the implementation of readiness activities. The planning process currently underway will identify key activities and tasks and provide the Board with a more detailed view of associated jurisdictional costs and related impacts.

In recognition of this issue, the program has allocated $2m in direct funding for readiness planning resources within jurisdictions and has also allocated 4 FTE Agency staffto support planning and implementation activities in each state. Consequently, the program is now managing this as risk to thebaselined resourcing and budget profiles.

Statewide Plans

The Agency is also developing state wide plans that integrate the readiness plans of all key delivery partners (PHN’s, jurisdictions, clinical peaks and private hospitals) into a consolidated, state plan. Each state and territory will have a separate readiness plan, allowing delivery partners within each state or territory to understand roles and responsibilities and to assist in identifying gaps, risks and issues. The team has developed a template to capture information as it becomes available and the team is targeting end of September for delivery of integrated plans for all stakeholders, noting that finalisation of the state wide plans have a critical dependency on inputs from the local planning activities of all key delivery partner organisations.

(Refer Item 6.1 Attachment B - Provider Readiness Plan Template)

Cyber Security

The Cyber Security Centre has finalised the details of a range of projects and cyber security initiatives. A separate Board development agenda item has been scheduled to discuss the Cyber Security Centre’s approach and to discuss the key initiatives designed to maintain and enhance trust in the system.

(Refer Item 6.1 Attachment C – Cyber Security plan)

My Health Record Capacity and scale up

To prepare for the scaling of the system to handle Opt Out volumes, the My Health Record Expansion programme is tracking a number of activities. These include the standard capacity management activities of building infrastructure ahead of forecasted demand and formal scale up testing. The Opt Out trial in 2016 provided a strong basis to inform the Medicare document load forecast on the system, which is the most significant component of the anticipated Opt Out volume. The programme is also tracking additional activities to mitigate the above normal risk of a single step 5x increase in registered consumers. These include:

  • Early performance testing in Opt Out volume labs (prior to formal scale up testing);
  • Introduction of a Quality of Service (QoS) architecture which, by separating user facing transactions from background transactions, greatly reduces the user impact of any scaling-up issues encountered;
  • Introduction of a lean upload Medicare document service between DHS and the NIO which will remove sub-optimal architecture components that have caused performance issues previously;
  • Exploration of an option to move the Medicare document components onto Amazon Web Services cloud infrastructure which supports elastic scaling to handle unanticipated loads;
  • Software product upgrades to support improved performance, in particular consideration of when to upgrade Oracle Healthcare Database Repository (HDR);
  • Finally, consideration is being given to the implication on the wider ecosystem.

While the above activities will help ready NIO and DHS infrastructure, end users will not distinguish failures in Clinical Information Systems and supporting local infrastructure from failures in national infrastructure. Therefore the programme will engage with jurisdictions and industry to explore opportunities to manage the risk of scale-up on the wider ecosystem.

(Refer Item 6.1 Attachment D – Indicative Plan for Key Infrastructure Scaling Activities)

(Refer Item 6.1 Attachment E – My Health Record Scalability)

FINANCIAL IMPLICATION

Not applicable.

LEVEL OF RISK

As part of the recently (31 July 2017) completed Implementation Planning phase, a further review of the Risk Management plan was undertaken to assess risk ratings, assess progress on mitigation strategies and enact where required and capture newly identified risks.

Upon baselining the Implementation Plan, formal governance arrangements for risk have been established including the conducting of fortnightly Risk and Dependency reviews with the Program Management Team (PMO, Work Stream leads and Delivery partners). As required this forum will escalate risks to the Program Implementation Working Group and / or Program Board.

While new risks have been identified and the ratings adjusted on a number of operational level risks, the key risk profile remains unchanged. This is reflective of the focus being on scoping and planning. The following table reflects the key high and very high program risks.

Risk Name / Mitigations / Mitigation Action Status
Consumer engagement activities may not meet community expectations. Consumer may not perceive they have been fully informed about the opt-out process and their options. / A detailed piece of analysis work is being undertaken by communications specialists to determine consumer engagement options and effective communications channels. / On Track
Provider registration is not sufficiently improved and remains a barrier for healthcare providers / Public and Private Hospitals, GPs, Pharmacies and private DI and Pathology labs are the focus for initial registration activities. Hospitals and GPs already have high registration rates. Detailed readiness planning will highlight the need to boost registration rates of specialists and allied health providers, where these groups use digital health systems for management of clinical records. Private and public hospital plans will also take into account specialist provider access to My Health Record when these providers are onsite. / On Track
The expansion of the My Health Record information system and content increases the risk of cyber attack / The Cyber Security team has undertaken a detailed analysis of the ecosystem and has plans to ensure system integrity which have been tested with relevant parties including the Australian Signal’s Directorate; the Special Adviser to the Prime Minister on Cyber Security; and the National Health CIO Forum. / On track
Public consultation on Secondary Use Framework creates consumer concerns resulting in increased Opt Out rate (>2%) / Public consultations will be held to demonstrate transparency and ensure the resulting framework has broad community acceptance. Timing will be aligned to ensure that the consultations have concluded well in advance of opt out communication activities. / Monitoring Risk
PHN capability and capacity may not be sufficient to enable provider adoption / PHN capability model has been developed and PHNs ranked accordingly. The model will inform the level of Agency support provided to the PHN to ensure adequate capability to support the program. / On track
Software providers fail to deliver clinical enhancements that enable increased utilisation / Market offers in place for pharmacy, DI and pathology software developers to encourage development of conformant software and uptake by the customer base / On track
Provider Adoption rate is insufficient to enable the benefits / Active ongoing engagement with healthcare providers through readiness activities (informed from the Opt Out Trials) and close monitoring of the adoption rate to identify remediation activities. / On track
Viewing of My Health Records in public and private hospitals remains low / 1. Provide providers with necessary training and understanding to be able to view patient records
2. Develop strategies to increase hospital viewing across jurisdictions / On track

PRIORITY AREA ORSTRATEGIC INITIATIVE

All.

ACTION OFFICER / Name / Ronan O’Connor
Position / Executive General Manager
Core Services Systems Operations
CLEARED BY / Name / Tim Kelsey
Position / Chief Executive Officer

ATTACHMENTS

Attachment A: Implementation Plan

Attachment B: Provider Readiness

Attachment C: Cyber Security Plan

Attachment D: Indicative Plan for Key Infrastructure Scaling Activities

Attachment E: My Health Record Scalability