-----
This weekly blog is to explore the larger issues around Digital Health, data security, data privacy and related matters.
I will also try to highlight ADHA Propaganda when I come upon it.
Just so we keep count, the latest Notes from the ADHA Board are dated 6 December, 2018! Secrecy unconstrained! This is really the behavior of a federal public agency gone rogue – and it just goes on!
Note: Appearance here is not to suggest I see any credibility or value in what follows. I will leave it to the reader to decide what is worthwhile and what is not! The point is to let people know what is being said / published that I have come upon.
-----
My View: A ‘conductor’ for medical internet research
Wednesday, 25 September 2019
Guest column by Saswata Ray and Samson Tse
Saswata Ray and HiNZ 2018 keynote speaker Samson Tse propose the need for a ‘conductor’ in the field of medical internet research in the form of a digital collaborative platform.
We can liken most of life’s experience to music. In jazz you will occasionally see a conductor helping direct the performance of all the musicians. However, you will never find him or her a hindrance to the musical experience that jazz gifts to our ears and soul. On the other hand, in an orchestra, the role and importance of a conductor is well observed.
We propose the need of a ‘conductor’ in the field of medical Internet research, primarily at national level, with a definite goal to better channel the progress of research worldwide -more so with the imminent introduction of a new era of 5G environment. The principal motivation behind this proposal is to have a more coherent, global intention in all aspects of research and, information and communication in the healthcare field using Internet and Intranet-related technologies.
The overarching objective of this would be to translate the findings into improved applied health practices in the real world. As a result, we know of the progress, the limitations, the advancement; and the unmet needs; and above all we’re better informed about what we already have so we can use it to save a life or to make a healthier society.
-----
Safe use of apps for My Health Record
16 September 2019
As the use of mobile devices increase, there has been a similar increase in the proliferation of applications (apps) for the mobile device market.
Mobile device apps provide a convenient way to transact and access personal information from any location or while on the move. Like personal computers, mobile devices can be affected by malicious software designed to compromise your information.
Therefore, it is important to make sure any app you install on your mobile devices, including apps that connect to your My Health Record, are authentic and can be trusted to do what they claim.
The way we interact with our mobile devices sometimes means we make quick decisions which can significantly increase the chance of compromising personal information and privacy.
-----
Safe use of apps for My Health Record
As the use of mobile devices increases, there has been a similar increase in the proliferation of applications (apps) for the mobile device market.
Mobile device apps provide a convenient way to transact and access personal information from any location or while on the move. Like personal computers, mobile devices can be affected by malicious software designed to compromise your information.
Therefore, it is important to make sure any app you install on your mobile devices, including apps that connect to your My Health Record, are authentic and can be trusted to do what they claim.
The way we interact with our mobile devices sometimes means we make quick decisions which can significantly increase the chance of compromising personal information and privacy.
-----
09.20.19
5 simple rules to make AI a force for good
The rise of AI has led to tattered privacy protections and rogue algorithms. Here’s what we can do about it.
This article is part of Fast Company’s editorial series The New Rules of AI. More than 60 years into the era of artificial intelligence, the world’s largest technology companies are just beginning to crack open what’s possible with AI—and grapple with how it might change our future. Click here to read all the stories in the series.
Consumers and activists are rebelling against Silicon Valley titans, and all levels of government are probing how they operate. Much of the concern is over vast quantities of data that tech companies gather—with and without our consent—to fuel artificial intelligence models that increasingly shape what we see and influence how we act.
If “data is the new oil,” as boosters of the AI industry like to say, then scandal-challenged data companies like Amazon, Facebook, and Google may face the same mistrust as oil companies like BP and Chevron. Vast computing facilities refine crude data into valuable distillates like targeted advertising and product recommendations. But burning data pollutes as well, with faulty algorithms that make judgments on who can get a loan, who gets hired and fired, even who goes to jail.
The extraction of crude data can be equally devastating, with poor communities paying a high price. Sociologist and researcher Mutale Nkonde fears that the poor will sell for cheap the rights to biometric data, like scans of their faces and bodies, to feed algorithms for identifying and surveilling people. “The capturing and encoding of our biometric data is going to probably be the new frontier in creating value for companies in terms of AI,” she says.
-----
Guide to health privacy
Health service providers routinely handle sensitive health information about their patients and customers.
This guide has been written to help health services providers — from doctors and private sector hospitals, through to allied health professionals, pharmacists, childcare centres and gyms — understand their obligations under the Privacy Act 1988, and embed good privacy in their practice.
-----
Current ATM View - RFIDH2298
Request for Information (RFI) about the future of the National Infrastructure, including My Health Record
Agency: Australian Digital Health Agency
Category: 43200000 - Components for information technology or broadcasting or telecommunications
Publish Date: 26-Sep-2019
Location: ACT, NSW, VIC, SA, WA, QLD, NT, TAS
ATM Type: Request for Information
Description:
This Request for Information(RFI) invites stakeholders to contribute to a conversation about the future of the national infrastructure, including My Health Record currently operated by the Australian Digital Health Agency (the Agency). The RFI seeks information from industry about potential future options, themes and considerations for products and services, including technology considerations for the future.
Contributing to this RFI will help the Agency identify priorities that will underpin an accessible, efficient and world leading environment that Australia can be proud of, delivering digital health improvements for all Australians.
Participants are invited to both:
a) attend the industry briefing or view the video of the industry briefing to hear directly from the Agency; and
b) complete the provided Response Form (in the RFI) and submit it to the Agency via AusTender.
There are no defined structures or requirements for the future. The Agency does not have a fixed view on the future design or technologies, nor does the Agency assume that the current model, technologies, operations are how the national infrastructure should operate into the future. Instead, the Agency intends to use information, from this RFI, to inform the development of future plans, including any requirements for capabilities, products and services to inform future development.
More information about the Australian Digital Health Agency can be found at : https://www.digitalhealth.gov.au/about-the-agency
-----
Have you updated the Practices My Health Record Policy? Does your Practice have a policy?
25/09/2019
My Health Record has privacy and security obligations for participating organisations. It may be timely to regularly review your practice policy and ensure any new staff have received My Health Record training and any old staff have been removed from the system. For more information refer to the My Health Record policy checklist here.
Digital health information and security guidelines:
My Health Record has privacy and security obligations for participating organisations. It may be timely to regularly review your practice policy and ensure any new staff have received My Health Record training and any old staff have been removed from the system. For more information refer to the My Health Record policy checklist here.
Digital health information and security guidelines:
- Security practices and policies checklist
- RACGP Social Media Guide
- View the Australian Digital Health Policy
- Information security in general practice
- Information Security Guide for small healthcare businesses
- Toolkit for selecting secure IT products and services
- Think before you click - protect your healthcare consumers
- Family and domestic violence - take steps to control the information in your My Health Record
- Visit Stay Smart Online for instructions on backing up business data
- Go to the Agency website for advice and information security guidance materials.
-----
10 things pharmacists need to know about using My Health Record
The PSA has released guidelines to coincide with World Pharmacists Day
25th September 2019
The Pharmaceutical Society of Australia has launched guidelines to help pharmacists use My Health Record appropriately.
Advice in the guidelines, launched on World Pharmacists Day, includes these 10 points:
- Pharmacists must be trained before they access the My Health Record system. Training should cover patient privacy, how to adjust dispense record uploads if a patient withdraws consent and what to do if there is a data breach.
- Always check that the correct patient is selected in the dispensing software before uploading records.
- PBS claim data is automatically added to a patient’s record. If the patient doesn’t want a dispense record loaded, it’s best-practice to advise them of this corresponding PBS entry, which they’ll need to remove themselves by logging onto their record via the consumer portal.
- For potentially sensitive prescriptions, such as psychotropic medicines or antimicrobials for STIs, ask the patient if they want the information uploaded to their record. Explain the security measures to limit access to this information by unauthorised users. The reasons for including the record, such as to help identify future medication interactions, should also be discussed with the patient.
-----
Thursday, 26 September 2019 02:18
ACMA warns SA Liberal Party over robocalls breach
The South Australian (SA) Division of the Liberal Party of Australia has been taken to task by the telecommunications regulator the Australian Communications and Media Authority (ACMA) for making polling robocalls during prohibited calling times.
The calls were made between 6.15 am and 7.30 am on two consecutive weekdays in July this year, prompting a formal warning from the ACMA chair Nerida O’Loughlin that “Australians have a right not to be disturbed by these types of calls early in the morning”.
Prohibited calling times are set out in the Telemarketing Industry Standard, and apply to all telemarketing and research calls, including opinion polling – and mandating that research calls must not be made on weekdays before 9 am or after 8.30 pm (or after 5 pm on weekends).
-----
Behaviour change key to digital transformation
Wednesday, 25 September 2019
eHealthNews.nz editor Rebecca McBeth
Behavioural change techniques can be used on both providers and consumers of care to drive transformation in the system, digital strategist Rachel de Sain says.
de Sain, chief executive of strategic design agency codesain, is presenting on the increasing importance of behavioural science during Digital Health Week NZ in Hamilton 18-22 November 2019.
She says health has traditionally followed a "find and fix" model of care, but "we have a phenomenal opportunity to move towards more prediction and prevention" and this transformation will require behaviour change.
Discussions around behaviour change in health are often focused on patients. However, in order to realise the full potential of digital health everyone from administrative staff to doctors needs to embrace change and the same techniques can be used to encourage them to do so.
-----
Behaviour change key to digital transformation
Wednesday, 25 September 2019, 11:42 am
Press Release: eHealthNews.nz
Press Release: eHealthNews.nz
Behavioural change techniques can be used on both providers and consumers of care to drive transformation in the system, digital strategist Rachel de Sain says.
de Sain, chief executive of strategic design agency codesain, is presenting on the increasing importance of behavioural science during Digital Health Week NZ in Hamilton 18-22 November 2019.
She says health has traditionally followed a "find and fix" model of care, but "we have a phenomenal opportunity to move towards more prediction and prevention" and this transformation will require behaviour change.
Discussions around behaviour change in health are often focused on patients. However, in order to realise the full potential of digital health everyone from administrative staff to doctors needs to embrace change and the same techniques can be used to encourage them to do so.
-----
The ACCC Digital Platforms Inquiry Final Report Released: Big changes to Australia's privacy and consumer laws recommended
The Final Report of the Australian Competition and Consumer Commission (ACCC) Digital Platforms Inquiry (Report) was released on 29 July 2019.1 The Report includes 23 recommendations which encompass a broad cross-section of laws, including competition, consumer protection, privacy law and media regulation, which reflects “the intersection of issues arising from the growth of digital platforms”.2
Our Focus Paper provides a summary of the various ACCC recommendations to amend and strengthen Australia’s privacy and consumer laws.
For a number of years, the ACCC has been concerned with the dominance of digital platforms and their impact on the economy. The ACCC’s Inquiry focused on three types of digital platforms: online search engines, social media platforms and other digital content aggregation platforms and their impact on:
- competition in the media and advertising markets; and
- three groups of users:
- advertisers (being the biggest category of business users of digital platforms);
- media content creators; and
- consumers.
The Report noted the substantial growth of digital platforms with Australian consumers frequently using platforms, especially those provided by Google and Facebook. Each month, for example, approximately 19.2 million Australians use Google while 17.3 million Australians use Facebook.3
-----
GDPR is here, but few Australian staff know what to do about it
Although 96% of Australian IT execs support privacy controls, just 13% of local companies are GDPR compliant
Eurovision may have accepted Australia as one of its own, but Australian businesses may be hoping European Union authorities forget about them for a while as survey after survey suggests that they have missed today’s deadline for compliance with the EU’s general data protection regulation (GDPR) by a country mile.
Australian businesses were generally positive about the intentions behind tighter data privacy protections – fully 96 percent of decision-makers believe that stronger data protection policies will reduce the number of data breaches – but just 13 percent of Australian respondents to a March Webroot survey said they were ready to comply with the privacy protections of GDPR.
That was a fraction of the 89 percent of Australian businesses that were compliant with the new notifiable data breach (NDB) scheme, which came into effect in February.
Low levels of GDPR compliance pose very real issues for businesses whose employees will be charged with activities such as providing copies of all data that the company holds about a particular customer.
-----
The problem steering robo-debt is there are no humans at the wheel
Robo-debt is headed for the courts. A class action will argue the federal government unjustly enriched itself by taking up to $300m from thousands of Centrelink clients. The case has the potential to turn a major money-spinner for the commonwealth into a much costlier exercise.
Governments have long struggled with ensuring Australians receive the correct social security benefits and that overpayments are returned. With millions of welfare recipients, it is impossible for agencies to be fully aware of the circumstances of each person. Reliance has been placed instead on personal disclosure and manual review of people at the highest risk of being overpaid. The system was time-consuming, expensive and often ineffective.
The government’s answer to this problem since 2016 has been robo-debt. It is an automated system based on an algorithm that crossmatches data on annual income held by the Australian Taxation Office with income reported to Centrelink. Where the tax income is higher, it is taken to mean that the people receiving benefits had been overpaid and so owe a debt to the government.
-----
Employee finger print scanning and privacy implications
Many employers have operated on the assumption that, because employee records are exempt from the Privacy Act, employers have significant freedom when dealing with employee privacy.
A recent Fair Work Commission decision from the Full Bench has clarified this is limited. The case also gave rise to interesting considerations around an employer’s ability to issue a lawful and reasonable direction for drug and/or medical testing.
Background
In the decision of Lee v Superior Wood[1] the Fair Work Commission found that a direction requiring an employee to consent to having a fingerprint scan was not lawful.
In fact, this insistence infringed the employee’s rights under privacy legislation.
The employee’s dismissal for failing to follow this direction was therefore deemed unfair.
-----
Clinical handover to primary care – what GPs need
Katrina McLean
Michael Rice
Tim Leeuwenburg
Michael Rice
Tim Leeuwenburg
AS patients transition between hospital and community, it is essential that a clinical handover precedes or accompanies them as they exit the hospital doors.
This article is the third in a series on the topic of clinical handover to primary care written by representatives of the GPs Down Under (GPDU) Facebook Group. The first article discussed the importance of a clinical handover occurring at the point of transition to the community, and our second article emphasised the need to reframe “discharge summaries” as clinical handovers. In our second article, we discussed “ISBAR” (introduction, situation, background, assessment, recommendation) as a clinical handover tool and drew on the suggestions of Brewster and Waxman to add some “kindness” to the mix, using “K-ISBAR”.
The following draws on the clinical discussions within the GPDU Facebook group and provides a GP wish list for those preparing clinical handovers to primary care.
-----
Predicting suicide risk using artificial intelligence
Authored by Daniel D'Hotman and Erwin Loh
SUICIDE and mental illness pose a significant burden in Australia and worldwide. Prime Minister Scott Morrison has made reducing the toll of suicide a key priority, announcing his aim to drive the suicide toll towards zero. While it may be impossible to completely eliminate suicide, it should be possible to improve prediction and prevention through better analytical tools.
Yet prediction of suicide risk continues to present a challenge for doctors and traditional epidemiological studies. This is due to the complex factors that underpin suicide and the difficulties around identification of a small number of individuals in a large group with similar risk factors. A landmark meta-analysis by Franklin and colleagues, spanning 365 studies over 50, years found that prediction of suicide was only slightly better than chance for all outcomes, and that this predictive ability has not improved across 50 years of research.
However, there is an emerging body of evidence suggesting that artificial intelligence (AI) and data science may be effective tools in predicting and preventing suicide. Two potential uses have been suggested: medical suicide prediction and social suicide prediction. Medical suicide prediction involves AI being deployed as a real-time decision support tool to assist clinicians in identifying patients at risk of suicide. Social suicide prevention involves analysis of behaviour on social media, smartphone applications and other online sources to determine those at risk of suicide.
-----
Transgender people “invisible” in health datasets
Authored by Nicole MacKee
TRANSGENDER men and women have been “invisible” in health datasets, say researchers who have found key differences in the rates of sexually transmitted infections (STIs) between transgender and cisgender people.
Researchers reported in this week’s MJA that, among people attending sexual health clinics, transgender women were more likely to have an STI than cisgender heterosexual patients (adjusted odds ratio [aOR], 1.56; 95% CI, 1.16–2.10; P = 0.003), while transgender men were as likely as cisgender gay and bisexual men to have an STI (aOR, 0.72; 95% CI, 0.46–1.13; P = 0.16).
They also found that the rate of gonorrhoea test positivity among transgender women had more than tripled over the 8-year study period (2010–2017), increasing from 3% to almost 10%.
For the study, the researchers analysed the data of 1260 transgender people (404 men, 492 women and 364 unrecorded gender), 78 108 cisgender gay and bisexual men, and 309 740 cisgender heterosexual people who attended 46 sexual health clinics across Australia, at their first visit.
-----
Monday, 23 September 2019 05:59
Sydney among top 20 cities for surveillance cameras
Cities around the world are increasing surveillance of their residents, with the number of cameras that look down on the public growing by leaps and bounds, a survey has found. Sydney is the 15th most surveilled city globally, with 60,000 cameras for 4.85 million people, meaning that there are 12.35 cameras for every 1000 people, the British website Comparitech claims.
While cities in China took the top five places for the number of cameras per 1000 people, London came in sixth with 627,707 cameras for its 9.2 million people or 92.87 cameras per 1000 people.
Another city outside China making the top 10 was Atlanta in the US, where there 78000 cameras for 501,178 people, or 15.56 camears per 1000 people.
The five cities in China that topped the list were Chongqing (2,579,890 cameras for 15.3 million), Shenzhen (1,1929,600 cameras for 12.2 million), Shanghai (2,985,984 cameras for 26.3 million), Tianjin (1,244,160 cameras for 13.4 million) and Ji'nan (540,463 cameras for 7.3 million).
-----
ADHA - Secure Messaging Adoption Survey
What is Secure Messaging?
Secure Messaging is used for exchanging clinical information between healthcare providers over a Secure Messaging network. This is achieved between a network of connected clinical information systems or practice management systems.
Healthcare providers need to frequently exchange patient information with other members of a patient's care team. This can be done through a messaging exchange service that is secure, seamless and efficient. Secure Messaging has some similarities to an encrypted email or digital fax – but it is neither. A Secure Messaging network is offered and managed by one or more Secure Messaging providers.
An example scenario is as below:
Doctor Smith needs to send a patient referral to Doctor Williams who works in a different specialist clinic. Doctor Smith accesses his clinical information system, enters the patient referral details and chooses a messaging provider that Doctor Williams also uses. Doctor Smith then sends the referral, and the message is securely transferred to Doctor Williams. Doctor Williams accesses his clinical information system and sees that Doctor Smith has sent a Secure Message containing a patient referral. He opens the referral and is able to see the patient referral details.
Healthcare providers need to frequently exchange patient information with other members of a patient's care team. This can be done through a messaging exchange service that is secure, seamless and efficient. Secure Messaging has some similarities to an encrypted email or digital fax – but it is neither. A Secure Messaging network is offered and managed by one or more Secure Messaging providers.
An example scenario is as below:
Doctor Smith needs to send a patient referral to Doctor Williams who works in a different specialist clinic. Doctor Smith accesses his clinical information system, enters the patient referral details and chooses a messaging provider that Doctor Williams also uses. Doctor Smith then sends the referral, and the message is securely transferred to Doctor Williams. Doctor Williams accesses his clinical information system and sees that Doctor Smith has sent a Secure Message containing a patient referral. He opens the referral and is able to see the patient referral details.
-----
Comments more than welcome!
David.
The Victorian Government is investigating the scale of a ransomware attack by "sophisticated cyber criminals" on some of the state's major regional hospitals that has forced healthcare providers to go offline.
ReplyDeleteWhen the Government says no personal information was accessed, you get a sense that personal information was accessed
ReplyDeleteSecure Messaging has some similarities to an encrypted email or digital fax – but it is neither.
ReplyDeleteIs that differential that efax and encrypted email are grounded in internationally agreed standards? Or is it the work? And don’t need to place ’digital’ in the name to sound technically relevant?
With Patient booking systems compromised it would indicate the potential identifying information has been offered up for exploitation. Have these systems proved a backdoor into the government health record system?
ReplyDeleteIf they did create a backdoor into the government health record system it might have been detected, but it almost certainly would not have been prevented.
ReplyDeleteAll part of machine learning education. Creating normal patterns of behaviours that once learned are near impossible to unlearn
ReplyDeleteWith respect to the Dr Smith refers to Dr Williams scenario presented for secure messaging. Some considerations:
ReplyDeleteWhy should Dr Smith have to ‘choose a messaging provider that Dr Williams also uses’ before he can send the referral? Surely he can simply select Dr Williams from a list and let the digital smarts work out how to send the referral securely.
The given scenario does not represent a realistic specialist referral workflow. In the scenario as presented here, what is the receiving Dr Williams supposed to do when she logs in and reads the patient referral message? Should she check if the patient has actually booked in for an appointment with her, and if not, should she ring the patient and ask them to make a booking? (Perhaps the patient has decided to go elsewhere, or not attend at all). Perhaps she (Dr Williams) should pass the referral message over to her receptionist/practice manager and ask them to chase the patient up for a booking? I am not sure if I would like to be rung by a receptionist and asked to make a booking with the specialist. “Is that Miss Brown? Well it seems you have some rather nasty symptoms that should be checked out, so when would you like to come in and see Dr Williams? By the way, it will cost you $XXX for the first visit…”
A more likely scenario is that on the advice of Dr Smith, the patient makes a booking via Dr Williams’ receptionist, and the receptionist advises whether a referral is required, and may also check to see if a referral from Dr Smith has already arrived (via a secure message). Then, closer to the booked appointment time, the specialist is able to access the referral letter either prior to, or during the actual patient appointment. Private, more consumer-inclusive, more efficient use of clinician time.
Workflow context is important when specifying messaging. It is not just about the message itself, but also about the functionality in the systems that are generating and receiving the messages. Otherwise it won't work.
Why send a referral in the first place?
ReplyDeleteThis is classic "automate an existing manual process" failure. The failure is to look at how the same result could be achieved in a better way.
For example: Dr Smith sends a request to Dr Williams. The request contains an encrypted patient ID and password (using quite standard PKI technology).
Dr Williams logs on to Dr Smith's system and sees not only the referral, but other medical data that relates to the referral and the patient.
It also enables the potential for a conversation between the two doctors as well as a channel for delivery of test results and a summary at the conclusion.
If other health professionals are involved they can be included in the same process.
The point of integration then becomes the referring doctor's system;
When the need for the patient to see Dr Williams concludes, Dr Williams' access to the patient's data is rescinded.
If the patient wishes to see their own data, they can also be given access.
Mmmm ... as I understand it, if a specialist doesn't receive a Referral,then under the MBS regulations the government does not have to pay the specialist the scheduled fee.
ReplyDeleteHmmmn a funding model issue, wonder why that never gets the attention it needs? While they are at it maybe the COO of ADHA could explain how their centralised repository fixes what is essentially a distributed business model?
ReplyDeleteIn the scheme I outlined, the referral document exists, but is not sent to the specialist, the specialist extracts it from the referrer's system.
ReplyDeletePKI not only ensures security of delivery of the request but authenticates the sender and receiver by using their public/private keys.
It's not rocket surgery.
The specialist is required to and wants to keep their own records and a referral is a summary document, having access to all the data in a GP system would potentially be information overload. Transfer of appropriate information in a machine and human readable form is the aim. You are not usually interested in an attendance for a sprained ankle 10 years ago which would be there if you had full access. This is the problem with MyHR, if all the data was actually there it is information overload, particularly when its only human readable. Its great to have 10yrs of LFTs when you can automate a cumulative view, but looking at 50 pdfs of those results is untenable, especially with bandwidth and storage requirements. You would end up doing what I used to do, get out a piece of paper and transcribe the numbers to create a human created cumulative view.
ReplyDelete"Transfer of appropriate information in a machine and human readable form is the aim."
ReplyDeleteI would have thought that access to appropriate information is the requirement.
I would also have thought that only the specialist can determine what is appropriate, not the referring GP.
In general, though I would have thought that the requirement is for secure communication (of whatever data, and in whatever form it has been acquired and is available), not secure messaging.
The point I'm trying to make is that secure messaging is little more than enhanced fax. Has anybody sat down and looked at the problem that needs to be solved? And alternative solutions that better solve that problem?
Not forgetting that the real problem of clinical care is in assisting the patient, for which better data and means of analysing that data are far more valuable - to the patient.
Specialists want a summary, not a dump of everything in the GPs system. In an ideal world this would also include access to the GPs records, and pathology records and this is possible with real time messaging and good PKI, but sending a summary is appropriate and we need to walk before we run.
ReplyDeleteCurrently I request pathology from local labs on patients I am going to be seeing and this works well. The actual transfer of a referral with a summary is still appropriate.
@10:13 AM What does the specialist do if the referring doctor's computer is down?
ReplyDelete"What does the specialist do if the referring doctor's computer is down?"
ReplyDeleteYou mean like the Vic hospital disruption?
Specialist referrals are not exactly time sensitive. They would wait.
Some time between the patient making an appointment and the consultation, the specialist's staff could log on and extract the referral letter and any other material.
I saw a specialist recently. They couldn't read all the material my doctor had faxed through (a toner problem) so they asked me to take along me the material that my doctor had given me - which was what had been faxed and which included the referral letter.
If you are going to specify the requirements for secure communications/messaging in an environment such as health care you need two things:
1. To avoid a single point of failure
2. A range of solutions that cater for different scenarios and needs.
This is a presentation on secure messaging from ADHA
http://files-au.clickdimensions.com/digitalhealthgovau-a5xdx/files/securemessagedeliverysmdv21.8webinar.pdf
It's a bit bland - it talks about benefits but not value, costs or risks - and gives the impression that a large part of the goal is to reduce the amount of paperwork.