Muḥammad ibn Mūsā al-Khwārizm (محمد بن موسی خوارزمی) was a mathematician and head of the library of the House of Wisdom in Baghdad in 820 CE. His book on calculations gave us the word algebra and his name lives on in the term algorithm.
An algorithm, as defined in Wikipedia, is a “finite sequence of well-defined, computer-implementable instructions, typically to solve a class of problems or to perform a computation. Algorithms are always unambiguous and are used as specifications for performing calculations, data processing, automated reasoning, and other tasks”.
The RSA (Rivest–Shamir–Adleman) algorithm is used for encrypting and decrypting messages. A user creates two paired keys, a public key that is widely disseminated to those with whom you may want to communicate securely and a private key, which unsurprisingly you keep to yourself. In simple terms the way it works is that one of the keys locks the message and only the other can unlock it. Its practical use is to allow the sending and receiving of secure, authenticated messages.
The RSA algorithm was first described in 1977 and came into widespread use in the late nineties. It was embraced by the Australian government in the 2000s and the HealthCare Public Directory was established as a repository for government authenticated public keys of health professionals. You can send an encrypted email to any person in the directory and be sure that it will be secure and the recipient will also be assured that it came from you. If you search the directory for yourself your public key will be displayed … or it may not.
If it is displayed, others in the directory can send you a secure message and you can decrypt it with your private key. Medical practitioners will recall their private key that was sent to them in the mid 2000s on a plastic card that plugged into the computer. Unfortunately not many GPs still keep that plastic card handy and the email you receive will be all “gobbledygook”.
So what went wrong? To the designers and implementers of the system the answer is users; to users it is the design and implementation of a system that did not mesh with their work flows. It was a mess and failed.
Nevertheless the need for the secure transmission of medical data between health professionals remained. Large pathology companies implemented their own systems and smaller companies use one of several secure message delivery (SMD) companies.
SInce point-to-point communication from practitioner to practitioner had failed, the solution was to enable secure communication from entity to entity, from one practice to another. The secure SMDs managed the whole pipeline from the generation of keys to the acknowledgement of successful delivery of the message.
It all worked seamlessly if you were all with the same SMD but communicating with doctors who were on a different system required each SMD to implement gateways to the others. This involved overcoming significant implementation barriers but more relevant is the fact that there were no strong financial incentives to provide interoperability and considerable business reasons for each SMD to maintain their own walled garden. We were yet again at an impasse.
The Australian government, like other governments around the world, has never been very keen on privacy. They are keen on encrypted communication between two parties but only with the proviso that they can be a silent third party in any electronic health communication. Despite the government’s protestations such backdoors are by definition insecure.
As a consequence, the government has mandated the use of the government public key infrastructure for a valid Medicare referral since the start of eReferrals in the early 2000s. As noted above this failed but the government did not care until the advent of the Personally Controlled Electronic Health Record, now known as the My Health Record (MHR). It was great that 20 million Australians each had a slot in the MHR but not so good that they were all empty.
The solution for the MHR was to make the upload of curated medical documents easier and not rely on GPs performing a separate authentication step. GPs could authenticate in their own electronic health record (by logging on) and then the practice would use the government issued keys (certificates) to communicate securely with the MHR.
Following some financial incentives to general practices the number of active MHRs had reached 6.45 million by January 2020.
This, however, raises the issue of the validity of the Medicare eReferral framework. If GPs don’t have to personally authenticate with government issued keys for upload to the MHR, why can’t they send a secure eReferral to a specialist via a similar process?
This issue remained unresolved for seven years until the Department was pushed in 2019 by GP and digital health expert Dr Oliver Frank to answer the question. After lengthy correspondence Dr Frank received the following:-
‘It is sufficient for an email referral to simply state that it is “signed electronically by [provider name]”. However … such an electronic signature will only be effective if the person receiving it (in your scenario the specialist) accepts the signature in that form.
‘Some specialists may insist on hardcopy referrals or some patients may be advantaged by having a hardcopy referral that can be taken to their choice of specialist.
‘But, unless there is something unusual, specialists are likely to accept email referrals from GPs, particularly in circumstances where such arrangements have been trialled and no problems have come to light.’’
The SMD provider Medical Objects has elaborated on these arrangements in a post on their website, Sending e-Referrals With or Without the Individual PKI. They state they satisfy DoHA and Medical Australia requirements and it is,
“Accepted that the referrer can sign the referral with an organisational certificate with the ability to identify the individual through local audit logs for the purposes of auditing, and this was supported for the current and interim state”.
These statements have been embraced by many GPs and specialists around the country. It is reported that over 70% of doctor-to-doctor communication on the Gold Coast is by electronic communication only. On the North Coast the figure is thought to be less than 30%.
The death of the fax machine has been long touted in medical circles. We have now reached the stage where turning off the fax machine is becoming a viable option. The only task that remains for the busy GP is working out which specialist still wants a paper copy or, if she is happy to receive an eReferral, which secure message delivery provider she uses.
Such is progress.
