Harriet Montgomery · Chief Technology Officer · Australia

Technology risk seen from inside a clinical service

My contribution to a board

Many healthcare and care boards now carry technology risk they cannot easily read. They receive assurance that systems are patched and backed up, but not a clear picture of what patients and clinicians would experience during an outage or a breach. I can help a board ask that question and test the answer. My experience covers the whole path of clinical information in imaging, from equipment in a remote hospital to reports arriving in practice software, and I have led a breach response that involved notifying patients and the OAIC. I understand the trade-offs between cloud and local systems, between convenience and identity controls, and between the promise of AI and the evidence a clinician needs. I also understand the limit of my role. I would not second-guess clinical decisions, and I would expect clinicians to own how any tool is used in care. As a director of Tindarra Hospice Care since 2022, I have learnt the difference between asking management a sharp question and doing management's work for it. On a larger board I would add a practical technology and cyber view to the audit and risk committee, while relying on colleagues for finance, law and clinical governance.

Judgement in practice

Deciding to close a service rather than contain an attack

The portal attack required a decision before the facts were complete. Blocking fourteen accounts would have kept the service open for thousands of clinicians; closing it protected everyone with a reused password but disrupted care for a day. I recommended closure, and the chief executive agreed. On a board, I would expect management to bring that kind of choice with its uncertainty stated plainly: what is known, what is not, and the cost of being wrong in each direction. I would ask whether the organisation has decided in advance who may shut a patient-facing system, and whether its notification process under the Privacy Act has been rehearsed. I would also ask the uncomfortable question this case taught me: which security control has been deferred to protect another project's timetable, and who accepted that risk?

Separating a commercial offer from a clinical decision

The AI licence was attractive commercially, and the vendor's suggestion that normal studies could wait was framed as efficiency. I treated both as clinical questions for the radiologists, not procurement matters for me. A board will meet similar proposals: software to triage referrals, flag deterioration or draft documentation. I would ask whether the product is included on the ARTG for its intended use, whether the organisation has tested it on its own patients and equipment, and who monitors its errors after go-live. I would also look at how the benefit is described to customers or families, because an honest description of what a tool does is part of clinical safety. A director need not judge a model's accuracy personally. The board needs to know that someone qualified does, and that their conclusion can stop a commercial plan.

My first year on a board

In my first months I would rather see the organisation working than read about it. I would ask to spend a day where its services are delivered, and to sit with whoever handles an outage or a complaint about lost information. With the chair's agreement, I would meet the chief executive, the head of technology, the clinical or care governance lead and the external auditor separately. By the first full risk cycle I would want to understand three things: which systems the service cannot run without, how long it could operate if each failed, and what personal information it holds that it no longer needs. I would read the last two incident reports and the board's responses to them. Before the year ends I would ask the chair for candid feedback on whether my questions were useful or too operational, since technology executives often drift into management on boards. I would also expect to have learnt the organisation's funding and regulatory pressures well enough to weigh technology risk against them rather than in isolation.

Conflicts and their management

My employment creates several relationships a board would need to see. Corrowyn buys from archive, cloud, messaging and AI vendors; it depends on referring practices and hospitals; it holds a state reporting contract; and a healthcare investment fund owns a minority share. I would decline any seat with a supplier to Corrowyn, an imaging or pathology competitor, or an organisation negotiating with us. Before accepting a role I would give the chair a written list of these relationships and my Tindarra directorship, and update it whenever Corrowyn signs a material contract. If a matter touched one of them, I would declare it and leave the discussion. Confidential information would stay with the organisation it belongs to; I would never compare one board's vendor terms with another's. Time is the other conflict. A cyber incident at Corrowyn would take priority, so I would tell a chair that honestly and agree in advance how my committee work would be covered.

My independence statement

I hold no shares in Corrowyn or its suppliers and have no family connection with any organisation I might join. My employment, and Corrowyn's vendor, referrer and investor relationships, would still need assessment by the board concerned before any view on my independence is formed.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to join	Audit and risk · Technology and cyber risk · Clinical or care governance, as a non-clinical member

Capacity and preferences

Time available: 24 days per year
Current directorships: 1
Sectors: Healthcare services · Aged care and community care · Not-for-profit health providers
Company type: Unlisted or ASX-listed healthcare-services or care provider, or a large not-for-profit health organisation, holding sensitive personal information at scale
Company stage: Moving clinical systems to cloud services, integrating acquisitions, or rebuilding confidence after a cyber incident

The seat I am pursuing

I am looking for a first non-executive seat on the board of a healthcare-services, aged-care or community-care provider, either unlisted or listed on the ASX, or a sizeable not-for-profit. The right organisation holds sensitive personal information at scale, depends on clinical or care systems that cannot simply stop, and wants a director who has managed technology risk rather than only reported on it. I would join the audit and risk committee, and a technology or cyber committee if the board has one. I am not ready to chair a committee of a larger board and would not ask to. I would also want a chair who expects disagreement to be voiced in the boardroom. My value lies in specific, practical questions about resilience and information, and those questions are useful only where the board wants them asked.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

The IICA Independent Directors' Databank is an Indian requirement and does not apply to Australian appointments, so I have not registered.

Completed a five-day company directors' course in 2022 covering directors' duties under the Corporations Act 2001, financial reporting and risk oversight.
Serve on Tindarra Hospice Care's finance, audit and risk committee, reviewing its cyber and privacy reporting and its annual financial statements.
Read the ASX Corporate Governance Council's Principles and Recommendations alongside listed healthcare companies' annual reports to study how boards disclose risk.

Board and committee exposure

Reported to a committee

Corrowyn Imaging

Audit and risk committee

July 2021–present

Quarterly reports on cyber risk, incidents and system availability, including the 2024 portal breach and its notification.

Presented to the Board or a committee

Corrowyn Imaging

Board

July 2021–present

Presented the cloud archive investment, the compulsory multi-factor sign-in decision and the overnight AI worklist proposal as CTO; not a director.

Served as a director

Tindarra Hospice Care

Board; finance, audit and risk committee

February 2022–present

Unpaid non-executive director of a Perth not-for-profit hospice and palliative home-care provider; committee member reviewing financial statements, cyber and privacy reporting.