Measured where the referring doctor reads the report

In mid-2022 Corrowyn sent reports to about 1,900 referring practices through three channels. Secure messaging into practice software carried 58 per cent, our referrer portal 21 per cent, and fax or post the remaining 21 per cent. An internal audit that year found 31 misdirected reports, most sent to fax numbers that practices had given up or to doctors who had moved on. Each was a privacy incident and a possible clinical delay, and fax volumes were not falling on their own.

I proposed ending fax for routine reports within fifteen months. The referrer-relations manager disagreed, and so did four radiologist partners whose regional referrers relied on it. They feared that older practices would send patients elsewhere. Their concern was legitimate, and we gave ground on two points: printed reports remained available on request for practices with no workable messaging, and nothing changed in how urgent findings are communicated. Radiologists still telephone the referrer, and the call is recorded in the RIS.

The programme cost A$1.1 million, mostly in directory clean-up, practice visits and messaging fees, and it delayed a planned portal redesign by six months. My integration team matched every active referrer's provider number, practice and software. Referrer-relations staff visited 340 practices, usually meeting the practice manager rather than a doctor, because that is who configures the inbox. We switched practices over in groups and checked each group's first week of deliveries.

By September 2023, 93 per cent of reports reached practice software directly, 6 per cent went through the portal and fewer than 1 per cent were printed on request. Misdirected-report incidents fell to six in FY2024. Referrer relations estimate that eleven practices moved some referrals to other providers during the change, a cost we accepted knowingly.

I would sequence it differently. We cleaned the provider directory while switching channels, so some early groups suffered errors that a directory-first approach would have prevented. I would also involve locum agencies earlier; their doctors moved between practices faster than our records did.

On a Tuesday morning in March 2024, our security monitoring flagged sign-ins to the referrer portal from overseas networks using valid usernames and passwords. Within two hours we confirmed that strangers were using fourteen referrer accounts. The passwords had almost certainly been reused from breaches of unrelated services. The portal gave about 6,200 registered users access to reports and images.

I recommended taking the portal offline until every active user had enrolled in multi-factor sign-in. The director of clinical operations argued for blocking only the affected accounts, because hospital doctors and specialists used the portal for comparison images and a full shutdown would flood our telephones. She was right about the telephones. I judged that we could not yet tell how many other accounts held reused passwords, and the chief executive supported closure.

The portal was offline for twenty-nine hours. Clinics handled 2,300 extra calls, and urgent images reached hospitals through the links used for the overnight contract. Our forensic adviser established that reports for 268 patients had been viewed without authority. We assessed that as an eligible data breach under the Privacy Act, notified the OAIC and wrote to each affected patient. We reopened with multi-factor sign-in compulsory; about 1,100 dormant accounts never re-enrolled and were closed.

The response cost about A$720,000. We have detected no further unauthorised access in the thirty months since. Portal use fell 22 per cent as more practices moved to messaging, which suited our results strategy.

What I would do differently is uncomfortable. Multi-factor sign-in had been on my 2023 plan, and I deferred it to keep the cloud archive migration on schedule. That was my call, and the attack exposed it. I now treat identity controls on any internet-facing system as a precondition for other projects rather than a competitor with them. I would also keep a pre-approved message ready for referrers; drafting one cost us two hours that morning.

Our overnight service reports scans for nine regional public hospitals, and non-contrast CT head studies make up about a third of that work. In 2024 the radiologists asked whether software could help find intracranial bleeds sooner in a queue that might hold forty studies at two in the morning. We assessed three products included on the ARTG for that purpose.

The preferred vendor offered an enterprise licence covering every CT head study in our clinics as well as the hospitals, at a discount worth about A$190,000 a year against a hospital-only licence. Our commercial director favoured it, wanting to tell hospitals that suspected bleeds would be flagged within minutes. The vendor also suggested that studies its software considered normal could be read later in the shift. The clinical governance committee and I declined both. Software would reprioritise the overnight worklist only; a radiologist would read every study within the usual contracted time, and our message to hospitals would describe a faster read for flagged studies, not a claim about detection.

Before go-live we ran the software silently on 2,400 earlier studies from the hospitals. Performance was weaker on images from two older scanners at two of the hospitals, which used thicker slices. We excluded those scanners until the hospitals changed their protocols, which took four months. The licence costs about A$260,000 a year.

In the first nine months the software flagged 1,870 of 14,600 overnight CT head studies. Radiologists judged 38 per cent of the flags false. For confirmed bleeds, the median time from scan completion to signed report fell from 52 minutes to 21. The radiologists also found three bleeds the software had not flagged, which is why every study is still read in turn.

I would write scanner and protocol requirements into the hospital contract before buying the software, rather than discover the gap during validation. I would also involve each hospital's emergency lead in deciding which flagged findings warrant a telephone call before the report is signed.