Holding less, and paying when systems fail

In early 2023 I commissioned an inventory of the personal information held across our systems. It showed complete identity records for about 690,000 former members, some of whom had left the fund in 1999. Those records included addresses, dates of birth, Medicare numbers, bank details used for direct debits and full claims histories. After the attacks on Australian organisations in late 2022, I could not explain to our board why we still held most of it.

I proposed deleting identity and bank details for anyone who had left more than seven years earlier, subject to legal advice on retention obligations. Our appointed actuary's team objected that identifiable histories helped them study members who leave and later return. The head of member services worried about returning members who needed evidence of earlier hospital cover for waiting periods and lifetime health cover loading. Both concerns were legitimate.

We settled on three treatments. For 512,000 people we deleted Medicare numbers, bank details, contact details and claims detail, keeping only name, date of birth and the dates and tier of hospital cover, so that earlier cover could still be confirmed. Their claims histories were de-identified with new random identifiers and no retained key. Studies of returning members became harder, and the actuarial team accepted reduced confidence in two lapse assumptions. The programme cost A$1.6 million and occupied two engineering teams for five months, which pushed a member-app release into 2024.

Medicare numbers on file fell from about 860,000 people to 470,000, and bank account records from 540,000 to 230,000. The search also found identifiable extracts in two analytical copies and in a supplier's test environment, which had received a partly masked file in 2019. Backups held the deleted data until their thirteen-month cycle expired, and we told the board so rather than reporting completion early.

Retention is now a design requirement for every new system. If I repeated the work, I would start with copies and suppliers, where our own inventory had been weakest.

In 2024, preparing for APRA's operational risk management standard, we named point-of-service extras claiming and hospital eligibility checks as two of our critical operations. Members made 2.1 million extras claims that year, 81 per cent of them at a practice counter. Hospitals confirmed membership electronically before admissions. Both depended on our claims engine and on an external claiming network that we classified as a material service provider.

Our chief risk officer favoured an active duplicate of the claims engine in a second hosting region, with a second connection to the network, at A$5.4 million over three years. I recommended a narrower design costing A$1.7 million. If the engine failed, the network would return a clear message asking practices to charge in full and members to claim later. Hospital eligibility would move to a small, separate service holding an hourly copy of membership status. The risk committee chair asked us to state in writing which members my option would inconvenience, and for how long.

The committee approved the narrower design with three tolerances: degraded extras service within thirty minutes, hospital eligibility within two hours and full extras claiming within twelve hours. We gave up a year of member-app work to fund it, and members would pay full fees during an outage. The chief risk officer recorded her continuing preference for duplication, and it was minuted.

In March 2026 a failed database upgrade stopped the claims engine for seven hours and forty minutes. Degraded mode began after twenty-two minutes. The eligibility service answered 410 hospital checks without a failure. About 4,900 extras transactions became pay now and claim later, and 96 per cent of those claims were lodged within thirty days. We received 64 complaints. We also learnt that 37 practices had read the network message as a lapsed policy and told members so.

We rewrote the message with practice representatives. Next time I would test such wording with counter staff before any outage; our internal exercises had never shown us how they would read it.

Our contact centre answers about 290,000 calls a year, and roughly a third ask whether a treatment is covered. The answer depends on the member's product, its clinical categories, waiting periods, annual limits and what the family has already claimed. In 2025 our general manager of member experience proposed a member-facing assistant built on a language model. A supplier estimated it would handle a fifth of calls and save about A$700,000 a year.

I argued against releasing it to members first. A fluent wrong answer about a waiting period could lead someone to book surgery expecting a benefit that would not be paid. My counter-proposal was an assistant for consultants that drew limits from the claims system, cited the product clause it relied on and required the consultant to confirm each answer before giving it. The general manager accepted a trial but disagreed with the sequence, and the projected saving was deferred. We also spent A$420,000 restructuring product rules into a form the assistant could cite reliably.

A twelve-week trial with 140 consultants ended in January 2026. Quality analysts reviewed 1,500 answers against the product documents. In the first four weeks, 4.1 per cent were materially wrong, mostly on waiting periods after a member upgraded cover and on limits shared across a family. Eleven incorrect answers reached members and were corrected by follow-up calls. After the product-rule changes, the material error rate in the final four weeks was 1.2 per cent. Average handling time for cover questions fell from 8.9 to 7.4 minutes.

All consultants now use the assistant. It does not decide claims, and no member-facing version has been released. The board has agreed that one would need an error rate we have not yet reached and a clear statement to members about what it can and cannot do.

If I began again, I would restructure the product rules before choosing any model, because most errors came from our own documents.