Decisions that cost revenue before they protected patients

Letting our largest insurer contract lapse for forty-one days

Wyralee Health Fund covered 27 per cent of our insured admissions in 2023. Its agreement with us expired on 31 August that year, and its renewal offer was indexation of 1.9 per cent a year for three years, a clause refusing payment for any readmission within twenty-eight days, and a move of several orthopaedic procedures to a fixed bundled price. Our costs were rising faster: the nursing enterprise agreement alone added 4.5 per cent that year. On my estimate the offer left a shortfall of about A$14 million a year by its third year, which in practice would have been met by fewer nursing hours on Wyralee patients' wards.

Our chief financial officer favoured signing with small amendments, because an out-of-contract period would hurt cash and members. Several senior surgeons argued that their patients would face bills and go elsewhere. Our chair worried about headlines. I recommended that we decline and prepare to operate without a contract, on three conditions: every Wyralee member already booked would be charged as if the contract applied, at our cost; maternity and cancer patients would be protected throughout; and we would say nothing publicly about the insurer. The board agreed.

Without a contract, a fund pays an eligible hospital a lower default benefit set under federal rules, and the difference can fall on the patient. For forty-one days, admissions of Wyralee members fell by 22 per cent. We lost about A$5.9 million of revenue and spent A$1.3 million honouring earlier bookings. Two surgeons moved some lists to a competitor and did not all return.

On 11 October we signed a three-year agreement indexed at 3.4, 3.6 and 3.5 per cent. The readmission penalty became a joint clinical review of readmissions, and the bundled orthopaedic price was rebuilt to fund rehabilitation at home, sharing any saving. Nurse unit managers and theatre managers now help prepare every negotiation, and the board sees ward-level staffing effects before approving any contract.

I would do two things differently. I would brief our surgeons in person before the insurer's letters reached their patients, because several heard the news from patients first. And I would publish a plain explanation for patients on day one instead of answering questions one call at a time.

Reallocating theatre sessions that surgeons were not using

In 2022 our 68 theatres were booked to surgeons in fixed weekly sessions, most of them allocated years earlier by seniority. Only 66 per cent of booked time was used. Seventeen per cent of sessions were released within forty-eight hours of the list, too late to offer to anyone else, while younger surgeons and our public-contract lists waited for time. Same-day cancellations ran at 5.8 per cent, often because lists were overbooked to compensate for the empty ones.

I proposed rules for all sixteen sites. A session released at least fourteen days ahead would carry no penalty. A session used below 75 per cent for two consecutive quarters would be reviewed by the hospital's surgical services committee, with the surgeon present, and could be reallocated after a quarter's notice. Leave, illness and parental leave would never count against anyone. The chair of the medical advisory committee at Kelvarra Brisbane North opposed the rule as a breach of long-standing arrangements, and an orthopaedic group of six surgeons, among our highest-earning, told me plainly they would take work elsewhere. Our chief executive asked whether the gain was worth the risk.

I judged that it was, because the cost of empty sessions fell on patients we could not see on any report. We gave each surgeon two quarters of private data about their own use before the rule took effect. The orthopaedic group moved about a third of their joint replacements to another hospital in 2023–24, costing us roughly A$8.7 million of revenue that year.

By 2025 utilisation of booked sessions had reached 81 per cent and same-day cancellations had fallen to 2.7 per cent. Forty-one sessions a week moved to other surgeons, including eleven to newly credentialed specialists and six to public-contract lists. Revenue lost in 2023–24 was recovered the following year. Each surgical services committee now reviews session use quarterly, and surgeons can see their own figures at any time.

What would I change? I would have met the orthopaedic group myself, hospital by hospital, before the policy was circulated. They learnt its details from a memorandum, and that, more than the rule, is what they resented.

Ending private births in Rockhampton and partnering with the public hospital

Kelvarra Rockhampton, a 96-bed hospital in central Queensland, delivered 640 babies in 2015–16 and 270 in 2021–22. Private obstetric care in the town was shrinking as fewer families held hospital cover that included pregnancy. Two of our five obstetricians had left, the remaining three were rostered one night in three, and the round-the-clock anaesthetic cover that safe birthing requires was costing more each year. Maternity lost A$4.6 million in 2021–22 and the whole hospital lost A$3.9 million. With so few births, our midwives were also struggling to maintain their skills in complex deliveries.

There were three options: continue with a subsidy from the group, close maternity outright, or close it in partnership with the public hospital. I recommended the third. The public maternity unit, run by Kinnabar District Health Service, could absorb our births if it gained staff, and the state wanted more elective surgery capacity in the region. Local obstetricians opposed closure, a community petition gathered 5,200 signatures, and one of our own directors, who lives in the district, voted against the proposal.

Because I had worked for Kinnabar for seventeen years, I declared that history to the board and left the negotiation of financial terms to our chief executive. The agreement transferred thirteen of our twenty-one midwives to the public unit with their service recognised; four stayed with us and four chose to leave. Every woman already booked to deliver with us was offered continuity with her obstetrician, who gained admitting rights at the public hospital. Our last birth was on 30 June 2023.

We converted the maternity floor to a short-stay surgical unit and now perform 2,100 public elective procedures a year under a state contract. The hospital earned a surplus of A$1.4 million in 2024–25. The regional health service's maternity unit reported no increase in transfers or adverse outcomes in its first two years after the change, and our board now reviews every regional service line against its volume and clinical safety each year.

Looking back, the decision was right but the order was wrong. I would commission an independent clinical review and publish it to the town before the board decided, rather than after. People accepted the reasoning; they did not accept learning about it last.

Isolating sixteen sites after a supplier's account was misused

At 2.10 am on Saturday 17 August 2024 our security operations provider reported that a support account belonging to Orrisdale Health Software, the supplier of our theatre management system, had logged in from an unfamiliar location and was copying files from a server holding scanned admission forms. The account had legitimate access to every hospital.

Our chief information officer and the supplier proposed disabling that one account and monitoring for further activity, which would have kept every system running. I argued for disconnecting all sixteen sites from every external link, including pathology results, insurer claims, the supplier's own connections and remote access, until forensic investigators could tell us whether other accounts or tools had been planted. The chief executive agreed, and so did our audit and risk committee chair when I called her at half past four. Isolating everything meant running hospitals on paper.

For four days we did exactly that. Pathology results arrived by courier and fax, medication charts reverted to paper, and claims stopped. We postponed 1,060 elective procedures on the Monday and Tuesday, about a third of planned activity, and A$41 million of insurer claims were delayed by roughly three weeks. Some surgeons were furious, and several patients had operations moved twice.

The investigation found a second planted tool on a server the single-account block would not have touched. The intruder had copied scanned forms relating to 2,140 patients before isolation, but there was no encryption and no further access. We notified the OAIC and the affected patients under the Notifiable Data Breaches scheme, reported the intrusion to ASD's Australian Cyber Security Centre, and offered identity-protection support to every patient concerned.

Supplier access now runs through brokered, recorded sessions approved for each task. Each hospital rehearses a paper downtime every quarter, and our contracts require suppliers to report suspected compromise within an hour.

I would do one thing differently. Our downtime procedures had been written for a single hospital losing its own systems, not for all sixteen at once. Pharmacy dispensing was the weakest link on the first night, and I should have tested a group-wide outage long before we needed one.