LinkedIn post he put out on Friday last week which everyone should have a read of<\/a>, about what he thinks he sees:<\/p>\n\u201cI \u2026 have absolutely no doubt I\u2019m actively breaking all the T+Cs of the PMS software I\u2019m using,\u201d he says.<\/p>\n
Kelly\u2019s position: the terms didn\u2019t contemplate us<\/p>\n
Dr Thomas Kelly, Heidi\u2019s co-founder and CEO, does not dispute the substance of what the RPA agents are doing.<\/p>\n
When asked directly about the T&C problem in an interview with Health Services Daily earlier today, his response was measured but clear:<\/p>\n
\u201cI think the original way that they were drafted their Ts and Cs probably didn\u2019t quite contemplate tools like this.\u201d<\/p>\n
His argument is essentially that the terms were written before agentic AI existed as a category, that Heidi\u2019s RPA is not classic screen scraping in the way those terms envisioned, and that the agent operates under the GP\u2019s own authenticated login \u2013 using the practice\u2019s own access to the practice\u2019s own patient data.<\/p>\n
\u201cWe\u2019re literally this week sharing an open MCP standard,\u201d Dr Kelly added.<\/p>\n
\u201cAnyone can connect with the system. Our preference is not to do computers [RPA automation of the GP computer to get access]. Of course it\u2019s faster to do a direct connection.\u201d<\/p>\n
The argument has some legal texture.<\/p>\n
Best Practice\u2019s terms, for instance, use language around \u201cyou\u201d that could arguably extend to an agent or contractor acting on the GP\u2019s behalf.<\/p>\n
But legal sources with knowledge of the agreements say this reading is a stretch, particularly given MediRecords\u2019 and MedicalDirector\u2019s explicit prohibitions on automated tools.<\/p>\n
The fact that Heidi operates under the doctor\u2019s login does not resolve the question according to those sources. In fact, it may actually compound it, given the fiduciary and clinical governance obligations attached to that login.<\/p>\n
Painted into a corner<\/p>\n
Everybody in this story has a problem now \u2013 the PMS vendors whose terms Heidi is breaching, the practice managers and their GPs, who might be breaching terms and exposing the practice to anything that goes wrong from here on in, and, unsurprisingly, Heidi itself.<\/p>\n
I\u2019m not entirely sure though that Heidi isn\u2019t aware of what it\u2019s done. It\u2019s literally driving a fully loaded fuel tanker into a smouldering fire.<\/p>\n
The PMS vendors know, with absolute certainty, that their doctors want what Heidi is offering. A pre-charted day. Agents drafting referrals while the next patient walks in. Evidence retrieval grounded in full journal text.<\/p>\n
The productivity upside is not marginal, it is transformational for a GP running 30-plus consults a day.<\/p>\n
If the PMS vendors had built this, their customers would be ecstatic.<\/p>\n
Note: we will talk about price tomorrow in Robot Doctor, because the amount of compute to do all this stuff is huge and may even be preventative in the end.<\/p>\n
The incumbent PMS vendors don\u2019t seem even close to this functionality, even Best Practice with its tight Lyrebird integration (more on that tomorrow too).<\/p>\n
Building a modern agentic AI layer on top of a clinical record system is not a feature addition. It is a fundamental reorientation of what the product is.<\/p>\n
The compliance overhead alone \u2013 conformance with Services Australia, TGA obligations for anything that touches clinical decision-making, state and federal data governance \u2013 is crushing.<\/p>\n
Dr Kelly himself noted that adding a single prostate cancer registry module to Heidi\u2019s earlier telehealth product would have taken six months of conformance work. Multiply that by the scope of a full PMS.<\/p>\n
Here\u2019s the trap the PMS vendors have unwittingly built for themselves.<\/p>\n
If the vendors enforce their terms and move to block Heidi\u2019s RPA access \u2013 technically, through rate limiting, login detection or legal action \u2013 they will be doing something that looks, from the outside, exactly like the information blocking that has made Epic and Oracle so loathed by clinicians globally.<\/p>\n
They will be denying their own customers access to tools and functionality those customers demonstrably want, for reasons that are commercial more than anything else.<\/p>\n
No doubt they will say there are important issues of safety, legality, compliance and so on. But it\u2019s about the money, not about the GP user experience at this point.<\/p>\n
The alternative for them, notwithstanding, is pretty bad.<\/p>\n
If they integrate \u2013 give Heidi the direct MCP access it is publicly requesting, with full read and write \u2013 they accelerate the process by which Heidi becomes the primary interface for the doctor and they become the expensive-to-maintain, heavily regulated database sitting underneath it.<\/p>\n
The compliance costs don\u2019t go away. The customer relationship does.<\/p>\n
Dr Kelly is frank about the endgame:<\/p>\n
\u201cWe can be the Heidi inside of a MediRecords or Best Practice or whoever.\u201d<\/p>\n
But he does say that Heidi can\u2019t just roll over the top of PMS vendors who own the customer now. There will need to be an appropriate commercial deal, he suggests.<\/p>\n
Just what that deal would be however is anyone\u2019s guess because no one has any understanding at all of the compute costs of agentic AI at this scale in the hands of a GP.<\/p>\n
It\u2019s messy. It\u2019s disruption writ large, something that the healthcare sector has largely been immune to through all the phases of digital disruption.<\/p>\n
Dr Kelly, you sense, is all about disruption \u2026 for all sorts of reasons, commercial and in the interests the profession.<\/p>\n
What happens next<\/p>\n
Best Practice was asked for comment today and politely declined (well, not all that politely, but we get it).<\/p>\n
None of PMS vendors are in a comfortable position. Best Practice is probably the least comfortable followed by Magentus and Genie.<\/p>\n
What feels clear is that Heidi has done something strategically deliberate here.<\/p>\n
Releasing RPA agents publicly \u2013 to all clinician-tier subscribers, without waiting for regulatory or vendor sign-off \u2013 isn\u2019t an accident. It is a test of market appetite designed to create facts on the ground before anyone can respond.<\/p>\n
Dr Kelly acknowledged as much:<\/p>\n
\u201cPart of this release is pushing the bleeding edge. I know that. I think it\u2019s partly to show that there\u2019s appetite.\u201d<\/p>\n
Show who?<\/p>\n
The Australian government has not yet contacted Heidi about Heidi II, despite the agents now operating live inside practice management systems across the country, navigating patient records under clinician logins, in an environment still raw from the Open AI\/Medicare hack. \u00a0<\/p>\n
Okay, it\u2019s only a week. But an \u201cAI week\u201d, is equivalent to months in the old tech development world, or, if you have waited a week to respond, you are sitting on your backside either perplexed or stuffing around.<\/p>\n
The legal exposure sits primarily with the GP practices running Heidi II against their PMS.<\/p>\n
The regulatory questions \u2013 what the TGA makes of autonomous agents operating within clinical software, what the OAIC makes of the data flows \u2013 aren\u2019t clarified by anyone other than Heidi itself.<\/p>\n
Dr Kelly unsurprisingly says it\u2019s all okay \u2013 they do nothing that makes them technically a medical device. They don\u2019t, but that\u2019s not the issue here. The issue now is just how well tested and safe these little agent critters running around inside our GP software actually are.<\/p>\n
I guess we\u2019ll all find out soon enough.<\/p>\n
The vendors whose terms are being breached (we think) are left choosing between two versions of the same bad outcome.<\/p>\n
In that sense, Heidi has done to Australian health software what Uber did to the taxi industry: not asked for permission, created demand at scale, and waited to see if the market and the regulators would follow.<\/p>\n
In transport, that worked (not for the taxi industry of course). In medicine, with patient records, we\u2019re in a different universe.<\/p>\n
Tomorrow, TMR\u2019s Robot Doctor will be running a special issue just on Heidi II. If you liked this story you might want to tune in to that issue (Robot Doctor is a different type of newsletter than TMR and Health Services Daily). To give you a taste of what we will be writing about here are the headings for the stories tomorrow:<\/p>\n
Heidi II agents escape, crash GP\u2019s new Chinese EV<\/p>\n
What is Thomas Kelly and his merry band really thinking here?<\/p>\n
Heidi II puts Best Practice in a difficult place<\/p>\n
Heidi II and the local non EMR hospital market<\/p>\n
Heidi II and the local EMR hospital market<\/p>\n","protected":false},"excerpt":{"rendered":"When an AI agent takes over a GP’s screen, navigates through their practice management system and extracts patient…\n","protected":false},"author":2,"featured_media":919300,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[256,64,63,11910,137,500,122663,1721,281643,105],"class_list":["post-919299","post","type-post","status-publish","format-standard","has-post-thumbnail","category-healthcare","tag-ai","tag-au","tag-australia","tag-general-practice","tag-health","tag-healthcare","tag-heidi","tag-opinion","tag-software-vendors","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/919299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=919299"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/919299\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/919300"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=919299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=919299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=919299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}