Primary Sense has been built and maintained as a highly-secure application for Primary Health Networks (PHNs) to safely extract, analyse and report on general practice data and to provide General Practices with clinical decision support, practice quality improvement and population health management tools.

Application Ownership and Governance

Primary Sense is owned by Participating PHNs as tenants-in-common through an unincorporated joint venture (UJV), and is operated by the WA Primary Health Alliance (WAPHA) as Lead PHN under a Primary Sense Project Agreement.

PHNs are Not for Profit organisations registered with the Australian Charities and Not-for-profits Commission (ACNC), and are funded by the Commonwealth Department of Health and Aged Care under the Primary Health Networks Grant Program (see here for more information).

Under the requirements of the Grant Program, the UJV and the Project Agreement, Primary Sense is not a commercial activity. Access is only available to PHNs that are party to the Project Agreement, who in turn provide the application to health care providers at no cost under a Data Sharing and License Agreement.

Primary Sense is governed by a national Steering Committee, which also functions as the Management Committee of the UJV, with Members elected from among the Participating PHNs, and includes the Chair of the Clinical Advisory Group.

Primary Sense has been authorised by the Australian Competition and Consumer Commission (refer to Authorisation AA1000577 for more information). 

Data Ownership and Governance

The Primary Sense Data Governance Framework is defined in both the Primary Sense Services Agreement between each Participating PHN and WAPHA as Lead PHN (see here for more information), and in the Data Sharing Agreement between each General Practice using Primary Sense and their Participating PHN.

General Practices remain the Data Owner / Data Custodian of any data extracted from their practice, and Primary Sense allows them to enforce any withdrawal of patient consent. PHNs become the Data Owner / Data Custodian of any new data created by Primary Sense as a result of data analysis or processing.

WAPHA, as Lead PHN, is the Data Steward for all extracted general practice data while it is stored in the central processing core, and authorised application support staff have read-only access rights to that data for the purposes of maintaining and operating the application.

Data extracted from practices is sent from the central processing core only to the secure Primary Health Insights lockbox of the Participating PHN that has a Data Sharing Agreement with that practice (see primaryhealthinsights.org.au for more information). No PHN has any access to, or data governance rights over, any data stored in the lockbox of any other PHN.

The Data Sharing Agreement between a Participating PHN and a General Practice clearly defines Permitted Primary and Secondary Purposes for extracted data, as well as Excluded Purposes. Under this Agreement, PHNs are prohibited from using, or allowing to be used, extracted data for any commercial purpose or gain, or for any performance benchmarking or financial audit undertaken by any Government or funding organisation without the express consent of the General Practice on each occasion.

Clinical Oversight and Governance

Primary Sense operates under the clinical oversight of a national Clinical Advisory Group (CAG), which includes as Members general practitioners (GPs), clinical specialists, health research academics and representatives of industry peak bodies such as the Royal Australian College of General Practitioners (RACGP) and the Australian Association of Practice Management (AAPM).

The CAG reviews and approves all clinical algorithms, prompts, alerts and reports prior to release, provides expert advice to the Steering Committee on clinical and general practice business priorities, and is available to advise PHNs on the clinical and ethical appropriateness of any research requests.

Primary Sense has been notified to the Therapeutic Goods Administration (TGA) as an electronic clinical decision support system that is an exempt medical device under current Regulations. As such, Primary Sense is unable to be listed on the Australian Register of Therapeutic Goods (ARTG).

Patient and Practitioner Privacy

Primary Sense extracts only de-identified data about individuals from practices. No personally identifiable information, such as names, addresses or Medicare numbers about any patient or practitioner are extracted or removed from the practice’s own computer systems.

Primary Sense Desktop reads data from a practice’s clinical information system (CIS) software using read-only permissions in line with any guidelines provided by the CIS vendor. WAPHA is an approved Integration Partner with the vendor of any CIS with which Primary Sense is compatible, where the vendor has such a partnership program. All access to a practice’s CIS is explicitly set up and controlled by the practice, and no CIS vendor is liable or responsible for any such access or the result of any such access by Primary Sense.

General Practices can explicitly identify patients in their CIS that have withdrawn consent for their data to be used by a product like Primary Sense. No data about such patients is extracted by Primary Sense, and any data extracted prior to their consent being withdrawn is deleted from the central processing core.

WAPHA as Lead PHN operates Primary Sense, and each Participating PHN manages extracted practice data, in full accordance with the Commonwealth Privacy Act and the Australian Privacy Principles.

Technical Security

The Primary Sense central processing core is hosted on Primary Health Insights (PHI), a highly secure cloud-based data storage and analytics platform owned and operated by PHNs nationally (see here for the PHI Public Security Statement).

All data stored in PHI is protected by a next-generation firewall. All network traffic is encrypted to at least TLS 1.2 using at least 128-bit AES. Stored data is encrypted using 256-bit AES, with keys and credentials securely managed within Azure Key Vault. Advanced Threat Protection and similar services actively detect, identify and respond to unusual and potentially harmful attempts to access data or exploit services. All data is locked to physical locations within Australia using cross-zone geo-redundant storage.

Primary Sense Desktop code is scanned for vulnerabilities and quality prior to release, and communicates with the PHI-hosted core via secure API. The core is fully segmented by PHN in accordance with Data Sharing Agreements, with each Participating PHN having a separate API and database for general practices in their region. All communication between Primary Sense Desktop software installed at a practice and the core is authenticated using encrypted Practice ID / secret credential pairs.

Security Assessment and Compliance

An annual security review and penetration test of PHI is undertaken by an independent cyber security firm and since late 2022 these assessments have included those elements of Primary Sense hosted in PHI.

Penetration testing is done for both ‘black box’ (unauthenticated access attempts based on limited system knowledge) to simulate external hacking and ‘grey box’ (authenticated access with full system knowledge attempting to gain elevated or prohibited privileges) to simulate potential internal threats.

No viable avenue for gaining unauthorised access to any part of PHI has ever been identified in these tests. This includes access attempts via API, websites and CDN.

The security review includes architecture, configuration and operations as well as automated vulnerability and compliance scanning of all platform resources against industry standards such as ISO 27001, Azure CIS Foundations, CSA Cloud Controls Matrix, and NIST SP 800-53.

No critical technical vulnerabilities (which identify current security risks) have ever been reported as a result of these reviews or scans.

All lower-risk vulnerabilities (which identify potential future risks of varying degrees) reported are assessed and addressed quickly, with recommendations for improvements implemented by default if at all possible.

The most recent penetration test report for the financial year 2022-23, delivered by ES2 Pty Ltd, rated PHI as a low risk, compared to their average industry risk rating of medium-high.

Insurance

WAPHA as Lead PHN holds cyber insurance for Primary Sense with $5 million in coverage ($10 million in aggregate) in addition to cyber insurance held for the hosting PHI platform.

This Public Security Statement provides an overview only of Primary Sense security and should not be interpreted as a comprehensive description of security, privacy or governance controls in place to protect the application or data.