Cancellation Fill safety and consent

Who this page is for: practice owners, privacy officers and staff reviewing whether a cancellation-list workflow fits the practice’s policies.

This page explains Refera’s product controls. It is not legal advice. A practice remains responsible for its collection notices, consent process, communication channel and booking decisions.

Activation posture: real-patient use is default-off until fresh privacy, legal and practice-operational sign-off for Cancellation Fill is recorded. Existing approval for the referral-capture workflow does not silently approve this separate patient-communication use.

The external guidance behind the controls

The OAIC’s communications with patients guidance explains that health-service communication depends on purpose, patient expectations and the context in which information was collected. It describes consent as informed, voluntary, current and specific, and notes that express consent may be withdrawn.

The OAIC Guide to Health Privacy v2 describes health information as sensitive and emphasises careful handling to preserve trust. The ACMA spam guidance distinguishes messages that are solely factual or provide a service from commercial messages, but classification depends on the actual content and purpose. Practices should obtain advice for their own use.

Refera takes a stricter product posture than relying on a broad assumption of consent.

Explicit evidence for earlier appointments

The Earlier appointment lane requires:

• an already-booked or in-scheduling administrative status;
• a specific opt-in to earlier-appointment offers;
• evidence time and method: written, phone, in person or practice portal;
• a stated availability window;
• a contact basis and contact route; and
• a withdrawal path.

The signed-in staff identity is recorded by the server. A CSV remains a preview until staff confirm each valid row. Uploading a file never enrols anyone.

Separate readiness evidence for initial booking

Ready to book does not claim a cancellation-list opt-in. Instead, named staff must record that the practice decided an unbooked referral was ready for ordinary scheduling contact. Refera does not make that decision. It also records whether the contact came from the referral or was separately verified by the practice.

The two lanes remain separate because their evidence and purpose are different.

Generic message content

Cancellation Fill drafts appointment facts only: a time, practice location and response instruction. The draft contains no diagnosis, referral reason, specialty detail, quoted urgency or clinical content. It tells the recipient that the appointment is not reserved until the practice confirms it.

No automatic transport

Approving a draft changes its content state only. It does not mark a patient contacted. Staff copy the approved text, use the practice’s normal SMS, email or phone system, then choose Mark offered as a separate attestation. The current feature does not claim a live patient-messaging transport.

One opening can have only one active offer. The next record stays locked until staff record a decline, skip or expiry. Acceptance still does not count as a booking. Staff must book in the practice system and separately mark the opening filled. This order is enforced on the server as well as shown in the interface: a request to draft for rank two or later is refused.

No clinical selection

The Inbox remains strictly arrival-ordered. Ready to book preserves referral arrival order. Earlier appointment uses the person’s stated available-from time, then arrival evidence as the tie-breaker. No diagnosis, urgency, acuity, severity or clinical priority enters either ordering function.

Minimum display and notification exposure

The workspace projects only the patient display name needed to recognise an eligible row, alongside the administrative participation and contact evidence authorised staff need for the workflow. It does not copy the patient’s date of birth, Medicare number, address, referral narrative, diagnosis or urgency into the Cancellation Fill response.

Browser push remains generic and count-only; it must not contain a patient, referral, appointment time, contact destination or message text. Openings at risk of going unfilled are highlighted in the authenticated app and link directly to the active-opening filter. Cancellation Fill does not claim an opening-alert worker, and that link does not send a patient or staff notification.

Audit and reporting boundary

Drafted, approved, marked-offered, accepted and marked-filled are separate events. Only the last event counts the opening as filled. Estimated session value sums practice-entered values on filled slots only and is always labelled an estimate, never recovered revenue.

Practice checklist

Before use, confirm the practice has:

1. updated its collection notice and internal procedure;
2. decided which staff roles may record readiness, opt-in and withdrawal;
3. chosen the permitted SMS, email or phone route;
4. approved the generic message wording;
5. trained staff that approval is not sending and acceptance is not booking; and
6. tested withdrawal, expiry and stale-tab refusal with patient-free records.