Medtech granted preservation order against Valentia Technologies (NZ) in copyright litigation
The High Court has granted Medtech Limited a preservation order against Valentia Technologies (NZ) Limited, allowing an investigation to be undertaken into allegations of copyright infringement, data breaches and threats to patient safety in the health sector.
The order, applied for by Medtech Limited, requires Valentia Technologies to preserve all source code, databases and content relating to the software it uses to manage and extract data from patients’ medical records.
Patient Management Systems
Medtech and Valentia develop Patient Management Systems (PMS): software that stores and manages patient information held by medical practices. Valentia’s PMS is called Indici. The records include personal information such as medical conditions, discharge summaries, immunisations, medication, allergies, test results and medical notes that doctors and practice nurses record when patients visit.
The preservation order requires Valentia to preserve a ‘snapshot’ of its software to allow investigation of whether the code and database structure of Indici infringe Medtech’s intellectual property rights.
Valentia extracts Medtech’s proprietary material
At the heart of the matter is a Valentia software utility called SEHR (Shared Electronic Health Record). SEHR is authorised by some Primary Health Organisations (PHOs) and District Health Boards (DHBs) to extract selected categories of data from patient records in the PMS (using a “SEHR Hook” query function) and feed it into a central database, so it can be used when caring for patients across practices. Organisations able to access data through SEHR include afterhours medical centres, general practices, community pharmacies, paramedics, emergency departments and other hospital departments. Data portability is important in the health system, as is the way it is managed. Medtech is concerned that Valentia’s SEHR Hook operates unlawfully.
Medtech’s allegations
Medtech claims that Valentia overreaches its authority in extracting data and has used the SEHR Hook to extract more patient information than it is entitled to. The way in which data is handled may also create further privacy risks to patient data in the event of a data breach.
Medtech alleges that, through the SEHR Hook, Valentia is also able to access information in the Medtech PMS that is either confidential or subject to copyright. Medtech claims that by taking more information than is required Valentia has also been able to copy Medtech’s data sets, database structures, codes and other proprietary material.
Finally, Medtech is concerned that Valentia is incorrectly transferring data records, creating a potential safety risk for patients, specifically in relation to historical medication and allergy records.
Previous litigation
This is not the first time that Medtech has taken Court action against Valentia. A similar preservation order was granted in 2018.
2023 PwC Report validates Medtech’s concerns
Independent experts at PwC in December 2023, confirmed Medtech’s concerns about Valentia’s conduct, including that:
- Valentia is extracting more data than is necessary for the SEHR central database.
- Valentia is using Medtech’s ETL ‘extract, transform and load’ code, breaching third-party intellectual property rights.
- There is an abnormally high level of correlation between the database schemas of Medtech PMS and Indici.
- Valentia is incorrectly transferring Medtech proprietary medication codes, resulting in incorrect drug references in the transferred data. This presents a safety risk to patients.
Evidence of breaches
In granting the preservation order, the High Court acknowledged the following:
- The evidence suggests that Valentia has not complied with public statements it made about addressing known issues with its product.
- There is prima facie evidence of breaches of Medtech’s intellectual property.
- There is prima facie evidence of a breach of settlement undertakings given by Valentia in 2018.
- PwC, as an independent expert, has verified Medtech’s concerns.
- Given Valentia’s conduct and the uncertainty of the location of the data, there is risk of deletion or alteration of the software.
Medtech is committed to ensuring that patient data is collected, stored, managed, transferred and used safely and appropriately. It is also committed to ensuring that its intellectual property is respected, as is the intellectual property of other third parties involved in managing patient data. Medtech is concerned that Valentia’s actions breach Medtech’s intellectual property rights and put patient data and safety at risk and so has commenced this litigation, obtaining the preservation orders detailed above.