Healthcare 2.0 — The Concept
The companion to Healthcare's Infrastructure Problem. The manifesto is the argument; this is the system. There is also an interactive walkthrough of everything described here.
1. The problem, stated structurally
Healthcare's defining failure is architectural. The clinical encounter is the unit around which almost every health system, record and software product is built: a consult here, a prescription there, a pharmacy visit somewhere else, each captured in its own system, each starting from near zero. The patient moves through the system, but the system does not move with the patient. The information almost always exists; it just doesn't flow. And so the patient carries the continuity themselves: repeating their history, ferrying results, reconciling advice, precisely when they are least equipped to carry anything.
This is not a failure of effort or of digitisation. Two decades of "digital health" have produced genuinely better interfaces on top of the same episodic foundation. The fragmentation is structural: a consequence of building healthcare as a collection of episode-specific databases, then attempting to reassemble continuity afterwards through integration projects. Every interoperability programme is an apology for the original data model.
Healthcare 2.0 names the alternative: care built on infrastructure where the patient is the unit, not the episode, where history carries forward by default because it was never split, and where the system, not the patient, carries the continuity.
2. The shift in one sentence
From a system the patient must open, navigate and push, to one that quietly reads where they are and brings the next step to them. Push becomes pull. The filing cabinet becomes attention.
3. The architecture: three layers
Healthcare 2.0 is built bottom-up, in three layers. Most of the industry ships only the top one.
The foundation: a longitudinal record held for the patient. One continuous record per person: consults, prescriptions, dispensing events, results, and the daily lived data from journals and wearables, accumulating across years and across providers, with the episode as a view over it rather than the unit of storage. It is portable by design. The patient can see it, share it with granular consent, and take all of it elsewhere. It persists beyond any single clinical relationship. This layer is unglamorous, and it is the strategic one: the layer that carries the patient is the one almost nobody owns.
The intelligence: preparation, never decision. A layer that reads the record continuously and decides what matters: learning the person's baseline, surfacing the anomaly, drafting the recommendation, translating the clinical plan into language the patient can act on. Its job is not to decide. Its job is to protect the scarce resource in clinical care, which is the clinician's attention, and to spend it only on the calls that genuinely need a human. The governing rule is fixed: the system prepares, the clinician validates.
The surface: an interface that disappears. For the patient, the end state is calm. Most days the system says nothing, and the silence is the product working. When it speaks, it says one true, clinician-validated thing at the moment it matters, and then gets out of the way. No dashboards, no streaks, no engagement mechanics. For the clinician, the surface is a triaged queue of decisions rather than a feed of data. The measure of maturity for the whole architecture is not adoption but disappearance.
4. What it feels like — the patient
A woman in her late twenties, three years into managing a chronic hormonal condition. The system has been quietly collecting the whole time: her cycle data, her sleep, her labs, the one-line journal entries that cost her a minute. Most mornings, nothing. One morning, her phone lights once: "Your sleep dipped this week, and your cycle's been steady three months. Nothing urgent." One line of provenance shows why she is seeing it and which clinician reviewed the pattern. Between consults, her plan adjusts. "Your clinician reviewed your trend and adjusted your plan. No appointment needed." The change is explained, attributed and logged. When she starts with a new specialist, a consent screen shows exactly what will be shared, and the new clinician opens to her history rather than to a blank intake form. She is known without being surveilled. Looked after without being sold to.
5. What it feels like — the clinician
The patient's calm is manufactured on the other side of the system. The clinician opens to an honest ledger: 3 need you · 41 handled and logged. The forty-one safe items, routine renewals within protocol, stable trends, completed steps, have been processed under hard rules and recorded, shown collapsed, for awareness. The three that rise are decisions: a proposed taper with its reasoning in one line and the evidence one tap away; a pattern worth a check-in message; and, pinned and visually distinct, a safety flag that cannot be bulk-dismissed and will not clear without a human. Each decision offers three verdicts: approve, adjust, or bring them in. When a visit is genuinely needed, it arrives prepared, with summary, history and reason already assembled, so the scarce consult is spent on judgment and connection rather than on catching up. Every action is signed, logged and auditable.
The loop this produces is measurable. In the working prototype's reference scenario, a patient logs nausea against her iron supplement at 7:40 one morning. By 8:05 the system has drafted the evidence-backed switch to alternate-day dosing, with her own words, her results and her adherence in the snapshot. Her clinician reviews and signs at 1:11pm; she is notified the same minute, with the reason attached and the superseded item preserved in her record rather than deleted. Five and a half hours, one clinician action, zero appointments.
The clinician's day stops being a sequence of mandatory appointments and becomes a stream of fast, confident, reversible decisions, with the appointment reserved for what actually needs one.
6. The constitution: trust by architecture
Trust in this system is not a promise; it is a set of structural properties a skeptic can inspect.
The clinician is always in the loop. Permanently, not as a transitional safeguard to be removed when the models improve. What improves over time is not whether a human decides, but how well the system spends human attention.
Safety is deterministic. The judgment of "safe enough to proceed" is made by a hard, rule-based layer that runs independently of the AI and never asks a model to assess its own output. Certain lines never cross without a human. The constitution is written once; the intelligence gets smarter underneath it forever. And when the rail fires, the system stays honest with the person it is protecting. A critical result holds the patient's view behind a plain message rather than an empty screen, and the message says exactly what is happening: "You are not waiting on us to decide whether to tell you. You are waiting about an hour so that you hear it from a person."
Commerce is walled off from the clinical decision. Where the care model includes products, the wall is scoped honestly: most of a catalogue is ordinary retail and needs no wall, but wherever a clinician's recommendation implies a product, the clinical layer records therapeutic intent — never the item, never the price. And the wall is enforced, not promised. In the working system, the ratio is counted on the screen itself: most of what a well-built integrative plan recommends (sleep, movement, referrals, lifestyle change) earns the operator nothing, and that ratio is measured live because it is precisely the thing that erodes first, one reasonable product decision at a time. The purchase affordance lives in a separate container that the clinical-rationale renderer structurally cannot reach, and automated tests assert that isolation on every build. "We'll keep them separate" is not a guarantee; it is an intention. The tests make it a property.
Everything is attributed and audited. Every item in a care plan carries its author, role and date. Every automated action carries what prepared it, what it was based on, who approved it and when, written to an immutable log. The patient-facing version of this is warmth ("reviewed by your clinician"); the professional-facing version is a complete, inspectable chain.
7. The hard questions, answered directly
A concept earns credibility by how it handles its best objections. Six come up immediately, and they deserve direct answers.
"Isn't this just the national health record with a better interface?" No, and the distinction is structural. Australia's national record, like its equivalents elsewhere, is a document repository: episodic summaries, uploaded by providers, exchanged between institutions. It is necessary infrastructure, and this model connects to it through the standard interfaces rather than competing with it. But a repository of documents is not a longitudinal model of a person. It does not learn a baseline, carry a care plan as live structured data, ingest daily lived signals, or coordinate multiple practitioners around one current picture. The national record is where summaries of care go; this is where care actually runs. The two are complementary by design: the platform speaks the national standards at its boundary and contributes upward, while the living record, the one that powers continuous care, runs underneath.
"What does 'patient-owned' actually mean, legally?" Said precisely: it is an architectural commitment, not a claim about legal title. In most jurisdictions, including Australia, clinical records are legally held by the provider, with patients holding access rights. Healthcare 2.0 does not pretend otherwise. What it commits to is the full practical substance of ownership, built into the system: the patient sees everything; consent to share is granular, explicit and revocable; the complete record is exportable in usable form at any time; and the record persists for the patient beyond the end of any clinical relationship. Where the law treats the operator as custodian, the architecture treats the patient as principal. If portability rights strengthen, and the regulatory direction is toward them, this design is already conformant. The plain version: she holds the keys. She can take all of it and leave, and the system was built so she could.
"Does 'the consult becomes the exception' survive regulation and funding?" It has to be built as a deliberate transition, and the claim should be made honestly. Today's clinical economics and funding models assume the consult is scarce and mandatory; asynchronous review, message-based care and between-visit adjustments sit unevenly across billing frameworks, and professional standards rightly expect defined review intervals for many treatments. The model respects both realities. The deterministic safety layer encodes the review intervals and escalation rules that standards require, so continuous care raises the floor of oversight rather than lowering it: between formal reviews, the system watches, where today nobody does. And the economic shift is named as a design input rather than discovered as a side effect. The operating model, workforce tiers and pricing are planned with clinical and financial leadership for a world where attention replaces appointments as the unit of care. The bet is that regulation follows demonstrated safety, and the architecture is built to demonstrate it: every automated action logged, every boundary auditable.
"An always-collecting record is a surveillance risk." The critique is serious and the answer must be structural, in the same register as the commerce wall. First, data minimisation with provenance: the system collects what serves the patient's care, shows her why anything is being surfaced, and keeps the inputs inspectable. Second, the record serves exactly one master. It is never sold, never used for advertising, and commercial logic is architecturally blind to it. Third, consent is the perimeter: sharing is opt-in, granular, previewable ("here is exactly what they'll see") and revocable, with safe defaults set to less. Fourth, the design acknowledges what no operator can promise away: breaches and legal compulsion exist in every system that holds health data. The mitigations are the honest ones: minimum retention of raw streams, de-identification at the analytical layer, encryption, and the patient's standing ability to export and delete. A system that monitors without returning value to the person monitored fails on its own terms; the first build of this thesis, a national-scale elderly-monitoring programme, taught that lesson at five hundred homes. The felt experience must be care, not watching. The structure must back the feeling.
"A record is only a passport if someone else accepts it." True, and the cold-start problem is what has killed most patient-held record attempts. The design answers it in stages rather than pretending it away. First, the record must be worth holding at zero external acceptance: it powers the patient's own continuous care from day one, so its value never depends on another provider reading it. Second, acceptance starts inside a federation: a second specialist clinic on the same base layer opens already knowing the patient, with consent, so cross-provider continuity is demonstrated within one ecosystem before it is asked of strangers. Third, the bridge outward is patient-mediated and standards-based: the export is usable by any clinician, and the platform speaks the national standards at its boundary, so external acceptance grows with the standards rather than waiting on bilateral integrations. In Australia, this posture is no longer merely pragmatic; it is structural. Programmatic access to the dominant incumbent clinical systems now runs through a single paid, vendor-approved gateway: direct integration is a permissioned commercial product, not an open door. Anything a new provider needs from the incumbent layer arrives by secure message, or the patient carries it. The patient-mediated record is not the fallback path. It is the path. The honest position: universal acceptance is a decade-scale outcome, and the architecture is built to be valuable at every point before it.
"Will clinicians, and their indemnity insurers, accept this?" This may be the real adoption constraint, ahead of regulation, and it deserves to be named. One automated miss costs more trust than a thousand good decisions earn, and the people carrying that asymmetry are clinicians and the insurers behind them. Their questions are concrete: what am I signing, what is my exposure when the system prepared the work, and what happens when something is missed between visits. The architecture is designed to make those answers better than the status quo, not merely tolerable. Every automated action runs under deterministic protocols that clinical leadership authored and can inspect. Nothing reaches a patient without either a hard rule or a named clinician's sign-off, and approval is informed, fast and reversible rather than a rubber stamp. The chain of who prepared what, on what basis, approved by whom, and when is immutable and complete — which is more defensibility than the current standard of care offers, where between-visit deterioration is invisible and undocumented. The claim to defend in front of an insurer is not "the model is accurate." It is: the system's worst day is better documented than the old system's best day, and the floor of oversight between visits is higher, because today that floor does not exist. Engaging professional bodies and indemnity insurers early, with the audit trail as the exhibit, is part of the build plan rather than an afterthought.
8. Why the operators build it
The data layer of health is being built by giants: device makers, cloud platforms, consumer-health companies. They are good at it, and it is commoditising. What they structurally avoid is the regulated middle — the care relationship itself, with its clinical accountability, its prescribing and dispensing loops, its professional standards. That is the layer where continuity is actually won or lost, and it can only be built by people inside it: teams who operate the clinics their infrastructure serves, who see where the workflow breaks at 4pm on a Friday, and who can change clinical logic at the speed the clinic needs. The strategy is not to compete with the data layer but to sit on top of it and consume it. The care layer is the defensible one, because it has to be lived in to be built.
9. How it gets built: concept versus construction
The end state described here is roughly five years out, and the worst response to a vision this size is to build it directly. The discipline has three parts.
Build a concept to align. A vivid, concrete depiction of the end state: cheap, disposable, high-leverage for getting a team and its leadership to see the same future. This paper is part of that artifact set.
Build the primitives to progress. A small number of components are simultaneously useful today and load-bearing for the end state: the patient-journey state machine as a first-class primitive; the federated longitudinal data model, where every contribution from every practitioner carries author, modality and intent; the immutable audit trail; the conflict-and-coordination engine that keeps multi-practitioner care safe; the consent and identity layer that makes the record portable without breaking privacy; and the consult-as-exception workflow that lets safe things proceed and routes contested ones to a human. Each earns its keep within twelve months and survives to year five. Nothing is throwaway.
Route around the dependency you don't control. Universal interoperability arrives slowly. The answer is not to wait. Start with patient-mediated import and the data the platform already owns, deliver real value from that alone, and let standards-based connections plug in as they mature, translating to the national standards at the edge and never rebuilding the internal model around them.
10. What this is deliberately not
Not a dashboard: no grids of metrics as a home screen, for patient or clinician. Not gamified: missed days are met with grace, and streaks never become pressure. Not noisy: no notification feed; the system earns the right to interrupt by almost never doing it. Not a store: commerce never appears inside a clinical moment. Not surveillant: collection is felt as care, with provenance and control one tap away. Not chatbot-first: the default is one surfaced, validated thing, not a blank prompt. Not a rubber stamp: approval is fast but never automatic, and safety cannot be one-tapped away. Not a black box: every call is explainable and auditable on tap. Not asymmetric against the patient: everything she can see, her clinician can see, and the reverse does not hold — the system's only asymmetry, held deliberately. Not engagement in disguise: a patient who has drifted is a prompt shown to her care team, never a nudge dressed as care shown to her.
11. The proof posture
This concept is not written from a whiteboard. It is being built: a multi-brand clinical platform operating in Australia, carrying prescribing, dispensing, patient records and multiple care pathways on shared infrastructure, with national clinical-identity foundations in place and conformance work for the national record underway. The measurements that motivated the design are real. In a sample of 113 referrals received by the clinics, the field naming the tests required was completed in ten. That is what free-text clinical communication looks like at the working end, and it is why this architecture captures structured data at the source: a value that arrives as prose cannot be flagged, queried, or trended, and structure cannot be applied retrospectively to records that were captured without it. Its first clinical instance, a women's-health clinic delivering integrative, multi-practitioner care, ships the unified care plan as the first visible surface of the longitudinal record this year, with the data, identity and intelligence layers sequenced behind it. The evidence so far behaves the way the thesis predicts. When dispensing data began flowing directly into the patient record, closing a loop that is broken across most of healthcare, the clinical team's reaction was silence: doctors saw what the pharmacy actually dispensed and simply moved on. Months of integration work, producing a moment no one registered. That is what the care layer feels like when it works.
12. The destination
The goal is not a better app, a better clinic, or even a better record. It is a system that understands where a person is — across the whole of their health, not the slice of it captured in the last appointment — and meets them there. Silently, continuously, built to last. When it works, nobody will write case studies about the interface, because there will be almost nothing visible left to describe. Care will simply happen. That is what infrastructure looks like when it is finished.
See it, not just read it: the interactive walkthrough. And the argument underneath it all: Healthcare's Infrastructure Problem — the manifesto.