OSCAR Open Source Electronic Medical Record Demonstration

The BC OSCAR User Group invites you to come and hear about Free / Open Source software and how physicians and midwives are driving the OSCAR (Open Source Clinical Application Resource) Electronic Medical Record in BC. There will be a presentation by Dr David Chan, from McMaster University, OSCAR’s founder, and the OSCAR user community in BC. OSCAR users will demonstrate the EMR including use with voice recognition software, tools for maternity and newborn care, leading chronic disease management tools, prescribing tools, billing and much more!

OSCAR is an open-source (free), Canadian EMR, developed by a collaborative community of programmers and users. Users pay no licensing costs and have the freedom to choose from a range of support companies. There are over a thousand OSCAR users and over a million patients on the system nationally, and it has won several prestigious awards for IT innovation. It’s ease of use, excellence in programming, high level of functionality, and low costs for ongoing support and implementation, are part of why OSCAR is experiencing rapid growth.

For more information visit http://www.oscarcanada.org/

Where:
Paetzold Auditorium VGH,
Jim Patterson Pavilion on the 1st floor
(Parking is available at 2775 Laurel St, between 11th and 12th)

When:
Monday, April 19, 2010 – 6:30 pm to 9:00pm

Cost:
Free


RSVP :
http://tinyurl.com/ydyfebe

Upcoming OSCAR Users Event - Vancouver General Hospital, Apr. 19-20, 2010

You are invided to the next BC OSCAR User Group Meeting: Monday April 19th and Tuesday April 20, 2010. The event will be held at in Vancouver at the Paetzold Auditorium at Vancouver General Hospital.

The agenda for the BC OSCAR user group meeting is available here and includes many interactive sessions for learning more about OSCAR and sharing experiences with other OSCAR users.

Please register to reserve your space.

Government As A Platform

The folks at O'Reilly have been talking a lot lately about the massive effort currently underway in the US to modernize the Heath IT infrastructure.

A number of posts are of particular interest to those people trying to figure out how to pull information together from so many different systems.

First, Tim O'Reilly discusses the emerging trend towards "government as a platform", that is, the government taking the role of defining what needs to be shared and what needs to be connected, but not actually getting involved with the specific implementation or hosting of the systems. O'Reilly uses the example of the Office of the National Coordinator, to illustrate:

There is also substantial funding for Blumenthal's office, the Office of the National Coordinator, or ONC. (This office was created by the Bush administration, but didn't receive substantial funding prior to the Recovery Act.) But rather than building a massive, centralized system for electronic health records, ONC's goal is to define the rules of the road for interchange of patient records. In internet-style, the expectation is that common protocols and file formats will allow vendors to compete on a level playing field to build the actual applications. But they aren't just writing paper standards; they are creating building blocks that actually implement those standards. (The internet analogy would be software like Bind, which implements the DNS protocol, and the root domain name servers, which for many years were funded by the US government.)

Also worth reading is Andy Oram's May 3rd report on the HIMSS Heath IT conference. Andy talks about the technology of openness and interoperability in a land of highly mobile people:

The U.S. has a mobile population, bringing their aches and pains to a plethora of institutions and small providers. That's why health care needs interoperability. Furthermore, despite superb medical research, we desperately need to share more information and crunch it in creative new ways. That's why health care needs openness.

 Oram covers what technology has been done and how it is fairing, and what still needs to be addressed and how different organizations are approaching the challenges. Of particular interest is the section on open source health projects such as Vista, OpenMRS, and CONNECT:

CONNECT is championed by the same Office of the National Coordinator for Health Information Technology that is implementing the HITECH recovery plan and meaningful use. A means for authenticating requests and sending patient data between providers, CONNECT may well be emerging as the HIE solution for our age. But it has some maturing to do as well. It uses a SOAP-based protocol that requires knowledge of typical SOA-based technologies such as SAML.

Two free software companies that have entered the field to make installing CONNECT easier are Axial Exchange, which creates open source libraries and tools to work with the system, and the Mirth Corporation. Jon Teichrow of Mirth told me how a typical CONNECT setup at a rural hospital took just a week to complete, and can run for the cost of just a couple hours of support time per week. The complexities of handling CONNECT that make so many people tremulous, he said, were actually much easier for Mirth than the more typical problem of interpreting the hospital's idiosyncratic data formats.

Just last week, the government announced a simpler interface to the NHIN called NHIN Direct. Hopefully, this will bring in a new level of providers who couldn't afford the costs of negotiating with CONNECT.

CONNECT has certainly built up an active community. One participant, who is responsible for a good deal of the testing of CONNECT, tells me that participation in development, testing, and online discussion is intense, and that two people were recently approved as committers without being associated with any company or government agency officially affiliated with CONNECT.

There is a lot to information to digest in these two posts from O'Reilly, but well worth the time.

Privacy and Regulation

Jennifer Stoddart, the Privacy Commissioner of Canada, recently gave a must-read speech on "The Future of Privacy Regulation" at the 11th Annual Privacy and Security Conference.

Very well stated is the daunting task that is facing regulators worldwide:

Of the many challenges we face, none is more dramatic than the impact of technology.

First and foremost, there is the sheer scope of the Internet, and the myriad ways in which we can now interact, shop, learn, and pretty much live online.

There’s also the staggering growth of computer capacity, which allows massive amounts of personal information to be collected, manipulated and shared.

Much of the content swirling through this Web 2.0 world is also generated by individuals, which poses new challenges for regulators.

From a privacy perspective, one consequence of these developments is that personal information can live on in cyberspace, pretty much in perpetuity. And so a typical data breach may no longer affect just a handful of people, but potentially hundreds of thousands of them.

Another consequence is that our lives have become open books. Even if we don’t advertise our whereabouts on Google Latitude, surveillance cameras and GPS-enabled cellphones are able to capture our movements.

Even if we don’t broadcast our latest purchases on Blippy.com, our online browsing habits are being quietly monitored and mined for their value to merchants and marketers.

And concepts of consumer knowledge – never mind consent – are become increasingly strained.

Of particular interest in the medical field is the simple assertion "[...] a typical data breach may no longer affect just a handful of people, but potentially hundreds of thousands of them."

If the risk of a data breach in a large centralized system is measured in hundreds of thousands, if not millions of confidential records, then one must ask, is the risk worth it?

One can not compare the lost of your famous "secret chicken recipe" due to a privacy breach on Facebook, to the damage associated with the lost of your most confidential information, which is currently known only by yourself and your healthcare provider.

When your medical records are located in the local office of a health professional, the risk of a data breach is similar whether a practitioner manages your records on paper or within the confines of a secure EMR platform.

However, it is clear now that any time a massive store of interesting data is centralized into a single location, is is much like painting concentric circles in bright red paint on the side of your web address. 

The risk to your specific privacy and, as a healthcare provider, the privacy of your patients is greatly affected by where your information is stored.

The OSCAR iPad Experience

Apple has just announced it's new iPad tablet and the technology community is reacting fast to this upcoming platform.

The Apple iPad via Apple

Windows based tablet devices have been around for ages, and now a new generation of devices are being reinvigorated from beneath the shadow of the Apple announcement.

HP Tablet via Gizmodo

The most promising of the new batch of iPad competitors are following a similar architectural strategy as Apple. Numerous vendors are showing tablet prototypes based on Google's Android mobile phone operating system.

Archos Android based tablet via Dance with Shadows

Furthermore, software houses are quickly moving to show that their wares will be compatible with the iPad. One very interesting announcement has come from Citrix, which has shown Windows 7 running via Citrix on top of the new iPad software simulator.

The Citrix Blog via Gizmodo

Of course it is too early to tell how well Windows or any other application will run on the iPad, as the devices just don't exist and outside of a few folks at Apple, very few people have actually had an opportunity to put one through its paces.

The iPad's operating system is based on the iPhone and it runs the same Safari browser as the iPhone. The iPad though, has a 9.7" screen which is capable of running at 1024 x 768 pixel resolution. (Only a few short years ago, this was the standard screen resolution of all computer monitors.)

To get a sense of what an image of that size looks like compared to your current monitor, click on and expand the below image which is a picture of the OSCAR Schedule, set to the 1024 x 768 dimensions. Now, from corner to corner, squish or stretch the image until you measure 9.7" and you'll have a rough sense of what size the iPad is, and what an unmodified version of OSCAR would feel like, running via the iPad Safari browser.

1024 x 768 pixel resolution image of the OSCAR Schedule (click to enlarge)

Many in the health care industry are very excited about the potential of using the iPad for not just unmodified access to existing applications, but also with purpose built, tablet centric tools.

We've long noted that doctors don't have technology adoption problems (as demonstrated by the wide use of iPhones and Blackberrys within the medical community), just issues with the value proposition of the existing medical IT technologies (as demonstrated by the weak market adoption rates in North America of the current batch of EMR/EHR platforms).

When it comes to health care, technology such as the iPad definitely seems, at least at this early stage, to have the potential to excite medical practitioners in a way that will deliver transformative change to the way one runs ones practice.

We don't have long to wait to see if this new technology will actually work.

In June, the first batch of OSCAR users will be firing up their freshly delivered iPads and pointing it at their OSCAR servers.

Minutes afterwards, the OSCAR iPad Experience will be christened.

iPhone EMR Apps

There is a very interesting post on the 3G Doctor blog which gives a quick look at the user interfaces of a wide range of fledgling iPhone EMR applications.

I'm impressed at the sheer number of the applications that have been purpose built for the iPhone. Definitely a space to watch.

Updated OntarioMD Funding Terms and Conditions

OntarioMD has updated the terms and conditions for New EMR Adopters, now allowing unaffiliated solo and duo practitioners funded access to OntarioMD Certified Local EMR Products such as OSCAR.

The new T's&C's, dated Jan. 5, 2010, now offer new choices for implementation:

1) a certified ASP EMR solution and use it as per ASP EMR Vendor’s and OntarioMD’s best practices, including: 

  [...]

OR,

2) a certified Local EMR solution hosted at a Participating Physician’s office and either:

2a) Join and maintain membership in and participate fully in the Vendor Collaborative Network (“VCN”) for the chosen Local EMR, and as per the VCN’s and OntarioMD’s best practices, including:

  [...]

2b) Sign OntarioMD’s EMR System Management Independent Undertaking, which includes undertaking the following as per industry and OntarioMD best practices: 

  [...] 

These changes to the OMD EMR funding program terms and conditions reflect a positive enhancement for many solo/duo practitioners across Ontario.

Of OSCAR, iPhones And iSlates

This is what OSCAR looks like when running on an iPhone.

I've used my iPhone a number of times to access OSCAR in a pinch, when I needed access to the EMR but was nowhere near a regular computer, or a regular internet.

In a pinch, OSCAR works fine on the iPhone, or any other one of these new breed of smart-phones-with-a-proper-web-browser-and-a-relatively-decent-mobile-internet-connection.

However, a pocket sized handheld computer is not a device for everyday EMR usage.

As we enter a new decade, a new class of device is being brought to market by a number of vendors. This device, a notepad sized smart phone-like device called a tablet, will soon be everywhere.

Although numerous devices are already available for purchase today, the most anticipated of these machines is an unannounced product from Apple, thought to be called the "iSlate" or "iTablet".

(image: Gizmodo)

The form factor of this new class of machine offers a similar experience to that of a smart phone, but with a larger and more spacious screen, much like a sheet of paper.

This type of computer has the potential to be particularly suited to the healthcare industry, and may end up being the specific catalyst which drives EMR adoptions throughout North America.

Welcome to 2010

Our very best wishes for a healthy and prosperous New Year.

Getting Started With OSCAR - What You Need

To get your practice up and running with OSCAR, You will need to consider and source the following products and services.

1. OSCAR servers – The typical clinic will deploy two redundant and resilient OSCAR servers in the office and, optionally, a third server at an offsite location for automated offsite backup. Your practice is a real time environment and you can not afford to have your EMR halt whilst humans continue to show up in your lobby every few minutes. Server redundancy and a robust backup strategy is a good thing.
2. OSCAR support – You will need an annual support contract to ensure that your practice continues to run smoothly. This support is just as critically important as having a robust server backup strategy. You should ensure that your annual support includes telephone and email support, annual software updates and 24/7 emergency coverage.  
3. OSCAR training – Both practitioners and staff will require specialized training to enable them to efficiently and correctly use OSCAR. You should plan for a minimum of staff training consisting of 2 x 3 hr sessions to cover basic functionality and 2 x 3 hr sessions to cover basic billing. Practitioner training commonly consists of 2 x 3 hr sessions to cover basic usage. Both practitioners and staff may elect to receive additional advanced level training. 
4. OSCAR installation – Considering the risks associated with having a poorly installed EMR sitting exposed on an unsecured network, you should consider professional installation and configuration. You should ensure that you are comfortable and confident in your environment's security before entering any sensitive medical information into your EMR.
5. OSCAR data conversion – Most established clinics move their demographic information into OSCAR. Some clinics will additionally move their billing histories, their appointments and schedule histories, and/or their electronic patient charts. Conversion continues to be "more art than science", and so it is important to understand what you will convert and what it will look like when it arrives on the new system. 

Depending on what infrastructure you currently have, there are additional items that you may need to purchase beyond the EMR that are not included above. These items may include additional user workstations, laser printers, documentation scanners, magnetic card readers and an uninterruptable power supply. In addition, your office will very likely need to be connected to the Internet, and additional phone lines may be required for billing and labs access.

What To Expect When You Are Expecting

When starting down the EMR path, there are a number of things that you need to consider.

Technology has the ability to improve the way you practice and interact with your patients. Technology also has the ability to degrade your practice and your patient interaction. There are no one-size-fits-all models that works for everyone.

Implemented well, you will become very happy with your new EMR and the ways that it aids in your patient care. However, with a poorly implemented EMR, you will soon pine for the "good old days", except they will never come back.

It is important to start with an open mind, a willingness to continue to adapt your strategy until you find what works best for you and your patients, and a similar willingness to abandon strongly held convictions on how things should be done, when clearly they are not working.

When adopting an EMR, join your user community and learn from those that came before you. Talk with practitioners that are using other EMR products too, as they may be able to give you insights to how different systems perform similar tasks.

Ask "why?". Ask "how?". Keep asking until you are comfortable with the answers.

Be skeptical. Don't believe what your vendor tells you just because they sound convincing. Don't believe what the government is telling you just because they too sound convincing. Ask critical questions. Apply critical thought. If it doesn't make sense, keep asking questions until it does. Check your facts and get references.

Engineers love to use Three Letter Acronyms (TLAs) just to confuse you. If you don't know what a WPA2-AES is, or why you would be a fool to move forward without using it, then ask. The same is true for hundreds of exotic sounding terms and TLAs associated with your new software. If your support team can't or won't explain plainly and simply the technology, then get a new support team.

You use technology everyday. Your mobile phone - lots of technology there. The cash machine in front of your bank - never read that user manual. Watching Star Trek parodies on YouTube - brought to you by 100 million lines of complex software. Everyday you are immersed in astounding complexity, however you've learned to live with it, to turn the utterly magical into the simply benign.

An EMR is an incredibly complex piece of industrial infrastructure. This complexity is why Health Canada and other national regulators have identified EMRs as Class II Medical Devices. These systems have come a long way from being just a replacement to your weekly shipment of paper.

After deploying an EMR in your practice you and your staff will go through a complex transformation from the old world to the new world. Many of your colleagues have already made the transition and many more are about to embark on the same journey as you.

You will be successful in modernizing your clinic if you take your time, move methodically, and remember to breathe.

Breathe, and continue to ask "why?".

A Billion Dollars Here, A Billion Pounds There

Canada isn't the only jurisdiction wrestling with billion dollar e-health boondoggles as it turns out.

Only 175 people using flagship NHS software, says minister

Lorenzo care records system is likely to be costing taxpayer hundreds of thousands of pounds per user per year

Recent news from the UK has identified that very few people are actually using one of the only two systems being brought in by the government to manage patient information.

There are only 174 clinicians using Lorenzo patient software across the five early adopter trusts, according to Mike O'Brien, minister for the National Programme for IT (NPfIT).

Five Boroughs Partnership, Bradford Teaching Hospitals NHS Foundation Trust, University Hospitals of Morecambe Bay, Hereford Hospitals and South Birmingham have only ever had 19 clinicians using the systems at the same time.

Lorenzo is one of two software packages being used to set up centralised electronic health records as part of the £12.7bn National Programme for IT. This part of the programme is already running four years late.

Lorenzo is being supplied by services company CSC to trusts in the north of England and by its developer iSoft directly to trusts in the south after Fujitsu was fired from the programme.

The other patient software package is Cerner Millennium, being supplied by BT in London and a handful of trusts in the south.

The information came from a parliamentary question tabled by Richard Bacon MP.

Last week in the Commons he said:

"I tabled a question yesterday about the number of hospital trusts where Lorenzo has been partially deployed, asking how many users — how many concurrent users — of Lorenzo there are.

"It is literally just a handful, which means that the cost per user is not what one would expect… the cost is going to be many hundreds of thousands — possibly even more than a million — pounds per user per year."

£1,000,000 per user, per year. (That's about $1.75 million dollars in Canada. Per user, per year.)

I guess they haven't heard of OSCAR.

Saving Healthcare From Demographic Demise

Harvard has posted a total package of information from the 2009 HIT Platform meeting.

We discussed this meeting in a prior post, and if you want a quick summary, this is a good place to start.

There are two major components of information available on Harvard's ITdotHealth website:

1.       the detailed meeting summary

http://www.itdothealth.org/wp-content/themes/atahualpa/images/header/HMS-HIT-Platform-final-v110909.pdf

2.       and presentation videos and photos

 http://www.itdothealth.org/multimedia/2009-hit-platform/#videos

If you only have time and space in your mind for one thing from this conference, please spend it on the keynote presentation from Clayton Christensen. In his keynote, he clearly articulates in very simple terms how healthcare will need to change in order to avoid complete financial disaster in the future.

Of Standards and Certifications

Much discussion is going on in the web-o-sphere these days about Health Canada's recent decision regarding the classification of EMR products as a Class II Medical Device.

Working within the regulatory frameworks of various jurisdictions are a normal way of life for many software applications, and OSCAR continues to meet and exceed these regulations on a regular basis.

Because of OSCAR's unique role in numerous social communities and academic organizations, the platform has always been at the forefront of technology, capability, privacy, and regulation.

In many cases, OSCAR leads the industry in terms of practice management. For example, OSCAR's efforts concerning security and privacy enhancing technology, especially as it pertains to delivering control and consent to clients over their own medical information, continuously shines as an example for others to follow.

It is no surprise then, that the OSCAR community continues to invest to achieve all relevant certifications for all jurisdictions that the software is deployed.

The 68% Solution

The issue of data portability is the single largest future problem that we need to address today if we have any hope of saving ourselves from our self imposed enslavement to our EMR platforms.

It is without doubt that our governments understands this.

The creation of the OntarioMD CMS v3.0 specification specifically ensures that compliant solutions will have to provide both import and export functions for a core patient data set.

In concept, this sounds very powerful. With the current standard, you are able to export and import data from any certified vendor EMR into any other certified EMR solution.

Unfortunately, this standard does not protect the doctor from EMR lock in. Unfortunately, this standard only perpetuates the problem.

It doesn't matter if today you have the most super-amazing-incredibly-awesome EMR ever invented. Are you willing to wager that your EMR will always be the very best? Forever? Forever and ever?!?

If you are not careful you will potentially chain yourself to your EMR for the rest of your life!

By defining a standard based on the concept of a finite core data set, one guarantees that valuable information will never be able to be moved from one system to another. Stated another way, by the very definition of the data set, by the identification of a finite set of important information, the government has ensured that anything not in this data set will not be abled to be moved.

By standardizing a core data set, we are making a bet on what information will be important to future medical applications. Who can predict what will be important in the future? We can guess, extrapolate, hypothesis, but we can not be sure.

The core data set is a 68% solution.

The future of your practice and the health of your patients may depend on information captured in the other 32%.

We do not live in the world of finite solutions, finite concepts, finite applications, or finite innovation. We live in a world of constant innovation, of constant refinement to what we deem important.

To make matters worse, day by day, the data pie keeps growing. The core data set, over time, will become less and less relevant. Unfortunately, this is guaranteed by the very definition put in place to protect us.

We applaud efforts to ensure data portability, however we encourage our government to go all-in: require all vendors to guarantee that 100% of the data you enter into you EMR is able to be extracted whenever you feel like doing it.

(While you are doing this, please legislate that software bombs must not be included in medical software systems -- their inclusion is morally reprehensible and those vendors that use them should be ashamed of themselves.)

100% data portability is an easy standard to define. It is future proof. Once implemented, it never has to be revisited.

If all vendors are required to make available all data at all times under all circumstances, you will be able to move to new technologies in the future, to new applications that haven't even been dreamed up yet, to new applications that will transform the way you will live, work, and practice medicine.

Today, we don't need to know what the applications will be. Today, we know with absolute certainty that they will come. We don't know what data sets these fantastic new tools will require. How could anyone know this? These brilliant new tools haven't been invented yet.

But there is one thing we do know. We know that high tech innovates on an every increasing cycle. The current technology world reinvents itself every 3 years or so.

For example, Twitter was founded in 2006. Who in 2003 could have predicted that in 2009, electoral fraud in Iran would be exposed and a revolution catalyzed by a technology that would be invented three years hence.

In 2003, no one could predict that a transformative social network, Facebook, would be founded in 2004. How could they, in 2003, people were busy trying to figure out how to integrate the modern Blackberry (first released in 2002) into their lives. In 2003, these first Blackberry users had no idea that the incredible technology that just changed their lives would be obsoleted by YouTube (founded 2005) watching iPhone users in 2007.

Now, are you absolutely sure that the EMR you implement in your office today, tomorrow, or next week will allow you to move to the next wave of technology? Are you willing to bet the health of your patients on that?

If you can only access 68% of your data, your prognosis is not encouraging.

If you deploy OSCAR in your office, your future is bright.

2009 Award of Excellence

Congratulations to Dr. Peter Hutten-Czapski, Dr. David Price, Dr. Elizabeth Shaw, each from Ontario, and Dr. Cameron Ross, from British Columbia are in order.

These four OSCAR users are recipients of the 2009 Award of Excellence by the College of Family Physicians of Canada.

Award recipients have either performed extraordinary patient care, service to the community, humanitarian work, or service to the profession that is beyond the normal practice for family doctor.

The complete list of the 2009 Award of Excellence recipients can be found here.

Dr. David Chan at the Ontario GNU Linux Fest

Dr. David Chan will be presenting OSCAR at the Ontario GNU Linux Fest this Saturday, Oct. 24th, in Toronto.

Ontario GNU Linux Fest is the lead-off event for Toronto Open Source Week as Proclaimed by Toronto Mayor David Miller.

We hope to see you there.

E-Health and Privacy: The Right Model of Patient Information Sharing?

Canadian Bar Association Privacy Sub-Section Talk – April 15, 2009
Excerpts of Presentation by Micheal Vonn

. . . Policy being driven by technology,
and privacy seen receding in the rear-view mirror,
this is clearly the central privacy challenge of our time.

Although the study of health information systems is now its own sub-discipline in the academy, there is no public awareness of this issue, let alone public discussion. Patients, citizens, the public have been no part of these developments and are practically barred from even venturing an opinion because of a complete failure on the part of the government to provide any meaningful information at all.

Where we would hope for comprehensive, balanced information, when we have received what amounts to advertising slogans from the PR department: Viagra will save your marriage, iPods will make you groovy, and e-Health will make you safer, cheaper.

Where, exactly would the average citizen look for a foothold to enter such a non-debate?

The presentation is so relentlessly one-sided that there is essentially – and irresponsibly - no discussion of the profound risks beyond the mandatory endorsement that systems will, of course, be “privacy protective” and “secure”.

The very troubling lack of public awareness on these issues has driven a small, informal coalition of privacy-concerned organizations to try to fill the informational void on e-Health. And I’d like to share some examples of what we think it is critical for the public to understand about the profound transformation in health care that is underway through e-Health.

First, let’s get specific about what we’re talking about. “e-Health”, writ large, is a vast field and includes all kinds of technologies that are of undisputed benefit with no privacy concerns. Technology, for example, that allows specialist surgeons to remotely direct and guide surgeries being undertaken in far-off locations. Just to be clear, there is no Luddite Conspiracy trying to derail such fantastic uses of technology.

Nor are we concerned with electronic health care records per se. If my doctor records my data electronically and that data is stored on a server in her office, there is not very much of a difference between that and paper files locked in a filing cabinet. She is the guardian and custodian of that information in the same way. We have no problem with that, naturally.

The concern is centralization: vast repositories; massive, longitudinal databases of citizens’ health information, envisioned, as you know, to ultimately be accessible across the entire country.

I have looked everywhere I can think to look and waited in vain for any government, or indeed, anyone to provide compelling evidence that a vast centralization of citizens’ health data improves health care outcomes and/or saves money.

There appears to be almost no evidence to support the very elaborate promised benefits of this system.

This is a very serious point, and yet, I admit it often takes a comic turn. Like when minutes before her keynote address at a recent e-Health conference, a BC government official changed the name of her talk from “Evidence-based Innovation” to “Leveraging the Investment”. Or the researcher at another e-Health conference who I credit with inventing the term “soft but compelling evidence”; which is rather like saying “vague but definitive”. . .

As Ross Anderson, Professor of Security Engineering at Cambridge, wrote in the Feb 2008 edition of “The Economist”:

Patient data held at a GP practice may be vulnerable to security lapse on the premise, but the damage will be limited. You can have security, or functionality, or scale – you can even have any two of these. But you can’t have all three, and the government will eventually be forced to admit this. In the meantime, billions of pounds are being wasted on gigantic systems projects that usually don’t work and that place citizens’ privacy and safety at risk when they do.

Britain, in fact, has had to stop even pretending that it can safeguard patient data faced with tens of millions of records lost or compromised and just recently, the Prime Minister’s own medical data illegally accessed and given to the media. The Telegraph reports that civil servants in the UK are fired or disciplined for privacy breaches at a rate of about one per day.

All the credible, independent security experts that I am aware of say that a massive concentration of electronic health information imperils the privacy of that data. The “Honeypot Problem” was discussed recently in an article in the Guardian:

This is the recurrent problem with large databases that contain valuable data. Because they are so valuable, they attract malevolent attention of large numbers of hackers, fraudsters, criminals, even terrorists. Under sustained attack, even such sophisticated organizations as Microsoft and the Pentagon have succumbed…

… As well as the honey pot problem, there is another difficulty that applies to these vast government databases. To do their job, these databases have to be accessible to many people…. they can only work if they have thousands of access points. If the government cannot protect one laptop or one flash drive, what chance a system with over ten thousand terminals?

All of which, I suggest, is obvious.

So, let me conclude my prepared remarks by saying this. Contrary to the reports that consensus favours the development of centralized electronic health records, I quote from the Rowntree Report:

There is a developing consensus among medical practitioners that for safety, privacy and system engineering reasons, we need to go back from the shared-record model, to the traditional model of provider-specific records plus a messaging framework that will enable data to be passed from one provider to another when it is appropriate.

In other words, the system needs to be an architecture in which data is pushed from one health care provider to another. Not pulled from every health care provider into a massive database.

We are not building the right model of patient information sharing.

An eHealth Plan For $20M

Christina Blizzard of The Toronto Sun writes:

There is a strong argument that government is the wrong culture to build such IT projects. In the private sector, it's often start-ups, or companies with a bottom line to satisfy that come up with the innovation and know-how to develop these programs efficiently.

On Global's Focus Ontario last week, McCarter pointed out the project has been nine years in the works, $1 billion down the drain -- and precious little to show for it. (You can catch the show at midnight tonight or at globaltoronto.com.) McCarter said it will be a "challenge" for this province to make the 2015 deadline for getting health records on line. This province is lagging embarrassingly behind all other provinces on this.

Perhaps the government should turn to one of its own universities for help.

McMaster University announced last week that it has developed a, "comprehensive, secure, web-based and open source electronic health records system which is ready to be rolled out across Canada."

[...]

The system, called OSCAR, was developed by Dr. David Chan, an associate professor with McMaster's department of family medicine.

In a press release, Dr. David Price, chair of that department, said that 8,000 family physicians in this province who are not using electronic medical records could be on-line within the next 24 months.

The cost? $20 million. Compare that to the $1 billion the government piddled down the eHealth drain.

Well said.

The Media Starts to Figure it Out - Will the Government Soon Follow?

From Anna Paperny of the Globe and Mail

Efforts by governments in Ontario and British Columbia to drag their provinces' medical records into the 21st century haven't gone well: Both provinces are embroiled in eHealth scandals that have turned the endeavour into a political poison pill.

But the doctors behind two made-in-Canada electronic record systems designed years ago and adopted around the world insist it doesn't have to be this hard.

OSCAR, an open-source software pioneered by McMaster University's school of medicine, is being used by hundreds of doctors from Prince Edward Island to British Columbia, and many more from outside the country.

It puts patients' information on secure servers that are based in a doctor's office but can be accessed online from just about anywhere by logging on the same way one would to an online bank account. A separate sister system, MyOSCAR, lets patients access their own records online.

Clearly the discussion coming from the eHealth scandal is creating a conversation on what we want as a society, and whether or not we should allow the powers at be to decide what is right for us.

It is time for us to start thinking about this issue.

Who owns your medical information? Who do you want to maintain the stewardship of this, the most personal of your personal information? Would you like it to be kept, as it is today, in the private offices of your family doctor, or do you prefer that this information is keep in a large government run registry?

The security community is pretty clear on how it feels about governments maintaining large databases of their population's personal information ("1984" anyone?), but this isn't a decision that should be made by the security community.

Currently, you own your own personal information. Most people currently trust their family doctor to maintain their medical information on their behalf. Would you like this to change? It is your choice on how this story ends.