Privacy and Regulation

Jennifer Stoddart, the Privacy Commissioner of Canada, recently gave a must-read speech on "The Future of Privacy Regulation" at the 11th Annual Privacy and Security Conference.

Very well stated is the daunting task that is facing regulators worldwide:

Of the many challenges we face, none is more dramatic than the impact of technology.

First and foremost, there is the sheer scope of the Internet, and the myriad ways in which we can now interact, shop, learn, and pretty much live online.

There’s also the staggering growth of computer capacity, which allows massive amounts of personal information to be collected, manipulated and shared.

Much of the content swirling through this Web 2.0 world is also generated by individuals, which poses new challenges for regulators.

From a privacy perspective, one consequence of these developments is that personal information can live on in cyberspace, pretty much in perpetuity. And so a typical data breach may no longer affect just a handful of people, but potentially hundreds of thousands of them.

Another consequence is that our lives have become open books. Even if we don’t advertise our whereabouts on Google Latitude, surveillance cameras and GPS-enabled cellphones are able to capture our movements.

Even if we don’t broadcast our latest purchases on Blippy.com, our online browsing habits are being quietly monitored and mined for their value to merchants and marketers.

And concepts of consumer knowledge – never mind consent – are become increasingly strained.

Of particular interest in the medical field is the simple assertion "[...] a typical data breach may no longer affect just a handful of people, but potentially hundreds of thousands of them."

If the risk of a data breach in a large centralized system is measured in hundreds of thousands, if not millions of confidential records, then one must ask, is the risk worth it?

One can not compare the lost of your famous "secret chicken recipe" due to a privacy breach on Facebook, to the damage associated with the lost of your most confidential information, which is currently known only by yourself and your healthcare provider.

When your medical records are located in the local office of a health professional, the risk of a data breach is similar whether a practitioner manages your records on paper or within the confines of a secure EMR platform.

However, it is clear now that any time a massive store of interesting data is centralized into a single location, is is much like painting concentric circles in bright red paint on the side of your web address. 

The risk to your specific privacy and, as a healthcare provider, the privacy of your patients is greatly affected by where your information is stored.

The OSCAR iPad Experience

Apple has just announced it's new iPad tablet and the technology community is reacting fast to this upcoming platform.

The Apple iPad via Apple

Windows based tablet devices have been around for ages, and now a new generation of devices are being reinvigorated from beneath the shadow of the Apple announcement.

HP Tablet via Gizmodo

The most promising of the new batch of iPad competitors are following a similar architectural strategy as Apple. Numerous vendors are showing tablet prototypes based on Google's Android mobile phone operating system.

Archos Android based tablet via Dance with Shadows

Furthermore, software houses are quickly moving to show that their wares will be compatible with the iPad. One very interesting announcement has come from Citrix, which has shown Windows 7 running via Citrix on top of the new iPad software simulator.

The Citrix Blog via Gizmodo

Of course it is too early to tell how well Windows or any other application will run on the iPad, as the devices just don't exist and outside of a few folks at Apple, very few people have actually had an opportunity to put one through its paces.

The iPad's operating system is based on the iPhone and it runs the same Safari browser as the iPhone. The iPad though, has a 9.7" screen which is capable of running at 1024 x 768 pixel resolution. (Only a few short years ago, this was the standard screen resolution of all computer monitors.)

To get a sense of what an image of that size looks like compared to your current monitor, click on and expand the below image which is a picture of the OSCAR Schedule, set to the 1024 x 768 dimensions. Now, from corner to corner, squish or stretch the image until you measure 9.7" and you'll have a rough sense of what size the iPad is, and what an unmodified version of OSCAR would feel like, running via the iPad Safari browser.

1024 x 768 pixel resolution image of the OSCAR Schedule (click to enlarge)

Many in the health care industry are very excited about the potential of using the iPad for not just unmodified access to existing applications, but also with purpose built, tablet centric tools.

We've long noted that doctors don't have technology adoption problems (as demonstrated by the wide use of iPhones and Blackberrys within the medical community), just issues with the value proposition of the existing medical IT technologies (as demonstrated by the weak market adoption rates in North America of the current batch of EMR/EHR platforms).

When it comes to health care, technology such as the iPad definitely seems, at least at this early stage, to have the potential to excite medical practitioners in a way that will deliver transformative change to the way one runs ones practice.

We don't have long to wait to see if this new technology will actually work.

In June, the first batch of OSCAR users will be firing up their freshly delivered iPads and pointing it at their OSCAR servers.

Minutes afterwards, the OSCAR iPad Experience will be christened.

iPhone EMR Apps

There is a very interesting post on the 3G Doctor blog which gives a quick look at the user interfaces of a wide range of fledgling iPhone EMR applications.

I'm impressed at the sheer number of the applications that have been purpose built for the iPhone. Definitely a space to watch.

Updated OntarioMD Funding Terms and Conditions

OntarioMD has updated the terms and conditions for New EMR Adopters, now allowing unaffiliated solo and duo practitioners funded access to OntarioMD Certified Local EMR Products such as OSCAR.

The new T's&C's, dated Jan. 5, 2010, now offer new choices for implementation:

1) a certified ASP EMR solution and use it as per ASP EMR Vendor’s and OntarioMD’s best practices, including: 

  [...]

OR,

2) a certified Local EMR solution hosted at a Participating Physician’s office and either:

2a) Join and maintain membership in and participate fully in the Vendor Collaborative Network (“VCN”) for the chosen Local EMR, and as per the VCN’s and OntarioMD’s best practices, including:

  [...]

2b) Sign OntarioMD’s EMR System Management Independent Undertaking, which includes undertaking the following as per industry and OntarioMD best practices: 

  [...] 

These changes to the OMD EMR funding program terms and conditions reflect a positive enhancement for many solo/duo practitioners across Ontario.

Of OSCAR, iPhones And iSlates

This is what OSCAR looks like when running on an iPhone.

I've used my iPhone a number of times to access OSCAR in a pinch, when I needed access to the EMR but was nowhere near a regular computer, or a regular internet.

In a pinch, OSCAR works fine on the iPhone, or any other one of these new breed of smart-phones-with-a-proper-web-browser-and-a-relatively-decent-mobile-internet-connection.

However, a pocket sized handheld computer is not a device for everyday EMR usage.

As we enter a new decade, a new class of device is being brought to market by a number of vendors. This device, a notepad sized smart phone-like device called a tablet, will soon be everywhere.

Although numerous devices are already available for purchase today, the most anticipated of these machines is an unannounced product from Apple, thought to be called the "iSlate" or "iTablet".

(image: Gizmodo)

The form factor of this new class of machine offers a similar experience to that of a smart phone, but with a larger and more spacious screen, much like a sheet of paper.

This type of computer has the potential to be particularly suited to the healthcare industry, and may end up being the specific catalyst which drives EMR adoptions throughout North America.

Welcome to 2010

Our very best wishes for a healthy and prosperous New Year.

Getting Started With OSCAR - What You Need

To get your practice up and running with OSCAR, You will need to consider and source the following products and services.

1. OSCAR servers – The typical clinic will deploy two redundant and resilient OSCAR servers in the office and, optionally, a third server at an offsite location for automated offsite backup. Your practice is a real time environment and you can not afford to have your EMR halt whilst humans continue to show up in your lobby every few minutes. Server redundancy and a robust backup strategy is a good thing.
2. OSCAR support – You will need an annual support contract to ensure that your practice continues to run smoothly. This support is just as critically important as having a robust server backup strategy. You should ensure that your annual support includes telephone and email support, annual software updates and 24/7 emergency coverage.  
3. OSCAR training – Both practitioners and staff will require specialized training to enable them to efficiently and correctly use OSCAR. You should plan for a minimum of staff training consisting of 2 x 3 hr sessions to cover basic functionality and 2 x 3 hr sessions to cover basic billing. Practitioner training commonly consists of 2 x 3 hr sessions to cover basic usage. Both practitioners and staff may elect to receive additional advanced level training. 
4. OSCAR installation – Considering the risks associated with having a poorly installed EMR sitting exposed on an unsecured network, you should consider professional installation and configuration. You should ensure that you are comfortable and confident in your environment's security before entering any sensitive medical information into your EMR.
5. OSCAR data conversion – Most established clinics move their demographic information into OSCAR. Some clinics will additionally move their billing histories, their appointments and schedule histories, and/or their electronic patient charts. Conversion continues to be "more art than science", and so it is important to understand what you will convert and what it will look like when it arrives on the new system. 

Depending on what infrastructure you currently have, there are additional items that you may need to purchase beyond the EMR that are not included above. These items may include additional user workstations, laser printers, documentation scanners, magnetic card readers and an uninterruptable power supply. In addition, your office will very likely need to be connected to the Internet, and additional phone lines may be required for billing and labs access.

What To Expect When You Are Expecting

When starting down the EMR path, there are a number of things that you need to consider.

Technology has the ability to improve the way you practice and interact with your patients. Technology also has the ability to degrade your practice and your patient interaction. There are no one-size-fits-all models that works for everyone.

Implemented well, you will become very happy with your new EMR and the ways that it aids in your patient care. However, with a poorly implemented EMR, you will soon pine for the "good old days", except they will never come back.

It is important to start with an open mind, a willingness to continue to adapt your strategy until you find what works best for you and your patients, and a similar willingness to abandon strongly held convictions on how things should be done, when clearly they are not working.

When adopting an EMR, join your user community and learn from those that came before you. Talk with practitioners that are using other EMR products too, as they may be able to give you insights to how different systems perform similar tasks.

Ask "why?". Ask "how?". Keep asking until you are comfortable with the answers.

Be skeptical. Don't believe what your vendor tells you just because they sound convincing. Don't believe what the government is telling you just because they too sound convincing. Ask critical questions. Apply critical thought. If it doesn't make sense, keep asking questions until it does. Check your facts and get references.

Engineers love to use Three Letter Acronyms (TLAs) just to confuse you. If you don't know what a WPA2-AES is, or why you would be a fool to move forward without using it, then ask. The same is true for hundreds of exotic sounding terms and TLAs associated with your new software. If your support team can't or won't explain plainly and simply the technology, then get a new support team.

You use technology everyday. Your mobile phone - lots of technology there. The cash machine in front of your bank - never read that user manual. Watching Star Trek parodies on YouTube - brought to you by 100 million lines of complex software. Everyday you are immersed in astounding complexity, however you've learned to live with it, to turn the utterly magical into the simply benign.

An EMR is an incredibly complex piece of industrial infrastructure. This complexity is why Health Canada and other national regulators have identified EMRs as Class II Medical Devices. These systems have come a long way from being just a replacement to your weekly shipment of paper.

After deploying an EMR in your practice you and your staff will go through a complex transformation from the old world to the new world. Many of your colleagues have already made the transition and many more are about to embark on the same journey as you.

You will be successful in modernizing your clinic if you take your time, move methodically, and remember to breathe.

Breathe, and continue to ask "why?".

A Billion Dollars Here, A Billion Pounds There

Canada isn't the only jurisdiction wrestling with billion dollar e-health boondoggles as it turns out.

Only 175 people using flagship NHS software, says minister

Lorenzo care records system is likely to be costing taxpayer hundreds of thousands of pounds per user per year

Recent news from the UK has identified that very few people are actually using one of the only two systems being brought in by the government to manage patient information.

There are only 174 clinicians using Lorenzo patient software across the five early adopter trusts, according to Mike O'Brien, minister for the National Programme for IT (NPfIT).

Five Boroughs Partnership, Bradford Teaching Hospitals NHS Foundation Trust, University Hospitals of Morecambe Bay, Hereford Hospitals and South Birmingham have only ever had 19 clinicians using the systems at the same time.

Lorenzo is one of two software packages being used to set up centralised electronic health records as part of the £12.7bn National Programme for IT. This part of the programme is already running four years late.

Lorenzo is being supplied by services company CSC to trusts in the north of England and by its developer iSoft directly to trusts in the south after Fujitsu was fired from the programme.

The other patient software package is Cerner Millennium, being supplied by BT in London and a handful of trusts in the south.

The information came from a parliamentary question tabled by Richard Bacon MP.

Last week in the Commons he said:

"I tabled a question yesterday about the number of hospital trusts where Lorenzo has been partially deployed, asking how many users — how many concurrent users — of Lorenzo there are.

"It is literally just a handful, which means that the cost per user is not what one would expect… the cost is going to be many hundreds of thousands — possibly even more than a million — pounds per user per year."

£1,000,000 per user, per year. (That's about $1.75 million dollars in Canada. Per user, per year.)

I guess they haven't heard of OSCAR.

Saving Healthcare From Demographic Demise

Harvard has posted a total package of information from the 2009 HIT Platform meeting.

We discussed this meeting in a prior post, and if you want a quick summary, this is a good place to start.

There are two major components of information available on Harvard's ITdotHealth website:

1.       the detailed meeting summary

http://www.itdothealth.org/wp-content/themes/atahualpa/images/header/HMS-HIT-Platform-final-v110909.pdf

2.       and presentation videos and photos

 http://www.itdothealth.org/multimedia/2009-hit-platform/#videos

If you only have time and space in your mind for one thing from this conference, please spend it on the keynote presentation from Clayton Christensen. In his keynote, he clearly articulates in very simple terms how healthcare will need to change in order to avoid complete financial disaster in the future.

Of Standards and Certifications

Much discussion is going on in the web-o-sphere these days about Health Canada's recent decision regarding the classification of EMR products as a Class II Medical Device.

Working within the regulatory frameworks of various jurisdictions are a normal way of life for many software applications, and OSCAR continues to meet and exceed these regulations on a regular basis.

Because of OSCAR's unique role in numerous social communities and academic organizations, the platform has always been at the forefront of technology, capability, privacy, and regulation.

In many cases, OSCAR leads the industry in terms of practice management. For example, OSCAR's efforts concerning security and privacy enhancing technology, especially as it pertains to delivering control and consent to clients over their own medical information, continuously shines as an example for others to follow.

It is no surprise then, that the OSCAR community continues to invest to achieve all relevant certifications for all jurisdictions that the software is deployed.

The 68% Solution

The issue of data portability is the single largest future problem that we need to address today if we have any hope of saving ourselves from our self imposed enslavement to our EMR platforms.

It is without doubt that our governments understands this.

The creation of the OntarioMD CMS v3.0 specification specifically ensures that compliant solutions will have to provide both import and export functions for a core patient data set.

In concept, this sounds very powerful. With the current standard, you are able to export and import data from any certified vendor EMR into any other certified EMR solution.

Unfortunately, this standard does not protect the doctor from EMR lock in. Unfortunately, this standard only perpetuates the problem.

It doesn't matter if today you have the most super-amazing-incredibly-awesome EMR ever invented. Are you willing to wager that your EMR will always be the very best? Forever? Forever and ever?!?

If you are not careful you will potentially chain yourself to your EMR for the rest of your life!

By defining a standard based on the concept of a finite core data set, one guarantees that valuable information will never be able to be moved from one system to another. Stated another way, by the very definition of the data set, by the identification of a finite set of important information, the government has ensured that anything not in this data set will not be abled to be moved.

By standardizing a core data set, we are making a bet on what information will be important to future medical applications. Who can predict what will be important in the future? We can guess, extrapolate, hypothesis, but we can not be sure.

The core data set is a 68% solution.

The future of your practice and the health of your patients may depend on information captured in the other 32%.

We do not live in the world of finite solutions, finite concepts, finite applications, or finite innovation. We live in a world of constant innovation, of constant refinement to what we deem important.

To make matters worse, day by day, the data pie keeps growing. The core data set, over time, will become less and less relevant. Unfortunately, this is guaranteed by the very definition put in place to protect us.

We applaud efforts to ensure data portability, however we encourage our government to go all-in: require all vendors to guarantee that 100% of the data you enter into you EMR is able to be extracted whenever you feel like doing it.

(While you are doing this, please legislate that software bombs must not be included in medical software systems -- their inclusion is morally reprehensible and those vendors that use them should be ashamed of themselves.)

100% data portability is an easy standard to define. It is future proof. Once implemented, it never has to be revisited.

If all vendors are required to make available all data at all times under all circumstances, you will be able to move to new technologies in the future, to new applications that haven't even been dreamed up yet, to new applications that will transform the way you will live, work, and practice medicine.

Today, we don't need to know what the applications will be. Today, we know with absolute certainty that they will come. We don't know what data sets these fantastic new tools will require. How could anyone know this? These brilliant new tools haven't been invented yet.

But there is one thing we do know. We know that high tech innovates on an every increasing cycle. The current technology world reinvents itself every 3 years or so.

For example, Twitter was founded in 2006. Who in 2003 could have predicted that in 2009, electoral fraud in Iran would be exposed and a revolution catalyzed by a technology that would be invented three years hence.

In 2003, no one could predict that a transformative social network, Facebook, would be founded in 2004. How could they, in 2003, people were busy trying to figure out how to integrate the modern Blackberry (first released in 2002) into their lives. In 2003, these first Blackberry users had no idea that the incredible technology that just changed their lives would be obsoleted by YouTube (founded 2005) watching iPhone users in 2007.

Now, are you absolutely sure that the EMR you implement in your office today, tomorrow, or next week will allow you to move to the next wave of technology? Are you willing to bet the health of your patients on that?

If you can only access 68% of your data, your prognosis is not encouraging.

If you deploy OSCAR in your office, your future is bright.

2009 Award of Excellence

Congratulations to Dr. Peter Hutten-Czapski, Dr. David Price, Dr. Elizabeth Shaw, each from Ontario, and Dr. Cameron Ross, from British Columbia are in order.

These four OSCAR users are recipients of the 2009 Award of Excellence by the College of Family Physicians of Canada.

Award recipients have either performed extraordinary patient care, service to the community, humanitarian work, or service to the profession that is beyond the normal practice for family doctor.

The complete list of the 2009 Award of Excellence recipients can be found here.

Dr. David Chan at the Ontario GNU Linux Fest

Dr. David Chan will be presenting OSCAR at the Ontario GNU Linux Fest this Saturday, Oct. 24th, in Toronto.

Ontario GNU Linux Fest is the lead-off event for Toronto Open Source Week as Proclaimed by Toronto Mayor David Miller.

We hope to see you there.

E-Health and Privacy: The Right Model of Patient Information Sharing?

Canadian Bar Association Privacy Sub-Section Talk – April 15, 2009
Excerpts of Presentation by Micheal Vonn

. . . Policy being driven by technology,
and privacy seen receding in the rear-view mirror,
this is clearly the central privacy challenge of our time.

Although the study of health information systems is now its own sub-discipline in the academy, there is no public awareness of this issue, let alone public discussion. Patients, citizens, the public have been no part of these developments and are practically barred from even venturing an opinion because of a complete failure on the part of the government to provide any meaningful information at all.

Where we would hope for comprehensive, balanced information, when we have received what amounts to advertising slogans from the PR department: Viagra will save your marriage, iPods will make you groovy, and e-Health will make you safer, cheaper.

Where, exactly would the average citizen look for a foothold to enter such a non-debate?

The presentation is so relentlessly one-sided that there is essentially – and irresponsibly - no discussion of the profound risks beyond the mandatory endorsement that systems will, of course, be “privacy protective” and “secure”.

The very troubling lack of public awareness on these issues has driven a small, informal coalition of privacy-concerned organizations to try to fill the informational void on e-Health. And I’d like to share some examples of what we think it is critical for the public to understand about the profound transformation in health care that is underway through e-Health.

First, let’s get specific about what we’re talking about. “e-Health”, writ large, is a vast field and includes all kinds of technologies that are of undisputed benefit with no privacy concerns. Technology, for example, that allows specialist surgeons to remotely direct and guide surgeries being undertaken in far-off locations. Just to be clear, there is no Luddite Conspiracy trying to derail such fantastic uses of technology.

Nor are we concerned with electronic health care records per se. If my doctor records my data electronically and that data is stored on a server in her office, there is not very much of a difference between that and paper files locked in a filing cabinet. She is the guardian and custodian of that information in the same way. We have no problem with that, naturally.

The concern is centralization: vast repositories; massive, longitudinal databases of citizens’ health information, envisioned, as you know, to ultimately be accessible across the entire country.

I have looked everywhere I can think to look and waited in vain for any government, or indeed, anyone to provide compelling evidence that a vast centralization of citizens’ health data improves health care outcomes and/or saves money.

There appears to be almost no evidence to support the very elaborate promised benefits of this system.

This is a very serious point, and yet, I admit it often takes a comic turn. Like when minutes before her keynote address at a recent e-Health conference, a BC government official changed the name of her talk from “Evidence-based Innovation” to “Leveraging the Investment”. Or the researcher at another e-Health conference who I credit with inventing the term “soft but compelling evidence”; which is rather like saying “vague but definitive”. . .

As Ross Anderson, Professor of Security Engineering at Cambridge, wrote in the Feb 2008 edition of “The Economist”:

Patient data held at a GP practice may be vulnerable to security lapse on the premise, but the damage will be limited. You can have security, or functionality, or scale – you can even have any two of these. But you can’t have all three, and the government will eventually be forced to admit this. In the meantime, billions of pounds are being wasted on gigantic systems projects that usually don’t work and that place citizens’ privacy and safety at risk when they do.

Britain, in fact, has had to stop even pretending that it can safeguard patient data faced with tens of millions of records lost or compromised and just recently, the Prime Minister’s own medical data illegally accessed and given to the media. The Telegraph reports that civil servants in the UK are fired or disciplined for privacy breaches at a rate of about one per day.

All the credible, independent security experts that I am aware of say that a massive concentration of electronic health information imperils the privacy of that data. The “Honeypot Problem” was discussed recently in an article in the Guardian:

This is the recurrent problem with large databases that contain valuable data. Because they are so valuable, they attract malevolent attention of large numbers of hackers, fraudsters, criminals, even terrorists. Under sustained attack, even such sophisticated organizations as Microsoft and the Pentagon have succumbed…

… As well as the honey pot problem, there is another difficulty that applies to these vast government databases. To do their job, these databases have to be accessible to many people…. they can only work if they have thousands of access points. If the government cannot protect one laptop or one flash drive, what chance a system with over ten thousand terminals?

All of which, I suggest, is obvious.

So, let me conclude my prepared remarks by saying this. Contrary to the reports that consensus favours the development of centralized electronic health records, I quote from the Rowntree Report:

There is a developing consensus among medical practitioners that for safety, privacy and system engineering reasons, we need to go back from the shared-record model, to the traditional model of provider-specific records plus a messaging framework that will enable data to be passed from one provider to another when it is appropriate.

In other words, the system needs to be an architecture in which data is pushed from one health care provider to another. Not pulled from every health care provider into a massive database.

We are not building the right model of patient information sharing.

An eHealth Plan For $20M

Christina Blizzard of The Toronto Sun writes:

There is a strong argument that government is the wrong culture to build such IT projects. In the private sector, it's often start-ups, or companies with a bottom line to satisfy that come up with the innovation and know-how to develop these programs efficiently.

On Global's Focus Ontario last week, McCarter pointed out the project has been nine years in the works, $1 billion down the drain -- and precious little to show for it. (You can catch the show at midnight tonight or at globaltoronto.com.) McCarter said it will be a "challenge" for this province to make the 2015 deadline for getting health records on line. This province is lagging embarrassingly behind all other provinces on this.

Perhaps the government should turn to one of its own universities for help.

McMaster University announced last week that it has developed a, "comprehensive, secure, web-based and open source electronic health records system which is ready to be rolled out across Canada."

[...]

The system, called OSCAR, was developed by Dr. David Chan, an associate professor with McMaster's department of family medicine.

In a press release, Dr. David Price, chair of that department, said that 8,000 family physicians in this province who are not using electronic medical records could be on-line within the next 24 months.

The cost? $20 million. Compare that to the $1 billion the government piddled down the eHealth drain.

Well said.

The Media Starts to Figure it Out - Will the Government Soon Follow?

From Anna Paperny of the Globe and Mail

Efforts by governments in Ontario and British Columbia to drag their provinces' medical records into the 21st century haven't gone well: Both provinces are embroiled in eHealth scandals that have turned the endeavour into a political poison pill.

But the doctors behind two made-in-Canada electronic record systems designed years ago and adopted around the world insist it doesn't have to be this hard.

OSCAR, an open-source software pioneered by McMaster University's school of medicine, is being used by hundreds of doctors from Prince Edward Island to British Columbia, and many more from outside the country.

It puts patients' information on secure servers that are based in a doctor's office but can be accessed online from just about anywhere by logging on the same way one would to an online bank account. A separate sister system, MyOSCAR, lets patients access their own records online.

Clearly the discussion coming from the eHealth scandal is creating a conversation on what we want as a society, and whether or not we should allow the powers at be to decide what is right for us.

It is time for us to start thinking about this issue.

Who owns your medical information? Who do you want to maintain the stewardship of this, the most personal of your personal information? Would you like it to be kept, as it is today, in the private offices of your family doctor, or do you prefer that this information is keep in a large government run registry?

The security community is pretty clear on how it feels about governments maintaining large databases of their population's personal information ("1984" anyone?), but this isn't a decision that should be made by the security community.

Currently, you own your own personal information. Most people currently trust their family doctor to maintain their medical information on their behalf. Would you like this to change? It is your choice on how this story ends.

Ontario & BC eHealth scandals - OSCAR to the Rescue

From the Globe and Mail:

The eHealth scandals unfolding in both B.C. and Ontario can be tied by one theme: Governments can get into a "bagful of trouble" when they rush to embrace technology they don't really understand.

This week, the Ontario eHealth debacle continued to spread when the Auditor-General tied Premier Dalton McGuinty to the appointment of top officials who have resigned over untendered consulting contracts.

In British Columbia, detailed allegations of breach of trust, influence-peddling and fraud involving B.C.'s share of the federal-provincial initiative were revealed in an RCMP search warrant that names a senior government official, now retired, who headed the program. No charges have been laid.

Interestingly, the highest number of OSCAR users in Canada are in... Ontario, and British Columbia.

Coincidence? I think not. Doctors know when they are being scammed by the government.

(Ask Your Kids) Open Source Is the Future

Supporting open source software as an alternative to proprietary systems is increasing becoming a global government initiative to ensure consumer protection and customer advocacy. However, the Ontario government seems to have missed the point.

This article from the Joanne Frketich of The Hamilton Spectator identifies what is missing - the will of the patients, practitioners, and bureaucrats to force the system to change.

OSCAR is one of several electronic health systems approved by the Ministry of Health, and is used by more than 600 doctors in Ontario, Quebec and British Columbia.

It's not the most popular of the electronic health systems but it uses open source technology, making it much cheaper than others because the university doesn't make a profit.

"People can use it and it doesn't cost an arm and a leg to get it and modify it," said Kevin Leonard, a scientist with the Centre for Global eHealth Innovation at Toronto's University Health Network.

He has no doubt McMaster could deliver as promised within 24 months for around $20 million.

"It would be in the ballpark," he said. "I think that statement would be true. But the problem is, we don't have the will. Someone has to have the will."

He believes patients are going to have to get much more demanding before the government will make real progress on electronic health records.

He hopes public outrage over the ongoing eHealth scandal, which saw the province spend 10 years and $1 billion in a largely failed effort to create digital health records, will be enough to force change.

After a billion dollars of wasted money, it is no longer acceptable to hide behind the fact that they don't understand open source.

It's easy folks... Ask your kids!

Ontario - Setting the Global Standard on How Not To Spend 1 Billion Dollars

It is called a "learning opportunity", or perhaps a "teachable moment" - how not to spend one billion dollars.

The Ontario government, through arrogance and folly decided that they new best how to pick the market winners, run their own networks, decide on which technologies to approve and which to ignore. Basically, big brother knows best.

So how did that work out for you?

Typically, one would expect that business folks are best at running efficient businesses, network folks are best at running stable networks, doctors are best at practicing medicine, and public officials are good at representing their constituents. We continue to run into trouble when we start mixing up the deck.

Now, as a leading example of what not to do, other nations are noticing:

On the other hand, McMaster University has long maintained an open-source e-health record system called OSCAR, which is already in use in hundreds of clinics in the country. The technology is based on Java, MySQL, PostGreSQL, Tomcat and Linux and the estimated cost of deploying it in all of Canada’s clinics is CAD 20 million (as compared to 1 Billion already spent on eHealth Ontario).

What is most interesting is that the report is written by the Auditor-General of Ontario.

This raises once again the question of what our own National ID project (led by Nandan Nilekani) would look like. While the government should unquestionably hire contractors, willing to do the due diligence for the project, I see no alternative but to develop the solution in an open-source manner and not enslave ourselves to some code-monkey’s bad software.

Via The Indian digital government.