e-Health -- security unplugged

Up until a few months ago, I was firmly of the opinion that clinicians should be doing what they do best, i.e. taking care of their patients; they should not be concerned with the complexities of an Electronic Medical Record (EMR) system's implementation and maintenance.
But before I go any further, let's review the 2 main implementation models:

1> Local Server -- this is where the entire system (hardware and software) is installed in the practice; the doctor(s) is(are) totally responsible for its operation, maintenance, security etc.

2> Application Service Provider (ASP) -- this is where clinic personnel simply use a browser to securely connect to a server typically hosted in a Ministry of Health facility; a vendor such as xwave or Nightingale is responsible for its operation, maintenance etc.; of course, perpetual monthly fees are involved

The ASP model has been my preference because of the hands-off approach; however, I've always wondered why the Local Server option has consistently dominated the vendor certification list at OntarioMD (https://www.emradvisor.ca/compare) -- clarity came a few months ago.
You see, I had the opportunity to attend a seminar that showcased an up-and-coming EMR product called OSCAR; seeing that the implementation model was also of the Local Server variety, I pondered aloud as to why any physician would want to take on the headache of managing such a system!

The retort I got still has me thinking why I ever preferred the ASP model to begin with; the gentleman who overheard me, made these 2 comments:

1> think about the person(s) who you've always trusted with your medical data
2> think about the arrangement whereby present/future governments and/or the various companies have access to a goldmine of a database potentially containing the medical records of millions of Ontarians

I must admit that the above has helped to change my way of thinking and the Local Server option has now become a no-brainer; with the ASP model, the vendor is in control of the collection and storage of patient data and although I have no security issues with the flow between clinic and the hosting facility, I have a few concerns, namely:

1> since companies on a whole exist solely to make money for their shareholders, having a database idly sitting by does not make good business sense -- heck, as an EMR vendor, my company would be chomping at the bit to anonymize the data and sell it for research or other marketing purposes on a subscription basis (within the confines of applicable laws, of course); could governments also not try to justify this as a potential revenue stream
2> what happens to/who owns the database should the vendor go belly-up; and whilst all this is being sorted out, what are the implications for the continued operation of the practice
3> databases containing such large amounts of personal information always will be targets for the unscrupulous -- what would be the implications of a breach

Agencies such as eHealth Ontario and Canada Health Infoway should be concerned with putting the plumbing and standards in place to facilitate the secure sharing of data between provider facilities (be it an ambulance, a hospital or a doctor's office) as opposed to expending resources toward the creation/maintenance of medical databases.
Dianne Daniel in her article "Patients want providers to use EHRs, and expect privacy protection", suggests that there's a new generation of tech savvy patients out there who not only want their records to be ubiquitous, but want it done in a highly secure and confidential manner (Canadian Healthcare Technology, Focus on Security, October 2009, p14).
The only way I can become comfortable with the ASP model again is if the data leaves my doctor's office encrypted with me having exclusive ownership of the key -- that way, we can decide which parts of my record gets shared and with whom.

With regards to the afore-mentioned overhead involved for doctors to run their own systems -- I guess security comes with a price!

In the meantime, your mission, should you choose to accept it, would be to find out whether your doctor uses the Local Server or ASP model and get a dialogue going with regards to the above.

After all, it's your data!

In the meantime, I'm betting we'll get our first snow storm during the week of December 13th -- what sayest thou?
'Till next time, watch  how you go!

Ernest A. James

President/CEO
Regal Informatics Inc.