I’ve read a modest amount about EMRs but you’ve provided perspectives I haven’t heard elsewhere.

For an update on Google’s ethics and other bloggers’ thoughts, see my update yesterday.

I tend to think that EMRs need to be owned and operated by hospitals. While it’s an old-fashioned way of doing it, I think in this case the issue of patient privacy far outweighs the cost-savings of an ASP-type model.

Additionally, one of the best arguments for EMR systems is the clarity they can provide to healthcare providers when the patient is unconscious or unable to clearly give details. Hospitals cannot and should not be dependent on functional Internet access to obtain this information. What would hospitals do during citywide blackouts? They have generators to run on, but imagine how crippled they would be without information systems they’ve come to depend on.

I would much rather see critical data located on local systems that are not connected to patient-accessible networks. Run separate physical networks for the systems that contain sensitive information, and allow data exchange with other hospitals via a public key-based secure infrastructure. It could easily run atop the Internet with several agencies maintaining authoritative signing keys. Think of it as how SSL works, but far more tightly run (keys manually verified, different types of keys for software vendors and health providers, any key failures or problems automatically disable access, etc). Hospitals could obtain the keys necessary as part of their support contract when they purchase compliant systems, and vendors that implement the open standards could easily be given chained authority to sign such keys.

And right as that’s being implemented, I’ll go see “Satan on Ice.”

I hear you’re gettin’ outa jail soon – wonderful! Great news!

Hey, what do you think about the Google Health controversy, Mister Doctor-To-Be? There are large arguments going on about the privacy issues. Google’s not a care provider so they’re not covered by HIPAA privacy regulations. They’re responding to those concerns by saying they wrote their own regulations, stricter than HIPAA… but, heh, unfortunately there’s nobody to enforce the ones they wrote themselves.