I’ve been engineering Healthcare solutions for many years. I won’t go into all the different reasons that your father shouldn’t be doing this; most of the reasons being academic: meaning, if you’ve been in the industry long enough you know how these things snowball and develop a life of their own.

Instead your father, as a physician, needs to understand the professional reasons and real-life, non-academic, reasons why what he is doing is dangerous and possibly life-threatening; dangerous to his colleagues, dangerous to his patients privacy and identity, and dangerous to his practice from a legal standpoint.

The danger is multi-faceted:

1. patient privacy (HIPAA, ARRA, Meaningful Use, HITECH Compliance)
   • what are the fields that are considered patient identifying fields (many professionals in the industry don’t understand this, and just because you eliminate some of the obvious fields like last name, address, zip code there are still many other fields that would make it easy to associate clinical data to a specific patient; this, in itself, is difficult; there are companies out there making lots of money de-identifying clinical data – it’s a whole domain in itself).
2. HIPAA, HITECH and newer legislation spells out clearly how
   • auditing should be done
   • security should be done
   • password requirements
   • should the data at rest be encrypted
   • should the data transmitted be encrypted, and how
   • you must consider the controls if you are using any kind of hosted service (IaaS, PaaS)
   • do you have proper BAA and DSA in place
   • how do those hosting your servers control access
   • how do they handle multi-tenancy (you’d be amazed at how some of these large entities do NOT handle this appropriately)
   • if you terminate the contract with those hosting your infrastructure, how will they ensure permanent deletion of your data (NIST regulations)
3. what are the governing controls in place for your development
   • do you have an sdlc in place
   • do you have traceability from requirements to code to QA
   • do you validate ‘intended’ use of your medical application/device
4. is your software being QA’d, and do you have a User Acceptance Test (UAT) environment
   • how do you secure this environment, because you’ll be using real patient data
5. is he going to handle medicare patients, if so is he planning to use his database to report out?
   • the government has strict controls in place for the exchange of this data to their Health Information Exchange (HIE)
   • which leads to how will he implement his own exchange if he wants to take advantage of his clinical data repository (CDR)
6. does he understand the particular NIST regulations he needs to abide by for data security
   • such as permanent deletion of data (if using a hosted infrastructure)
7. you mentioned he will be taking data from medical machines
   • does he understand the new FDA medical device standards?
   • starting in 2013, any digital system that displays data from medical devices can be categorized as a medical device … this means he must meet the FDA regulatory requirements for medical devices
8. will his team and staff be making medical decisions based on the data in his database?
   • has he developed a solid clinical data model, flexible enough to handle the ever changing requirements (i.e., ICD-9 to ICD-10 to ICD-11 coding standards)?
   • how will he version the data model and keep it in sync with the data (i.e., if he changes the clinical data model how will older data be represented?)
   • will his system be able to produce an exact snapshot of the clinical data as it was seen on the day that a clinical decision was made? there are legal repercussions if he can’t
   • does he know the difference between a real delete and a logical delete, and the implications to his data model; to his storage requirements; to his practice’s policies?
   • does he have a vocabulary solution in place to handle all the different services he will need to use; much of the data needs to be coded (as opposed to free text), because he will want to take advantage of his CDR to produce ICD-9 compliant reports. And then he needs to take into account the changing of these standards; e.g., ICD-9 to ICD-10.
   • for vocabulary, terminology or Health Data Dictionary (all basically synonyms) how will he implement and ensure that old terminology can still be rendered for old clinical decisions?
9. will he be storing allergy data?
   • how will his ‘medical terminology’ or ‘vocabulary’ definitions be stored?
   • will he integrate with other terminology systems like LOINC and First Data Bank?
   • does he have an understanding of terminology services (i.e., Health Data Dictionary)
10. will he want to have data interfaced into his system, and maybe out to a health information exchange (HIE)?
    • if so, does he understand HL7 and its impact on his database?
    • does he understand interface engines and all that goes along with that?
11. does he understand how to de-identify information?
    • this is important in the development phase and the bug fixing phase

These are just a few questions, and by no means should it be considered a comprehensive list. And for each answer there will be countless more questions.

In a Healthcare database there should not be any deletion or over-writing of previous data. This means there are never going to be ‘delete from where…’ or ‘update set …’. Instead you will only have inserts. You can imagine how this changes your data model and your queries. Now you can be creative and come up with different solutions to attain this goal, but the fact remains that this is a requirement that is unique to the Healthcare Clinical Data repository.

Just one more thought regarding the life-threatening side of this issue:

Let’s take, for example, allergy information; I raise this one up because institutions who have been doing this digitally for years have learned that their processes need to ensure that allergy data is captured and that we can’t assume that because technology captured the data in a database it is somehow inherently correct forever. This is why patients are asked for their allergies every single time as they move from one department to another, even within the same hospital. A patient’s allergies can’t be deleted (updates to a row delete the old information). A clinical decision based on digital data needs to capture what was ‘presented’ to the clinician at the time of the decision.

I know much of this may seem to be geared to a large institution. However, the regulatory parts aren’t. And in any case, Healthcare Information Systems are inherently complex. Healthcare system engineering depends and recognizes the expertise and experience of good clinicians. However, there is a larger than average impedance mismatch (to borrow terminology from the ORM technology) in the Healthcare IT domain … I venture to say larger because every domain has its mismatches.

Good luck!

A hacked together solution isn’t always bad. If it’s solving his problem, I wouldn’t make too much of a stink over it. There’s probably 10 working hacked together solutions in File Maker and Access for every professional database solution. After all, that’s what Filemaker and Access are for. Sure, most of the hacked together solutions are awful under the hood. But they exist to solve problems, not win beauty contests. Often the scope of these solutions grow, and that’s when someone is hired to build a professional solution.

What you might do to help his chances at success is express interest in his project and offer to sit down & help him define the database and walk through everything. If he doesn’t want your help… drop it & let him be. What are you going to do, badger your father? If/when he gets in over his head, he’ll let you know.

Another thing to consider is if this is a common problem among doctors, you might have a very good business opportunity in creating a generic solution.

As a software designer with 25+ years of experience, I can still see the attraction in crafting something yourself. Explaining things to someone not versed in that industry can be a huge drag.

So what if the database isn’t normalised or could be made faster? A lot of non-critical software (especially in the age of agile) follows the wabi-sabi principle. It does what it needs to do and no more.

Please appreciate that not all software has to scream along with a perfect interface, lightning-fast database access and an immaculate GUI.

My issue is, that whilst I want him to succeed 100%, I don’t think
it’s appropriate for him to be handling these types of decisions.

Filemaker got its start as a database that anybody could use, and it still works very well in that role. If your father knows what he wants and feels comfortable putting it together himself, what are you worried about? If it works the way he wants, he wins. If it doesn’t work the way he wants, he’ll fix it.

You’d be right to be concerned if he were building a database for all the doctors that work for Kaiser Permanente, but if he’s just building a tool for use in his own practice it seems like he’s probably exactly the right person to be handling these decisions.

Don’t let perfect be the enemy of good.

My advice is to pretend this doesn’t exist or else it will drive you mad. I have a relative who’s done a similar thing with his client list, and what he’s created on his own is a monstrosity. I initially offered to help and he thought my quote (which had a hefty “family” discount) was outrageous. After having a look at it I suggested a bunch of changes, which he asked me to make in exchange for “a couple of beers.” Family or not, Homie don’t play that. I told him he should hire someone to do it, but he never did. I just had to cut myself off from it completely and pretend it doesn’t exist, just to keep the awfulness of the project from eating at me.

You should let him try. However, you should make him aware of the fact, that when he reaches an impasse, it’s his problem and any developer he decides to hire at that point, will have to start from scratch.

I like to hack together things a lot, like furniture and even plumbing. I enjoy it and I see nothing wrong with it. I just never would even dare to ask a skilled craftsman to jump in for me when I get stuck, simply because I think they’d throw up at the mere sight of my creations.

So let your father do what he likes, but try to let him understand the risks. Just explain to him, that when he at some point hires a trained developer to “just add one little feature”, it’s like asking experienced craftsmen to “just fix a couple of things” in a house where most the wiring and plumbing has been done with duct-tape, aluminium foil, Plasticine and good faith.

he sees these types of jobs as “childs play”

I am a developer consultant of 4 years

For your own well-being and your father’s personal development let him fail. John’s answer is rock-solid and you should mention enough to keep your father from getting on the wrong side of the law, or at least enough that he should know better. But this whole “humility” thing isn’t something you can lecture to people and expect them to learn it. It’s a very important life-lesson to try your hardest and utterly fail. Failure is a very powerful teacher. And he might gain some respect for his son’s profession.

And hey, if he manages to cobble something that works well enough (and doesn’t violate any laws), all the more power to him.

It’s his business. And if he is determined, he’ll make it work. And lots of folks have cobbled together solutions from various technologies to get stuff working.

Years ago, I reviewed the code of a friend of mine who put together a web application with PHP and some bulletin board software. He customized it heavily to meet his needs. The code was an abomination. Asides from barely being 1st normal form, he had HTML tags with data in his database. No MVC separation. But God bless him. His application worked, and he was able to pay his bills with the income from that web site.

My advice to him was this: If you are content to milk your application for revenues as long as possible, then don’t refactor it using good software design techniques, and leave “well enough” alone. If you want to evolve your application to offer more services and get more revenue, then you’ll have to pay up and refactor the code. He elected to go with the former. C’est la vie.

If your dad doesn’t feel the pain of data duplication and weak data integrity now, he will later, and only then will he learn the value of what you’re saying.

As a recently retired software engineer for a large non-profit healthcare provider, I strongly recommend looking for a hospital or large practice nearby that can for a reasonable fee allow him to share their electronic medical records system that meets the requirements for the Meaningful Use initiative (and other government incentive programs).

I am aware that “Epic” (http://Epic.com) supports their customers allowing smaller providers to share their system, and I imagine some of their competitors do also. Cerner is their biggest competitor, but several others are discussed at http://www.beckershospitalreview.com/healthcare-information-technology/50-things-to-know-about-epic-cerner-meditech-mckesson-athenahealth-and-other-major-ehr-vendors.html

There is a 75% subsidy from CMS for that sort of sharing. We passed on the subsidy to our clients by making the subscription price 25% of our cost.

I think the answer to your question mainly depends on how critical for his medical practice is this application. Will he be storing there just some patients data which he finds useful or any malfunction of this application may have severe consequences?
If it may have severe consequences then he shouldn’t do it but because we are not living in a perfect world convincing him that it is not a good idea may be completely different matter.

As you are a developer consultant I would suggest offering him help in QA and testing process. In this way you will keep good relationship with your father because you are “helping” him but at the same time you can make sure that his app is doing what is supposed to do or even find a problem which he will not be able to solve so he will seek more professional solution.

BTW I have seen quite many terrible apps which were doing their job and no amount of explanation why it’s terrible would convince anyone to make any real changes in it.