7 ms·

NHS data: Can Sir Tim Berners-Lee fix it?

52 points by mellosouls 6y ago

part1of2 6y ago
Maybe we can first test these secure PODs with data a bit less sensitive than NHS data? Then fix the problems before adding in my person’s health data
deleted 6y ago
[deleted]
thinkingemote 6y ago
It's a good idea and we could have data brokers built into this, software that filter out the data to companies that request it from this central store. For example my bank doesn't need my exact location coordinates so I will only let them have generalised version to 20 miles accuracy. An age verification service should only get a yes or no. The police shouldn't get all details of my medical records, just the basics like if I'm diabetic or allergies. Give the users control over their data
mellosouls 6y ago
My own feeling is a little bit of scepticism when the headline asks if person rightly heralded for one paradigm shifting invention several decades ago can save us again. That's not to downplay Berners-Lee's historical importance or the usefulness of the stuff covered here, just that we sometimes - at least on a popular level - look to big name saviours which probably says more about the journalist's constraints than the value of the contemporary contribution.
- Vinnl 6y ago
  I think that's valid, but the flip side of that is that the name alone can also be a factor in its success. For example, there are quite a few other projects that could potentially deal with the NHS's challenges as well, but the question is whether the NHS would have even heard of those, let alone pilot them.
  - bryanrasmussen 6y ago
    >but the flip side of that is that the name alone can also be a factor in its success Sure it sounds good, but aside from his big paradigm shifting invention those many years ago he has attempted to do some paradigm shifting things since then that have fallen short. So I think hesitation may be warranted.
- bfieidhbrjr 6y ago
  It's a reputational thing. We call on the great and the good because they usually have no skin in the game, so they're impartial. They have a reputation to uphold so they'll do the right thing. It cuts through all the local politics and power that caused the problem. See Feynman and the solid rocket booster o rings in the 80's.
  - est31 6y ago
    Yeah you can be the smartest person on earth, if nobody listens to you then your advice isn't helpful to society. Not your fault, to be clear, it's society's fault, but that doesn't change anything about the helpfulness. A lot of people give a lot of proposals for how something should be done. What will tell you that the proposal is good? Especially if you are a politician who isn't educated in computer science.
    - usrusr 6y ago
      Also compromises. Exceptional status enables pulling through with uncompromising solutions that would be wildly impossible without that status. Unfortunately, some problems are solved much better with heavy compromises ("listening to every stakeholder"), other problems can only be solved well by an uncompromising solution. The meta-problem is telling one from the other ahead of time. I don't know if that's even possible.
- joshspankit 6y ago
  I’d argue that his perspectives on interconnected data are not only more deeply thought out for his continual thought on it over the past decades, but they are even more relevant today. I’d also say in a very real way that for reasons beyond his control, the WWW fell short of what Sir Berners-Lee envisioned, giving him the opportunity to start over and make sure it’s on the right course this time.
- redwood 6y ago
  The thing is, no one else would be able to get the NHS to pilot a platform like this... so while he may be a figurehead, his reputation makes it more conceivable that a next-generation privacy-oriented internet could get off the ground.
  - BillinghamJ 6y ago
    The article says the NHS is already piloting it. There is a lot of appetite in government and the GDS-esque groups like NHSX to make significant improvements on these kinds of areas. Many of them have actually been a lot more successful than you'd think, in many very old departments.
- Angostura 6y ago
  For me though, the thing about TBL is he isn't a glory-hound, my sense of him is he gets involved in interesting problems that he thinks have serious benefits and gets stuck in. He's been thinking and working on this current problem for quite a while, takes it seriously and it is very close to the domain that he has been involved in for decades now. The name may generate some buzz, but I suspect the project may have intrinsic value in its own right.
- usrusr 6y ago
  I'm torn as well. Part of me is massively envious of a country being able to field TBL for its NHS. That's kind of like getting Banksy to design your birthday invitation cards because he happens to be your neighbor or something like that. Another part of me suspects that he might get seriously lost in overoptimism for some theoretically appealing but highly impractical idea that yields nothing in the end. Ironically, both those parts of me claim to be the one that majored in semantic web. (edit: punctuation for readability)
- solarkraft 6y ago
  I had a similar thought reading the headline. Is Tim Berners-Lee actually an exceptional guy with repeatable wisdom or just a cool guy who happened to stumble upon the idea of the web?
ape4 6y ago
The <back button didn't work for me from that page (in Firefox). Slightly ironic on an article about Tim Berners-Lee.
- iso1631 6y ago
  works fine for me
ianopolous 6y ago
Is the data in solid encrypted at rest? If your pod gets hacked does all your data get exposed?
- dijksterhuis 6y ago
  > When using Solid, how is data stored? > It depends on the Pod Provider. From a user point of view, how the data is stored is not as important as how it is accessed and controlled. No matter who the Pod Provider is, in order to be Solid compliant, it has to expose data the same way: as resources in folders. However,the implementors of the standard are free to pick the underlying technologies according to their own purposes and constraints. That is why performance may vary from one Pod Provider to another. > As any standard, Solid only describes the interaction model the system must be compliant with. The Pod Provider only exposes a REST read-write interface to the clients, to which the storage technology is irrelevant, as it is in most Web-based systems. How this interface binds with the storage is specific to each Pod Provider. https://solidproject.org/faqs#pod https://solidproject.org/faqs#pod Solid is just the standard. It's up to others (e.g. inrupt) to build the actual thing.
  - ianopolous 6y ago
    As a potential user I disagree. I absolutely want to know that it doesn't matter if my storage provider is hacked because all the data is E2EE. Once everything is encrypted then you can comfortably layer cryptographic access control on top.
    - Vinnl 6y ago
      I think that intended to say that it's not important in the sense of being able to use Solid. It's up to you to choose who hosts your Pod (or you can do it yourself), and that's where you are able to decide whether the host encrypts your data at rest.
    - pwdisswordfish4 6y ago
      > As a potential user I disagree. You can't disagree, at least not in an informed way, because your idea/position on the follow-on effects are based on a misunderstanding of what Solid is. Asking if "is the data in solid encrypted at rest" is like asking if email is encrypted at rest. It can't be answered, because it's the wrong question. The right question is "Does $PROVIDER keep my data encrypted at rest?"
detritus 6y ago
Given how messy that POD concept was when I looked at it upon release a couple of years back, I'm going to suggest that the answer to the headline is 'No'.
cfv 6y ago
Here's an idea: - Move all documents to a simple doc server like idk Alfresco - Any any all single read requests to this server are authorized after biometric confirmation of any parties involved, which are then added to the users' "file". - Any one use of this data that can be construed as malicious carries 4 to 8 years of jail for anyone involved in the chain of custody of the specific bits of misused data. You don't need superstars on the project, you need the right balance of incentives around mucking with it.
- dtech 6y ago
  That doesn't solve the SPOF for leaks/breaches/corruption that is the problem for these kinds of systems at all.
  - deleted 6y ago
    [deleted]
petepete 6y ago
As with the NPfIT/CFH, the main problem around NHS data is wrestling control of it back from the big players and actually building a standard around the main concepts of what medical data should look like. It goes beyond the medical record (HL7 etc) to stuff like appointments and prescriptions. TBL making a framework for this kind of thing is all well and good, but when iSOFT, Accenture, Fujitsu and their friends all ignore it or try to shoehorn it into their current systems it all falls down.
- pydry 6y ago
  We need a coterie of well paid, humble, independent and responsive architects who can design protocols which will let smaller players build interoperable software for this stuff - prescriptions, appointments, etc. At the moment we have behemoths trying to do the spiderweb vendor lockin thing.
  - specialist 6y ago
    Sounds great. However. Us savvy capable earnest architects don't have enough gumption and swarminess to work three years to close the typical sales account. Our sales and marketing people were basically a different breed. Completely disconnected from reality. Utterly oblivious to their own ignorance. But wow they were able to close deals. It was both disgusting and fascinating to witness up close.
- robertlagrant 6y ago
  This is what FHIR is meant to be.
- specialist 6y ago
  My impression is the NHS had sole custody of their patient's data. I know nothing about UK's system. https://en.wikipedia.org/wiki/NHS_Connecting_for_Health https://en.wikipedia.org/wiki/NHS_Connecting_for_Health From this article, looks like CFH project brought in consultants around the same time (mid-2000s) CSC sold us (a tiny startup team) to MedPlus (owned by Quest Diagnostics). I wouldn't trust CSC any further than I could kick them across a football field. I assume all the big consultants are the same.
dijksterhuis 6y ago
I love the idea of Solid and really hope it gets experiences wide adoption. Can't wait to have my own private server hosting all my data that I can set access on.
- stevekemp 6y ago
  That was one of the reasons I was interested in the camlistore project, now renamed Perkeep.
PaulKeeble 6y ago
The original idea around the NHS spine was that people would have a legitimate relationship with the customers data. So a doctor treating them but not someone random they had no intreaction with. The key was keeping an audit of all the access and updates so at the very least you could determine after the fact if a breach had occurred. Patients don't have access to their spine data however so its impossible for them to administrate it and ensure only those they want to see things do. It doesn't ensure its owned by you only controlled with trust in the NHS spine but still it could have been a lot better than it has been if the project had continued.
Zenst 6y ago
I've worked at the DOH and involved in the regional splits carried out in the late 90's that saw area's split into Trusts. The level of control Trusts and other departments have is not zero and the divergence in systems and data is huge. Many legacy systems, old systems that just work and yet to tie that all together is such a massive undertaking. You could anneal all the data, but the process and systems that get that data has so much divergence that any standard is at the mercy of work-arounds and there are many. Then the whole aspect that IT support/system design was all TUPEd (employee's handed over to private companies on the grounds their pension's etc stayed the same) and you have a core system that is so outsourced that to manage that in a way that looked past the 4-5 years contract window and you can see why things just limp along. To document and look at what the systems should be and how they are is going to be a struggle with all those different hands and time factor as you get with any system. Also many systems connect to bespoke hardware that will be a limiting factor and how many lovely working fine as tools used that are connected to stand alone windows 3.11 systems and data exported via floppy in 90's excels flavours again is not zero. To control the NHS data you need firm in-house IT staff at at the DOH and due to the splitting off and outsourcing in the 90's, the problems that was before are now far larger. This is not only a problem with the NHS but so many government bodies that saw IT development/support outsourced and is a product of that as if your paid for a 4-5 year contract, your not going to plan 20 years ahead, indeed planning for 4-5 years and locking yourself in so you get another 4-5 years is what they will want to be doing, and they do as that is what they are contracted and paid for. No one person can fix this, as the level of change and work involved as greater than doing a whole setup greenfield style and this is not that, legacy costs and support are huge. How would I tackle it - for a start, in housing and restructuring the whole IT support/development. Then the data flows and identifying the most addressable/impacting area's and working slowly from there. But a project upon this scale is not your 5 year plan affair, it would be close to a lifetimes work, and to resolve it all would be a huge chunk out of 10-20 years effort. I'd expect documenting and rationalising the existing systems fully to take best part of 5 years, just to see the path forward. Sure there will be some stand out area's that could be paralleled, but the crux is that the data and systems used by the DOH/NHS are more diverse than anything I've ever experienced, or will and having worked on many migration projects of various scale and fields of work both in and out of government. This is if Sir Time took it on, a lifetime job and one in which most people would not want to commit that long too. I wish him luck but no one person could ever fix this, it would take many years just to define the problems and until that is done, you can not fix poorly defined problems and that may well become the problem itself.
iudqnolq 6y ago
To me it sounds as though the hard part of every actual feature request in TFA is frontend ux related. For example, the request that first responders should see non medical personal info like people's favorite bands is matter of getting people to enter that (hard), storing it in a secure database (hard but solved), and displaying it in a text field (easy).
- Vinnl 6y ago
  I don't see how that's front-end UX-related? I think the "favourite bands" example is pretty contrived, but the idea behind Solid is that your Pod can be used to store all your data, i.e. you could also use a Solid-connected music player that stores data like your playback history in your Pod. That would be the way to get people to enter it.
  - iudqnolq 6y ago
    My point was that the mechanism by which the data is stored doesn't seem to matter to the NHS's use cases. The example mentions humans entering things like that a person talking about music, not automated gathering. Besides how creepy it would be if first responders randomly worked your personal data into conversations, if you really wanted to do that integrations with existing music platforms would take a moderately skilled team a few weeks to achieve what Solid promises at some point in the far future, if everyone adopts it.
rich_sasha 6y ago
Sounds neat, but to me at least, this isn't really the key problem with the web in 2020s. So OK, various organisations could _opt in_ to be respectful to data, at a cost (to them) of additional complexity of using this thing (technical, dealing with 3rd party data instead of owning it, etc.), not to mention licensing costs to TBL. This does not at all stop FAANGs from monopolising the web. So what that NHS stores the data on a Solid server if I can only access it through a Google-owned HTTP protocol? Or next thing you know, Facebook only works if you voluntarily sign all your data off to them (which in essence it does now)? So what I can store my e-mails there if e-mail dies in favour of some closed-source Slack-esque invention, that definitely has E2E encryption? The real issue is that internet is a common utility like railways, water mains or EM spectrum, and yet it can be monopolised by the megacorps with impunity. That some small town can put up its own water well and have a local waterworks - that's nice, but it doesn't really help the 95% of the country held in the grips of a monopoly owning wells, pipes, water storage and customer data.
vergessenmir 6y ago
The problem isn't with TBL but the team of engineers and their leadership implementing the system and that they're doing this within government. I don't think there's been a successful large scale IT project in the NHS/Government in the last 20 years. The intertia to success will be people and existing legacy system. This is a challenging integration project, so I'm not holding my breath tbh.
- mellosouls 6y ago
  Almost all those failures have involved (been down to?) external (private) suppliers. Perhaps the real problem is too much "nobody ever got sacked for buying IBM" timidity amongst senior managers...
- Vinnl 6y ago
  The NHS's project is not the only pilot and the NHS is not the only partner: https://inrupt.com/enterprise-server-release https://inrupt.com/enterprise-server-release
tomcat27 6y ago
I really hope TBL puts together a sound platform before companies like Apple fuck up the platforms like they did in mobile operating systems.
specialist 6y ago
TLDR: TBL's personal datastore proposal (Solid) is a non-starter for medical records in a healthcare context. (In the USA. See mea culpa at end.) Why: How does a patient grant access (consent) if they are incapacitated? Like during an ER visit? More: How does a patient manage that consent for all the other care providers? Can a patient ever retract the consent? Source: Implemented 5 regional healthcare medical records exchanges in the mid-aughts. My teammates handled the web portal for accessing same data. The "break the glass" edge use case, where care providers bypassed the consent, was ~80% of daily usage. Because that's the reality of healthcare. Mea culpa: Haven't yet found the tech specs for TBL's Solid. Maybe it does something new. Like translucent data store with centralized key authority. (Something we considered; would be practical at the NHS, where patients have GUIDs.) I reserve the right to change my position.
- specialist 6y ago
  Ok. Found the Solid FAQ link down thread. https://solidproject.org/faqs https://solidproject.org/faqs After skimming, PODs sound a bit like IPFS. Intriguing? I'll have to ponder. It'll take some effort to work thru some use cases, see how PODs could line up. There's so many different types of care, each with its own gestalt (for lack of better term). Just from memory: Clinic (visit-based, episodic, aka encounter), on going care (chronic conditions, kidneys, cancer), emergency care, ambulances and EMTs, continuity of care stuff (more like a journal or diary), delegation and consults, ad nauseam. This list is only meant to illustrate that interaction patterns for consent (grants & revoke), access, and life spans are many and varied. But just know ahead of time that I'm not optimistic that Solid & PODs bring anything new or practical to the table.
  - pwdisswordfish4 6y ago
    > After skimming, PODs sound a bit like IPFS. Bad takeaway. Solid is basically the principle of, "Hey, don't store my data on your servers. Store it on mine."
jjtheblunt 6y ago
Does this feel a bit unfair to TBL, as it's not his expertise, so setting up an evaluation with a question like this is precarious?
ThinkingGuy 6y ago
This part of the article caught my attention: "A few years ago the optometrist who first spotted my serious eye condition told me she was unable to send my latest scan to my doctor because their IT systems were incompatible." This sounds more like something we'd encounter here in the US. Are incompatibility issues like this so common in the UK?

52 points by mellosouls 6y ago

Maybe we can first test these secure PODs with data a bit less sensitive than NHS data? Then fix the problems before adding in my person’s health data

deleted 6y ago

[deleted]

thinkingemote 6y ago

It's a good idea and we could have data brokers built into this, software that filter out the data to companies that request it from this central store. For example my bank doesn't need my exact location coordinates so I will only let them have generalised version to 20 miles accuracy. An age verification service should only get a yes or no. The police shouldn't get all details of my medical records, just the basics like if I'm diabetic or allergies. Give the users control over their data

mellosouls 6y ago

My own feeling is a little bit of scepticism when the headline asks if person rightly heralded for one paradigm shifting invention several decades ago can save us again. That's not to downplay Berners-Lee's historical importance or the usefulness of the stuff covered here, just that we sometimes - at least on a popular level - look to big name saviours which probably says more about the journalist's constraints than the value of the contemporary contribution.

Vinnl 6y ago
I think that's valid, but the flip side of that is that the name alone can also be a factor in its success. For example, there are quite a few other projects that could potentially deal with the NHS's challenges as well, but the question is whether the NHS would have even heard of those, let alone pilot them.
- bryanrasmussen 6y ago
  >but the flip side of that is that the name alone can also be a factor in its success Sure it sounds good, but aside from his big paradigm shifting invention those many years ago he has attempted to do some paradigm shifting things since then that have fallen short. So I think hesitation may be warranted.
bfieidhbrjr 6y ago
It's a reputational thing. We call on the great and the good because they usually have no skin in the game, so they're impartial. They have a reputation to uphold so they'll do the right thing. It cuts through all the local politics and power that caused the problem. See Feynman and the solid rocket booster o rings in the 80's.
- est31 6y ago
  Yeah you can be the smartest person on earth, if nobody listens to you then your advice isn't helpful to society. Not your fault, to be clear, it's society's fault, but that doesn't change anything about the helpfulness. A lot of people give a lot of proposals for how something should be done. What will tell you that the proposal is good? Especially if you are a politician who isn't educated in computer science.
  - usrusr 6y ago
    Also compromises. Exceptional status enables pulling through with uncompromising solutions that would be wildly impossible without that status. Unfortunately, some problems are solved much better with heavy compromises ("listening to every stakeholder"), other problems can only be solved well by an uncompromising solution. The meta-problem is telling one from the other ahead of time. I don't know if that's even possible.
joshspankit 6y ago
I’d argue that his perspectives on interconnected data are not only more deeply thought out for his continual thought on it over the past decades, but they are even more relevant today. I’d also say in a very real way that for reasons beyond his control, the WWW fell short of what Sir Berners-Lee envisioned, giving him the opportunity to start over and make sure it’s on the right course this time.
redwood 6y ago
The thing is, no one else would be able to get the NHS to pilot a platform like this... so while he may be a figurehead, his reputation makes it more conceivable that a next-generation privacy-oriented internet could get off the ground.
- BillinghamJ 6y ago
  The article says the NHS is already piloting it. There is a lot of appetite in government and the GDS-esque groups like NHSX to make significant improvements on these kinds of areas. Many of them have actually been a lot more successful than you'd think, in many very old departments.
Angostura 6y ago
For me though, the thing about TBL is he isn't a glory-hound, my sense of him is he gets involved in interesting problems that he thinks have serious benefits and gets stuck in. He's been thinking and working on this current problem for quite a while, takes it seriously and it is very close to the domain that he has been involved in for decades now. The name may generate some buzz, but I suspect the project may have intrinsic value in its own right.
usrusr 6y ago
I'm torn as well. Part of me is massively envious of a country being able to field TBL for its NHS. That's kind of like getting Banksy to design your birthday invitation cards because he happens to be your neighbor or something like that. Another part of me suspects that he might get seriously lost in overoptimism for some theoretically appealing but highly impractical idea that yields nothing in the end. Ironically, both those parts of me claim to be the one that majored in semantic web. (edit: punctuation for readability)
solarkraft 6y ago
I had a similar thought reading the headline. Is Tim Berners-Lee actually an exceptional guy with repeatable wisdom or just a cool guy who happened to stumble upon the idea of the web?

ape4 6y ago

The <back button didn't work for me from that page (in Firefox). Slightly ironic on an article about Tim Berners-Lee.

iso1631 6y ago
works fine for me

ianopolous 6y ago

Is the data in solid encrypted at rest? If your pod gets hacked does all your data get exposed?

dijksterhuis 6y ago
> When using Solid, how is data stored? > It depends on the Pod Provider. From a user point of view, how the data is stored is not as important as how it is accessed and controlled. No matter who the Pod Provider is, in order to be Solid compliant, it has to expose data the same way: as resources in folders. However,the implementors of the standard are free to pick the underlying technologies according to their own purposes and constraints. That is why performance may vary from one Pod Provider to another. > As any standard, Solid only describes the interaction model the system must be compliant with. The Pod Provider only exposes a REST read-write interface to the clients, to which the storage technology is irrelevant, as it is in most Web-based systems. How this interface binds with the storage is specific to each Pod Provider. https://solidproject.org/faqs#pod https://solidproject.org/faqs#pod Solid is just the standard. It's up to others (e.g. inrupt) to build the actual thing.
- ianopolous 6y ago
  As a potential user I disagree. I absolutely want to know that it doesn't matter if my storage provider is hacked because all the data is E2EE. Once everything is encrypted then you can comfortably layer cryptographic access control on top.
  - Vinnl 6y ago
    I think that intended to say that it's not important in the sense of being able to use Solid. It's up to you to choose who hosts your Pod (or you can do it yourself), and that's where you are able to decide whether the host encrypts your data at rest.
  - pwdisswordfish4 6y ago
    > As a potential user I disagree. You can't disagree, at least not in an informed way, because your idea/position on the follow-on effects are based on a misunderstanding of what Solid is. Asking if "is the data in solid encrypted at rest" is like asking if email is encrypted at rest. It can't be answered, because it's the wrong question. The right question is "Does $PROVIDER keep my data encrypted at rest?"

detritus 6y ago

Given how messy that POD concept was when I looked at it upon release a couple of years back, I'm going to suggest that the answer to the headline is 'No'.

cfv 6y ago

Here's an idea: - Move all documents to a simple doc server like idk Alfresco - Any any all single read requests to this server are authorized after biometric confirmation of any parties involved, which are then added to the users' "file". - Any one use of this data that can be construed as malicious carries 4 to 8 years of jail for anyone involved in the chain of custody of the specific bits of misused data. You don't need superstars on the project, you need the right balance of incentives around mucking with it.

dtech 6y ago
That doesn't solve the SPOF for leaks/breaches/corruption that is the problem for these kinds of systems at all.
- deleted 6y ago
  [deleted]

petepete 6y ago

As with the NPfIT/CFH, the main problem around NHS data is wrestling control of it back from the big players and actually building a standard around the main concepts of what medical data should look like. It goes beyond the medical record (HL7 etc) to stuff like appointments and prescriptions. TBL making a framework for this kind of thing is all well and good, but when iSOFT, Accenture, Fujitsu and their friends all ignore it or try to shoehorn it into their current systems it all falls down.

pydry 6y ago
We need a coterie of well paid, humble, independent and responsive architects who can design protocols which will let smaller players build interoperable software for this stuff - prescriptions, appointments, etc. At the moment we have behemoths trying to do the spiderweb vendor lockin thing.
- specialist 6y ago
  Sounds great. However. Us savvy capable earnest architects don't have enough gumption and swarminess to work three years to close the typical sales account. Our sales and marketing people were basically a different breed. Completely disconnected from reality. Utterly oblivious to their own ignorance. But wow they were able to close deals. It was both disgusting and fascinating to witness up close.
robertlagrant 6y ago
This is what FHIR is meant to be.
specialist 6y ago
My impression is the NHS had sole custody of their patient's data. I know nothing about UK's system. https://en.wikipedia.org/wiki/NHS_Connecting_for_Health https://en.wikipedia.org/wiki/NHS_Connecting_for_Health From this article, looks like CFH project brought in consultants around the same time (mid-2000s) CSC sold us (a tiny startup team) to MedPlus (owned by Quest Diagnostics). I wouldn't trust CSC any further than I could kick them across a football field. I assume all the big consultants are the same.

dijksterhuis 6y ago

I love the idea of Solid and really hope it gets experiences wide adoption. Can't wait to have my own private server hosting all my data that I can set access on.

stevekemp 6y ago
That was one of the reasons I was interested in the camlistore project, now renamed Perkeep.

PaulKeeble 6y ago

The original idea around the NHS spine was that people would have a legitimate relationship with the customers data. So a doctor treating them but not someone random they had no intreaction with. The key was keeping an audit of all the access and updates so at the very least you could determine after the fact if a breach had occurred. Patients don't have access to their spine data however so its impossible for them to administrate it and ensure only those they want to see things do. It doesn't ensure its owned by you only controlled with trust in the NHS spine but still it could have been a lot better than it has been if the project had continued.

Zenst 6y ago

I've worked at the DOH and involved in the regional splits carried out in the late 90's that saw area's split into Trusts. The level of control Trusts and other departments have is not zero and the divergence in systems and data is huge. Many legacy systems, old systems that just work and yet to tie that all together is such a massive undertaking. You could anneal all the data, but the process and systems that get that data has so much divergence that any standard is at the mercy of work-arounds and there are many. Then the whole aspect that IT support/system design was all TUPEd (employee's handed over to private companies on the grounds their pension's etc stayed the same) and you have a core system that is so outsourced that to manage that in a way that looked past the 4-5 years contract window and you can see why things just limp along. To document and look at what the systems should be and how they are is going to be a struggle with all those different hands and time factor as you get with any system. Also many systems connect to bespoke hardware that will be a limiting factor and how many lovely working fine as tools used that are connected to stand alone windows 3.11 systems and data exported via floppy in 90's excels flavours again is not zero. To control the NHS data you need firm in-house IT staff at at the DOH and due to the splitting off and outsourcing in the 90's, the problems that was before are now far larger. This is not only a problem with the NHS but so many government bodies that saw IT development/support outsourced and is a product of that as if your paid for a 4-5 year contract, your not going to plan 20 years ahead, indeed planning for 4-5 years and locking yourself in so you get another 4-5 years is what they will want to be doing, and they do as that is what they are contracted and paid for. No one person can fix this, as the level of change and work involved as greater than doing a whole setup greenfield style and this is not that, legacy costs and support are huge. How would I tackle it - for a start, in housing and restructuring the whole IT support/development. Then the data flows and identifying the most addressable/impacting area's and working slowly from there. But a project upon this scale is not your 5 year plan affair, it would be close to a lifetimes work, and to resolve it all would be a huge chunk out of 10-20 years effort. I'd expect documenting and rationalising the existing systems fully to take best part of 5 years, just to see the path forward. Sure there will be some stand out area's that could be paralleled, but the crux is that the data and systems used by the DOH/NHS are more diverse than anything I've ever experienced, or will and having worked on many migration projects of various scale and fields of work both in and out of government. This is if Sir Time took it on, a lifetime job and one in which most people would not want to commit that long too. I wish him luck but no one person could ever fix this, it would take many years just to define the problems and until that is done, you can not fix poorly defined problems and that may well become the problem itself.

iudqnolq 6y ago

To me it sounds as though the hard part of every actual feature request in TFA is frontend ux related. For example, the request that first responders should see non medical personal info like people's favorite bands is matter of getting people to enter that (hard), storing it in a secure database (hard but solved), and displaying it in a text field (easy).

Vinnl 6y ago
I don't see how that's front-end UX-related? I think the "favourite bands" example is pretty contrived, but the idea behind Solid is that your Pod can be used to store all your data, i.e. you could also use a Solid-connected music player that stores data like your playback history in your Pod. That would be the way to get people to enter it.
- iudqnolq 6y ago
  My point was that the mechanism by which the data is stored doesn't seem to matter to the NHS's use cases. The example mentions humans entering things like that a person talking about music, not automated gathering. Besides how creepy it would be if first responders randomly worked your personal data into conversations, if you really wanted to do that integrations with existing music platforms would take a moderately skilled team a few weeks to achieve what Solid promises at some point in the far future, if everyone adopts it.

rich_sasha 6y ago

Sounds neat, but to me at least, this isn't really the key problem with the web in 2020s. So OK, various organisations could _opt in_ to be respectful to data, at a cost (to them) of additional complexity of using this thing (technical, dealing with 3rd party data instead of owning it, etc.), not to mention licensing costs to TBL. This does not at all stop FAANGs from monopolising the web. So what that NHS stores the data on a Solid server if I can only access it through a Google-owned HTTP protocol? Or next thing you know, Facebook only works if you voluntarily sign all your data off to them (which in essence it does now)? So what I can store my e-mails there if e-mail dies in favour of some closed-source Slack-esque invention, that definitely has E2E encryption? The real issue is that internet is a common utility like railways, water mains or EM spectrum, and yet it can be monopolised by the megacorps with impunity. That some small town can put up its own water well and have a local waterworks - that's nice, but it doesn't really help the 95% of the country held in the grips of a monopoly owning wells, pipes, water storage and customer data.

vergessenmir 6y ago

The problem isn't with TBL but the team of engineers and their leadership implementing the system and that they're doing this within government. I don't think there's been a successful large scale IT project in the NHS/Government in the last 20 years. The intertia to success will be people and existing legacy system. This is a challenging integration project, so I'm not holding my breath tbh.

mellosouls 6y ago
Almost all those failures have involved (been down to?) external (private) suppliers. Perhaps the real problem is too much "nobody ever got sacked for buying IBM" timidity amongst senior managers...
Vinnl 6y ago
The NHS's project is not the only pilot and the NHS is not the only partner: https://inrupt.com/enterprise-server-release https://inrupt.com/enterprise-server-release

tomcat27 6y ago

I really hope TBL puts together a sound platform before companies like Apple fuck up the platforms like they did in mobile operating systems.

specialist 6y ago

TLDR: TBL's personal datastore proposal (Solid) is a non-starter for medical records in a healthcare context. (In the USA. See mea culpa at end.) Why: How does a patient grant access (consent) if they are incapacitated? Like during an ER visit? More: How does a patient manage that consent for all the other care providers? Can a patient ever retract the consent? Source: Implemented 5 regional healthcare medical records exchanges in the mid-aughts. My teammates handled the web portal for accessing same data. The "break the glass" edge use case, where care providers bypassed the consent, was ~80% of daily usage. Because that's the reality of healthcare. Mea culpa: Haven't yet found the tech specs for TBL's Solid. Maybe it does something new. Like translucent data store with centralized key authority. (Something we considered; would be practical at the NHS, where patients have GUIDs.) I reserve the right to change my position.

specialist 6y ago
Ok. Found the Solid FAQ link down thread. https://solidproject.org/faqs https://solidproject.org/faqs After skimming, PODs sound a bit like IPFS. Intriguing? I'll have to ponder. It'll take some effort to work thru some use cases, see how PODs could line up. There's so many different types of care, each with its own gestalt (for lack of better term). Just from memory: Clinic (visit-based, episodic, aka encounter), on going care (chronic conditions, kidneys, cancer), emergency care, ambulances and EMTs, continuity of care stuff (more like a journal or diary), delegation and consults, ad nauseam. This list is only meant to illustrate that interaction patterns for consent (grants & revoke), access, and life spans are many and varied. But just know ahead of time that I'm not optimistic that Solid & PODs bring anything new or practical to the table.
- pwdisswordfish4 6y ago
  > After skimming, PODs sound a bit like IPFS. Bad takeaway. Solid is basically the principle of, "Hey, don't store my data on your servers. Store it on mine."

jjtheblunt 6y ago

Does this feel a bit unfair to TBL, as it's not his expertise, so setting up an evaluation with a question like this is precarious?

ThinkingGuy 6y ago

This part of the article caught my attention: "A few years ago the optometrist who first spotted my serious eye condition told me she was unable to send my latest scan to my doctor because their IT systems were incompatible." This sounds more like something we'd encounter here in the US. Are incompatibility issues like this so common in the UK?