Can a company vendor lock patient data?

When I first started my new blog, I wanted to post at least one post a week. But just like everything else I have not being able to post at least one blog post per week.

One reason for this has been I have been assigned to work at an ICU taking care of COVID-19 patients. 

COVID-19 was on the rise, and doctors were in short supply and therefore, me and my colleagues were taken out from our Health (bio)-Informatics course and were assigned to work at different hospitals. 

The place where I’m working at the moment is a small hospital far away from the capital, and most of the things we do are paper-based. 

• A person will take the blood sample and the request from the lab.
• The analyzer will analyze the sample.
• The analyzer will send the data to a computer.
• The lab staff can take a printout from the computer.
• Someone will have to go to the lab from the ICU and collect the printout and get back to the ICU.

There are a lot of things wrong with this approach,

• Reports can get lost, and this is a daily occurrence at the hospital.
• Since someone has to walk to the lab and check whether the report has been issued, reports tend to get delayed.
• Sometimes reports are being sent to a different unit because of human error.

These are some of the common pitfalls that we see every,

I was having this idea, what if we can connect the ICU and the hospital lab? Once the sample is analyzed, doctors can see the report from the ICU from their smartphones, or via a portal at the ICU. Won’t that be great? 

Rather than a paper-based system, doctors can even see a timeline of investigation reports and their values. There won’t be a delay in getting the report, and you don’t have to worry about losing the report since they are no longer paper-based. 

There are a lot of advantages one can get by connecting the ICU with the lab.

Today, I went to the hospital lab to discuss a way to connect the two. However, I instantly realized that it’s far complicated and frustrating than I imagined, thanks to a vendor lock over the data.

So what’s the vendor lock, and who’s putting the vendor lock?

It seems that the producers or importers of the analyzer machines are putting a vendor lock over the data you receive from the machines.

That means you can’t build an API over the data and allow other doctors and staff to access the data.

How are they putting this vendor lock?

Software, the analyzer will send data to a PC that runs proprietary software, and no one else can read this data other than this proprietary software.

Even this proprietary does not allow any way to export that data. The only way that the data can come out is through the printer.

Hardware, there is a hardware vendor lock too. That further prevents anyone from getting out of the computer. This is done by voiding the warranty to the analyzer and the PC which operates the analyzer if we tamper with the PC. 

This means we can’t plug a USB or a data cable into this PC. You can’t connect the PC to the internet, the PC can only work with the analyzer and it’s only as good as a brick.

Even if I can write something to extract the data, by installing that the lab faces the risk of losing warranty, or pay a hefty fee to re, which the lab does not want to happen.

But here’s the thing,

• The hospital has paid for the analyzer and the PC.
• The hospital buys reagents for these analyzers, which is also vendor locked, for example, one reagent that works for one brand of analyzer does not work for another.
• There is no insentive for the analyzer maker by putting a vendor lock over the data, because that’s not interfear with their business, making analyzers.
• It’s patients’ information that they are keeping hostage, and by doing so reduces the quality of care which the hospital can provide for the patients. 
• Aren’t patients or the hospital supposed to own their data and not the makers of the machine? Isn’t that the reason we puchace these analyzers, and pay for the reagents, which are not free.

So out of frustration, I came out from the lab. I can still try to find a workaround by writing an OCR and scanning the report on screen and extracting the data to a smartphone and submitting it to the portal. But should I go that far because of this unwanted vendor lock?