NHS data: Can Sir Tim Berners-Lee fix it?

My own feeling is a little bit of scepticism when the headline asks if person rightly heralded for one paradigm shifting invention several decades ago can save us again.

That's not to downplay Berners-Lee's historical importance or the usefulness of the stuff covered here, just that we sometimes - at least on a popular level - look to big name saviours which probably says more about the journalist's constraints than the value of the contemporary contribution.

It's a good idea and we could have data brokers built into this, software that filter out the data to companies that request it from this central store.

For example my bank doesn't need my exact location coordinates so I will only let them have generalised version to 20 miles accuracy.

An age verification service should only get a yes or no.

The police shouldn't get all details of my medical records, just the basics like if I'm diabetic or allergies.

Give the users control over their data

Sounds neat, but to me at least, this isn't really the key problem with the web in 2020s.

So OK, various organisations could _opt in_ to be respectful to data, at a cost (to them) of additional complexity of using this thing (technical, dealing with 3rd party data instead of owning it, etc.), not to mention licensing costs to TBL.

This does not at all stop FAANGs from monopolising the web. So what that NHS stores the data on a Solid server if I can only access it through a Google-owned HTTP protocol? Or next thing you know, Facebook only works if you voluntarily sign all your data off to them (which in essence it does now)? So what I can store my e-mails there if e-mail dies in favour of some closed-source Slack-esque invention, that definitely has E2E encryption?

The real issue is that internet is a common utility like railways, water mains or EM spectrum, and yet it can be monopolised by the megacorps with impunity. That some small town can put up its own water well and have a local waterworks - that's nice, but it doesn't really help the 95% of the country held in the grips of a monopoly owning wells, pipes, water storage and customer data.

As with the NPfIT/CFH, the main problem around NHS data is wrestling control of it back from the big players and actually building a standard around the main concepts of what medical data should look like. It goes beyond the medical record (HL7 etc) to stuff like appointments and prescriptions.

TBL making a framework for this kind of thing is all well and good, but when iSOFT, Accenture, Fujitsu and their friends all ignore it or try to shoehorn it into their current systems it all falls down.

Maybe we can first test these secure PODs with data a bit less sensitive than NHS data? Then fix the problems before adding in my person’s health data

The original idea around the NHS spine was that people would have a legitimate relationship with the customers data. So a doctor treating them but not someone random they had no intreaction with. The key was keeping an audit of all the access and updates so at the very least you could determine after the fact if a breach had occurred. Patients don't have access to their spine data however so its impossible for them to administrate it and ensure only those they want to see things do.

It doesn't ensure its owned by you only controlled with trust in the NHS spine but still it could have been a lot better than it has been if the project had continued.

Here's an idea:

- Move all documents to a simple doc server like idk Alfresco

- Any any all single read requests to this server are authorized after biometric confirmation of any parties involved, which are then added to the users' "file".

- Any one use of this data that can be construed as malicious carries 4 to 8 years of jail for anyone involved in the chain of custody of the specific bits of misused data.

You don't need superstars on the project, you need the right balance of incentives around mucking with it.

I love the idea of Solid and really hope it gets experiences wide adoption.

Can't wait to have my own private server hosting all my data that I can set access on.

Given how messy that POD concept was when I looked at it upon release a couple of years back, I'm going to suggest that the answer to the headline is 'No'.

I really hope TBL puts together a sound platform before companies like Apple fuck up the platforms like they did in mobile operating systems.

To me it sounds as though the hard part of every actual feature request in TFA is frontend ux related.

For example, the request that first responders should see non medical personal info like people's favorite bands is matter of getting people to enter that (hard), storing it in a secure database (hard but solved), and displaying it in a text field (easy).

This part of the article caught my attention:

"A few years ago the optometrist who first spotted my serious eye condition told me she was unable to send my latest scan to my doctor because their IT systems were incompatible."

This sounds more like something we'd encounter here in the US. Are incompatibility issues like this so common in the UK?

TLDR: TBL's personal datastore proposal (Solid) is a non-starter for medical records in a healthcare context. (In the USA. See mea culpa at end.)

Why: How does a patient grant access (consent) if they are incapacitated? Like during an ER visit?

More: How does a patient manage that consent for all the other care providers? Can a patient ever retract the consent?

Source: Implemented 5 regional healthcare medical records exchanges in the mid-aughts. My teammates handled the web portal for accessing same data. The "break the glass" edge use case, where care providers bypassed the consent, was ~80% of daily usage. Because that's the reality of healthcare.

Mea culpa: Haven't yet found the tech specs for TBL's Solid. Maybe it does something new. Like translucent data store with centralized key authority. (Something we considered; would be practical at the NHS, where patients have GUIDs.) I reserve the right to change my position.

Does this feel a bit unfair to TBL, as it's not his expertise, so setting up an evaluation with a question like this is precarious?

I've worked at the DOH and involved in the regional splits carried out in the late 90's that saw area's split into Trusts. The level of control Trusts and other departments have is not zero and the divergence in systems and data is huge. Many legacy systems, old systems that just work and yet to tie that all together is such a massive undertaking. You could anneal all the data, but the process and systems that get that data has so much divergence that any standard is at the mercy of work-arounds and there are many.

Then the whole aspect that IT support/system design was all TUPEd (employee's handed over to private companies on the grounds their pension's etc stayed the same) and you have a core system that is so outsourced that to manage that in a way that looked past the 4-5 years contract window and you can see why things just limp along.

To document and look at what the systems should be and how they are is going to be a struggle with all those different hands and time factor as you get with any system. Also many systems connect to bespoke hardware that will be a limiting factor and how many lovely working fine as tools used that are connected to stand alone windows 3.11 systems and data exported via floppy in 90's excels flavours again is not zero.

To control the NHS data you need firm in-house IT staff at at the DOH and due to the splitting off and outsourcing in the 90's, the problems that was before are now far larger.

This is not only a problem with the NHS but so many government bodies that saw IT development/support outsourced and is a product of that as if your paid for a 4-5 year contract, your not going to plan 20 years ahead, indeed planning for 4-5 years and locking yourself in so you get another 4-5 years is what they will want to be doing, and they do as that is what they are contracted and paid for.

No one person can fix this, as the level of change and work involved as greater than doing a whole setup greenfield style and this is not that, legacy costs and support are huge.

How would I tackle it - for a start, in housing and restructuring the whole IT support/development. Then the data flows and identifying the most addressable/impacting area's and working slowly from there.

But a project upon this scale is not your 5 year plan affair, it would be close to a lifetimes work, and to resolve it all would be a huge chunk out of 10-20 years effort. I'd expect documenting and rationalising the existing systems fully to take best part of 5 years, just to see the path forward. Sure there will be some stand out area's that could be paralleled, but the crux is that the data and systems used by the DOH/NHS are more diverse than anything I've ever experienced, or will and having worked on many migration projects of various scale and fields of work both in and out of government. This is if Sir Time took it on, a lifetime job and one in which most people would not want to commit that long too.

I wish him luck but no one person could ever fix this, it would take many years just to define the problems and until that is done, you can not fix poorly defined problems and that may well become the problem itself.

The problem isn't with TBL but the team of engineers and their leadership implementing the system and that they're doing this within government.

I don't think there's been a successful large scale IT project in the NHS/Government in the last 20 years. The intertia to success will be people and existing legacy system. This is a challenging integration project, so I'm not holding my breath tbh.

Is the data in solid encrypted at rest? If your pod gets hacked does all your data get exposed?

The <back button didn't work for me from that page (in Firefox). Slightly ironic on an article about Tim Berners-Lee.