Free software is about freedom from control. This article discusses how the free software ideals should be applied to hosted personal health record software and how Microsoft's newest PHR, HealthVault, is a threat to free software.

Heard about HealthVault?

Microsoft has released a Personal Health Record web platform called HealthVault. One sentence in, and any regular reader of this magazine will already be concerned. Imagine the problems here. We are talking about health records, one of the most critical functions that computers can carry out, and we are talking about Microsoft, one of the greatest enemies of the free software movement. You know what I am going to be saying in this post will not be pretty.

I have been blogging about this on my personal site Fred Trotter for quite some time. I have done a series of articles called a "week of HealthVault". This title is good marketing since not all of the articles are about HealthVault (I will be discussing Googles coming PHR), and not all of the articles took place over a single week.

I do not have time to remake my arguments here, but if you really care about this issue, I suggest that you read and then comment on the following articles.

• HealthVault: Failing the seven generation test This post talks about how our societies need health records that last for many generations, and how HealthVault fails to realize this.
• HealthVault: Abusing vs. Implementing standards Here I discuss the familiar issue of standards implementation. Microsoft has abused its monopoly position to break standards. We cannot afford this with healthcare software.
• HealthVault: No commitments and a sleeping watchdog A patient privacy advocacy group has endorsed HealthVault despite the fact that HealthVault's privacy policy fails to meet the standards of that group.
• HealthVault: A complex problem underestimated Patient privacy is a complex problem, with complexities that HealthVault ignores.
• HealthVault: The food critic never took a bite Discusses the folly of evaluating the security of a software package without looking at the sourcecode.
• HealthVault: Medically and Legally savvy, but technically uninformed Shows that Microsoft's primary "patient privacy" expert is probably unqualified to make the recommendation in favor of HealthVault

The next article on HealthVault...

Is here on free software magazine. Here I am going to briefly discuss the implications of HealthVault from a free software standpoint. Hopefully, by publishing this here, I might be able to draw some attention from the medical community to the free software community. Its something of a blind date, but I strongly believe the two of them should definitely meet!

What are the implications of a proprietary software PHR on software freedom? The ideals of software freedom are that users should have control of software, rather than companies controlling users through software. It may seem like a trivial point to my geek readers, but without control of software it is not possible to have control of data.

To a degree, _determined by Microsoft_, you can configure how Word behaves

When you write a document, you are using a word processor. The document is your data, and the word processor is the program that manipulates that data. But what if the word processor is not doing what you want it to do? Microsoft Word, for instance, marks documents with information about the user who created the document. This may not seem important unless you happen to be writing a word document that criticizes, say, Iran or China. If you were in those nations writing such a document, you might be concerned to find that your documents could be traced back to you. Can you change how Microsoft word behaves? To a degree, determined by Microsoft, you can configure how Word behaves in these situations. Beyond this only Microsoft can change how Microsoft Word behaves, and as a result, only Microsoft controls you and you relationship to your data.

The Free Software movement aims to change this. When we say "free" we mean free from exactly the kind of control that Microsoft has with Word. Suppose you create a document in Open Office, which is free software. If you really, really dislike how Open Office handles that document then you have the access you need to change how it works. You might need to learn programming or (more likely) hire a programmer, but you only have technical hurdles when you want to change Open Office, rather than control issues. Legally, you cannot change Microsoft Word's fundamental behavior. You only have the power that Microsoft gives you, and what Microsoft giveth, Microsoft taketh away.

We cannot afford to have our health care record data abused in this fashion. The only way to ensure that this happens is for Personal Health Record (PHR) services to follow three rules.

• Use free software for the PHR exclusively.
• Allow users to download the PHR software source code running snapshots.
• Allow users to download database dumps of their software

The implication of these three rules are simple. A user of a PHR must have the right to replicate his or her record using their own private server. That same user must have the right to modify and control the downloaded PHR software according to the definition of free software.

It should be noted that there are PHRs available under the GPL, like Indivo Health, which can easily be used in this fashion.

I promised I would also talk about how HealthVault is a threat to free software. Microsoft makes platforms. This is a great business strategy. Windows became more popular than other operating systems because there was more and better software available for it. So far, there are many organizations that are planning to "leverage" the HealthVault platform. If HealthVault is widely adopted, it will prevents an equivalent, even superior, free software alternative from receiving attention and support. In short, proprietary platforms are worse than mere proprietary programs because they encourage the use of further proprietary programs. HealthVault, like Windows, is a brood-mother of proprietary lock-in and inappropriate control.

What you can do

If you are geek, keep your family and friends away from HealthVault. Help people who are non-technical to understand these risks. If you are a health care provider you can lobby your leadership to use only free (as in freedom) PHR software like Indivo. If you need help with either of these things Contact Me