It is similar to economics, in that somewhat arbitrary values, weightings and judgments contribute to the process and eventual outcome. Continued technological advancement makes predicted costings of technical solutions in the medium term quite uncertain. It is important to distinguish between management and technical issues in the protection of privacy and security. Management issues are firmly within the control of GPs in their practices and the professional bodies who are responsible for overseeing 'best practice'. In Australia, awareness of privacy and security management appears to be poor.
Education is paramount.
Professional bodies must demonstrate leadership. Technical issues, on the other hand, are largely the responsibility of the system vendors. It is the vendors who must build in the smart card access control, the secure operating system patches, the encrypted audit trails and messages, the automatic backup procedures, and whatever else is deemed appropriate for a reasonable implementation of information system security in general practice. Clearly, no vendor will spend time implementing security solutions if there is no demand. We as GPs must arrive at a means for letting the vendors know what is required of them.