We know that information technology continues to advance at breakneck speed. We know that GPs don't want to spend a lot on information security. We know that transmission, aggregation and secondary uses of electronic data add significant value and are highly desired by clinicians, government, researchers, and corporations. We also know that the transmission and aggregation pose significantly greater risks to privacy and security. The fundamental difficulty arises from trying to balance all of these conflicting requirements.
Risk assessment seems to be the key to sorting out a reasonable solution.
Thoughtful consideration of all of the risks to information privacy and security and their consequences can result in a reasonably balanced solution. The problem with risk assessment is that it is not an exact science. It is similar to economics, in that somewhat arbitrary values, weightings and judgments contribute to the process and eventual outcome. Continued technological advancement makes predicted costings of technical solutions in the medium term quite uncertain. It is important to distinguish between management and technical issues in the protection of privacy and security.