# Design, Implementation, and Field Testing
## 3 System Design
### System Design Rationale
#### 3.2.5 Design for Usability while Protecting Patient Privacy  
Privacy is a double-edged sword with respect to the usability of a system. For PACTS, without privacy protection for patients, it will not be allowed to use in nursing homes. Furthermore, without privacy protection for the participating nursing assistants (for example, their images will not be recorded in anyway), they will unlikely agree to be tracked. However, privacy may also negatively impact the usability of the system.  
At the beginning of the field study, a nursing assistant would have to manually register with our system every time she or he went to a room to provide bedside care. This caused significant frustration with them and many eventually chose not to register with the system. The nature of the patient-care work requires the nursing assistant to move in and out of a room frequently. Even while a nursing assistant was doing bedside care, she or he might be unregistered by our system due to temporary occlusions by furniture or by the patient. This unexpected difficulty forced us to improve the usability of the system while not significantly reduce the privacy protection of patients.  
We decided to incorporate a lease-based mechanism into the system. Once a nursing assistant manually registered with a KinectServer, the KinectServer grants the nursing assistant a lease. While the lease is active, the KinectServer would automatically re-register the nursing assistant as long as the KinectServer has detected one and only one user is present in the view of the Kinect server. This mechanism could improve the usability of the system because the nursing assistant would be automatically re-registered if the KinectServer accidentally unregister her/him or when the nursing assistant goes out and in the view of the Kinect sensor. In the mean time, this mechanism does increase the risk of privacy violation because if one nursing assistant leaves the room and a visitor goes into the same room, the latter would be registered as the nursing assistant. However, this scenario occurs very rarely because a visitor typically would be accompanied by a nursing assistant, at least during the initial visit.  
The lease time is critical to the success for the lease-based mechanism. If it is too long, it increases the risk of privacy violation. If it is too short, the usability of the system will not be improved significantly. We consulted with the administrators of the nursing home, and concluded that the lease duration should be set to 30 min because the time corresponds to the average duration of a bedside care session. Hence, with the lease-based mechanism, a nursing assistant would only have to manually register with the system once for every session of bedside care. Typically, a patient only needs bedside care during early morning when she or he is about to get up, and at night when she or he is about to go to sleep. Hence, a nursing assistant would only need to manually register with the system once or twice per shift.  
As a pre-caution for privacy protection, we added a way for a nursing assistant to manually terminate the lease and stop tracking when she or he knows that another nursing assistant will replace her/him. For the Pebble smartwatch, this can be done by pressing the down button.  
Before we conclude this section, we should note that there are other factors that impact the usability of the system. For PACTS, the non-compliance activity detection accuracy also plays a big role in the usability of the system. As evidenced in the field test, the presence of false positives and false negatives negatively impacted the usability of our system, which we will address in future works.