Every healthcare interoperability platform makes judgment calls about a patient’s identity. When a record comes in for “Robert Smith,” born March 12, 1980, and the EHR already has a “Bob Smith” with the same birthday, someone, or something, has to decide whether that’s the same person. Get it wrong, and a documented penicillin allergy doesn’t make it into the chart, with impacts to the med list checked by a nurse, the alert an e-prescribing system doesn’t fire, and the summary an AI tool gives the next clinician.
These decisions are made constantly, on multiple platforms, usually in a black box.
The data layer closest to a patient's identity is where trust is especially important, because every downstream process and technology is built on it. Right now, the trust in that layer largely runs on faith. Open source is a structural advantage here, because it turns that faith into a verifiable process.
A company's open source codebase isn't just audited by its employees. Customers, security researchers, and teams building products on top of it can see its judgment calls, spot bugs, and suggest improvements.
A hospital’s compliance and security teams can review their own systems to see what’s running and how. A proprietary platform used by that hospital, however, isn't scrutinized by anyone besides the vendor that supplies it. PHI breaches involving third-party systems are not uncommon, and when one happens, only the vendor really knows what went wrong or how to fix it.
If a system can't be trusted to identify a patient, it's hard to trust anything built on top of it. When millions of records are involved, there are difficult choices to make, and some mistakes are inevitable. Open source code doesn't build trust with perfect matching, but with transparency: everyone can see how the decisions are made.
Broadly speaking, this matching process is straightforward. The devil of course, is in the details. Here's an example of Metriport code that determines whether two very similar records belong to the same person.
This example shows some of the decision-making criteria Metriport uses and the judgement call made. Between 0.0 (no information overlap) and 1.0 (virtually identical records), we selected 0.96 as the threshold that determines whether two records are merged into one patient’s history or remain separate. The trade-off between matches and potential errors is public, and we welcome the debate.
Broader scrutiny provides concrete benefits. Open source codebases receive bug warnings and improvement suggestions from external engineers, and in the spirit of transparency, a company's own developers often work out issues in public.
From a practical standpoint, open code also offers protection if a vendor changes direction or shuts down. Proprietary code usually disappears along with the company; published code doesn't.
Before Facebook shut down its Parse “backend as a service” platform, it open-sourced Parse Server, letting customers migrate their apps onto their own infrastructure. Similarly, after Basho went bankrupt in 2017, its community continued to develop its distributed database and release new features. (In Metriport's case, a company could independently run our open source code, but would face non-code challenges like network agreements.)
Interwoven open source companies tend to be greater than the sum of their parts. Companies that build in the open can plug into each others' work, giving customers more options for interconnected tools versus getting stuck with one vendor.
The data layer closest to the patient's identity is the foundation of digital health, making it too critical to trust to a black box. Everything from basic record keeping to AI-assisted diagnosis depends on it, and that dependency deserves to be identifiable.
To see what Metriport looks like under the hood, check out our GitHub repository or contact us anytime.
Get the latest updates and blog posts from the Metriport team.
