Earlier quoted context omitted.
>"This is an important observation, and one that deserves some serious and deep reflection" From my perspective as someone who studied drug development and testing heavily in university, and now works as a programmer for medical ehr (hospital) software, I don't particularly think they're being unethical. The typical Phase 1 trial for a NME (new molecular entity; a new novel drug) is basically giving young dudes some…
Can you expand on how HIPAA and PHI impact testing? That sounds interesting and important.
This information is generated by real physicians, real nurses, real aides, etc, in actual care environments. People who trained for over a decade to understand what they're doing.
I trained for a very long time be a programmer, and I have extensive biology education.
But when testing my code, how can I emulate a PhD MD oncologist? How can I emulate a certified Nurse Practitioner, a Home Health Aide or a Licensed Nurse Practitioner? How can I generate an enormous amount of valid, real-world medical data for my test patient? I can learn that coumadin + aspirin creates a drug interaction and is a big no-no for I50.x style heart failure patients. But that's just one little trope I can repeat. There's 10,000 more things they do on a daily basis that I'll never grok.
The short answer is that I cannot. I use the programs, I enter things, I learn and do my best to emulate what my users do, but many of them have spent more time learning and perfecting their job than I have been alive. Plus, I don't have ten millions dollars worth of hospital equipment to generate real data with, to interface with, just various abstractions/test code we use when testing.
In the case of HIPAA/PHI, if there was more freedom to use protected health information, I wouldn't have to emulate medical professionals, I could copy real patient data and test my code against a production database.
But for the ultimate safety of the patients in our care, protected patient data is only allowed in 2 very secure messaging systems we use, and literally no where else.
So it often falls to the other half of our programming staff, the support staff, to take our code, patch it to a real hospital test system (hospitals generally have a live system and a test system physically hosted in their facility), and test against actual patient data from within the hospitals own network. As an application programmer that option isn't really available to me.
So it's two fold: the difficulty of emulating the incredibly technically detailed behaviors of highly educated professionals when testing, and the inability to use real world data for in-house testing efforts prior to shipping code.