So, my father is currently in the process of "hacking" together a database using FileMaker Pro, a GUI based databasing tool for his small (4 doctor) practice. The database will be used to help ease the burden on reporting from medical machines, streamlining quite a clumsy process.

He's got no programming background, and seems to be doing everything in his power to not learn things correctly. He's got duplicate data types, no database-enforced relationships (foreign/primary key constraints) and a dozen other issues. He's doing it all by hand via GUI tool using Youtube videos.

My issue is, that whilst I want him to succeed 100%, I don't think it's appropriate for him to be handling these types of decisions. How do I convince him that without some sort of education in these topics, a hacked together solution is a bad idea? He's can be quite stubborn and I think he sees these types of jobs as "childs play"

How should I approach this? Is it even that bad an idea - or am I correct in thinking he should hire a proper DBA/developer to handle this so that it doesn't become a maintenance nightmare?

NB: I am a developer consultant of 4 years and I've seen my share of painful customer implementations.


So it's a few years later now, and I've had time to reflect on this question. My dad ended up implementing a solution using Google Docs, FileMaker Pro and some email hooks. He set the whole thing up himself, and he says he is getting immense value from it.

If you are an experienced developer, you are perhaps reading that description and cringing. But I learnt a pretty good lesson from the whole thing actually - that people only care about the results, and not the implementation. All my dad cares about is the fact he doesn't need to enter patient information down on paper manually, and can instead quickly fill out a Google docs form. What's great is he's looking to hire a junior dev/ops person to focus solely on automation within his practice.

  • 6
    something hacked together like that can work fine... until the requirements change then the real trouble begins... Commented Nov 23, 2012 at 23:53
  • 33
    Ah yes. Common problem with doctors, they believe that being a doctor makes them smarter than everyone else and able to do everyone else's jobs. They don't realize what they don't know, even after it bites them in the ass. I would start by asking him what his response is going to be if his home-grown system is challenged during a HIPPA audit. With luck that will cause him to make some necessary requirement changes, and will cause everything to become much harder.
    – btilly
    Commented Nov 23, 2012 at 23:58
  • 8
    I should note that my comment about doctors is from much indirect experience of them. Quite a bit came because my wife is a doctor.
    – btilly
    Commented Nov 23, 2012 at 23:59
  • 10
    As somebody who has extensive experience in working healthcare IT, I can attest that a good number of doctors don't appreciate the skill and expertise of professionals in other fields. Let him try and if he fails then he will learn something very valuable. If he succeeds then I think you will learn something very valuable.
    – maple_shaft
    Commented Nov 24, 2012 at 2:57
  • 31
    just start to give him medical advice based on knowledge you collect from youtube videos... Commented Nov 24, 2012 at 7:39

10 Answers 10


I've been engineering Healthcare solutions for many years. I won't go into all the different reasons that your father shouldn't be doing this; most of the reasons being academic: meaning, if you've been in the industry long enough you know how these things snowball and develop a life of their own.

Instead your father, as a physician, needs to understand the professional reasons and real-life, non-academic, reasons why what he is doing is dangerous and possibly life-threatening; dangerous to his colleagues, dangerous to his patients privacy and identity, and dangerous to his practice from a legal standpoint.

The danger is multi-faceted:

  1. patient privacy (HIPAA, ARRA, Meaningful Use, HITECH Compliance)
    • what are the fields that are considered patient identifying fields (many professionals in the industry don't understand this, and just because you eliminate some of the obvious fields like last name, address, zip code there are still many other fields that would make it easy to associate clinical data to a specific patient; this, in itself, is difficult; there are companies out there making lots of money de-identifying clinical data - it's a whole domain in itself).
  2. HIPAA, HITECH and newer legislation spells out clearly how
    • auditing should be done
    • security should be done
    • password requirements
    • should the data at rest be encrypted
    • should the data transmitted be encrypted, and how
    • you must consider the controls if you are using any kind of hosted service (IaaS, PaaS)
    • do you have proper BAA and DSA in place
    • how do those hosting your servers control access
    • how do they handle multi-tenancy (you'd be amazed at how some of these large entities do NOT handle this appropriately)
    • if you terminate the contract with those hosting your infrastructure, how will they ensure permanent deletion of your data (NIST regulations)
  3. what are the governing controls in place for your development
    • do you have an sdlc in place
    • do you have traceability from requirements to code to QA
    • do you validate 'intended' use of your medical application/device
  4. is your software being QA'd, and do you have a User Acceptance Test (UAT) environment
    • how do you secure this environment, because you'll be using real patient data
  5. is he going to handle medicare patients, if so is he planning to use his database to report out?
    • the government has strict controls in place for the exchange of this data to their Health Information Exchange (HIE)
    • which leads to how will he implement his own exchange if he wants to take advantage of his clinical data repository (CDR)
  6. does he understand the particular NIST regulations he needs to abide by for data security
    • such as permanent deletion of data (if using a hosted infrastructure)
  7. you mentioned he will be taking data from medical machines
    • does he understand the new FDA medical device standards?
    • starting in 2013, any digital system that displays data from medical devices can be categorized as a medical device ... this means he must meet the FDA regulatory requirements for medical devices
  8. will his team and staff be making medical decisions based on the data in his database?
    • has he developed a solid clinical data model, flexible enough to handle the ever changing requirements (i.e., ICD-9 to ICD-10 to ICD-11 coding standards)?
    • how will he version the data model and keep it in sync with the data (i.e., if he changes the clinical data model how will older data be represented?)
    • will his system be able to produce an exact snapshot of the clinical data as it was seen on the day that a clinical decision was made? there are legal repercussions if he can't
    • does he know the difference between a real delete and a logical delete, and the implications to his data model; to his storage requirements; to his practice's policies?
    • does he have a vocabulary solution in place to handle all the different services he will need to use; much of the data needs to be coded (as opposed to free text), because he will want to take advantage of his CDR to produce ICD-9 compliant reports. And then he needs to take into account the changing of these standards; e.g., ICD-9 to ICD-10.
    • for vocabulary, terminology or Health Data Dictionary (all basically synonyms) how will he implement and ensure that old terminology can still be rendered for old clinical decisions?
  9. will he be storing allergy data?
    • how will his 'medical terminology' or 'vocabulary' definitions be stored?
    • will he integrate with other terminology systems like LOINC and First Data Bank?
    • does he have an understanding of terminology services (i.e., Health Data Dictionary)
  10. will he want to have data interfaced into his system, and maybe out to a health information exchange (HIE)?
    • if so, does he understand HL7 and its impact on his database?
    • does he understand interface engines and all that goes along with that?
  11. does he understand how to de-identify information?
    • this is important in the development phase and the bug fixing phase

These are just a few questions, and by no means should it be considered a comprehensive list. And for each answer there will be countless more questions.

In a Healthcare database there should not be any deletion or over-writing of previous data. This means there are never going to be 'delete from where...' or 'update set ...'. Instead you will only have inserts. You can imagine how this changes your data model and your queries. Now you can be creative and come up with different solutions to attain this goal, but the fact remains that this is a requirement that is unique to the Healthcare Clinical Data repository.

Just one more thought regarding the life-threatening side of this issue:

Let's take, for example, allergy information; I raise this one up because institutions who have been doing this digitally for years have learned that their processes need to ensure that allergy data is captured and that we can't assume that because technology captured the data in a database it is somehow inherently correct forever. This is why patients are asked for their allergies every single time as they move from one department to another, even within the same hospital. A patient's allergies can't be deleted (updates to a row delete the old information). A clinical decision based on digital data needs to capture what was 'presented' to the clinician at the time of the decision.

I know much of this may seem to be geared to a large institution. However, the regulatory parts aren't. And in any case, Healthcare Information Systems are inherently complex. Healthcare system engineering depends and recognizes the expertise and experience of good clinicians. However, there is a larger than average impedance mismatch (to borrow terminology from the ORM technology) in the Healthcare IT domain ... I venture to say larger because every domain has its mismatches.

Good luck!

  • 3
    This is surely the best, most comprehensive, answer I've seen. The OP's father could not only lose his practice by handling this wrong but even face a criminal penalty.
    – Rig
    Commented Dec 2, 2012 at 4:36
  • EMRs decrease physician productivity. The regulatory burdens you describe deal with things separate from medical care. Here a doc wants to write some software to get his job done better and the whole IT field goes off on him. Consider that this doc is actually going to learn something and will better be able to talk to IT about his needs. Personally, I find IT doesn't understand physicians speaking about their problems, but when I speak in IT language they get it. Also, this whole answer speaks to a centralized IT organization. Too bad medical IT can't create interoperable systems.
    – kd4ttc
    Commented Sep 1, 2017 at 16:18

A hacked together solution isn't always bad. If it's solving his problem, I wouldn't make too much of a stink over it. There's probably 10 working hacked together solutions in File Maker and Access for every professional database solution. After all, that's what Filemaker and Access are for. Sure, most of the hacked together solutions are awful under the hood. But they exist to solve problems, not win beauty contests. Often the scope of these solutions grow, and that's when someone is hired to build a professional solution.

What you might do to help his chances at success is express interest in his project and offer to sit down & help him define the database and walk through everything. If he doesn't want your help... drop it & let him be. What are you going to do, badger your father? If/when he gets in over his head, he'll let you know.

Another thing to consider is if this is a common problem among doctors, you might have a very good business opportunity in creating a generic solution.

  • +1 - But if he's as stubborn as the asker makes him out to be, he may not ask for help. ;)
    – jmort253
    Commented Nov 24, 2012 at 0:30
  • He is quite difficult to work with, as someone who has been "the boss" with no real formal education in those extraneous areas is. Commented Nov 24, 2012 at 0:42
  • +1 for "you might have a very good business opportunity" Commented Aug 21, 2013 at 4:03

As a software designer with 25+ years of experience, I can still see the attraction in crafting something yourself. Explaining things to someone not versed in that industry can be a huge drag.

So what if the database isn't normalised or could be made faster? A lot of non-critical software (especially in the age of agile) follows the wabi-sabi principle. It does what it needs to do and no more.

Please appreciate that not all software has to scream along with a perfect interface, lightning-fast database access and an immaculate GUI.

  • 2
    Fair point. I'm not dissuading him from this idea. I just want him to sit down and read a book, understand the problems and difficulties inherent in designing a relational database, before he hacks something out. Commented Nov 24, 2012 at 0:44
  • Hacking together a solution is not bad idea per se. Using hammers to drive screws is a bad idea in all circumstances. You need to know the basics and the tools to make something that has a chance of working correctly. Commented Nov 25, 2012 at 5:15
  • 6
    "Using hammers to drive screws is a bad idea in all circumstances." No it isn't. The point I'm making is that it often isn't important that the software is perfect as long as it does the job. The idea that writing software is some kind of other worldy task that should only be left to skilled professionals is a rather parochial attitude if I may say so...
    – Robbie Dee
    Commented Nov 25, 2012 at 23:29
  • If this is USA, I would say that given (1) the amount of government interference, (2) the complicated standards for receiving government incentives, and (3) the consequences of errors in someone’s medical records, it is highly advisable to leave it to people who are not only skilled professionals in the software realm, but skilled in the real of requirements for such systems.
    – WGroleau
    Commented Nov 30, 2015 at 21:41

My issue is, that whilst I want him to succeed 100%, I don't think it's appropriate for him to be handling these types of decisions.

Filemaker got its start as a database that anybody could use, and it still works very well in that role. If your father knows what he wants and feels comfortable putting it together himself, what are you worried about? If it works the way he wants, he wins. If it doesn't work the way he wants, he'll fix it.

You'd be right to be concerned if he were building a database for all the doctors that work for Kaiser Permanente, but if he's just building a tool for use in his own practice it seems like he's probably exactly the right person to be handling these decisions.

Don't let perfect be the enemy of good.


My advice is to pretend this doesn't exist or else it will drive you mad. I have a relative who's done a similar thing with his client list, and what he's created on his own is a monstrosity. I initially offered to help and he thought my quote (which had a hefty "family" discount) was outrageous. After having a look at it I suggested a bunch of changes, which he asked me to make in exchange for "a couple of beers." Family or not, Homie don't play that. I told him he should hire someone to do it, but he never did. I just had to cut myself off from it completely and pretend it doesn't exist, just to keep the awfulness of the project from eating at me.

  • 1
    +1 "Family or not, Homie don't play that." Commented Dec 1, 2012 at 21:22

You should let him try. However, you should make him aware of the fact, that when he reaches an impasse, it's his problem and any developer he decides to hire at that point, will have to start from scratch.

I like to hack together things a lot, like furniture and even plumbing. I enjoy it and I see nothing wrong with it. I just never would even dare to ask a skilled craftsman to jump in for me when I get stuck, simply because I think they'd throw up at the mere sight of my creations.

So let your father do what he likes, but try to let him understand the risks. Just explain to him, that when he at some point hires a trained developer to "just add one little feature", it's like asking experienced craftsmen to "just fix a couple of things" in a house where most the wiring and plumbing has been done with duct-tape, aluminium foil, Plasticine and good faith.


he sees these types of jobs as "childs play"

I am a developer consultant of 4 years

For your own well-being and your father's personal development let him fail. John's answer is rock-solid and you should mention enough to keep your father from getting on the wrong side of the law, or at least enough that he should know better. But this whole "humility" thing isn't something you can lecture to people and expect them to learn it. It's a very important life-lesson to try your hardest and utterly fail. Failure is a very powerful teacher. And he might gain some respect for his son's profession.

And hey, if he manages to cobble something that works well enough (and doesn't violate any laws), all the more power to him.


It's his business. And if he is determined, he'll make it work. And lots of folks have cobbled together solutions from various technologies to get stuff working.

Years ago, I reviewed the code of a friend of mine who put together a web application with PHP and some bulletin board software. He customized it heavily to meet his needs. The code was an abomination. Asides from barely being 1st normal form, he had HTML tags with data in his database. No MVC separation. But God bless him. His application worked, and he was able to pay his bills with the income from that web site.

My advice to him was this: If you are content to milk your application for revenues as long as possible, then don't refactor it using good software design techniques, and leave "well enough" alone. If you want to evolve your application to offer more services and get more revenue, then you'll have to pay up and refactor the code. He elected to go with the former. C'est la vie.

If your dad doesn't feel the pain of data duplication and weak data integrity now, he will later, and only then will he learn the value of what you're saying.


As a recently retired software engineer for a large non-profit healthcare provider, I strongly recommend looking for a hospital or large practice nearby that can for a reasonable fee allow him to share their electronic medical records system that meets the requirements for the Meaningful Use initiative (and other government incentive programs).

I am aware that “Epic” (http://Epic.com) supports their customers allowing smaller providers to share their system, and I imagine some of their competitors do also. Cerner is their biggest competitor, but several others are discussed at http://www.beckershospitalreview.com/healthcare-information-technology/50-things-to-know-about-epic-cerner-meditech-mckesson-athenahealth-and-other-major-ehr-vendors.html

There is a 75% subsidy from CMS for that sort of sharing. We passed on the subsidy to our clients by making the subscription price 25% of our cost.


I think the answer to your question mainly depends on how critical for his medical practice is this application. Will he be storing there just some patients data which he finds useful or any malfunction of this application may have severe consequences? If it may have severe consequences then he shouldn't do it but because we are not living in a perfect world convincing him that it is not a good idea may be completely different matter.

As you are a developer consultant I would suggest offering him help in QA and testing process. In this way you will keep good relationship with your father because you are "helping" him but at the same time you can make sure that his app is doing what is supposed to do or even find a problem which he will not be able to solve so he will seek more professional solution.

BTW I have seen quite many terrible apps which were doing their job and no amount of explanation why it's terrible would convince anyone to make any real changes in it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.