PPMC receive and produce a huge amount of data. We should create a structure to keep a log of what was received or sent and when. How to secure the files will be a challenge.
Before putting together such a structure, however, I think it would be beneficial to list what we receive and or send together with pertaining information.

In

• Claims
• Encounters
• Cap
• Eligibility
• Healthcare data (Ingenix)
• Fee Schedules
• Anything else?

For "In" data we should know the source, format, schedule, type (FTP, CD, ...), responsible party (who is supposed to receive or download it), URL, PGP Key, username, password and contact person.

Out

• Eligibility
• PCP Upload
• Encounter submission

For "Out" data we should store destination, format, schedule, type, responsible party, URL, PGP Key, username, password and contact person.

HMS Rewrite: Building blocks

Thinking of the different pieces for the rewrite. There was a lengthy article on Infoworld regarding SOA applications. The article mentioned several concepts that we will need to consider when developing the new HMS.

1. Repository / Registry
2. Logging
3. Monitoring
4. Version control
5. Security
6. Testing
7. Debugging

Repository / Registry
We will need at least a document listing the available services and their interface (parameters accepted and data (XML) returned.
There are real repositories/registries out there that could simplify this task. Few questions need to be posed:

1. Which repositories/registries are out there?
2. How expensive are they?
3. What features do they offer?
4. Do they handle ReST or only SOAP?

Logging
Originally I thought that we could simply use IIS logs to analyze usage and patterns. I'm now wondering if we will need to add additional logging within the single services.

Monitoring
How can we follow in real time who is logged into the system, which page/service are they using, what is the response time, etc. I will need to get together with Carl to see whether there are tools that offer this kind of information out of IIS. If it is not the case, we will have to either embed these measures into the services themselves or we will have to purchase some kind of net appliance to watch the traffic.

Version Control
How do we handle version control? A service should have a single URI/URL independent from the version or the implementation (ASP, PHP, .Net, ...). The version requested could be passed as a parameter.

Security
This is pretty much defined but the article in InfoWorld raised an interesting point: if an high level service authenticate and authorize a specific user, we shouldn't be authenticating and/or authorizing the user again when this service calls lower level services.

Testing
What's the best way to test? Have Shane and Stephen come up with some ideas and (maybe) some tools to take care of this issue. I think they should put together several requests to each service and see what the response is, then match the response with the expected response.

Debugging
How do we debug? Should we have some tracing within each service that we can turn on and see what the service is doing?
What other option for debugging do we have?