WCMA Forum

Updated with some information from MotorsportReg:

QuoteWe already store medical data (you can see your own by going to My Account -> click your name -> Medical info) and we protect it the same way we protect credit card data: PCI DSS compliance, strong encryption, limited access, etc.  There is the fact that organizers need access to the medical data but the only way to get it as an organizer (as of today) is to print off a single PDF which is designed to be handed to the ambulance crew. 

It's not directly relevant to you in Canada but we are not subject to HIPPA because we are not a "covered entity".  Nonetheless, we treat the information very seriously and we believe our system is at least as secure and private as any filing cabinet in a club HQ/office/home.

In short, they have experience handling sensitive medical information, and do take it very seriously.

---

I'm investigating options for online license applications for the 2015 season.  I would like to gauge everyone's comfort level with submitting medical information online.

Note: I intend for a mail in option available.

Thanks,
Chris

I have no issue with online applicatrion process, but unless you have a very secure system I donot want medical documents signed by a physcian exposed to the vagaries of the net, email is not even close to secure enough for this information.
Thanks
Dana

I agree with Dana and was looking for one more option in your poll - 5) It depends. If its a secure closed (i.e not public) online system, then no problem. not fond of the 3 options you list but I'n not a "No". Make sense?

Thanks Dana; my poll question is specific to the medical form because I assumed this would be the likely piece that people may not be comfortable with.

Jeff,
Could you elaborate on 'not public'?

Chris

I'm ok with motorsportreg, for all docs, which I would use. But agree a mail in option is require.

Nope, sorry.  Not gonna happen. It's difficult enough to get a busy physician to fill out a paper form. The odds of getting one to sit down and figure out a website-based form are slim to none.  If this proposal only involves the self-declaration form, then there's no advantage to an online form anyway, since logbook, membership card, cheque, photo etc must be sent in hardcopy regardless. 

Good point; my question is not clear!

The intention is that you would scan/take a picture with your phone/etc. of the paper medical form and submit that.  The intention is to offer a fully online application; attach the medical form and picture, and pay online.

Does this clear it up?

Chris

For 2015 ARCA is planning on sending it's members an electronic copy of their membership card in a pdf format which can be forwarded to WCMA for their license.

Sue

I'd like to see it get easier on the WCMA folks before easier on us racers. It really isn't that hard for me to fill out the forms, put them in an envelope, and mail it off. If Gail/everyone else would now have to print out/cut out/etc, I'd rather leave it as is.

I don't know that I have any good suggestions, in any case, I wouldn't be terribly concerned with sending my current medical stuff via the net - there isn't really any special info on the form that I can think of.

Gary

Why not have the application on line but then have the option of faxing in the medical form as a supporting document?  This is similar to what I just did for my daughter's university requirements.

Thanks

Gary,

I appreciate you thinking about the effort of volunteers!

We will be moving to printed hard cards this year, so electronic photos are easier to work with.  Any mailed in photographs will have to be digitized anyways.

I'm hoping the new system will be easier for everyone.

Chris

Not that I am a modern tech wizard, but who still has a fax?

Only lawyers, and real estate agents have fax machines...or know where a working one still resides.

Quote from: Sue Wilson on September 19, 2014, 04:29:10 PM
For 2015 ARCA is planning on sending it's members an electronic copy of their membership card in a pdf format which can be forwarded to WCMA for their license.

Sue

That's another really good discussion topic Sue.  I've created a separate thread for it:
http://www.wcma.ca/forum/index.php?topic=732.0

Chris

Quote from: 10cc on September 21, 2014, 03:11:21 PM
Not that I am a modern tech wizard, but who still has a fax?

Would you believe, Apple?

You know, the ieverything company.  Called them regarding a faulty product, shocked when then told me to fax them a copy of my receipt.

No problem submitting on line, as long as it a secure site. 

The submission processes for Karelo and MotorsportReg are actually quite secure (128bit RSA encryption blah blah blah...  basically in the realm of online banking).  The real question is do you trust them to handle/hold your information once they have it.

The 'Only a WCMA owned system' option is really just a gauge of how much you trust those 3rd parties.  I'm not sure it's feasible for us to do that, and provide adequate security.

Is there any preference between MotorsportReg or Karelo?  I think MotorsportReg is easier to use, and has a pure motorsport focus, but Karelo is a Canadian company (vs. US).

Note: I clarified the voting options to more clearly split out email from the 'all online options' choice.

Chris

I received a re-assuring response from MotorsportReg that I thought I'd share.  In short, they have experience handling sensitive medical information, and do take it very seriously:

QuoteWe already store medical data (you can see your own by going to My Account -> click your name -> Medical info) and we protect it the same way we protect credit card data: PCI DSS compliance, strong encryption, limited access, etc.  There is the fact that organizers need access to the medical data but the only way to get it as an organizer (as of today) is to print off a single PDF which is designed to be handed to the ambulance crew. 

It's not directly relevant to you in Canada but we are not subject to HIPPA because we are not a "covered entity".  Nonetheless, we treat the information very seriously and we believe our system is at least as secure and private as any filing cabinet in a club HQ/office/home.

Chris

Personally I'm not too wild at trusting an online event registration company for medical records.

Another issue is that the "data" would be subject to that countries law.

I do like the convenience, but I'm left with too many questions to feel safe.

What terms of agreement would I be subjected to?
Ownership of the medical data?
Who has access to the data (developers, held desk, staf,etc...)?
What third party (data center, contractors, etc...) has access ?
How long will the medical record data be retained?
What method is the medical record stored?
What security procedures are in place (PCI-DSS is a merchant to payment compliance life cycle)?
What policy's and procedures are in place to safe guard the information ?

Sorry, lots of questions.  :-[