Poll: Online License Applications

[ChrisS]

The submission processes for Karelo and MotorsportReg are actually quite secure (128bit RSA encryption blah blah blah...  basically in the realm of online banking).  The real question is do you trust them to handle/hold your information once they have it.

The 'Only a WCMA owned system' option is really just a gauge of how much you trust those 3rd parties.  I'm not sure it's feasible for us to do that, and provide adequate security.

Is there any preference between MotorsportReg or Karelo?  I think MotorsportReg is easier to use, and has a pure motorsport focus, but Karelo is a Canadian company (vs. US).

Note: I clarified the voting options to more clearly split out email from the 'all online options' choice.

Chris

[ChrisS]

I received a re-assuring response from MotorsportReg that I thought I'd share.  In short, they have experience handling sensitive medical information, and do take it very seriously:

We already store medical data (you can see your own by going to My Account -> click your name -> Medical info) and we protect it the same way we protect credit card data: PCI DSS compliance, strong encryption, limited access, etc.  There is the fact that organizers need access to the medical data but the only way to get it as an organizer (as of today) is to print off a single PDF which is designed to be handed to the ambulance crew. 

It's not directly relevant to you in Canada but we are not subject to HIPPA because we are not a "covered entity".  Nonetheless, we treat the information very seriously and we believe our system is at least as secure and private as any filing cabinet in a club HQ/office/home.

Chris

[speedracer]

Personally I'm not too wild at trusting an online event registration company for medical records.

Another issue is that the "data" would be subject to that countries law.

I do like the convenience, but I'm left with too many questions to feel safe.

What terms of agreement would I be subjected to?
Ownership of the medical data?
Who has access to the data (developers, held desk, staf,etc...)?
What third party (data center, contractors, etc...) has access ?
How long will the medical record data be retained?
What method is the medical record stored?
What security procedures are in place (PCI-DSS is a merchant to payment compliance life cycle)?
What policy's and procedures are in place to safe guard the information ?

Sorry, lots of questions.