Ten Years with MCSD

A few months ago, I downloaded my Microsoft Certified Professional Transcript. The significant portion is shown here:

Ten years ago today, I passed the SQL Server 7.0 exam—the final requirement for MCSD certification.

Remember SQL 7? That was back when none of us really knew whether Microsoft would be a serious player in the RDBMS space. I think we know the answer now.

We started building AdvancedMD using SQL 7, but migrated to SQL 2000 by the time we released. Today, we’re enjoying the T-SQL and data type benefits (think XML) of SQL 2005, and our DCO team is in the process of migrating our primary client database servers to SQL 2008. Combined with Windows Server 2008, it’s giving us some significant performance perks.

Back when I passed Exam 176, we were still basking in the glow of Windows NT 4.0, and the “Option Pack” (including MSMQ and MTS) that came out in 1998. (I started building on MSMQ when it was in beta testing in 1997.)

So…ten years since I passed any sort of Microsoft certification exam, and now I’m waxing nostalgic over a queueing system. I must be getting old…maybe it’s a good thing I’m not writing code any more!

Happy Anniversary to Me: 10 Years as Microsoft Certified Partner

On October 1, 1999, I took (and passed) Exam 176: Designing and Implementing Desktop Applications with Microsoft® Visual Basic 6.0, thereby officially becoming an MCP (Microsoft Certified Partner).

Years earlier, I had made a conscious decision to ride Microsoft’s coattails, having developed a fondness for Visual Basic as a quick and dirty development tool. Fortunately, I never had to build a Windows application using MFC or ATL, since my career has focused on middle tier and database code, with a few opportunities to play with .NET (C#) WinForm apps and VB6 ActiveX controls.

This certainly wasn’t the only road to follow, and I wouldn’t even say it was definitively “the best” choice. Many developers have built successful careers around Java, the “LAMP stack”, etc. But it’s worked out well for me.

In a few months (January 25, to be exact), I’ll celebrate my 10th anniversary of passing the last of four exams required to achieve Microsoft Certified Solution Developer certification.

A lot of water has gone under the bridge in those 10 years, and a lot of code (good, bad, and ugly) has fallen out of my head. Not a bad way to spend ten years.

Engaging with Microsoft: Conferences, Forums and Summits

Let me say first of all that Microsoft feeds you better than anyone I know. My favorite part of the annual MS-HUG Tech Forum in Redmond are the meals.

Kind of funny: A co-worker and I were driving around in the Microsoft campus a few years ago and he chuckled when he saw one of these vans:

You know, Microsoft Analysis Services, Microsoft Reporting Services, Microsoft SharePoint Services, and now Microsoft Dining Services…

Anyway, in addition to great food, Microsoft serves up some great content (no pun intended) at their events.

Some of the best used to be their “Ready to Launch” events, where they would go across the country (and around the world) booking big movie theaters and filling them with developers and IT geeks, and giving away software.

Sadly, these events are a thing of the past—perhaps (as suggested by some Microsoft employees I spoke to recently) a victim of economic turmoil.

Also cancelled (or, more accurately, changed from an annual to a bi-annual event) is the 2009 Business Intelligence Conference. I went to last year’s conference and it was really excellent.

Apparently, they announced most of the really cool stuff coming out in SQL Server 2008 R2 next year, so there wasn’t a real need for a conference this year. Much of the content they would have had will be incorporated into the SharePoint Conference and PASS Summit Unite.

My other favorite events:

• MS-HUG Exchange (formerly MS-HUG Tech Forum)
  This is a free event hosted by the Microsoft Health User Group, which merged a couple of years ago with HIMSS. It’s only a couple of days long, but is very focused on how Microsoft technology is being used in healthcare. It usually features “marketecture” from Bill Crounse, MD, Microsoft’s worldwide health senior director, as well as case studies from various healthcare institutions.
• PDC
  Last year’s PDC was phenomenal. They had some pretty incredible technologies to introduce (Azure, Office 14 for Web, Surface, etc.), and the training sessions were very well done. I hadn’t attended a PDC for about 10 years, and I was impressed at how it has evolved.

Engaging with Microsoft: Case Studies

One of the tools that Microsoft uses to get its story out is case studies. As a “Microsoft Shop”, AdvancedMD has been featured in two case studies, both of which were driven and sponsored by Microsoft.

The first was a collaborative effort between a writer contracted by Microsoft and a couple of us (Ken Meyers, former VP of Operations, and myself), and it gives a broad view of our interactions with Microsoft, and how we leverage Microsoft technologies:

• Hosted Solution Offers a Better Option for Medical Practice Management

The second is a case study of Women’s Healthcare Associates, an AdvancedMD customer in Houston, Texas:

• Beyond the Exam Room

The final sentence in the introductory paragraph pretty much says it all: “Just ask Lourdes Rubio, who, as Practice Manager for Women’s Healthcare Associates in Houston, Texas, lost more than U.S.$150,000 in insurance claims due to bad software.”

So, why bother with case studies? They end up on Microsoft’s website, where they can be searched, but it’s doubtful that many prospective AdvancedMD customers would do that.

A couple of weeks ago I went to the local Microsoft Sales office (near the Salt Lake City Airport) to meet with a couple of ISV evangelists, and was surprised to see this one-page summary of our case study on the wall of the lobby (along with a dozen or so others):

To be honest, I’m not sure that we’ve really taken advantage of the case studies that Microsoft has done about us. We should probably have a few boxes of copies that we could deliver to prospects…but, since we do most of our business over the phone and Web demos, printed documents don’t fit into the equation very well.

So, here’s the really sad thing about this blog post: I can’t tell you how to get Microsoft’s attention to get a case study written, because I wasn’t involved except for a brief interview.

Speaking of which…I had to laugh the first time I saw my quotes in the case study. The writer did a GREAT job of making me sound eloquent. I did actually say everything in the case study that was attributed to me, but I’m pretty sure the words weren’t mine. Probably for the best.

In any case, I seem to recall that our PR company contacted Microsoft and set the wheels in motion. If we are successful in becoming a managed account, I would imagine that this kind of thing will become just part of relationship.

Engaging with Microsoft: Become an MCP

It’s been almost 10 years since I became a Microsoft Certified Professional. At that time, four tests were required, including two that related to building Enterprise-grade software, and two for specific development technologies (I chose VB6 and SQL 7). It took a fair amount of effort, but for the most part the exams covered concepts that an experienced developer would know without studying anything (although I did have to study for the SQL exam).

So, what have I gotten out of it? Nothing really material, but I do believe that it can help a job candidate stand out.

As an employer, I would never hire anyone just because they had MCSD, MCSE, MCAD, or MCDBA behind their name…any more than I would hire anyone just because they happened to have a degree from a prestigious school.

But the hiring process is essentially a process of gathering a dozen or more different pieces of information (aptitude test results, references, employment history, education, certification, personality fit, etc.), and certification certainly is a strong indicator of commitment to a career path, and dedication to a goal.

I would highly recommend to anyone who is committed to a career in IT (as a system admin, DBA, developer, or any similar career path) that they get some sort of certification. If you’re established in Microsoft technology, then the MCP program makes a lot of sense. Otherwise, there are other well-respected certifications out there (like A+, Security+, and CCNA) that could provide a similar “feather in your cap”.

For more information:

• Microsoft Certified Professional program website
• “10 Best IT Certifications”

Windows Server 2008 R2: 64-bit Only

Microsoft has announced that Windows Server 2008 R2, the server companion operating system to Windows 7, will run only on 64-bit processors. According to the web page describing improvements to Scalability and Reliability, "With customers being unable to purchase a 32-bit server CPU for over two years, the performance and reliability advantages to moving to this architecture were too beneficial to ignore."

That's pretty cool. We've known for a long time that the most recent version of Exchange, Exchange 2007, would run only on 64-bit servers, and Microsoft announced at PDC 2008 (and on this blog) that SQL Server 2008 R2 (due to be released in the first half of 2010) will be 64-bit only.

Looks like the 32-bit server is dead.

So...will the Standard Edition of SQL Server still be limited to 4GB of RAM? That would be pretty lame, but it's probably true.

Microsoft PDC 2008

This summary is not available. Please click here to view the post.

"Free" PMS and EMR software

Every few months, I get an e-mail or see a blog post about a new Open Source, "free" EMR or PMS. Usually, the e-mail is entitled something like, "We'd better keep our eyes on this..."

(By the way, I intentionally capitalize Open Source, because, as far as I'm concerned, it's a brand name. Or, if it's not a brand name, it's a movement. Or a religion. Or a political party. Whatever it is, it's a proper noun, and consequently requires capitalization.

For evidence of this, look at the Wikipedia entry for Open Source. As of this writing, it has the disclaimer, "The neutrality of this article is disputed" at the top. Of course it is! It's difficult to write about your religion and stay neutral.)

But I digress. I don't want to rehash the worn-out debate between Open Source and commercial software. That's about as interesting as Microsoft vs. Apple, Microsoft vs. Oracle, and Microsoft vs. Mozilla. The fact is, if Open Source works for your project, then you should use Open Source. If a commercial package meets your needs, use it.

Having spent most of the past 15 years of my career in the medical practice management software arena, I believe there are two broad categories of medical practices:

Open Source		Commercial Software
Sophisticated internal IT staff		Everyone else
Doctors = Technologists
High threshold of pain
Interest in or need for heavy customization
Equal/greater interest in tech innovation vs. treating patients

I honestly can't see where Open Source projects compete with commercial software like AdvancedMD. First of all, AdvancedMD and other SaaS-based software (is there any other kind?) are essentially free. The only up-front cost is for training and implementation. With commercial software, those services are available directly from the vendor, or from their authorized VAR. With Open Source, you'll have to find someone to provide those services, or you're working with a consultant. Either way, they're not free.

The real cost of software comes in the ongoing maintenance and support. With AdvancedMD, you pay a reasonable, fixed monthly cost. The software is maintained by the same team of IT professionals that maintain our other 3,000 customers. Help Desk support is provided by the same team of Support professionals that serve those same 3,000 customers.

If you choose Open Source, someone has to install and maintain the software, and provide end-user support. The software was free...these services are decidedly not.

That's not to say that there is no place for Open Source. There certainly is, and I'm certain that there are dozens if not hundreds of success stories.

The point is that it is very, very easy to determine whether you are a candidate for Open Source PMS and EMR software or not: If you fall in the left side of the above table, you should consider it. If you're one of "everyone else", well, welcome to AdvancedMD. (Sorry, that really was a shameless plug.)

IE8 compatibility looking good...so far

I downloaded the first beta of Microsoft Internet Explorer a couple of months ago to check out the new features and, while I was at it, find out how well AdvancedMD runs in it. (I blogged earlier about some of my fears about IE8.)

This is an important issue for us, because, historically, new versions of IE and (especially) Windows have caused us a few problems.

Most of the hurdles have come in the form of security enhancements. For example, we sometimes pop up dialogs outside the viewable area of the screen to test for the existence of controls, measure window title bars and borders, etc. Well, a couple of years ago (IE6 SP2), Microsoft decided to stop allowing windows to be opened outside the visible area of the screen (by default). Not a big deal--the only impact was that screens that used to be invisible suddenly started popping up on our users' screens. (Well, they would have if we hadn't identified and addressed the issue before SP2 was released to our customers.) But it was annoying.

Quite often, we see changes in behavior early in the beta process, and the behavior continues through the second beta, or even the release candidate, but the previous behavior returns in the final release. That happened in IE7, where the beta releases blocked pop-ups in the Trusted Sites zone (and we were scrambling to figure out what to do about it), but then the final release restored the previous behavior. (Pop-ups should not be blocked in the Trusted Sites zone by default.)

So, given this history, I was more than a little concerned when, after downloading and installing IE8 Beta 1, I couldn't run AdvancedMD. At all. I couldn't even log in. In fact, the user name, password, and office key text boxes didn't appear, just a scary-looking security alert of some kind.

Well, a few days ago I installed IE8 Beta 2, certain that I'd see the same behavior, and we would have to start exploring the problem and devising solutions.

To my astonishment, though, AdvancedMD runs perfectly under IE8 Beta 2, at least in all of the areas that I tested. Our QA team will continue to validate my findings, but at the moment, I'm very encouraged.

Perhaps the best explanation for this is that Microsoft invested extremely heavily in IE6 SP2 and IE7 to restrict javascript behavior to avoid the wide array of exploits that had become prevalent (and that seriously, perhaps permanently, damaged Microsoft's security credibility). That work is largely done, so they've begun to focus more on the feature set again. And javascript has been so severely restricted at this point that few further changes are required.

Whatever the reason, it looks like the upcoming release of IE8 will be uneventful for AdvancedMD and our users...unless they introduce something in the final release.

Microsoft HUG Tech Forum 2008 - Day 2

The Transformative Power of Technology, at the Intersection of Physicians and Patients (Opening Keynote)
Steve Shihadeh, VP, Health Solutions Group, Microsoft Corp.
Clyde Wesp, MD, FAAP, CMO, St. Joseph Health System

Today's Steve, like yesterday's Steve, compared HealthVault to PayPay, in the sense that "no one goes to the PayPal website...they go to eBay or Barnes and Noble..." I'm not sure that's quite accurate--PayPal was, in the early days, just a way to send money to send money to friends and family, and perhaps eBay sellers, instead of mailing a check. Once that business model was successful, online merchants jumped on the bandwagon.

In the case of HealthVault, Microsoft is hoping that vendors, hospitals, and insurance carriers jump on the bandwagon in a leap of faith that other vendors, hospitals and insurance carriers will follow suit.

As I've mentioned before, Google is taking more of a consumer-focused approach, much closer to PayPal's approach than HealthVault's.

Also, PayPal generates its revenue from transation fees. Microsoft claims that theirs is an advertising-based revenue model.

Another difference is that, for the most part, PayPal isn't a central storage facility for...well, anything. They do offer the ability to store cash in a money market account and then use that cash for future transactions, but many PayPal users (myself included) never store any cash in their PayPal accounts. Transactions pull money directly from the user's checking account or credit card to the merchant's account.

But I see what the Steves are saying. There is a need for a central clearinghouse for healthcare information, and it makes perfect sense that the patient should have control over the distribution of his/her information...even if (or especially if) they aren't fully aware of the control that they have (like they would if they were carrying around a PHR on a smart card or flash drive).

Click here for full presentation

One participant suggested that HealthVault would be useful to scientists as a source of participants in clinical trials and in other ways. Steve's response was that Microsoft made a hard choice early on that HealthVault would NOT be used in that way, because they worried that going down that road might inhibit adoption of the platform. Consequently, their position is very firm that they are going to err on the side of security and privacy, potentially at the expense of the life sciences side.

Great Healthcare via Unified Communications: A Developer's Perspective (Developer Track)
Chris D. Mayo, Technology Evangelist for the Unified Communications Platform, Microsoft Corp.


It should be news to no one that Microsoft would like to have all of their products fully entrenched in every company in the world. That's obviously not going to happen, since different IT shops have different platform expertise. But for companies that are already on the Microsoft bandwagon, it makes sense to at least explore Microsoft's offerings and, in the case of communications, consider Microsoft's Unified Communications platform as a replacement for traditional PBXs (or even newer IP-based telephony systems).

From a software engineering perspective, Microsoft has provided a wealth of tools (Web services, drag-and-drop WFC controls, etc.) to make it really easy to build UC features into apps.

Cross Enterprise Document Sharing (XDS.b) Reference Implementation (Developer Track)
Mark Simmons, Health Consultant, SIMPL
Wagner Silveira, Microsoft Technical Architect, Microsoft Corp.

This was an interesting discussion of the SIMPL/Microsoft approach to IHE...not highly relevant to AdvancedMD right now, because we're not pursuing IHE implementation at this point. Another opportunity to catch up on e-mails.

Better User Experience in Clinical Applications (Developer Track)
Anand Gaddum, Director, Healthcare Practice, iLink Systems
William Hughes, Director, Product Innovation, GE Heatlhcare Enterprise IT Solutions Division

Anand and William demo'd a prototype application built on Silverlight. It was very impressive, and only took a team of 5 full- and part-time engineers about 2 1/2 months to build...but it clearly wasn't ready for prime-time.

Still, it reinforces my believe that Silverlight will be a powerful development platform as it matures, and as the runtime becomes more ubiquitous.

In particular, as we try to encourage doctors to adopt new technology, Silverlight provides UI "eye candy" that might help pique their interest.

Building Safer Healthcare Applications in WPF and Silverlight with the Microsoft Health Common User Interface (Developer Track)
Andrew Kirby, Director in Microsoft Services UK, Microsoft Corp.

MSCUI was launched a year ago at the last Tech Forum in Redmond. This session was an overview of MSCUI and a view into how it's been adopted over the past year.

This is a really interesting project, because it isn't a sellable product, or even an initiative that directly results in the sale of Microsoft technology. It's a collection of design guidelines that are totally platform agnostic, as well as a collection of free controls that illustrate the principles of the guidelines using Microsoft technology.

Obviously, one of Microsoft's objectives is to provide enough free controls and other shortcuts using their technology that healthcare organizations will be encouranged to use Microsoft tools to create solutions, so it isn't a purely altruistic endeavor, but it's pretty cool, anyway.

There is a ton of information available at http://www.mscui.net/, so I won't dive in any deeper here.

Surface Technology in Healthcare (Closing Keynote)
Randy Fusco, CTO & Strategist, Microsoft U.S. Healthcare Provider Solutions, Microsoft Corp.

This was a pretty exciting session. Surface started out as an informal collaboration between a couple of departments at Microsoft back in 2001. A few years ago, it was officially funded as a research project by Microsoft, and now it is an actual product.

It's difficult to describe how cool this stuff is without actually seeing it. If you're interested, check out the Microsoft Surface website.

Microsoft HUG Tech Forum 2008 - Day 1

I'm at the Microsoft HUG (not "MS-HUG" any more, according to Michael Clifford's opening remarks) Tech Forum in Redmond today and tomorrow. My primary objective is to gain more exposure to HealthVault so that I can bring that knowledge back to my colleagues, but I'll be posting highlights from all of the sessions that I attend.

Opening Keynote
Steve Aylward, General Manager, Health & Life Sciences, Microsoft

I skate to where the puck is going to be, not where it's been.
- Wayne Gretzky

Steve started his presentation with Microsoft's Health Future Vision video (direct link).
The video has a lot of cool, visionary ideas, but I was especially impressed by the sweet TV in the patient's living room. Being a Tucson native, I liked her low-care landscaping (in contrast to the huge lawns in the Salt Lake City area). I was also happy to see that shopping carts wouldn't change.

In all seriousness, the video demonstrates a vision that Bill Gates has talked about for a long time: The convergence of media, computing, telecom, etc. My favorite part is when the patient uses her cell phone as a TV remote. Having 4 kids, that would change my life. (I'm not sure why the patient's "Digital Wallet" wasn't part of her phone or some other device.)

Microsoft's growth in healthcare market:

2000
63 employees
< $100 million in sales in healthcare market 2008
> 700 dedicated employee
> $1.2 billion in US
> $2 billion in sales world-wide

In 2008, Microsoft invested $8B in R&D. Steve couldn't say how much of that was invested in healthcare, but indicated that it was a large percentage.

Aside from core initiatives like Office, Windows, BizTalk, etc., healthcare is among Microsoft's largest areas of investments.

Other notes:

• Amalga HIS is for emerging markets, where there isn't already a lot of infrastructure in place.
• Amalga Unified Intelligence System: I don't know what this is.
• HealthRamp: "Internet health platform that enables third-parties to create valuable health-related services." That description (pulled from one of Steve's slides) confirms my earlier assessment that Microsoft is taking a more vendor-based approach than Google.

Unified Communications in Health Care (Developer Track)
Dr. Albert R. R. Kooiman
Bill Crounse, MD

Unification (via Office 2007) of:
- E-mail and unified messaging
- Instant messaging
- Enterprise telephony
- Conferencing

Dr. Kooiman opened with a demo of Outlook: He selected an e-mail message, then clicked a button to open an IM window with the sender. With another click, he called the sender on the phone. Presumably, another click or two would allow him to conference in another participant to the conversation.

The "Call to Action" for this session was to encourage developers to use Office 2007 as a platform to integrate unified communications into their applications.

Dr. Crouse introduced this video on unified communications on his HealthBlog, and showed it during this presentation. To be honest, I find UC to be more applicable to hospitals than ambulatory clinics, but perhaps there is a more relevant application for larger clinics.

Solving the Difficult Problems of Healthcare and Life Sciences with the Latest Generation of Microsoft Technologies (Developer Track)
Tim Huckaby, CEO, InterKnowlogy

Tim was invited to present because his company has done a lot of cool projects for healthcare organizations using Microsoft technologies. Also, Microsoft is IngerKnowlogy's largest client.

Tim demo'd a WPF application built on top of SharePoint Web services for Scripps research. Visually, the data is represented as complex, hyperlinked, rotatable 3D images, but they're stored as large text files in SharePoint. The graphical performance of WPF is impressive, and the rendering code was written by one developer in one week (although InterKnowlogy had invested heavily in WPF prior to embarking on this project).

Why hasn't WPF been widely adopted?
- It is huge: Larger than ASP and WinForms combined.
- It's a thick client, and thin clients are the current rage.

WPF is built on top of DirectX, and it makes sophisticated graphics much easier to deal with.

Silverlight only contains about 18-20% of the classes available in the full WPF framework.

InterKnowlogy has some some cool Silverlight demo apps.

Microsoft HealthVault Architecture Overview (Developer Track)
Sean Nolan, Chief Architect, Microsoft Corp.

Our bet: Patients as the hub of of communication.
- Sean Nolan's HealthVault presentation

Reasons to Integrate with HealthVault

• Private and Secure Storage
• Authenticate Users, Manage People Relationships
• Share Securely, Authorize Data Access
• Application Interoperability
• Device Connectivity
• Application and Device Discovery
• Developer Assistance

How does Microsoft monetize HealthRamp? (There are no fees or charges to use the platform.) They see healthcare being like travel - opportunities for advertising in the future.

HealthVault can be used in "Native" or "Copy" model:

• Native: Healthvault replaces traditional database and authentication mechanisms
• Copy: HealthVault is an external repository, you can pull data out of it or push data into it (import/export, merge, sync)

HealthVault supports both Windows Live ID and Open ID.

Interesting: All access to HV goes through the XML API (Basic XML over -HTTP interface, POST a request and receive a response)...NOT SOAP! (Although SOAP and WSDL will probably come in the future.)

This is interesting to me because we took the same approach with our core (XMLRPC) API 9 years ago. (In our case, SOAP wasn't fully baked, but we continue to believe that our lightweight version of SOAP is better suited for our application.)

Security, authentication, and access control are very important in HealthVault.

HL7 Based Data Warehousing: Fast Build to Data Use (IT Pro Track)
Eric V. Washburn, CTO, Athena Advanced Technologies/HVHS

This was a great opportunity to catch up on e-mail. (Eric did a good job, but his audience was pretty small--few organizations need to do what he did.)

Xbox: Gaming machine or healthcare platform?

If you thought that the Microsoft Xbox 360 was a gaming machine, like I did, you're a couple of years behind the curve.

I've attended 2 sessions at the Microsoft HUG Tech Forum so far, and both of them included slides that included the Xbox 360 in the Microsoft technology stack that is targeted at healthcare. The Xbox? I was intrigued, so I googled "Xbox healthcare". Here's what I found.

Almost 2 1/2 years ago, Dr. Crounse at Microsoft wrote about how the Xbox can be used to "help cure healthcare woes," based on research being done by Dr. Harold Goldberg. A month earlier, an AP article covered the work that Dr. Goldberg had been doing with the Nintendo Game Cube to encourage young people with diabetes to communicate with their doctors and manage their conditions.

It seems unlikely that Nintendo is interested in making heavy investments into healthcare, Wii Fit notwithstanding. So Microsoft, already generating about $2B in revenue from healthcare, is in an excellent position to leverage the Xbox in the healthcare market, particularly among young patients.

At CES in Las Vegas this year, Cerner demo'd their Cerner Care Console (announced in this press release), which is essentially just a customized Xbox 360. It allows hospital patients to play games, of course, but also provides education, a feedback mechanism, maps, information about the patient's doctors and other care providers, etc.

In my role as Chief Architect at AdvancedMD, it may become important that I get one of these in my office...for research purposes. That realization alone justifies my trip to the Tech Forum!

Microsoft SQL Server: World's most secure RDBMS

Hey, that's a pretty controversial headline for a mild-mannered blog like this one! But I think it's supported by evidence.

In November of 2006, Enterprise Strategy Group released an "Information Security Brief" that makes the following conclusions, based on Common Vulnerabilities and Exposures (CVE) data from the National Vulnerability Database:

• Oracle’s results over the past two years show that much work has to be done to bring the vulnerabilities into line with competing database products from IBM, Microsoft, MySQL and Sybase.
• ESG considers Microsoft to be years ahead of Oracle and MySQL in producing secure and reliable database products.
• Microsoft’s results are almost too good to believe, and thus serve as a model for other database vendors.

During that same month, David Litchfield did a separate study based on a broader set of data and reported:

• It is immediately apparent...that Microsoft SQL Server has a stronger security posture than the Oracle RDBMS.
• The conclusion is clear – if security robustness and a high degree of assurance are concerns when looking to purchase database server software – given these results one should not be looking at Oracle as a serious contender.

Even before those reports were compiled, Cesar Cerrudo of Argeniss put together this presentation in which he provides lists of Oracle security flaws and SQL Server security strengths and asks, in apparent exasperation, "Why do you think [Oracle] is Secure?" And, "Why do you think [Microsoft] is not Secure?"

It's interesting that Microsoft has several pages on its website where you can find articles like these (albeit not these specific ones) touting the security of SQL Server, while I couldn't find anything on Oracles site (and I looked) citing independent analyses that provide evidence that Oracle is more secure than SQL Server...and Oracle has had a couple of years to respond.

OK...so, all of this does NOT mean that SQL Server is better than Oracle. Recent releases of Oracle 11g and related products offer all kinds of features that SQL Server doesn't. I'm certain that there are literally thousands of companies currently using Oracle that would be foolish to consider a switch to SQL Server. There may even be hundreds of companies that should seriously consider switching from SQL Server to Oracle, for any number of valid reasons.

But, c'mon, think about it: Microsoft SQL Server more secure than Oracle??? Are we talking about the same Microsoft and Oracle? Unbreakable Oracle?

And don't forget that ESG found SQL Server to be more secure than MySQL...and MySQL doesn't have a target painted on its back. Hackers exploiting flaws in MySQL would be like animal rights activists vandalizing PETA headquarters. Well, not exactly, but it makes an entertaining simile.

In any case, SQL Server has worked great for us. We're looking forward to using some of the features in SQL Server 2008. I'll try to describe how we end up taking advantage of those features in future posts.

Cloud computing: Evolution of the species?

So I'm registering for the Gartner Web Innovation Summit, and I'm seeing two major, broad themes: Web 2.0 (which I understand) and Cloud Computing (which I don't).

From the look of things, everybody and their dog is "computing in the cloud"...except me. How did I get so far behind?

As I've studied up on the technology, I've been reminded of this classic (but obviously modified) drawing:




(I'm probably infringing someone's copyright, but I can't find out who the owner is...let me know if you find out.)

Here's how I see the (possible) evolution of application hosting (assuming that you manage your own servers):

1. Self-hosting
   Here, we get some Internet connectivity within our office space, grab some IP addresses, build some web servers, and announce ourselves to the world. When it's time to deploy or update the application, we sit on a stool in front of a keyboard and monitor and use an A/B switch to choose which server we want to work on.
2. Co-location (Phase 1)
   In this stage, we move our servers to a hosted environment, where the data center provides power and Internet connectivity. Aside from that, it all works the same: Every time a server needs to be refreshed, or the application needs to be deployed, someone drives to the data center, sits on a stool in front of a keyboard and monitor, etc.
3. Co-location (RDP)
   Now we're getting high tech: Instead of running to the data center all the time, we use RDP (if we're running Windows, or some equivalent technology if we're running something else) to hit our servers remotely. But we still own all of the equipment, and we have to get it in there somehow (perhaps using a 3rd-party IT resource).
4. Cloud computing
   Here's where it gets kind of...um...cloudy for me. Those nuts at Google, Amazon, and Microsoft (among others) are using virtualization on steroids to offer...well, heck, I don't know what! But instead of selling servers or hosting space, they're offering these funky units of computing time like "EC2 Compute Units". Wha...?

Is this where application hosting is going? The idea is pretty amazing: These huge players build megaservers that can host dozens or hundreds of virtual servers, and then they provision them out like web sites or SQL Server instances.

If your business suddenly doubles, you don't hop on a plane to install a bunch of blades in your data center. Instead, you fill out a form online asking for a bunch of EC2 Compute Units, then deploy your app. If traffic falls, you just decommission a few servers, and your invoice reflects the drop in usage.

Anyway, it's cool stuff. To be honest, I don't see AdvancedMD moving into this space any time soon, but it may be a fun spectator sport.

Events and Travel Plans for 2008 - Redux

Due to scheduling conflicts, I've had to make some changes to my travel plans for the year. Here's what I'm planning now:

HIMSS MS-HUG Tech Forum Redmond, WA, Aug. 26-27
I always learn something from these events in Redmond, beyond Microsoft's sales pitches. Most of the value comes from hearing about the challenges that other HIT people are facing, and how they are dealing with them.

Gartner Web Innovation Summit Los Angeles, CA, Sept. 15-17
I missed the Gartner Enterprise Architecture Summit in June, but this event seems more relevant to our business, anyway.

Microsoft Business Intelligence Conference Seattle, WA, Oct. 6-8
I'm really looking forward to this one. I don't know how they're going to make me more intelligent, but it's worth a shot!

Seriously, we've built our reporting strategy around Reporting Services, so I'd like to take a few days to find out what's going on in that area.

Health 2.0 Conference San Francisco, CA, Oct. 21-23
As the name would suggest, Health 2.0 (like "Web 2.0") is mostly about consumer-focused applications, but I'm interested in exploring how Web 2.0 technologies like mashups can be used within our offerings.

Construx Software Executive Summit Seattle, WA, Oct. 27-29
This conference comes highly-recommended by a business acquaintance who until recently worked for a local EMR company.

Alternate: Microsoft PDC Los Angeles, CA, Oct. 27-30
I really hate to miss this one, because Microsoft has a lot going on (HealthVault, Live Mesh, SQL 2008, etc.), and there's no better place to catch up, IMO. But it conflicts with the Construx summit.

Microsoft's "SaaS Maturity Level"

Microsoft has an interesting way of looking at SaaS-iness. They have a four-level "SaaS maturity model" that looks at an application's scalability, configurability, and "multi-tenant-efficiency" to determine what SaaS level it fits into.

This model has been around for a couple of years, but I was introduced to it in a "CTO P2P Forum" put on by the Utah Technology Council and featuring Nate Bowler, CTO of @Task.

It was obvious from Nate's presentation that they're doing some really great things there, but it was also clear that they haven't reached the 4th level of SaaS maturity, according to Microsoft's model. But that isn't necessarily a bad thing, as Microsoft clearly states.

But what's really interesting to me about Microsoft's SaaS maturity model is that it only seems to address the architectural aspects of SaaS...which, while fundamental to an overall SaaS philosophy, don't in and of themselves make a SaaS offering.

We learned years ago (before the "SaaS" acronym was coined) that there is a lot more to SaaS than software. If your Sales team isn't SaaS-oriented, or your client support teams aren't SaaS-oriented, then you're not going to have much success...because your salespeople won't sell, and your customers won't get adequate support.

For example, how do you price SaaS? If your nearest client-server competitor is selling their system for $50,000 with a 20% annual maintenance contract, do you sell your system for $49,000 with a 15% annual maintenance contract? Of course not. If you're truly SaaS, then you may (and probably will) charge an upfront fee for implementation and training, but your pricing should be a monthly (or annual) subscription model, of perhaps $1,999/month.

So, that brings in steady recurring revenue month after month as long as you can keep the customer. But then how do you pay the salesperson? I don't know the answer, but certainly it will be different from your competitor's compensation plan.

Anyway, Nate's presentation was excellent, but it was clear that their un-SaaSiness extended beyond their architecture into their deployment model and other business decisions. Again, that's not a problem, as it seems to work well for them.

I came to the conclusion that AdvancedMD is just about as SaaSy as you can get. That's pretty cool, considering that our archicture and business model predate the industry's fascination with SaaS by several years.

It's good to be king!

Only Microsoft could get away with launching a product that won't actually be released for another six months or so.

Was it just me, or was anyone else expecting a concurrent release of Windows Server 2008, Visual Studio 2008, and SQL Server 2008?

Turns out we were confused. What's been happening all around the world for the past several weeks at "Heroes Happen Here" events, is the launch of those three products, not the release.

Apparently, "launches" no longer have to coincide with "releases", as attested by Microsoft's announcement of the delayed release of SQL Server 2008, in a post on The Data Platform Insider blog on January 25, 2008.

That delay is no big deal, of course--SQL2005 is a fine product, and I think we'd all agree that a high-quality release is more important than a quick one. Just disappointing...especially to our Engineering and IT teams, who have their eyes on a couple of the juicier features.

As Joe Wilcox says on eWeek's Microsoft Watch, Microsoft doesn't need to rush, because those of us who license Microsoft products under their SPLA or annuity models are going to keep ponying up the cash in anticipation. The only possible downside may be the acquisition of MySQL by Sun. (Huh? A billion bucks for "free" software?)

Events and Travel Plans for 2008

For the benefit of other AdvancedMD employees who may care, and the morbidly curious, here is a list of the events that I plan to attend this year:

Microsoft Heroes Happen Here - May 20
Free Microsoft swag! They'll be giving away free copies of Windows Server 2008, SQL Server 2008, and Visual Studio 2008. (I wonder if I could trade Window Server 2008 in for a copy of Windows 2000 Server...?)

Utah HIMSS Annual Spring Conference - June 6
It's cheap and it's local. To be honest, I haven't been able to find out exactly what goes on at these things, but for $85 and no flights or hotels, I figure it's worthwhile to find out.

Gartner Enterprise Architecture Summit - June 9-13
In December 2006, I was invited by Microsoft's BizTalk team to give a 15-minute presentation at the Gartner IT Summit in Orlando about how AdvancedMD has incorporated SOA and SaaS concepts to build a successful business. I didn't have an opportunity to attend many other sessions, because I was busy hacking together my presentation, but I was sufficiently impressed by their lineup of speakers and topics that I'd like to check this architecture conference out and see whether Gartner puts on a worthwhile event.

HIMSS MS-HUG Tech Forum - August 26-27
I always learn something from these events in Redmond, beyond Microsoft's sales pitches. Most of the value comes from hearing about the challenges that other HIT people are facing, and how they are dealing with them.

Microsoft PDC '08 - October 27-31
It's been about 10 years since I last attended a PDC. Like most technical conferences targeted at developers, the PDC doesn't have many answers...but it helps you identify the questions so that you can go home and research the answers. Other premier conferences like VSLive offer certain advantages, but I attended VSLive in San Francisco a few years ago, so I'd like to check out the PDC this year.

[Edit: Scratched TEPR from my schedule. I hadn't realized before that Monday, the only day I could go, was a half day, with only the exhibit hall available in the afternoon. Too costly for just a few hours of value.

TEPR 2008 - May 19 TEPR ("Towards the Electronic Patient Record") is, to the best of my knowledge, THE EMR conference to go to. Of particular interest is their EMRCompare program, which allows participants to watch a bunch of EMR vendors demonstrate the basic workflow of their products. The main TEPR conference goes from the 19th through the 21st of May, but I'll only be hitting the first day so that I can get back for... ]