Integrating contact tracing into Norway’s complex health information ecosystem: A case study of flexibility and redundancy in the information system response to COVID-19

(1)

Integrating contact tracing into Norway’s complex health

information ecosystem

A case study of flexibility and

redundancy in the information system response to COVID-19

Bendik Sem Kvernevik

Thesis submitted for the degree of

Master in Informatics: Programming and System Architecture

60 credits

Department of Informatics

Faculty of mathematics and natural sciences

UNIVERSITY OF OSLO

(2)

(3)

Integrating contact tracing into Norway’s complex health

information ecosystem

A case study of flexibility and redundancy in the information system

response to COVID-19

Bendik Sem Kvernevik

(4)

Integrating contact tracing into Norway’s complex health information ecosystem

http://www.duo.uio.no/

Printed: Reprosentralen, University of Oslo

(5)

Preface

This work has been carried out as the final part of my master’s degree in Infor- matics at UiO. It has been quite special circumstances to immerse oneself into a full-time project related to the pandemic whilst everything you read about and experience in your personal life is affected by it. The sole focus on the unfolding situation has been both a challenge and a benefit to the research. Right now, I look forward to a more diverse everyday life, perhaps not so driven by external forces.

Thank you to my supervisor Terje Aksel Sanner and co-supervisor Ragnhild Bassøe Gundersen for guidance, support, and interesting discussions throughout this process. An extra thanks to Ragnhild for the collaboration in the data collection central to this study. I also want to thank all the respondents for contributing to this research, these interactions have been enlightening, encour- aging, and essential to the outcome of this thesis. Lastly, thank you for all the support from Victoria, family and friends.

–

Bendik Sem Kvernevik Oslo, June, 2021

(6)

Abstract

The importance of a robust, yet responsive health information ecosystem has proven crucial with the COVID-19 pandemic. As contact tracing became a re- source intensive task posing major challenges for the Norwegian public health system, the information flow between systems gained more importance, to reduce time-consuming processes and ensure data for well-informed decision making. In lack of an integrated system the contact tracing teams in the municipalities were prone to strain and overtime; focused on tracing outbreaks to get index cases in isolation and close contacts in quarantine, as well as having an important role as data collector with the increased pressure for timely and high quality data for national disease surveillance. However, introducing systematic changes to improve interoperability during a state of emergency can be risky with respect to personnel resources, timeliness of data and ultimately patient safety. Thus, tackling the integration challenges and increasing data quality, without decreasing data timeliness critical to quick outbreak response has been key, demanding flexibility from the health information ecosystem.

In thecontext of information system integration and standardization related to the data flow of test results the following research question has been explored: What is the role of flexibility and redundancy when integrating digital contact tracing in a complex national health information ecosystem? A holistic approach aligned with interpretive qualitative methodology has been used, considering stakeholders in the operational and the strategic level of the health sector. Thepractical contributionis the identification of key pressure points and dependencies which may halt the ability to adapt in a complex health information ecosystem. The theoretical analysis argues that flexible standardization is useful but may fall short in a complex ecosystem where quick adaptation is needed. A bottleneck concerning the observed complex integration processes has been the lack of standardization. However, the dependencies behind what is making the standardization process hard should perhaps attain more focus.

Redundancy has a supportive role in complex transitions like these.

(7)

List of Figures

2.1 Problem dimensions for system integration by Hasselbring (2000) 8 3.1 Overview of the health system in Norway (Saunes, Karanikolos,

and Sagan 2020) . . . 14 4.1 Pre-COVID-19: Information flow of positive test results following

a test of suspected respiratory disease . . . 21 4.2 Post-COVID-19: Information flow of positive COVID-19 test re-

sults following a test of suspected respiratory disease . . . 22 4.3 Fiks Contact Tracing integrations (2021-04-07) showed in GUI,

registration form for index case. (1) ID and contact detail integration, (2) test result integration, (3) Clinical Report integration. 25 4.4 Timeline of significant events . . . 26 5.1 Analysis process: Early draft of holistic model attempting to

comprehend the processes and systems in play with Fiks Contact Tracing system . . . 32 5.2 Analysis process: Later refinement of figure 5.1 simplified for case

focus on MSIS integrations . . . 33 6.1 Information flow of positive COVID-19 test results: Contact trac-

ing system integration highlighted . . . 36 6.2 Information flow of positive COVID-19 test results: NIPH and

laboratory highlighted . . . 41 6.3 Bar chart displaying distribution of 26 most common laboratory

test result values reported to MSIS labDB in december 2020.

The least used text values are neglected in this data set, the per- centages represent approximates relative to the group, calculated from total values (appendix A.2) . . . 44 6.4 Example of test result reporting in a LIS used by one laboratory 47 6.5 Information flow of positive COVID-19 test results: Contact tracer

highlighted . . . 50 6.6 Data sources and notification of test results. From the inter-

viewed contact tracers point of view. . . 51 7.1 Circular dependency: Standardization and redundancy of labo-

ratory data . . . 63

(11)

List of Tables

4.1 Initial integration efforts . . . 24

5.1 List of video interviews . . . 29

5.2 List of textual interviews . . . 29

5.3 Concepts used in analysis . . . 31

6.1 Valid values in the first edition of the Norwegian standard for microbiological test result textual values (Direktoratet for e-helse 2020c) . . . 46

6.2 Stakeholder challenges . . . 55

6.3 Overarching obstacles to seamless data flow . . . 56

6.4 Overarching consequences due to stitched data flow . . . 56

7.1 Concepts . . . 59

7.2 Use flexibility sub-categorization . . . 60

(12)

Acronyms

APIApplication Programming Interface

CCRCommon Contact Register (Norwegian: “Kontakt-, og reservasjonsregis- teret”)

COVID-19Coronavirus Disease 2019 (SARS-CoV-2, Severe Acute Respiratory Syndrome Coronavirus 2)

DHIS2District Health Information Software 2 EDIElectronic Data Interchange

EPRElectronic Patient Record

GAENGoogle Apple Exposure Notification

GP General Practitioner (also referred to as regular GP which specifies the continuity of the patient relationship in the Norwegian health care)

GUIGraphical User Interface HISHealth Information System ICAInfection Control Act ISInformation System

KITH Norwegian Centre for Informatics in Health and Social Care

KSThe Norwegian Association of Local and Regional Authorities (Norwegian:

“Kommunesektorens Organisasjon”) LIS Laboratory Information System

MSISThe Norwegian Surveillance System for Communicable Diseases (Norwe- gian: “Meldingssystem for Smittsomme Sykdommer”)

NDEThe Norwegian Directorate of eHealth NDHThe Norwegian Directorate of Health NHN Norwegian Health Network

NIPHThe Norwegian Institute of Public Health

NLK Norwegian Laboratory Coding System (Norwegian: “Norsk Laborato- riekodeverk”)

NPRThe National Population Register NPU Nomenclature for Properties and Units

OECDOrganisation for Economic Co-operation and Development RHA Regional Health Authority

RISRadiology Information System UiOUniversity of Oslo

(13)

Chapter 1

Introduction

1.1 Case introduction

The real world problem considered in this case study is that the complex national health information ecosystem in Norway introduces challenges to the assembly of quality data, in a timely manner, to coordinate contact tracing. With the COVID-19 pandemic, there was quickly identified a need for a software solution to aid the public health care service in monitoring disease outbreaks at the municipal level. Prior to COVID-19, the low occurrence of communicable disease in Norway had suppressed the need for a digital contact tracing system. The national surveillance of communicable diseases was operated through the Norwegian Surveillance System for Communicable Diseases (MSIS), a national database managed by the Norwegian Institute of Public Health (NIPH) to which health personnel are obliged to report detected cases of notifiable diseases. This was done by paper and post when COVID-19 was discovered. At the local level, health personnel were using pen and paper, Excel spreadsheets, and Google searches in the contact tracing work (Coronavirus Comission 2021), which did not scale well with the management of a highly contagious and un- controllable virus. With the substantial increase of communicable disease cases from COVID-19, a digital system was needed at the local level to report and manage the index cases, close contacts, and related data. The primary health care system in Norway is largely decentralized with 356 municipalities having key responsibilities. These municipalities thus had to individually administer measures in the face of the challenges, which made way for the innovation of multiple contact tracing systems. The research done for this study has mainly revolved around the DHIS2-based information system developed in collaboration between NIPH, University of Oslo (UiO), and the national advocacy organization for local governments in Norway (KS), namely Fiks Contact Tracing (KS 2021). However, aspects related to integration with national information system infrastructure may apply to the general case of contact tracing systems in Norway.

The development of an efficient and secure contact tracing system demanded integration with existing system infrastructure to minimize manual and duplicate work load, in this way making it scalable in the event of a virus outbreak.

This case study explores the integration with systems, registers and services

(14)

which unfolded in the early phase of the COVID-19 pandemic. The integration challenges from the empirical findings are analyzed with a holistic socio-technical perspective using the concepts of flexibility and redundancy, as they pertain to standardization. The focus regarding integration efforts is primarily on the data flow of the test result data following the integration with MSIS, including the emergent national laboratory database, which plays a central role in the disease surveillance in Norway. This entails the test result integration and the Clinical Report integration (Norwegian: “Klinikermelding”), which are codependent on the other integrations for a secure and seamless workflow for the contact tracers. The Clinical Report introduces more complexity in the data flow of test results and was highly sought as an integrated solution, being the root cause for a significant amount of paperwork in the early stage. The test result data was a recurring theme early on in the data collection of this study, and there were identified multiple challenges related to quality, timeliness, and standardization, arising from different needs from the various stakeholders.

Timely and high quality test result data is of importance for efficient contact tracing, disease surveillance and decision making in outbreak response; thus making it key to the person being tested, the local authorities (districts, municipalities), and national authorities. A statistical report from NIPH in early January 2021, being considered in decision making by the Ministry of Health and Care Services, was based on data from MSIS and was revealed by the press to entail great uncertainty (Aftenposten 2021a). The statistic significantly un- derreported the number of people tested, and had counted some positive cases more than once, resulting in falsely reporting almost double (1.86) the amount of new positive cases out of the number of tested, mainly due to the increase of negative test results. ¹ NIPH responded to the flaw:

Then we will have to live with the fact that we will make a few mistakes. The alternative is that we are sitting on numbers, and that the public does not get access to them. So I hope we will be understood when we say that the number was not so useful, but that we chose to do so because we were working on the assessment and reported on a uncertain situation. Luckily, the number was not crucial for the assessment.

- Director general, NIPH

From a political perspective, the issue becomes less of a choice: “Not acting because knowledge is imperfect is usually not an option” (Coronavirus Comission 2021, p. 85). This illustrates the tension between timeliness and quality of data in this critical situation, which is related to challenges with data flow, and consequential extra work due to lack in data quality.

1.2 Research question

The main research question for this study is:

1The numbers in question, regarding test results from 28. and 29. of December 2020, have since that correction been updated multiple times. Based on daily reports from NIPH available at https://www.fhi.no/en/id/infectious-diseases/coronavirus/daily-reports/daily-reports- COVID19/, fetched regularly by Our World in Data at https://github.com/owid/covid-19- data/.

(15)

RQ: What is the role of flexibility and redundancy when integrating digital contact tracing in a complex national health information ecosystem?

Theoretically, this relates to the flexibility of standards and information systems required to adapt in a changing health care environment. Redundancy concerns the coexistence of similar processes and data in the health sector and whether they may be considered of useful functionality or something that may be eliminated. This discourse have been chosen as it is highly relevant to the situation with the pandemic where the public health care system has needed to adapt, demanding flexibility. Redundancy may be observed as similar data, processes and systems may emerge or gain foothold in local settings. The latter apply specifically to the repetitive tasks performed in the contact tracing work and reporting routines related to obligated notification of communicable disease cases. The contact tracing system had to fulfill increasing amounts of different integration needs regarding seamless flow of data input and output to support the various information needs.

Furthermore, the RQ is considered with special attention to the emergent need of obtaining scalability for timely notification of positive test results amid the pandemic. The following question, more specific to practical implications, has been driving the empirical data collection and provides a basis for answering the main research question:

What affects the seamless flow of high quality and timely COVID-19 test result data in Norway?

1.3 Digital tools in response to the pandemic

There have been multiple kinds of digital tools developed in the response to the COVID-19 pandemic. This thesis revolves around the official contact tracing system functioning as a data collection tool used by the public health service to register and monitor index cases and close contacts in relation to COVID-19 disease outbreaks. Such kind of system is categorized as a outbreak response tool by the WHO (World Health Organization 2020).

There are other kinds of contact tracing tools, in particularproximity tracing apps like “Smittestopp 1” used in Norway and similar automated tools taking advantage of, and pro-actively collecting data from areas with a high population of smartphones. These kind of tools could possibly streamline the collection of close contacts, but relates to a fundamental different discussion about data privacy(-preservation), ethics, public trust in government, and politics.

The global discussion and development regarding proximity tracing culminated in the deployment of GAEN API (Google Apple Exposure Notification Appli- cation Programming Interface, Apple 2020), available for governments in the privacy-preserving use of exposure notification, thus helping only to a limited part of the overarching contact tracing work. While acknowledging that fetching close contacts from a pre-collected list from an index case’s smart phone,

“distributing” the workload to individuals, could possibly lift a heavy burden off the contact tracers, these kind of proximity tracing apps are left outside of the scope of this thesis.

(16)

Moreover, there are digital tools related to communicable diseases in other ways, like following up the state of health of people who have tested positive for COVID-19, categorized by WHO as symptom tracking tools. This thesis does not cover such standalone tools, even though some systems developed for contact tracing may have a more holistic approach, with a larger scope of features and integrations concerned beyond the fundamental work of tracing COVID-19 disease outbreaks. As this case study explores the contact tracing in the context of integration, the observed integration efforts will be in focus.

1.4 Stakeholders, information needs and defini- tions

The stakeholders relevant to this study are the contact tracer (Norwegian:

“smittesporer”), regular GP, NIPH, laboratory and the individual (either an index case or close contact of an index case). The laboratory has the critical function of analyzing test samples and delivering test results to the other stakeholders. The contact tracer is critical to the local infection control work, NIPH is responsible for the national infection control measures, and the GPs are important to the follow-up of patients. The main part of this study has revolved around the contact tracer, NIPH, and the laboratory; with special focus on the aspects that may contribute to easier and more effective contact tracing and thus a better outbreak response.

Contact tracers have been organized in contact tracing teams in several municipalities, their responsibility being formally within that of the municipal doctor. The user of a contact tracing system has thus become a key stakeholder in the primary health care sector, tracing COVID-19 infection through registration, interviewing and informing people possibly subject to COVID-19 infection.

They need high quality and timely data in the form of test results, identification and contact details, to ensure effective mitigation of disease outbreaks. This is also important for simplifying the collecting of data to NIPH and the national disease surveillance. A contact tracer is the data collector when talking about a contact tracing system, and may be a person qualified for health care work.

Considering the lack of health personnel in such a public health crisis, a goal should be to minimize the time at which these qualified personnel spend time doing contact tracing work at the cost of being unavailable for other health care services. Nevertheless, since non-qualified health personnel (preferably with some experience) was needed and recruited to these positions in Norway, the more case specific term contact tracer will be used to describe this actor.

NIPH, as the national institute responsible for infection control, needs high quality and timely data in the form of test results and Clinical Reports with supplementing information about an index case. This is important for disease surveillance and informing decisions at a national (and international) level. The laboratories serves a key role in supplying the test results to all actors in the public health service.

The contact tracing system introduce some phrasing challenges to an individual registered in the contact tracing system; a node in the contact tracing graph. A registered person in a contact tracing system may be an index case (a person tested positive for COVID-19),close contact, or both (or perhaps in

(17)

some systems, neither). As a person who have tested positive to a disease, like COVID-19, who is being registered in a health system, it makes sense to be referred to as apatient. However, the same does not necessarily apply to a person who is registered as a close contact of an index case, as the word patient may have connotations to a receiver of health service. The wordcitizen may also be relevant in most cases of a registered index case or close contact, referring to a citizen of Norway, but there may also be registered foreigners, citizens of other states. Health service beneficiary may be used to denote a person who receives benefits through health service programs, and may seem more descriptive in this context. The terms may be used interchangeably, however,registered person is mostly used when talking about an individual registered in the contact tracing system, andpatient when talking about positive test results and the data flow.

(18)

Chapter 2

Literature review

2.1 Related research

2.1.1 Data quality and timeliness

The importance of high quality and timely data in health care is well known.

This applies to the requirement of timeliness and quality in test result and index case data to secure efficient contact tracing (including quick isolation and quarantine), disease surveillance and decision making in outbreak response.

Thereby making it key to the person being tested, the local authorities (districts/municipalities), and national authorities.

In applying information technology in health care services, it is essential that the correct information is available at the right time and place to health care professionals, citizens and authorities, world- wide. (Pontet et al. 2009, p. 266)

Furthermore, the need for high quality and timely data implicates the need for standardized data. Having timely data is of less value if the same kind of data is represented and communicated in various ways, making comparison and aggregation hard. Agreeing to how data should be communicated and what it should look like and contain walks hand in hand with the quality of the data one ends up with.

For medical data to become comparable, for example, terminologies and communication routes need to be standardized, and technical standards have to be implemented so that the information systems of all these different parties can communicate smoothly. (Timmermans and Berg 2003, p. 7)

2.1.2 Standardization

Timmermans and Berg define standardization “as the process of rendering things uniform, and standard as both the means and outcome of standardization” (Tim- mermans and Berg 2003, p. 24). Using their following definitions of categories of standards, there are 4 kinds: design standards, terminological standards, performance standards and procedural standards. In relation to the standardization of COVID-19 test result values this case study observes the development

(19)

of terminological standards, which is to “ensure stability of meaning over different sites and times, and are essential to the aggregation of individual health care data into larger wholes.” (Timmermans and Berg 2003, p. 25). Procedural standardization may be observed in relation to reporting routines of notifiable diseases and the contact tracer workflow in general. Design standards, as a specification of social and technical systems, may apply to the contact tracing system development; the Laboratory Information Systems (LIS) as involved in the test result data flow; and the constitution and jurisdiction of the new contact tracing team. The lack of standardization has been linked to fragmentation, in- efficiencies, excessive data of poor quality and weak use of it. Hence, prioritizing integration of health information systems (HIS) is considered important (Braa et al. 2007).

2.1.3 Socio-technical complexity

Integration from a socio-technical perspective involves considering the interre- lationship between human behavior and technological constructs. This stands in contrast to simply focusing on technical solutions. Acknowledging a more complex and co-dependent reality with the social perspective requires considering the interplay between technology and organizational structures, information needs and workflow. The needs may vary when moving vertically from the operational to the strategic level of organizations. The same applies in the horizontal dimension, considering localities, geographical differences, variation in disciplines, understanding and practice.

When talking about information system integration “data is distributed over a multitude of heterogeneous, often autonomous information systems, and an exchange of data among them is not easy” (Hasselbring 2000, p. 36). The fragmentation may involve legacy systems which there may be no time or jus- tification to replace. System integration thus “aims at building applications that are adaptable to business and technology changes while retaining legacy applications and legacy technology as reasonably as possible” (p. 36).

To obtain this objective, system integration focuses on three key “problem dimensions”: autonomy, heterogeneity, and distribution (figure 2.1), as explained by Hasselbring. Distribution is due to the existence of multiple individual systems, often created before holistic approaches of overall systems are engaged, which relates to connecting legacy systems of dissimilar organizations. Obtain- ing transparency for system users by “hiding” the distribution can be done by creating proxy services, like APIs.

Heterogeneity applies on a technical level to the use of different hardware platforms, operating systems and programming languages. On a conceptual level it applies to the different understanding and modeling of similar real- world concepts, like using the same word for different concepts (homonyms), and different words for the same concept (synonyms). It allows organizations and departments to select the technology and strategy best for obtaining their business goals, at the same time as it increases the challenge of bridging the differences. Strategies to manage this problem is the development of common models, structures, standards and wrappers.

Autonomy is a significant issue in the context of integration as it bears an inherent conflict to having dependency to other systems and organizations.

It applies to the integration of individual autonomous systems which may be

(20)

autonomous regarding design or communication and execution. The ability to reduce autonomy through technical solutions is considered very limited, and may usually only be managed through organizational changes. The ultimate goal would be to approach the origin in this coordinate system, mitigating all three key integration challenges (figure 2.1). However, reaching this focal point may not always be possible, or reasonable, as it may limit desired flexibility.

Figure 2.1: Problem dimensions for system integration by Hasselbring (2000) The integration challenges are reflected in the situation of standards which grows more complex when an increasing number of guidelines are created in various organizations to be used in similar disciplines:

All throughout the Western world (and increasingly in third world countries as well), professional societies, public-sector agencies, research organizations, health care insurers, health maintenance organizations, and individual health care institutions are constructing and implementing guidelines. In fact, the number of guidelines being produced by all these different bodies, in all these different countries, leads to a bewildering situation, in which there may be dozens of often overlapping and contradictory guidelines for any given condition or decision problem. (Timmermans and Berg 2003, p. 7)

While standardization is needed for setting rules for communication and comparison of data, flexibility is needed for adaptability to local practice and innovation.

Handling this balance means that the complexity needs to be assessed. Efforts of reducing the complexity has been linked to the creation of disorder (Ellingsen and Monteiro 2006; Hanseth et al. 2006; drawing upon Timmermans and Berg 2003). Ellingsen and Monteiro (2006) discuss seamless integration in relation to the development of a more uniform LIS system and talk of how integration is traditionally considered a technical issue, and argue why it should rather be considered a socio-technical issue. The analysis presents two main aspects: (1) how imposing order some place creates disorder other places, that the disorder generated by integration efforts is immanent; and (2) how “integration and the implicated standardization is not a binary concept but an issue of degree” (p.

456). The article is written in relation to a standardization effort of laboratory systems in the Northern Regional Health Authority in Norway. While the fundamental challenges seem quite similar, a rather specific difference to this case is that the integration in Ellingsen and Monteiro’s case seem more politically and

(21)

economically motivated, while the integration efforts happening in relation to the COVID-19 contact tracing was first and foremost driven by the immediate need from the municipalities handling the contact tracing. The time critical situation may have had impact on the decisions and development in a different sense. The perspective of disorder as a side-effect of standardization has been discussed in similar work. Hanseth et al. (2006) calls for more research on IS standardization, looking to socio-technical complexity as a major issue.

2.2 Conceptual framework

In the context of integration and required standardization this study examines the observed case from a socio-technical perspective using the concepts of flexibility and redundancy. Flexibility has been considered important in standardization to enable innovation and support local variation in practice (Hanseth, Monteiro, and Hatling 1996; Braa et al. 2007). The strategy broadly involves balancing standardization and allowed flexibility in order to achieve the benefits of comparable data and simultaneously be able to adapt to a changing health care environment. In a complex environment with multiple systems (some perhaps of legacy state) and stakeholders to consider, speedy adaptation may be hard to achieve, as seen with the COVID-19 pandemic. So what happens if the standardization cannot adapt quickly enough? While redundancy may be linked to the need for standardization in the first place, through negative consequences of inconsistencies and lack in data quality, it may also be linked to positive ef- fects of improving effectiveness and safety in clinical work (Cabitza et al. 2018;

Ellingsen and Monteiro 2003). This leads us to how redundancy may be tied to safeguarding mechanisms and workarounds when the standardization strategy fails to swiftly adapt to meet emergent needs in a locked state of dependencies. Is this kind of redundancy necessary with the increasing socio-technical complexity, or may it just be argued as a product of failing standardization?

Furthermore, will this kind of redundancy be part of a positive evolution of de facto standards (Braa et al. 2007, p. 411), or will it just be the root to further fragmentation and deeper lock-in states? The evolution of standardization strategies has been further explored in Hanseth and Bygstad (2015), valuing working solutions for user practice and needs over standardization; and in Poppe, Sæbø, and Braa (2019), emphasizing the role of flexibility in software and at the organizational level.

These kind of relations regarding redundancy and flexibility will be explored in the context of integrating a contact tracing system. Sub-concepts of flexibility and redundancy will be further elaborated in the sections below to assist in dissecting the complexity of the case.

2.2.1 Use flexibility and change flexibility

Hanseth, Monteiro, and Hatling (1996) and Braa et al. (2007) conceptualize and define the termsuse flexibility andchange flexibility in relation to enabling flexibility in standardization. Hanseth, Monteiro, and Hatling (1996) discuss flexibility in the tension between standardization and flexibility, while Braa et al. (2007) build upon this when conceptualizing a flexible standard strategy in the context of HIS. The concepts have been brought up in multiple literature

(22)

contributions (see e.g. Braa and Sahay 2013; Jensen 2013).

Change flexibilityrelates to the ability to change standards without changing the practices supported by the standard. This is enabled primarily through modularization. Use flexibility relates to the ability of a standard to support different activities and tasks.

In software development modularity is a well known concept appearing in many forms; through libraries, packages, and programming conventions (like the object-oriented SOLID principles). Key to the concept is breaking down complexity by decomposing and creating simpler modules with interfaces between them. Similarly, modularization of standards has been argued as an important concept to enable change flexibility, which will be the main application of modularization in this study.

[Hanseth, Monteiro, and Hatling (1996)] discuss two kinds of flexibility—use and change flexibility—and argue that standards need both. Change flexibility (the ability to change standards) is enabled by modularization. That means, in this context, combining simple standards with gateways translating between them [...], not only gateways between computer-based infrastructures, but also gateways integrating paper- and computer-based infrastructures, as has proved very useful for improving the information systems in hospitals [...]. Use flexibility determines the extent to which a standard can support many different activities and tasks. Use flexibility makes it possible for users to change the practices supported by the standard without changing the standard. (Braa et al. 2007)

While flexibility in general may be related to the health information ecosystem’s ability to integrate contact tracing, the concepts of use flexibility and change flexibility will be primarily used to analyze the standardization relevant to the integration efforts observed.

2.2.2 Redundancy

In order to assess the case of data flow the concept of redundancy will be discussed in relation to integration and flexibility. The term redundancy relates to something that may in its broadest form be considered something “between

‘being superfluous’ and ‘concerning repetition’”, and it may carry both positive and negative connotations (Cabitza et al. 2005). Redundancy may have positive connotations in the form of robustness, reliability and fault tolerance. On the other side it may be associated with inefficiency, desynchronization, extra cost and work. When it comes to IT and health, a fundamental distinction to make is the difference betweenredundancy of data andredundancy of work.

Both concepts may be highly interconnected, so it is not to say that one may be discussed in complete absence of the other. A simple example to explain the concept is to look at the world of Electronic Patient Records (EPR). Norway has a hodgepodge of EPR systems existing at the different medical offices and hospitals (Hanseth and Bygstad 2018). Redundancy of data in this case is the existence of duplicate information in the different systems, for example in relation to a patient receiving treatment at different hospitals using different EPRs.

The redundancy of work will be the registration of the same patient information into the different systems by the health personnel at the different hospitals. In

(23)

this regard redundancy has an obvious negative connotation. Redundancy of work may also apply to situations in health care where safeguarding principles are implemented to make sure a patient has received the treatment that it is meant to receive, like follow-up procedures. Such work has positive connotations. To further specify the concept of redundant work, the term redundant effort is adopted:

[...] we consider redundancy of effort involved whenever some task is accomplished either again – after the corresponding goal has been reached at least once – or by using more resources than necessary.

If the classic (human) resources management is adopted, we could consider redundancy of effort necessarily inefficient, and hence something to reduce or even to eliminate. A more attentive look could also see in redundant effort also a clear strategy to improve either effectiveness or safety. (Cabitza et al. 2005, p. 160)

The concepts of use flexibility, change flexibility, redundancy of effort and redundancy of data will be used to link the empirical findings to theory. This will be done in the analysis in an effort to make sense of the socio-technical challenges, and the relation between the concepts.

(24)

Chapter 3

Background

3.1 Health sector in Norway

The Ministry of Health and Care Services is the ministry responsible for the nationwide governance of public health services in Norway. The ministry reigns several national agencies responsible for specific domains (see figure 3.1), where the three most relevant actors for this case are: The Directorate for eHealth (NDE), role of national governance within eHealth; Norwegian Health Network (NHN), service provider for national eHealth solutions; and The National In- stitute for Public Health (NIPH), national competence institution conducting research and surveillance related to the population’s health, including infectious disease control.

The responsibility for hospital and specialty care is handled at a regional level through four Regional Health Authorities (RHAs); Central, Northern, South- Eastern, and Western Norway RHA. The responsibility for administration of primary health care and social services is shared with the municipalities, which have been largely responsible for the administration of the pandemic response measures. The municipalities have thus been responsible for the contact tracing work, including prior to COVID-19 (Infection Control Act 1994). While centralization efforts have been happening in Norway in the 2000s, like the re- duction from 5 to 4 RHAs, 19 to 11 counties, and 422 to 356 municipalities, there has been a shift in the recent years where increasing responsibility for health-, and social care is moved from state and counties to the municipalities (Saunes, Karanikolos, and Sagan 2020). So while the health system in total may be considered semi-decentralized, the primary health care is considered largely decentralized, with the municipalities having a major role. This requires more collaboration across sectors with the digitalization efforts in the public health service. The development of API services for more seamless integration with contact tracing system solutions, as observed in this case study, illustrates this socio-technical complexity challenge from an organizational perspective:

Collaboration across health and municipality is demanding, but here we have really gained momentum in the collaboration. There are two ministries that manage this: The Ministry of Local Government and Modernization, and the the Ministry of Health and Care Services.

[...] It is a bit demanding because there is an interaction between

(25)

NIPH, KS and the suppliers of the contact tracing solutions. And then it is the case that it all goes on the Norwegian Health Network, so there are many actors who shall cooperate who are not used to cooperating. So it is quite demanding, it is really going very well, but it takes some time to get the solutions out. - Enterprise architect 2, KS

3.2 Digitalization of the health sector

3.2.1 Digitalization and standardization in the Norwegian health sector

A determined transition toward a digitalized public health care service has hap- pened over the last decades in Norway. Both in terms of digitization, a long and slow process of phasing out the paper-based parts, and the further development and involvement of digital services in the health service workflow. Albeit being considered a highly developed country, the digital tool response in Norway was outperformed by other developing countries when the COVID-19 pandemic hit (Aftenposten 2020a), and was dependent on manual paper-based messaging.

The governmental organization of IT in health started with Norwegian Cen- tre for Informatics in Health and Social Care (KITH) established 1990, which was responsible for the development of IT and standards in the Norwegian health sector. KITH was later incorporated in to the Norwegian Directorate of Health in 2012. In 2016 the IT mandate was forked out again with the es- tablishment of Norwegian Directorate of eHealth, bearing responsibility for the eHealth governance and thus the standardization in the health sector to this day. This includes the terminological standardization concerning the communication of laboratory analysis results like the Norwegian Laboratory Coding System (NLK). Norwegian Health Network is used to denote the agency working closely with the NDE as a national health service provider. However, the term (Norwegian Health Network) is used interchangeably to denote the closed network for the health sector, maintained by said agency.

3.2.2 Integration in the Norwegian health sector

Politically and strategically, the agenda has for quite some time implicated the need for more interoperability and thus integration in the health sector. Al- though Norway was early in utilizing ICT in the health sector, the white paper One citizen - One journal from 2012 (Helse- og omsorgsdepartementet 2012) point to the situation with fragmented patient information and challenge with many autonomous businesses. The national health data program launched in 2018 addresses the challenge in the health registers: “The health registers in Norway have been shaped over a long time, without there being any requirements set for a common standard, for example that variables have the same name or definition across registers.” (Direktoratet for e-helse 2021a).

A large ongoing project in the Norwegian health sector is Akson. It was launched in 2019 and addresses the challenges of fragmentation and need for interoperability across the health sector. It is the biggest IT project in Norway, and was a manifestation of a concept study from the work with the vision

(26)

Figure 3.1: Overview of the health system in Norway (Saunes, Karanikolos, and Sagan 2020)

(27)

of One citizen - one journal. It entails two goals, the first being a common EPR for the municipalities, the second being holistic interoperability across the country, i.e. enabling interaction between the EPR and other digital solutions.

The project is estimated to cost 11,200 MNOK (million NOK), 22,000 MNOK including maintenance and life cycle costs until 2040, the total socioeconomic saving is estimated to 25,000 MNOK (Direktoratet for e-helse 2020b). The project has given rise to controversy and has gained a lot of media attention, including skepticism related to the scale, cost and process of the project (see e.g. Aftenposten 2021b; Bygstad 2020).

3.2.3 Information systems

When talking about information systems we consider both the information technology making up the technical system and the organization as the social system, which interact and transform over time (Lee 2004). In extension of this we consider a health information ecosystem the collection of information systems, organizations, individuals, and processes that interoperate in the health sector, providing health services to the public.

The health information ecosystem in Norway encompasses multiple different health information systems of different kind (e.g. Patient Administration Sys- tem – PAS; Electronic Patient Record – EPR; Laboratory Information System – LIS). A variety of these are in use at the different health care institutions in Norway (e.g. hospitals, doctors’ offices, emergency wards, laboratories). These systems mainly communicate by sending messages over the network infrastructure provided by Norwegian Health Network (NHN). NHN was established in 2004 and their key role is “to develop, manage and operate the national eHealth solutions and infrastructure”, ensuring secure interoperability in the health sector (Norsk Helsenett 2021b). Thus while NHN has more responsibility for implementation, the NDE is more responsible for the governance in eHealth. They provide a electronic data interchange (EDI) service for secure communication between health actors in Norway, in addition to other core services like the health personnel authorization service HelseID (Norsk Helsenett 2020), ePre- scription, summary care record, lookup registers¹, and the public health portal for citizens of Norway Helsenorge (Norsk Helsenett 2021a). The summary care record consists of certain vital health information of beneficiaries of Norwegian public health services, for convenient centralized access for health personnel.

3.2.4 Fragmentation and lack of digitalization

Digitalization and fragmentation has been a persistent issue in the health sector.

The OECD (Organisation for Economic Co-operation and Development) report from 2019Health in the 21st Century: Putting Data to Work for Stronger Health Systems(OECD 2019), brings attention to the lack of digitalization in the health sector.

The OECD-report Health in the 21. century points to that the health care sector is 10-15 years behind other sectors and industries in utilizing the potential in electronic data and digital technology.

1Examples of the registers maintained by NHN are the health personnel register and the regular doctor register – registers of authorized health personnel.

(28)

The structures that were established in the pre-digital time is highlighted as an explanation. (Direktoratet for e-helse 2020d)

Furthermore, a OECD-report of the digitalization in the Norwegian public sector, Digital Government Review of Norway: Boosting the Digital Transforma- tion of the Public Sector (OECD 2017), states that system fragmentation is a weak spot.

In OECDs review of the digitalization of the public sector in Norway it is pointed to that the system is fragmented. There is developed sector internal solutions without there being sufficiently taken into account if better solutions are already developed other places or if the need for a own solution should work together with other solutions. This fragmentation makes it so that Norway does not suc- ceed in solving the systematic management challenges across sector boundaries. (Kunnskapsdepartementet 2017)

The role of the information system is further important because of the economic expense it constitutes in the society. The financial cost of the digitalization of the health sector in Norway is significant. The total cost of ICT-expenses was estimated to be 11,000 MNOK in 2017 and 13,000 MNOK in 2019 (Direktoratet for e-helse 2017; Direktoratet for e-helse 2019). Although the digitalization of the health sector may save resources after a certain time, the challenges with fragmentation and interoperability is limiting to reaching the true potential.

3.2.5 Integration projects with limited success

The introduction of a new information system carries a lot of tension, as there are multiple examples of costly integration projects with limited success.

The early life of the DocuLive project in Norway, an effort to standard- ize EPRs in Norwegian hospitals, started out in 1996. Although the aim was to replace paper-based patient records, the production of paper documents increased after the new system was implemented a hospital (Hanseth et al. 2006).

“The failure of DocuLive, at least as a standardization story, can be seen as a failure in attempting to control complexity. Arguably, the main mistake was to follow a ‘traditional’ standardization approach–typical for (first) modernity that is, overemphasizing criteria of universality, uniformity, and centralization of control to achieve alignment, stabilization and closure.” (p. 575).

In 2004-2005, a new integration effort took place in Health Region North in Norway, replacing the existing EPR with a new one, Dips. It was estimated that expenditures would be reduced with 8.5 MNOK a year, later estimates suggested that the expenditures would increase with 4.5 MNOK a year (Ellingsen and Monteiro 2005).

In more recent years, specifically 2018, Health Region South-East gave up on landing a new Radiology Information System (RIS). There was already spent at least 220 MNOK (NRK 2018).

Other European countries have also had limited luck with the daunting task of integrating new systems in the health sector. One example is the project in Great Britain of developing a new EPR system, which was abandoned in 2013.

It was estimated to cost 6,400 MGPB (million GPB), the actual cost became closer to 10,000 MGBP (The Guardian 2013).

(29)

“Sundhedsplatformen” in Denmark has faced many challenges and received a plethora of critique since the launch in 2016, even regarding endangerment of patient safety (Politiken 2019). It is a large health platform project set to replace systems in use at multiple hospitals, and considered the single biggest IT investment in the Danish health care service. It was estimated to cost 1,300 MDK (million DK), but had spent 2,800 MDK in 2018 (Version2 2018). The scale of the project is similar to that of the ongoing project Akson in Norway, which has engaged the same company involved in “Sundhetsplatformen” in the development of an EPR system.

The challenge is not unique for the health sector. In 2014 a project mod- ernizing the IT infrastructure at NAV (The Norwegian Labour and Welfare Organization) failed. At the time, about 340 MNOK was spent at the project (NRK 2014). In 2015 the Norwegian police stopped a project renewing IT systems. About 240 MNOK was already spent (Aftenposten 2015).

Keywords for these projects are large scale, holistic vision, complexity, de- lays, and exceeding costs. Needless to say, initiating large scale IT projects may come with a high risk, and cautious behavior regarding the implementation of a official contact tracing system is expected.

(30)

Chapter 4

Research context

4.1 Contact tracing in Norway

The response to the COVID-19 pandemic in Norway revolved around the TISK- strategy, a national strategy with the goal to stop outbreaks of the virus. The name is an acronym for the four main principles; testing, isolation, contact tracing, quarantine. Testing should be done in the case of suspected disease, in the case of respiratory disease symptoms, or if people have been close contacts to confirmed index cases. People who have tested positive to COVID-19 should be put inisolation. Contact tracing should be performed to monitor the spread of the disease by finding close contacts of index cases, and subsequently putting the close contacts inquarantine. The contact tracing work involves extensive in- vestigative work with collecting data from sources, informing of regulations and routines, getting people tested and in quarantine, registering data in systems, and notifying and informing the needed municipal and governmental actors.

The collection of data, informing, and possibly follow up of index cases and close contacts is typically performed through phone interviews.

As the primary health care in Norway is largely decentralized, and the municipalities are largely autonomous in handling the COVID-19 measures, each municipality had to choose their tools for contact tracing. Some of these tools are the software systems Fiks Contact Tracing, ReMin, Pasinfo, DIPS FastTrak, referred to as contact tracing systems. Fiks Contact Tracing is an adapted version of the open source health information software District Health Information Software 2 (DHIS2), developed through global collaboration by the Health In- formation Systems Programme (HISP) lead by the University of Oslo (UiO).

Both the DHIS2 platform and the contact tracing adapted system are developed according to WHO recommendations. The contact tracing system became the official system available through the municipality software platform Fiks by KS, a advocacy group and service provider functioning as a link between the municipality service level and the national digital infrastructure strategy level.

The contact tracing system had to fulfill (increasing amounts of) different integration needs regarding seamless flow of data input (collection of index cases through positive test results with personal ID, relevant data for contact tracing: place of infection, possible infection source, symptoms, close contacts etc.), and data output (obliged reporting of communicable disease to national health

(31)

governance, sharing data structure – for instance index cases – with other municipalities). The integration efforts are thus strongly connected to the information need.

The flow of information is guided by the various needs and also controlled by the regulations stated in the law. The ICA (Infection Control Act 1994) is the basis for regulations regarding communicable diseases. It has been updated multiple times in response to the COVID-19 pandemic, significantly with the formulation of the COVID-19 regulation (2020), this study focuses on the state these were in when the pandemic emerged. TheMSIS regulation (2003), pursuant to the ICA, contains a list of which communicable diseases that are notifiable. As required by the regulation, both the municipal doctor (also called municipal chief physician) and the NIPH shall be notified of a detected case of significant communicable disease, like COVID-19. This is needed for the municipal doctor working with infection control measures at a local level, and the NIPH as the professional authority advising measures at a national level. The reporting from physician to the municipal level is specified to entail the municipal doctor of the municipality in which the infected lives, and the municipality in which the infected is staying, should those differ (MSIS regulation §2-1). The granular separation of responsibility, exactly who informs who, and the distinction between duty to notify and duty to report (Norwegian: “varslingsplikt”

and “meldeplikt”), have been influencing factors in the data flow of positive test results. The local practice has been affected by the interpretation of the regulations and guidelines, which have been stated by informants as being fragmented and hard to interpret.

These actors have key responsibility in the Norwegian infection control measures. The municipal doctor’s responsibility is, among other things, to “have continuous overview of the epidemiological conditions in the municipality”, and to “assist the municipality, health personnel and others in the municipality who have tasks in the work of protection against communicable diseases” (ICA §7-2).

The NIPH have similar responsibility at the national level:

The Norwegian Institute of Public Health shall monitor the national epidemiological situation and participate in the monitoring of the international epidemiological situation, carry out health analyzes, conduct research in the field of infection control and ensure the necessary vaccine supply and vaccine preparedness.

The Norwegian Institute of Public Health shall provide professional assistance, advice, guidance and information to municipal, county and state institutions, health personnel and the population on communicable diseases, infection control and the choice of infection control measures. (ICA §7-9)

With an update of ICA in june 2020 the role was further clarified: “The Nor- wegian Institute of Public Health is the state’s infection control institute”.

The first integration efforts observed during the case study may be viewed as two phases, closely connected to identified bottlenecks of work-intensive areas.

The first phase of information needed was the basic identification and non- medical data to ease the most basic form of time-consuming activity of the contact tracers. The activities involved manually collecting and typing in such information. Collecting data from available registers was important to simplify

(32)

the process. The second phase was related to the test result data flow and the Clinical Report. The new system had to be incorporated with reporting routines, as communicable diseases has strict reporting policies. Furthermore, seamlessly integrating the contact tracing system in the test result data flow was a key goal to quickly identify new index cases. This phase involved the creation and integration of new APIs for interoperability with MSIS.

4.1.1 Data flow of positive test results prior and posterior to COVID-19

This section describes the data flow of positive test results before and after COVID-19, including the non-digital sequence of events related to the notifiable disease routines.

Pre-COVID-19

Prior to the COVID-19 pandemic, in the suspected case of a communicable respiratory disease a person would contact their regular General Practitioner (GP). The information flow prior to COVID-19 is depicted in figure 4.1. If the GP sees it necessary, they would take a test sample from the patient’s nose and/or throat. The test sample would then be sent to the laboratory servicing the GP’s medical office for analysis, along with a requisition of which analysis was needed including clinical details.

After the analysis was performed, the result would be sent to the requesting physician (GP in this case) electronically via NHN or in fewer cases by paper, should the medical office not be a user of the NHN messaging service. If the analysis detected any notifiable disease under the monitoring responsibility of the municipality, the laboratory would report to the municipality (the municipal doctor) where the patient resides, via telephone. Furthermore, a copy of the laboratory report would be sent via NHN or by paper to the Norwegian Surveillance System for Communicable Diseases (MSIS; Folkehelseinstituttet 2020), maintained by the NIPH. A list of which communicable diseases that shall be reported to NIPH and the municipal doctor is defined in the MSIS regulation (MSIS regulation 2003). Prior to COVID-19 this system consisted of one database, the register database (MSIS regDB), containing data only regarding positive cases.

(33)

Figure 4.1: Pre-COVID-19: Information flow of positive test results following a test of suspected respiratory disease

To supplement the laboratory test report, the GP would send a Clinical Report (appendix A.1) containing details about the patient and the infection case to the NIPH, while keeping a copy in the patient’s record. Prior to COVID- 19 this was communicated by paper, being a manageable solution in this era due to a general low number of communicable disease cases. In addition, the GP (as the requesting physician) also carries a responsibility of notifying the municipal doctor and providing necessary clinical details. However, in 2017 the clinical reporting to the municipality was estimated to only happen in about 50% of the cases (Folkehelseinstituttet 2017). Moreover, the requesting physician has a joint responsibility with the laboratory (or any health personnel discovering a notifiable disease) in notifying the municipality, which leads to the GP also possibly calling the municipal doctor. It is hard to know for a fact how often this occurred in practice, however, this communication line may be related to the lack of paper reporting. The GP would notify the patient of the test result over phone or report it by paper or electronic messaging.

Lastly, the municipal doctor formally had a responsibility of also notifying NIPH of positive cases. Nonetheless, this formal obligation was phased out, probably because the inconvenient and redundant character of the action was identified as a problem when COVID-19 became a fact.

Post-COVID-19

Because of COVID-19, and the surge of communicable disease cases, there has been a change in testing and reporting routines. A person with symptoms of respiratory disease is advised to book a test at their local test center due to

(34)

the risk of spreading infection by going to a GPs office. The test is performed at the test center which sends the test sample to a laboratory. From there, the laboratory sends the COVID-19 result, regardless of the outcome (positive, negative, inconclusive), not only to the requesting physician (in this case the physician responsible at the test center), but also to the NIPH. This secondary reporting line emerged with the creation of the MSIS laboratory database (MSIS labDB) deployed in March 2020. Thus, this resulted in the laboratory reporting test results to the MSIS labDB and a copy being sent to the MSIS regDB, in the event of a positive test result. The development of the laboratory database is important because it admits a key role in the COVID-19 digital response and the health information ecosystem in general.

Figure 4.2: Post-COVID-19: Information flow of positive COVID-19 test results following a test of suspected respiratory disease

Furthermore, a not so insignificant organizational change of the new testing and tracing regime is the evolution of the “organization” in the municipalities assuming tasks usually held by the regular GP. This was pointed out by an enterprise architect in KS:

You order a test [...] and now it is not a GP, now there is a whole team that handles this in the municipalities. It could be a contact tracing team, the municipal doctor in smaller municipalities, or it could be a group of non-health professionals sitting there. It can be very different compositions, so I have only described it as an organization in the municipalities.

(35)

- Enterprise architect 2, KS

The responsibility traditionally held by the regular GP which would be distributed to test centers and contact tracing teams involves taking the test sample, requesting the analysis from the lab, filling out the Clinical Report and informing the municipal doctor and the NIPH of positive cases. The organization is represented as Municipal Contact Tracing Team in figure 4.2, and may be tightly or loosely coupled with the municipal administrative level, depending on the size and structural choice of each municipality. In the new figure, the contact tracing team has thus replaced the Municipal Doctor actor, and the Test Center has been introduced.

The contact tracers working in the contact tracing teams would notify the patient as part of their interview routine following a notification from a laboratory. As part of the reorganization they would take over the responsibility for sending the Clinical Report to NIPH. This would also have to be stored in the/a patients record, exactly which one was hard to interpret, concerning the fragmented patient record situation in Norway. The inquired contact tracers said this was initially sent to the GP, for them to save it in their record system, as this was the old practice. Seeing it as the tedious routine it was, they had re-examined what the regulations allowed, and transitioned to store it in a local EPR whilst notifying the GP over the phone. As the GPs were usually informed by a test result copy sent from the laboratory, they were transitioning to not calling the GP and rather informing the patient of calling their GP. However, the GP could sometimes have questions regarding the development of the disease which would be directed to the contact tracing team. Consequently, the GP would either call the patient when/if they were informed by a laboratory report concerning one of their patients, or the patient would call their GP first. The routine of record-keeping Clinical Reports would vary between municipalities.

The contact tracers would initially struggle with adopting the Clinical Re- port responsibility, which was not digitalized. Later they would use the Clinical Report web application service deceloped by NIPH. Ultimately, this routine was integrated into the contact tracing system with the Fiks Clinical Report API (see timeline, figure 4.4).

The MSIS labDB would make test results available in the patients summary care record available for them to see through the public health portal helsenorge.no. Health care professionals could also look up a patient’s test results in relation to treatment via the summary care record. This is not included in the figure to simplify the visualization, and it was not involved in the notifiable disease reporting routines relevant to contact tracing. Eventually, the MSIS labDB would enable contact tracers to be able to look up a patients test results through the Fiks Clinical Report integration.

Lastly, these diagrams depict the situation where the index case is within their municipality of residence. Additional complexity would be added to the reporting routines in the case where the patient tested positive outside their municipality of residence, thus involving a second municipality. This emphasized the need for a digital contact tracing system enabling horizontal collaboration.

(36)

4.2 Case specific systems and integrations

In order to make the contact tracing more effective, the new contact tracing system needed to take advantage of existing registers and systems.

In an effort to map the situation, the first integration efforts started on or deployed during the period of this case study, related to existing architecture in Norway have been categorized in this non-exhaustive table (table 4.1). New integration efforts may be expected in the future, like integration with the national vaccination register, SYSVAK.

Category Name of integration Involved system/service

Authorization Authorization HelseID authorization service

Data fetching (non-medical)

ID information National Population Register (NPR, norwegian: Folkeregisteret) Data fetching

(non-medical)

Contact information Common Contact Reg- ister (CCR, norwegian:

Kontakt-, og Reser- vasjonsregisteret) Data fetching

(medical)

Test result MSIS (laboratory database)

Data reporting (medical)

Clinical Report MSIS (register database) Data fetching

(non-medical)

Self-registration of close contacts

helsenorge.no

Table 4.1: Initial integration efforts

The deployed integrations may be observed in the graphical user interface (GUI) of the Fiks Contact Tracing application in figure 4.3, showing the form for registering an index case. The numbering used in the figure is in chronological order. They work as single-click features where (1) is the realization of the integrations with NPR and CCR for fetching ID and contact details; (2) with MSIS labDB for fetching COVID-19 laboratory test results; and (3) with MSIS regDB for reporting to national disease surveillance.

To obtain perspective of the events over time, some key events related to this case are provided in a timeline (figure 4.4). This includes events related to test result standardization and contact tracing integration efforts following the COVID-19 pandemic until January 2021.

HelseID

HelseID is an authentication service for certified health workers. It enables secure authorization through established national eHealth requirements and access to national eHealth services. For the contact tracing system it was a prerequi- site to obtain access to test result data. The authentication service is available for services on both the open internet, and the closed health network.

(37)

Figure 4.3: Fiks Contact Tracing integrations (2021-04-07) showed in GUI, registration form for index case. (1) ID and contact detail integration, (2) test result integration, (3) Clinical Report integration.

The National Population Register (NPR) and Common Contact Reg- ister (CCR)

The National Population Register contains data about all registered citizens in Norway including identification details and other essential personal data. The Common Contact Register contains address and contact details of Norwegian citizens. Integration with the registers was sought to make the contact tracers able to look up identification data essential to their work by using the national

Integrating contact tracing into Norway’s complex health information ecosystem: A case study of flexibility and redundancy in the information system response to COVID-19

Integrating contact tracing into Norway’s complex health

information ecosystem

A case study of flexibility and

redundancy in the information system response to COVID-19

Bendik Sem Kvernevik

Thesis submitted for the degree of

Master in Informatics: Programming and System Architecture

60 credits

Department of Informatics

Faculty of mathematics and natural sciences

UNIVERSITY OF OSLO

Integrating contact tracing into Norway’s complex health

information ecosystem

A case study of flexibility and redundancy in the information system

response to COVID-19

Bendik Sem Kvernevik

Preface

Abstract

Contents

List of Figures

List of Tables

Acronyms

Chapter 1

Introduction

1.1 Case introduction

1.2 Research question

1.3 Digital tools in response to the pandemic

1.4 Stakeholders, information needs and defini- tions

Chapter 2

Literature review

2.1 Related research

2.1.1 Data quality and timeliness

2.1.2 Standardization

2.1.3 Socio-technical complexity

2.2 Conceptual framework

2.2.1 Use flexibility and change flexibility

2.2.2 Redundancy

Chapter 3

Background

3.1 Health sector in Norway

3.2 Digitalization of the health sector

3.2.1 Digitalization and standardization in the Norwegian health sector

3.2.2 Integration in the Norwegian health sector

3.2.3 Information systems

3.2.4 Fragmentation and lack of digitalization

3.2.5 Integration projects with limited success

Chapter 4

Research context

4.1 Contact tracing in Norway

4.1.1 Data flow of positive test results prior and posterior to COVID-19

4.2 Case specific systems and integrations