On your own server, with your own keys

The question no supplier answers clearly

«Can you read my clinical records?» Most clinic systems answer with a policy: that they do not, that there is access control, that staff are bound by professional secrecy. That is probably true. It is also a promise, and a promise is something other than an impossibility.

If Anotera runs with you, the answer is a different one: no, and that is not something we have decided. The clinical records are encrypted with one key per clinician, which comes into being on your machine the second the setup runs. It never leaves it. We cannot retrieve it, and we cannot be compelled to hand it over.

The other half of the sentence appears at the same type size in the setup: if you lose a key, that clinician’s clinical records cannot be read again. Not by us either. That is the price, and it has to be said out loud before anyone says yes — not in a footnote afterwards.

One script, twelve minutes

You need a server with Docker, a domain that points at it, and ports 80 and 443 open. The rest is one script, which can be run by someone who does not work with servers day to day:

bash anotera-opsaet.sh --tjek     # er maskinen klar?
bash anotera-opsaet.sh            # sæt op

It asks for the clinic’s name, your domain and who is to have access. Then it creates the keys, writes the configuration, fetches the certificate and starts the clinical record, booking and video. At the end one thing stands on the screen that you have to do before you close the window: write the keys down and hand them out in person.

The script checks DNS before it does anything else. A certificate that cannot be fetched fails in a way that resembles all sorts of other things — and then one looks in the wrong place for an hour.

The whole system, not a light edition

Clinical record with encryption per clinician. Calendar with drag-and-drop, conflicts and several participants per appointment. Booking with identification, so that the same client does not become two clinical records. A waiting list that turns a cancellation into a session. Video consultation with recording the client has to agree to themselves. A client page where the client sees their own appointments. Export of everything, without asking us for permission.

The last one is worth reading twice. A clinic that cannot get its record material out cannot terminate its supplier without breaching its own retention obligation. The export therefore sits behind the same button as everything else, and it works without anyone having to approve anything.

Four things that are not self-service

These require something only you can obtain, because they are agreements in your name — not in ours:

• Backups. The script sets them up, but you choose where the copy outside the machine is to be kept. A copy on the same disk protects against a mistake, not against the server dying.
• SMS. Your own account with a gateway. Until then the system counts the messages instead of sending them — and says so on the screen, so that no one believes a reminder is on its way.
• Note drafts. Your own agreement with a language model provider. We do not enable it by default: transcripts would then be sent somewhere without anyone having said yes.
• Reporting to «danmark». Your own clinician number and your own access. The system builds the reports in full and files them as drafts until that is in place.

These are not gaps we have forgotten to mention. It is the difference between a system that runs with you and one that runs with us: you own the agreements as well.

What is not yet good enough

The setup has been tested on a clean machine and it works. It has not been tested on twenty different server providers, and it does not have an upgrade path that can be run without reading a guide. If you are to run it yourselves today, you need someone who is willing to open a terminal.

If you run with us instead, we take that part on. The difference in confidentiality is real: then we hold the keys, and then the answer to the question above is a promise again instead of an impossibility. Both are defensible. They are simply not the same, and we would rather say so than not.