The amount of information a patient generates while staying at the hospital is pretty immense. Vital signs, lab results like imaging data, lab results like blood tests, documentation created by every single professional who sees the patient, diagnosis data, financial/billing data, medication/pharmaceutical data, an insane amount of regulation check box filling things like as a random example, the CCD - Continuity of Care Document. As they move from ER outpatient to inpatient observation to outpatient ambulatory (or whatever unique pathway they take entering a hospital and returning to their primary care physician or homecare/hospice), new accounts are created, diagnoses entered, complicated compounding medications evaluated and modified.

This information is generated by real physicians, real nurses, real aides, etc, in actual care environments. People who trained for over a decade to understand what they're doing.

I trained for a very long time be a programmer, and I have extensive biology education.

But when testing my code, how can I emulate a PhD MD oncologist? How can I emulate a certified Nurse Practitioner, a Home Health Aide or a Licensed Nurse Practitioner? How can I generate an enormous amount of valid, real-world medical data for my test patient? I can learn that coumadin + aspirin creates a drug interaction and is a big no-no for I50.x style heart failure patients. But that's just one little trope I can repeat. There's 10,000 more things they do on a daily basis that I'll never grok.

The short answer is that I cannot. I use the programs, I enter things, I learn and do my best to emulate what my users do, but many of them have spent more time learning and perfecting their job than I have been alive. Plus, I don't have ten millions dollars worth of hospital equipment to generate real data with, to interface with, just various abstractions/test code we use when testing.

In the case of HIPAA/PHI, if there was more freedom to use protected health information, I wouldn't have to emulate medical professionals, I could copy real patient data and test my code against a production database.

But for the ultimate safety of the patients in our care, protected patient data is only allowed in 2 very secure messaging systems we use, and literally no where else.

So it often falls to the other half of our programming staff, the support staff, to take our code, patch it to a real hospital test system (hospitals generally have a live system and a test system physically hosted in their facility), and test against actual patient data from within the hospitals own network. As an application programmer that option isn't really available to me.

So it's two fold: the difficulty of emulating the incredibly technically detailed behaviors of highly educated professionals when testing, and the inability to use real world data for in-house testing efforts prior to shipping code.