About Ordi

The future of healthcare will change significantly when communications and information technology are fully utilized. Improvements in the efficiency and effectiveness of healthcare systems will lead to improvements in the quality of life.

Good information is an essential component of improved patient care. By combining cutting edge technology in healthcare management, we aim to play a key role, not only in assisting our clients during the transition from traditional systems, or from paper-based records to electronic records, but to focus on the application of information science and technology in healthcare.

Ordi Limited is a software services provider of Internet based Practice Management solution. Our solution is designed to optimize the automation of the workflow in healthcare organizations in order to promote efficiency, enhance patient care and increase profitability. The comprehensive feature set is customer-driven, innovative and continuously updated to ensure that it keeps pace with the changing needs of the healthcare industry. Serving physicians across every practice size and specialty, our experts in information technology and health information management utilize leading-edge technology to allow physicians and their staff to focus on their patients rather than on administrative work.

Being modern physicians and healthcare providers not only need to connect their practices from anywhere but also need to connect beyond their practices with their business partners and community safely and securely. The end result will not only increase the value of information exponentially but will also dramatically embrace a new standard not only for their profession but also in the region.

Our mission is to be a clear leader to provide innovative software platform to serve healthcare industry comprising Electronic Medical Records (EMR), Medication Dispense Management (MDM) and Practice Management (PM) software services that empower physicians and other healthcare providers to improve the health of both their patients and their bottom line with an utlimate goal to transform our disconnected 'healthcare' system into a connected system of 'health'. We understand and respect the individual nature and needs of physicians, and taking the advantage of new technology, we aim to help physician practices streamline the delivery of patient care with strong commitment to protect patient confidentiality.

The efficient connection in our solutions provides pharmacies, laboratories, medical suppliers and physicians to obtain up-to-date information and knowledge within the healthcare industry.

Founders

David Chi Ho LI was formerly the vice president of Regional Logistics Asia Pacific at Crédit Agricole Corporate and Investment Bank Hong Kong 東方匯理銀行 (Crédit Agricole Corporate and Investment Bank being the corporate and investment banking arm of the Crédit Agricole group). He began his career with the Kwangtung Provincial Bank Hong Kong 廣東省銀行 (now part of Bank of China Hong Kong 中國銀行香港分行) in January 1987. He joined Crédit Agricole Corporate and Investment Bank in June 1988 and served in various capacities with Crédit Agricole Corporate and Investment Bank Hong Kong and Crédit Agricole Corporate and Investment Bank Australia, primarily in information technology management. In 2003, he was in charge of building a global electronic banking system for cash management services, using Internet technology, which was successfully launched the following year. Beginning of 2009, David becomes a visiting lecturer for an undergraduate degree program at The Hong Kong Polytechnic University. David holds a bachelor's degree in computer studies from University of Southampton in 1986 and a master's degree in management (majoring in logistics management) from Macquarie University in 1998.

Gary Hin Chung SIU was formerly the senior system analyst of Regional Logistics Asia Pacific at Crédit Agricole Corporate and Investment Bank Hong Kong 東方匯理銀行. Gary joined Crédit Agricole Corporate and Investment Bank in 1986 and he has more than 19 years of knowledge and experience in all aspects of design, development and implementation of mission critical applications. He was a leading member in the building of the global electronic banking system for cash management services using Internet technology.

Josephine Tat Yan WONG holds a graduate diploma in diagnostic radiography from Hong Kong Polytechnic. She furthered her studies in health information management at the University of Sydney, Australia in 1996.

Secure technology, secure processes

HKMA GUIDELINE

The original content of the Strengthening Security Controls for Internet Banking Services. (http://www.info.gov.hk/hkma/eng/guide/index.htm)

Strengthening Security Controls for Internet Banking Services

23 June 2004

Dear Sir / Madam,

The purpose of this letter is to set out the HKMA's recommendations for strengthening Authorized Institutions' (AIs) security controls for internet banking services.

As you may be aware, there have been an increasing number of internet banking fraud cases, particularly involving fake bank websites and e-mails. Although no financial losses have been reported in relation to fake bank websites in Hong Kong so far, there are reported cases overseas, where consumers are known to have fallen victim to such fraudulent schemes. In view of the increasing acceptance of internet banking services and in anticipation of more sophisticated internet banking frauds targeting the public in Hong Kong, AIs would need to be careful in implementing appropriate security controls for their internet banking services. Any mishaps would undermine the public's confidence in internet banking and would not only be detrimental to the AI concerned, but also to the development of the industry as a whole.

In February 2004, the HKMA issued a guidance note on Supervision of Electronic Banking which suggested, inter alia, that AIs should employ stronger customer authentication for transactions with higher risk. In this regard, the e-Banking Working Group of the Hong Kong Association of Banks has reached a general consensus that, as a minimum standard, AIs should offer two-factor authentication for high-risk transactions to their retail internet banking customers as an option. It is also important for AIs to make their customers fully aware of the risk involved if they choose not to adopt a stronger authentication method when using internet banking services. We endorse the group's consensus and would hereby recommend AIs to adopt the minimum standard. AIs are, of course, free to adopt a higher standard, e.g. to mandate two-factor authentication for all high-risk transactions.

AIs are recommended to conduct a detailed risk assessment to identify high-risk internet banking transactions that need to be subject to two-factor authentication. In general, high-risk internet banking transactions should at least include unregistered third-party fund transfers and payments, and change requests concerning customers' sensitive information (e.g. correspondence address). If AIs determine that it is not necessary to implement two-factor authentication for their internet banking services, their risk assessment should be adequately documented. This will be reviewed as part of the HKMA's on-site examinations and off-site reviews.

Passwords are commonly used as the basic factor of authentication. The choice of a second factor is considerably wider. Examples of the technologies used or being considered by a number of banks as a second factor authentication in addition to login passwords include:

digital certificates;
one-time passwords generated by a security device (e.g. a security token); and
Short Message Service-based one-time passwords.
In line with the HKMA's supervisory approach, we believe that maintaining technological neutrality is crucial for allowing AIs to have the flexibility to choose and implement technologies that are appropriate to their internet banking services. The HKMA therefore will not specify a particular technology to be used. AIs should evaluate the possible technologies carefully and implement the two-factor authentication solution that is commensurate with the risks associated with the types of transactions involved.

In general, the HKMA expects AIs to complete the implementation of two-factor authentication for high-risk retail internet banking transactions they have identified within one year from the date of this letter. Should AIs find it difficult to complete the implementation within the aforesaid period, they should discuss their timetable with the HKMA individually. Meanwhile, AIs should continue to review and enhance their security measures as appropriate (e.g. enhancing fraud monitoring and reporting mechanism, or requesting customers to input an additional authentication code for high-risk transactions) before the two-factor authentication mechanism is in place. The HKMA will continue to monitor the technological developments and the trends of internet banking frauds, and work with the banking industry to consider other possible preventive and detective measures if required.

If you have any questions on this letter, please feel free to contact Mr Shu-Pui Li at 2878-1826 or Mr Raymond Suen at 2878-1817.

Yours faithfully,

Raymond Li

Executive Director (Banking Development)

As set out in the guidance note on Supervision of Electronic Banking issued by the HKMA, two-factor authentication refers to the combination of the following two factors:

something a customer knows (e.g. user IDs and passwords); and
something a customer has (e.g. one-time passwords generated by a security token or Ais' security systems, a hardware electronic key, or the customer's private key stored in a smart card or other devices in the customer's possession).

Why HKMA guideline

We believe that the context of security guideline from HKMA is a good reference for other industries, as the importance of protecting personal privacy is no difference between the banking and the healthcare sector. Thus, our Software Services follows the same principle and has chosen to be empowered by RSA token as the second factor in tightening the security.

What you have and know

Using a combination of two factors on "what you have" and "what you know," the two-factor authentication technology is more widely adopted for identity management among enterprises. Users that seek access to the network require a secret PIN as well as a token code generated by an authenticator.