Slashdot Mirror
Microsoft Working On Health Information 'Vault' System
josmar52789 wrote with an article from the New York Times, discussing Microsoft's new push into the consumer health care market. The plan is to offer personal health care records online via a system called HealthVault. Numerous big names in the medical field have signed up for the service, including the 'American Heart Association, Johnson & Johnson LifeScan, NewYork-Presbyterian Hospital, the Mayo Clinic and MedStar Health'. The ultimate purpose of the service is to provide an online accessible but highly secure service to patients and medical facilities: "The personal information, Microsoft said, will be stored in a secure, encrypted database. Its privacy controls are set entirely by the individual, including what information goes in and who gets to see it. The HealthVault searches are conducted anonymously and will not be linked to any personal information in a HealthVault personal health record. Microsoft does not expect most individuals to type in much of their own health information into the Web-based record. Instead, the company hopes that individuals will give doctors, clinics and hospitals permission to directly send into their HealthVault record information like medicines prescribed or, say, test results showing blood pressure and cholesterol levels. "
Well, yes, there's a potential problem any time you put enough personal information into one place: sure, it's more convenient for the appropriate people to access, but it's also more convenient for someone to steal.
My bigger concern, however, is that this is Microsoft proposing this. It makes me want to vet the idea for possible abuses. Beyond the obvious privacy concerns, is Microsoft going to make it accessible only to Windows Vista machines, thereby forcing the entire medical system and any potential clients to upgrade, followed by years of lock-in?
Even if such a system is going to be set up, I'd rather someone with a good track record build something that makes use of open formats and protocols. I'd like to know that my family's medical records aren't going to go up in a puff of smoke because Windows Update decided my Office license wasn't "genuine", or something other bizarre thing.
The company that gave us the ultimately secure Windows OS and the uncrackable Passport?
As you know, Windows' security issues are ones of legacy. The more they fix it, the more they wreck existing apps.
Apart from this, I have to be honest with you: I'd rather have Microsoft work on this health information system, than some unknown little entity that just is in to grab the money and run.
Microsoft is here to stay, and while they may not end up with the most perfect solution possible, they don't need the money desperately, and can't hide if a major security breach occurs (and it's their fault).
The actual HIPAA regs appear quite stringent, but you'll find that they don't make the data more secure.
/.'er will probably discover it addresses some basic stuff, but leaves the door wide open for familiar and massive compromises.
For example, Use is well-defined in many cases, but actual security mechanisms are not. This kind of programming is right up Microsoft's alley. Not only is the security model pretty weak, there's limited interoperability requirements.
Please, read the standard. It's not fun reading, but the average
http://www.hhs.gov/ocr/hipaa/
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
http://www1.va.gov/CPRSdemo/
2. HIPPA says no. If a nurse accidentally allows access to your health information, that's a $10,000 fine for her and a $100,000 fine for the hospital.
3. HIPPA says no.
-- http://aspe.hhs.gov/admnsimp/pl104191.htm#1177
Geez, you'd think that people involved in IT would be somewhat aware of the demands of HIPPA PHI.
The road to tyranny has always been paved with claims of necessity.
The guy you are thinking of is Mark Lucovsky and he does now work for Google.
This article, at least my understanding of it...isn't just about keeping medical info on a computer running MS Windows....it is more about a centralized medical record datastore that Microsoft is building and itself responsible for....that everyone's records are kept on an internet accessible server (or set of servers). Healthvault is MS keeping everyone's health data.
I'd guess that insurance companies would be drooling at the chance to get all this data in one place...a 'definitive source'. Shoot, combine that with some DNA records and evaluations....and you're all set to be denied coverage for possible future diseases. Hook this centrally to some other datastores on you...and all kinds of living/health habits can be established.
Let's forget the nightmare scenarios I was laying out above...what if there is a security break? Embarrasing info about your treatment for VD might come out...that's bad enough, but, what if it was treated due to an affair you mistakenly had while on a long trip away....you get treated, you'r sorry and won't do it again...but, your wife now finds out?
At the very least...MS products are already a HUGE target for hackers and crackers....wait till a MS system becomes the centralized repository on some of the most personal and possibly private information on citizens of the US and maybe the world. You trust them to keep that info safe with that big a target painted on the system?
As I said in another post.....Snowballs chance in hell of me voluntarily letting my info on there.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
It's called Indivo Health, formerly known as Ping on Sourceforge. It's been around for years and it is LGPL licensed. There's been some recent activity with the Dossia Group. More information and links here. -- IV
http://www.LinuxMedNews.com Revolutionizing Medical Education and Practice.