Slashdot Mirror
Microsoft Working On Health Information 'Vault' System
josmar52789 wrote with an article from the New York Times, discussing Microsoft's new push into the consumer health care market. The plan is to offer personal health care records online via a system called HealthVault. Numerous big names in the medical field have signed up for the service, including the 'American Heart Association, Johnson & Johnson LifeScan, NewYork-Presbyterian Hospital, the Mayo Clinic and MedStar Health'. The ultimate purpose of the service is to provide an online accessible but highly secure service to patients and medical facilities: "The personal information, Microsoft said, will be stored in a secure, encrypted database. Its privacy controls are set entirely by the individual, including what information goes in and who gets to see it. The HealthVault searches are conducted anonymously and will not be linked to any personal information in a HealthVault personal health record. Microsoft does not expect most individuals to type in much of their own health information into the Web-based record. Instead, the company hopes that individuals will give doctors, clinics and hospitals permission to directly send into their HealthVault record information like medicines prescribed or, say, test results showing blood pressure and cholesterol levels. "
unsubscribe
Microsoft is starting its long-anticipated drive into the consumer health care market by offering free personal health records on the Web and pursuing a strategy that borrows from the company's successful formula in personal computer software.
I'll bet this sentence is not going to go over too well with the slashdot crowd.
This sounds like one horribly, terribly bad idea to me from a security standpoint.
Also, I can't help but believe that 'anonymous' information will be handed over to drug companies so they can 'research' their 'market'.
Some things are still best done with paper and pen.
Message contains 1 attachment: spam.gif
The last thing I need is an employer or potential employer tracking down my medical records. Or the CIA, NSA, ATF, or cybercriminals or any other organization or individual who wishes to covertly steal my personal data for nefarious purposes.
Do you know what your medical history contains and how it can be used against you? I do.
My blog
meaning, that is.
Read radical news here
Remember Hailstorm? The plan was to expand Passport to first include calendar, todo, and some other web services, and then to provide an ActiveDirectory back-end for auth and ultimately to include all these kinds of services (including payroll and AR/AP data) in a massive cloud.
Privacy experts freaked out, but Microsoft never cancels anything.
Well at least the Vault will always lock up...
Did you get that thing I sent ya?
Man if anyone could link Google searches to individuals we would know every person's medical condition.
Google Search: Itchy crotch
NSA: Hey Fred Smith has crabs again...lol
I personally think microsoft windows server is a great platform to build websites.
There are range of tools and cookie cutter stuffs already written for in asp/net allows very powerful function to exist especially inter-operate ability with different MS product like sharing outlook generated schedule via exchange server out to web portal.
However, putting medical records requires requires middleware between ms platform and medical softwares. I see this use of middleware becomes security problem here. Windows do not work very well when 3rd party glue is applied to the what seems to be rigid architecture it shares between products of ms. This inability to have full control over the protocol, situation usually involving previously unthoughtful of...should I say out of boundary for what original purpose of the software calls for...ends up becoming the problem.
Oktokie
and require Microsoft Windows to access it.
No thanks.
Just look at what Microsoft is planning to do with Office Live or whatever they are calling it. You need to have Microsoft Office installed locally on your HD. All you are storing is your data. GNU Linux OSes probably won't even be able to run WINE to access those Office Live files. So even if they don't actually charge to access the data, it extends their reach into your life.
The company that gave us the ultimately secure Windows OS and the uncrackable Passport?
As you know, Windows' security issues are ones of legacy. The more they fix it, the more they wreck existing apps.
Apart from this, I have to be honest with you: I'd rather have Microsoft work on this health information system, than some unknown little entity that just is in to grab the money and run.
Microsoft is here to stay, and while they may not end up with the most perfect solution possible, they don't need the money desperately, and can't hide if a major security breach occurs (and it's their fault).
``...privacy controls are set entirely by the individual, including what information goes in and who gets to see it. The HealthVault searches are conducted anonymously and will not be linked to any personal information in a HealthVault personal health record. Microsoft does not expect most individuals to type in much of their own health information into the Web-based record. Instead, the company hopes that individuals will give doctors, clinics and hospitals permission to directly send into their HealthVault record information like medicines prescribed or...''
That sounds good. You actually get full say in who is allowed to do what, and "give permission" sounds like the permissions are secure by default.
I have about zero trust that Microsoft will actually implement this correctly and securely (I've seen far too many stupid bugs from them lately), but at least they're saying the right things. Not vague promises that it will be "very secure", but an actual description of the security controls they are planning to provide. Moreover, those security controls seem to actually provide the security one would want in such a system.
Please correct me if I got my facts wrong.
Actually, I would have said "Let the CHAIR Throwing Begin!"
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
The actual HIPAA regs appear quite stringent, but you'll find that they don't make the data more secure.
/.'er will probably discover it addresses some basic stuff, but leaves the door wide open for familiar and massive compromises.
For example, Use is well-defined in many cases, but actual security mechanisms are not. This kind of programming is right up Microsoft's alley. Not only is the security model pretty weak, there's limited interoperability requirements.
Please, read the standard. It's not fun reading, but the average
http://www.hhs.gov/ocr/hipaa/
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Putting paranoia aside, managing healthcare information is a major pain in the butt. I see this as a way for ME to control how my information is shared rather than my Dr. or my insurance provider. If this idea matures I can see how insurance providers and health providers would need to ask for the patients permission to exchange information rather than just doing it...which is what happens today. If you're worried about the CIA looking into your health information this isn't going to make the problem any worse. Perhaps a little medication might alleviate your stress on that...
Doctor: I've examined you, and reviewed your MSMedicalHistory(tm) and it looks like you are in fine health, though I see your blood pressure is slightly higher than last time.
Patient: Well, work has been a bit stressful, should I worry?
Doctor: Not at all. It is still good for your age. Have you tried Halo 3?
Patient: huh?
Doctor: Video games are a great stress reliever. If you don't have an Xbox 360 with Halo3, I can put in an order for one for you. Have you had any other problems?
Patient: Sometimes I get a headache from staring at the computer too long.
Doctor: Hold on -- there, I've adjusted your screen resolution and font size on your home and work computers.
Patient: Umm.....
It's nice of them to admit they are and be described as a one trick pony.
...
One hell of a pony
http://www1.va.gov/CPRSdemo/
That sounds good. You actually get full say in who is allowed to do what, and "give permission" sounds like the permissions are secure by default.
Prepare to see a new waiver in the stack of crap you have to sign when going to a new doctor's office requiring you to give permission for full access to your records for any purpose not prohibited by law.
This will happen because doctors will not want to spend time having you okay access to each locked off section of your records that they might need, and they sure as heck don't want to spend time arguing with you about it when it's something you find embarrassing and don't know may be relevant.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
MS has the marketing, economic, and political clout to get themselves the contract for keeping the health records for everyone in the USA. Washington is already salivating over the prospect of:
- Saving hundreds of billions on health care costs, and
- All of the money that companies will make from providing medical informatics services [1]
Curiously, they don't see any conflict between those two points.One way or another, though, giving MS (or possibly someone else, but MS is the main chance) custody over your health records is well on its way to being a requirement for getting any kind of medical care in the USA.
[1] Sort of the way the FCC is drooling over all the money that the carriers will make from the spectrum they buy.
Lacking <sarcasm> tags,
Unfortunately, it will sound nice to health care companies. I am involved in the healthcare sector, and I am worried that this will succeed, without the health care companies knowing (or caring) about the issues. Microsoft has the cash, the clout and the reputation for this. (Remember, to non-geeks, Microsoft is the premier computer company --lay people can't even tell whether Microsoft is software or hardware.)
The health care industry is greatly dependent on information technology, and is beholden to IT --without realizing it. People in healthcare have this attitude, for better or worse, that they are more important and special and have a unique place high on the totem pole, so they don't really see their vulnerability to some run-of-the-mill thing like IT, which is held with the same regard as the people who answer the phones or clean the medical instruments.
I just pray that Microsoft can have some high-profile screw-ups, maybe a few databases hacked here and there, that can reveal to non-geeks the dangers of having a convicted monopolist at the reins of the nation's healthcare info.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
It's called Indivo Health, formerly known as Ping on Sourceforge. It's been around for years and it is LGPL licensed. There's been some recent activity with the Dossia Group. More information and links here. -- IV
http://www.LinuxMedNews.com Revolutionizing Medical Education and Practice.
This will probably crush a couple of small startups - like my previous job here:
www.ndma.us
(National Digital Medical Archive)
NDMA never did get all the bugs out. It was a little slow and lacked some key xml protocol sharing features. Security and never losing a file are a legitimately difficult task, in itself, and that was addressed. Maybe Microsoft will come up with better ideas than NDMA did. The protocol for the application there was terribly slow, but the website to access the information eventually came through.
Selling anonymous data is, unfortunately, a necessary evil. It's already happening, all Hospitals require you to sign things on joining that will give them rights to sell your data, with your name and ID numbers removed. Doctors do truly need that information, especially for disease outbreaks and drug treatment information. This system by Microsoft just makes it more practical.
With Microsoft entering, it probably means Oracle, IBM, and maybe Sun will as well. There's tens of billions of dollars to be made.
-Ben