Slashdot Mirror
Microsoft Working On Health Information 'Vault' System
josmar52789 wrote with an article from the New York Times, discussing Microsoft's new push into the consumer health care market. The plan is to offer personal health care records online via a system called HealthVault. Numerous big names in the medical field have signed up for the service, including the 'American Heart Association, Johnson & Johnson LifeScan, NewYork-Presbyterian Hospital, the Mayo Clinic and MedStar Health'. The ultimate purpose of the service is to provide an online accessible but highly secure service to patients and medical facilities: "The personal information, Microsoft said, will be stored in a secure, encrypted database. Its privacy controls are set entirely by the individual, including what information goes in and who gets to see it. The HealthVault searches are conducted anonymously and will not be linked to any personal information in a HealthVault personal health record. Microsoft does not expect most individuals to type in much of their own health information into the Web-based record. Instead, the company hopes that individuals will give doctors, clinics and hospitals permission to directly send into their HealthVault record information like medicines prescribed or, say, test results showing blood pressure and cholesterol levels. "
unsubscribe
Microsoft is starting its long-anticipated drive into the consumer health care market by offering free personal health records on the Web and pursuing a strategy that borrows from the company's successful formula in personal computer software.
I'll bet this sentence is not going to go over too well with the slashdot crowd.
The last thing I need is an employer or potential employer tracking down my medical records. Or the CIA, NSA, ATF, or cybercriminals or any other organization or individual who wishes to covertly steal my personal data for nefarious purposes.
Do you know what your medical history contains and how it can be used against you? I do.
My blog
meaning, that is.
Read radical news here
Remember Hailstorm? The plan was to expand Passport to first include calendar, todo, and some other web services, and then to provide an ActiveDirectory back-end for auth and ultimately to include all these kinds of services (including payroll and AR/AP data) in a massive cloud.
Privacy experts freaked out, but Microsoft never cancels anything.
Man if anyone could link Google searches to individuals we would know every person's medical condition.
Google Search: Itchy crotch
NSA: Hey Fred Smith has crabs again...lol
This sounds like a horrible idea to me from other standpoints too:
1) Medical professionals never like patients to have full access to their records, as if a patient misunderstands something on their file, their life could be at stake based on the decisions they make.
2) The US has this thing called the PATRIOT act, and MS has agreements with some agencies allowing back-door access to data they host. Let's just say that I highly doubt this information will be protected from people working for US "security" agencies.
3) The system appears to be designed so that MS can sell aggregated data to drug companies and insurance companies. Seems to me though that even with aggregated data, you could reverse-mine it to have a reasonable suspicion regarding individuals (you'd know trends, which would help in searching for more specific details)
Anyway, the whole thing could be really useful if used correctly, but there are so many ways it could be misused even if the system doesn't have a major security breach that I for one would never use it.
and require Microsoft Windows to access it.
No thanks.
Just look at what Microsoft is planning to do with Office Live or whatever they are calling it. You need to have Microsoft Office installed locally on your HD. All you are storing is your data. GNU Linux OSes probably won't even be able to run WINE to access those Office Live files. So even if they don't actually charge to access the data, it extends their reach into your life.
Like it or not, your medical information is going to become electronic. Microsoft isn't the first company to propose an Electronic Health Record -- not by far. The Cerner Corporation, for example, has been working modernize the health record since 1980. There are at least two universities in the U.S. which host a major in Medical Informatics, a program specifically designed to produce experts in this very subject.
Try to fight the Electronic Health Record is like trying to fight the use of computers in any other field -- it's inevitable.
The company that gave us the ultimately secure Windows OS and the uncrackable Passport?
As you know, Windows' security issues are ones of legacy. The more they fix it, the more they wreck existing apps.
Apart from this, I have to be honest with you: I'd rather have Microsoft work on this health information system, than some unknown little entity that just is in to grab the money and run.
Microsoft is here to stay, and while they may not end up with the most perfect solution possible, they don't need the money desperately, and can't hide if a major security breach occurs (and it's their fault).
The actual HIPAA regs appear quite stringent, but you'll find that they don't make the data more secure.
/.'er will probably discover it addresses some basic stuff, but leaves the door wide open for familiar and massive compromises.
For example, Use is well-defined in many cases, but actual security mechanisms are not. This kind of programming is right up Microsoft's alley. Not only is the security model pretty weak, there's limited interoperability requirements.
Please, read the standard. It's not fun reading, but the average
http://www.hhs.gov/ocr/hipaa/
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Putting paranoia aside, managing healthcare information is a major pain in the butt. I see this as a way for ME to control how my information is shared rather than my Dr. or my insurance provider. If this idea matures I can see how insurance providers and health providers would need to ask for the patients permission to exchange information rather than just doing it...which is what happens today. If you're worried about the CIA looking into your health information this isn't going to make the problem any worse. Perhaps a little medication might alleviate your stress on that...
Doctor: I've examined you, and reviewed your MSMedicalHistory(tm) and it looks like you are in fine health, though I see your blood pressure is slightly higher than last time.
Patient: Well, work has been a bit stressful, should I worry?
Doctor: Not at all. It is still good for your age. Have you tried Halo 3?
Patient: huh?
Doctor: Video games are a great stress reliever. If you don't have an Xbox 360 with Halo3, I can put in an order for one for you. Have you had any other problems?
Patient: Sometimes I get a headache from staring at the computer too long.
Doctor: Hold on -- there, I've adjusted your screen resolution and font size on your home and work computers.
Patient: Umm.....
It's nice of them to admit they are and be described as a one trick pony.
...
One hell of a pony
http://www1.va.gov/CPRSdemo/
2. HIPPA says no. If a nurse accidentally allows access to your health information, that's a $10,000 fine for her and a $100,000 fine for the hospital.
3. HIPPA says no.
-- http://aspe.hhs.gov/admnsimp/pl104191.htm#1177
Geez, you'd think that people involved in IT would be somewhat aware of the demands of HIPPA PHI.
The road to tyranny has always been paved with claims of necessity.