Slashdot Mirror
EHR Privacy Debate Heats Up
CurtMonash writes "The New York Times reports on President-Elect Obama's continued commitment to electronic health records (EHRs), which on the whole are a great idea. The article cites a number of legislative initiatives to deal with the privacy risks of EHRs. That's where things start to go astray. The proposals seem to focus on simply controlling the flow of information, but from a defense-in-depth standpoint, that's not enough. Medical care is full of information waivers, much like EULAs, only with your health at stake. What's more, any information control regime has to have exceptions for medical emergencies — but where legitimate emergencies are routine, socially-engineered fake emergencies can blast security to smithereens. So medical information privacy will never be adequate unless there are strong usage-control rules as well, in areas such as discrimination, marketing, or tabloid-press publication. I've provided some ideas as to how and why that could work well."
Every receptionist who leaves her PC logged in at the clinic will be a risk factor.
Either you get over yourselves and take the good with the bad, or you shut yourself in and never gain the benefits of the technology.
This isn't even specific to medical records. There will be bumps in the road for any technology.You can make sure your car or bike never hits a pothole by never driving it. But then you will need to walk to where you're going.
The danger of an Electronic Health Record is that it may perpetuate mistakes which of course do happen and any mistakes can carry on and lead to more problems. Sometimes for people with mental health problems, a diagnosis is made and then subsequently it's discovered that that was not the actual diagnosis. Having this kind of an electronic trail to follow you around forever could be extremely dangerous, in my opinion.
This game will waste your life. Don't clicky!
I saw this the other day. Basically, a pair of professors, one in law and another in computer science (specializing in software testing) are trying to bring the problems with EHR to a wider audience.
They call for testing and certification of EHR systems (Though thankfully not through the FDA).
It'll be interesting whether anyone listens to them.
$emails = $DB->get('SELECT email FROM records WHERE records.dysfunction LIKE "%erectile%"');
foreach( $emails as $email ){
mail($email, 'hello i hear you are in need of herbal via....');
}
One of the problems with EHR is that it potentially follows you your entire life.
If information about your economic status, familiar situation, physical location, customs, etc. Usually becomes unreliable after some time. A leak on those informations slowly loses effect.
Medical information, however, is permanent in many cases. A single leak of a person's data can have fresh information for, literally, a lifetime.
banking has a network for wire transfers that is not accessible from the internet. Make electronic medical records transferable and accessible only from within a closed off network. Then information can not be stolen from an outside attacker and you are left with the same risk you had before, insiders stealing data.
This has been in place in many other countries for years, including the UK where - for all the bureaucracy and wastage of the NPfIT initiative - it's been largely successful.
The system isn't perfect, and human error is the main source of problems and breaches (as ever), but the benefits have so vastly outweighed the risks that I'm surprised this is even being debated.
Most importantly, all the problems envisaged by critics have already been anticipated, encountered and (largely) overcome in other countries. Take a look outside your borders and learn a few things. Find out what works and what doesn't, and use the mistakes of others to build a better system. Just don't start panicking over nothing. This is not a pioneering initiative, in global terms.
Meta will eat itself
Essentially what you need is DRM. The data is only available on a limited number of machines and then strictly limited in what you can do with it, with strong audit trails. Not using general purpose computers but rather devices might help.
But in the end I don't think this is likely to work, the incentives for hacking are too strong and the distribution has to be too wide. EHRs mean that there will be substantially less medical privacy in exchange for better medical care and lower costs (70b-300b / year). That doesn't seem like a bad trade.
.
A doctor dictates his diagnosis into a microphone on a PC. It becomes a data file. It sits in his output queue. It is then sent to a server to be electronically signed (a Word Macro is run). It sits on it's input queue until done then sits in its output queue. Then it gets sent to an HL7 routing engine where it sits on queues. Then on to our medical database. This generates some billing info which goes to the HL7 router then on to a private company in Tennessee, which sends results to a website....
Now I'm sure there will be controls on who can get at the medical database. But what about the data whizzing around the network? Tell me about the audit trail that lets me know who saw some of the info generated by that one encounter. Because it sat on at least 7 machines in 3 states for some amount of time.
And now you want each of those machines to check to see if the patient has signed off on that machine getting the info? Good luck with that.
And if someone shows up unresponsive in the ER, how do we send the X-ray to the remote radiologist if the patient can't release the data? And if 'emergencies' override that control, expect to see EVERY encounter be an emergency.
"Medical care is full of information waivers, much like EULAs, only with your health at stake."
This is sloppily worded, but let's be clear that medical privacy is not the same thing as "your health". If someone sees my private medical records, it doesn't make me sicker. If anything, more eyeballs would tend to make me less sick, as medical errors would be more likely to be caught.
Funny this should come up, considering what I just read last night in the RISKS Digest:
The proposition that EHR are a good idea remains as unproven as the idea that touchscreen voting machines with no paper trail are a good idea. Sometimes electronic documents and records introduce brave new failure methods that outweigh any benefit.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
that you once tried to overdose on aspirin 25 years ago, as a 14 year old
I tried to kill myself by taking 500 aspirin. But after the first two I felt better.
...Making your information no longer valuable. What use are medical records to a script kiddie if we're in a single-party payer system? Not that I'm a fan of either one...Obama's friends on the left seem to favor this approach..not that he necessarily does. Just sayin..
The amount Labour has thrown to the NHS is almost obscene.
There is a lot of mismanagement to be sure (if it is worst than a bank would be open to debate, at least most people get relatively decent health service) but to say the NHS is underfunded is not a serious point, as can be quickly checked.
IANAL but write like a drunk one.
I am by no means rich and have been privately insured all my working life in the UK.
When I need to be treated quickly I go for private insurance, for long term treatment I rely on the NHS.
IANAL but write like a drunk one.
Whose information is that?
The patient's.
Who should control it?
The patient.
Any other solution should not be allowed to prevail.
An intelligent card, easy to back up at home and protected by well thought of security mechanisms is all what is needed.
There is no need for massive centralized databases, you just send the encrypted information to the person that needs to see it in an "as needed basis", perhaps by swapping your card in terminals connected to a private network that allows the sharing of this data.
IANAL but write like a drunk one.
between the U.S. and the rest of the world is the rest of the world gives up their rights readily and freely without a fight. You claim to welcome us to the 21st century simply because it's based on technology, and I say, enjoy the your life in 16th century based on the rights your government protects for its citizens.
I read Slashdot for the headlines, because the headlines, unlike the articles, are usually original and never duplicated
I completely agree. I do not understand, whatsoever, how it is burdensome for a patient to bring their medical records to their doctor. The doctor and/or hospital keep those records privately; access and review/add to them when necessary--- and if the patient needs to see another doctor, they can get a copy and carry them on over to the new doctor.
This is how it already works; this is NOT a big deal.
Unless you were remarkably more stupid than everybody else, those old posts or photos will be much like everybody else's, and that employer will have a severe difficulty in finding *anyone* to hire.
The main difference between credit records, personal blogs, and health records is that you and nobody else was responsible for what you did in you personal and financial life. If you find it difficult to get credit or a job because you acted more stupid than average in the past, that's a problem you created for yourself. But health records are a different matter, they depend mostly on genes your ancestors gave you, it would be rather unfair if you were blamed for that.
Because sometimes, shit happens to the patient and the exact nature of how they're taken to the hospital may prevent them from carrying their EHR with them. In that case it'd really suck for the hospital if they didn't have the record on file or access to another hospital that did. Maybe the patient is severely allergic you're about to give him. Added to whatever current condition the patient has, you might kill him.
"In that case it'd really suck for the hospital if they didn't have the record on file or access to another hospital that did."
Which is the current default. I don't see a huge outcry about this.
"Maybe the patient is severely allergic you're about to give him."
Also the current default. Which is why they make medalert bracelets. If you have a severe medical problem, you already have the info on you. At least if you give a damn. Problem solved.
EHR's are a solution to a problem that patients don't have. It would be great for employers, insurance companies, the government, software companies, etc. But not really for the patient (or the doctors).
Have you ever read your records?
They ALL have errors. And omissions. Lots of them. Often important ones. There is even relevent information that is not included with them.
It won't get better with electronic records. It will probably get worse (one universal input format). The (unwilling) doctor will be expected to enter the information into the computer. As a result, the information will be notated on paper or recording device (more errors) and transcribed (yet more errors). Then any information that does not fit into a standardized category will be lost. Wow, what an improvement!
Not to mention the fact that my records will now be public for all intents and purposes. At least with paper records you have to know what doctors I have seen and have to physically find and access them.
Develop a new network port completely different from cat5. (this network will be separate from the internet just like bank transactions are today)
Make regulations requiring any computer with this new network port not be allowed to carry cat5 or wireless, and that the computers be kept in a feraday caged room with no cat5 plugs or wireless.
Limit electronic storage of medical records to those computers, with transfer to paper required for every other use.
Then institute hefty criminal and civil penalties for anyone caught in possession or use of illegally obtained criminal records.
No need for orwellian systems, no need to burden individuals with hefty costs for new equipment, and minimized leakage.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
There is no need for massive centralized databases, you just send the encrypted information to the person that needs to see it in an "as needed basis", perhaps by swapping your card in terminals connected to a private network that allows the sharing of this data.
Wait what?
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Unfortunately, patients are not trusted with medical records. Any possibility of alteration or forgery cannot be permitted, because this would invalidate the concept of those records being reliable.
Why would a patent alter their records? Malpractice for one. Insurance scams. Drug seeking parients. Basically anything you can imagine.
This is why you can have a copy and not the original of any records today in the US. And every provider is responsible for their own records.
Unfortunately, patients are not trusted with medical records. Any possibility of alteration or forgery cannot be permitted, because this would invalidate the concept of those records being reliable.
Easily solved with a system of digital signatures that enforce an audit trail.
Unfortunately life is never that simple.
Medical records may contain information that the patient should not see - or to put it better - doctors constrained by the restriction that the patient sees everything will not provide optimal health care. For example, if a doctor suspects a patient is an alcoholic, but letting the patient know that will cause them to stop seeing the doctor ... how should that be documented? If we say the patient owns their records and can see everything then doctors simply won't document these things at all, which is not an optimal outcome.
Also - can we hold doctors legally liable for information in the health record if they themselves do not have access to it? This is a thorny issue. I would not like to be held responsible for information that I cannot even myself view. What happens if a doctor thinks of a complication after the patient left?
To counteract that problem, I change my DNA and fingerprints every few weeks, together with my windows login and password.
You're that paranoid, and you use windows? You should be underground somewhere in a faraday cage running some obscure BSD variant no one has heard about, and posting to the internet using a telepathic connection to the lynx-enabled terminal just outside the faraday cage...
The problems of implementing EHR privacy are actually similar to the problems of implementing DRM. You attempting to hide information from the very people who control the system. So it is a losing battle.
And why are we in this absurd battle? Because health care payees - insurance companies, have a financial incentive to abuse whatever knowledge they have of a person's health conditions.
So essentially, we doomed to have more insane, self-defeating systems as long as we have a private health care system.
Because sometimes, shit happens to the patient and the exact nature of how they're taken to the hospital may prevent them from carrying their EHR with them. In that case it'd really suck for the hospital if they didn't have the record on file or access to another hospital that did. Maybe the patient is severely allergic you're about to give him. Added to whatever current condition the patient has, you might kill him.
I'd prefer to OPT-IN by making my records available to any local hospitals; or at least to opt-in to a national health database system.
The current plans seem to leave no option available other than---your records, made public. Yes, they pretend the records will be private, but how many large databases of information get compromised every single day? I'm not even 30 yet and I've received at least 5 (that I can remember) notices from places that keep my information private, alerting me that it has been compromised.
Let me spell this out for you real simple. Insurance and medicine are still generally private in the US. With most anyone who deals with records at hospitals having access to the centralized database, your records are now available to and resting within the responsibility of thousands and thousands of people; none of which are perfect, or even necessarily 'good' people.
Your medical history is as private as your anus, your porn favorites, and that little thing your wife loves you to do. Would you like thousands of people to have the ability to make your anus public with the click of a mouse? What about your history of alcoholism and drug abuse?
Privacy must be protected. Given a centralized system that is accessed or even developed by humans, we will not have any privacy. Even if all but one of those with access is a good person, that one person, acting on deliberate interests, or possibly manipulative interests (medical espionage) like needing money, drug abuse, companionship, etc, can make anything in that database available to anyone who asks them for it.
Think about that for a minute... If it doesn't bother you yet, you're too young to have any medical history worth keeping private.
What if the patient loses his/hers card? What if his in an emergency and happens not to walk with that card in the pocket? Also, these information is not relevant only when the patient is in front of a doctor - sometimes, the case is reviewed by a board, or acessed for preventive care (like, your parents had cancer and you haven't showed up in 6 months), or for scientific research or juridical purposes. Usually, the information kept by the institution is different from the one given to the patient. In Brazil, the patient has the right to get reports on anything he wants, but not the originals.
-- --
He didn't mention anything at all about the patient being able to read the record.
Red herring. It is a requirement to prevent unauthorized alterations to the record, no matter who stores the record. Additionally, no one I've seen has said anything about the patient even being able to read the record, let alone write to it. It's simply a question of who has responsibility for the record.
I know, I know. You believe individuals can't do anything without the government as a safety net.
> What if the patient loses his/hers card?
What if the government or insurance company loses the card?
> What if his in an emergency and happens not to walk with that card in the pocket?
Gee, I don't know. What do they do now?
> Also, these information is not relevant only when the patient is in front of a
> doctor - sometimes, the case is reviewed by a board, or acessed for preventive
> care... or for scientific research or juridical purposes.
Did I consent to my medical records being public or semi-public? I don't care what the purpose is. My medical information is private and no one has the right to that information unless I (not the government) gives it to them. Ok?
> What if his in an emergency and happens not to walk with that card in the pocket?
Gee, I don't know. What do they do now?
What they do now is get inferior treatment to that which they would/will get with good EHRs, sometimes dying as a result.
To err is human. To forgive is good system design.
"In that case it'd really suck for the hospital if they didn't have the record on file or access to another hospital that did."
Which is the current default. I don't see a huge outcry about this.
"Maybe the patient is severely allergic you're about to give him."
Also the current default. Which is why they make medalert bracelets. If you have a severe medical problem, you already have the info on you. At least if you give a damn. Problem solved.
EHR's are a solution to a problem that patients don't have. It would be great for employers, insurance companies, the government, software companies, etc. But not really for the patient (or the doctors).
Please get out of the 1980s, and start heading for the 2020s. Personalized medicine is coming. Everything in the record will actually be relevant to treatment.
To err is human. To forgive is good system design.
There is a January 1, 2010 deadline for all pre-hospital (EMS) providers to be entering reports in electronic form. My service is already on computer, and my rescue squad starts next month. Great idea, unfortunately they went nuts with it. It takes 15-20 minutes to write a report for someone that scratched their elbow. A complex trauma or medical patient is a nightmare to write up. The national requirement is for around 400 pieces of information, and more can be required at the state level. This is even before insurance and other things are added. See www.nemsis.org to get an idea. Pre-hospital providers are appalled.
Um, if you're concerned about inferior treatment, just wait until universal health care starts kicking in. Lack of documentation during emergency situations is the least of your problems
Been there, done that - EU financed EHR-S project (Project ID: EuropeAid/117681/D/SV/YU) executed within 3 years, taking all aspects into the account (legal, system, technology, privacy, medical, procedural, insurance, ...) we made a multy-lingual, standards - compliant system on JEE5, and integrated it with the number of existing local vendors systems (ranging from J2EE to FoxPro to VisualBasic to Clipper). Not easy, but can be done within 4 years for the US size country if managed and executed properly. Integration risks and the approach are described at 6th ICICTH Samos 2008 conference (APPROACH AND RISKS OF EHR-S INTEROPERABILITY AND INTEGRATION WITH THE LEGACY HEALTHCARE ICT SYSTEMS)
sbs from Advanced Systems Guild
I agree that if an audit trail really is required almost all the communications currently done would have to be redesigned. This would be a GOOD THING. Just don't expect it to be easy since it requires REPLACING ALL CURRENT SYSTEMS.