Slashdot Mirror
Accessing Medical Files Over P2P Networks
Gov IT writes with this excerpt from NextGov:
"Just days after President Obama signed a law giving billions of dollars to develop electronic health records, a university technology professor submitted a paper showing that he was able to uncover tens of thousands of medical files containing names, addresses and Social Security numbers for patients seeking treatment for conditions ranging from AIDS to mental health problems. ... The basic technology that runs peer-to-peer networks inadvertently exposed the files probably without the computer user's knowledge, Johnson said. A health care worker might have loaded patient files onto a laptop, for example, and taken it home where a son or daughter could have downloaded a peer-to-peer client onto the laptop to share music."
Sorry but what does one have to do with another?
Currently Doctors are using word documents with every patient's name as the title in some locations. While others are using VB apps with a Acess Database type solution.
Putting real money into a real electronic system with access controls and a audit trail is a GOOD thing and will stop things like records spreading onto P2P networks.
It is good for patients, it is good for doctors, and it is good for the general quality of healthcare.
I grant that it is expensive though. I also grant that governments are bad at large IT projects and always give it to the lowest bidder.
The issue here aren't P2P networks. The issue is government employees either loading confidential data on non-approved environments, or unauthorized software being installed on supposedly restricted environments. Both these problems must be addressed with traditional security controls that are completely independent of P2P technologies.
The problem here is one of trust: right now, you can trust the Internet to carry all sorts of information to all sorts of people.
The answer is to expect some measure of caution: to carefully remove the more dangerous aspects and protocols of this most wonderful medium, so that its best parts are allowed to shine.
Imagine how great it would be if in the future a doctor around the world could just drag and drop health records into an online folder and know those records will get to your physician -- and no one else. The price may be P2P, but the purchase is virtually limitless.
Just days after President Obama signed a law giving billions of dollars ...
Let's be clear, because it appears that more and more people do not understand how the government works.
The president, nor congress, "give" money. You cannot give what is not yours. What is happening is that the government is using the police power of state to take money from its citizens and then redistributing that money. That is what happens every time congress passes an appropriation. So, just keep that mind every time you see congress being "generous". They took that money from you and me at gun point to give to someone else.
"Clueless docs store patient data on wide-open PCs?"
plz seed
able to uncover tens of thousands of medical files containing names, addresses and Social Security numbers for patients seeking treatment for conditions
This is a disaster waiting to happen.
Its not my fault, someone put a wall in my way.
Comment removed based on user account deletion
If a doctor kept medical records on paper in a filing cabinet at home, would they let anybody else touch that cabinet?
The real problem here is that doctors take patient information home on a laptop, then allow somebody else to access that laptop. It's easiest to just get another laptop for the kids and not let them near your work computer.
Usage: km/h for speed (kilometers per hour); kph for very slow impulses (kilopond hours).
Here is a Alpha rpm installer for nearly the entire Veterans Affairs hospital system server:
http://sourceforge.net/projects/worldvistarpmin
This is a GOOD thing. The public can know in its entirety how the thing works and check it for privacy and security.
-- IV
http://www.LinuxMedNews.com Revolutionizing Medical Education and Practice.
And part of what I needed to do was block myspace, etc., on the LAN. But the head pharmacist had some P2P running on his computer (its good to be the king). I remember thinking at the time how insecure to run P2P on a business machine with a lot of confidential information on it.
I don't think the customer data was stored locally, but that doesn't stop spyware, key loggers, etc., from still being an issue.
Free music or maintaining the integrity of customer data. That's a tough call.
transporter_ii
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
This is the second story this week I've heard villainising P2P beyond basic piracy.
The first, from the Today show I think, was about somebody having their identity stolen because somebody accidentally shared some financial records. The reason a FUD campaign came to mind was the way my wife reacted to the story. Some comment about how dangerous P2P applications were.
Anybody else think these stories could an organized effort to create paranoia in the less technical crowd?
I don't either. Something illegal file sharers don't realize is the law of unintentional consequences applies to them. Did anyone involved in the creation of these tools ever realize that a program that's designed to make easier the sharing of the contents of whatever it's pointed to with the entire world was going to have consequences like this? Check mark in the column labeled," But I ain't hurting no one".
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
A health care worker might have loaded patient files onto a laptop, for example, and taken it home where a son or daughter could have downloaded a peer-to-peer client onto the laptop to share music.
Or the son or daughter could have emailed the patient files. Or printed them out. Or uploaded them to googledocs. Come on, what has this to do with p2p? And how about not giving your child access to your patient files? Hm?
On second thought, let's not go to Camelot. It is a silly place.
I have a friend who runs an insurance investigation business. A lot of his data includes claimants' medical, criminal, income, and other assorted records. He has several investigators working in his office, each with a PC (fortunately, no laptops) and all behind a secure(?) firewall. From time to time, I've helped him configure or repair his network and/or desktop systems. In doing so, I've noted that every system has their C: drive shared out on the LAN with read/write privileges granted to everyone else in the office. In spite of the problems with security or system corruption (why anyone would need to share out all their system .DLLs with write permission is beyond me), he insists that everyone in the office 'needs' complete access to everyone else's files. A disaster waiting to happen, IMO.
People just don't understand, or give a sh*t about the consequences of lax data security. P2P networks, or the mis-configuration of file sharing s/w is just one symptom of this.
Have gnu, will travel.
Just search for .doc and .xls on your favourite network. Most of the results certainly aren't supposed to be public. Search for a file normaly found in the root directory (in win98 days it was AUTOEXEC.BAT), and you've got thousands of "friends" sharing their complete hd.
With public sharing of formerly-private data, companies can discriminate against unhealthy persons whenever they desire.
Only if you have shitty privacy laws. Those jurisdictions that help to protect their citizens (e.g., EU, Canada's PIPEDA law) have much less to worry about. Doctor-patient privilege and all that.
Of course if the US health system focused more on health that on profit, things would be different regarding the motivation of all of these records.
http://www.ansi.org/
They already standardized the electronic file for just about everything else involving the medical industry. And did a good job of it, IMO.
A P2P program should not be installed on any system that has sensitive information. By doing so you are not just opening up the possibility of accidentally sharing those files, but you also open yourself up to a slew of viruses which could further compromise the system. Any system that has this kind of information should be FOUO (for official use only).
Who mods this garbage up?
Or how about doctor asks patient, "how are you feeling? Have you experienced anything like this before?" Patient says, "Yes. Here I have a [paper] record of my previous doctor visits. Does that help?". Doctor says, "it could". Patient says, "Okay, but those are my property [responsibility] and I want them back when I leave". Doctor says, "Sure. Your the boss.".... Whoahh.. What was I thinking?!
to keep cutting and off shoring IT services and departments.
You've gotta have geeks on-site
Its not the years, its the mileage
... did the files get transferred faster through P2P than with other transfer tools? How many clients were serving each file?
Federal law (Health Insurance Portability and Accountability Act - or HIPAA) levels serious legal liability on "any doctor who asks" (or any other person in a health-care organization who looks at a medical record outside of their job responsibilities. By definition, this, then is not "public sharing of information." XYZ company is not entitled to look at your health information.
Do errors occur? Hell, yes, they do. Laptops get stolen, people screw up. But to deny the benefits of having access to critical information in emergency situations, or to avoid repeating a test done last week, or to avoid a person getting a medication that doesn't work because another doctor recently changed another of the meds, or to get a drug that can be fatal to a person because the information wasn't available, is to say that you'd rather life be a crap-shoot.
The way for this technology to get better is for people to work on the solutions to the issues of security and privacy, not to keep medicine in the stone-age of information utility.
For an interesting read about why this is so important, read the Medicare Annual Report. Everyone's payroll taxes have to go up 3.5 percent to cover the estimated shortfall of Medicare for the next 75 years (I expect to retire sometime in that timeframe). With life expectancy increasing, and the baby boom generation in retirement for the next 40-50 years, OASDI and MMS look take a bigger bite out of everyone's paycheck.
One solution to this projected problem is to reduce the cost of healthcare by reducing errors, repeating unnecessary tests because of lack of access to a record, having technology that alerts clinical staff (doctors aren't going to be the only people providing medical care) to potential interactions, matching medications/treatments to genetic likelihood of therapeutic benefit, and enabling greater home health care. All of these opportunities require increasing use of information technology.
Good luck with that heart condition.
This assumes that the doctor has access to the server.
That the link will hold whenever critical decisions have to be made about his patients.
would let their kid use their work laptop.
http://www.ansi.org/
They already standardized the electronic file for just about everything else involving the medical industry. And did a good job of it, IMO.
You forgot to mention that it did not cost billions of dollars. Only the Government possesses the special skill of spending a trillion dollars on something that's worth about 50 cents.
If it will help effeciency [sic] and reduce cost then private institutions will adopt it voluntarily.
That makes sense. However, what it makes sense to do is not always what gets done.
In the eyes of some medical institutions, they see a cost in changing the records, but no change in what they can feasibly charge per patient nor any promise of an increase in their number of patients. They see a definite cost and only a nebulous possibility of future gain.
But let's say you're right and even without government intervention, within the next two years most US medical institutions digitize their records. Let's give a high figure and say 95% of them do this.
That remaining 5% will still cause problems when patients realize that health care is better and cheaper with other providers, or just leave for other reasons, and have to deal with beaurocracy in order to transfer records that they might need immediately. The possibility that something in their previous medical records might affect their treatment from their new physicians might escape them entirely. The record either might not get there in time or they might not see any reason to request its transfer at all. The original record might be lost by fire or natural disaster or any number of things. Creating electronic records (SECURELY) makes sense, but businesses don't want to make sense. They want to make money.
Also, with the economic shitstorm, why not create some immediate clerical jobs? Not everyone can help build roads and lay cable.