Slashdot Mirror
Accessing Medical Files Over P2P Networks
Gov IT writes with this excerpt from NextGov:
"Just days after President Obama signed a law giving billions of dollars to develop electronic health records, a university technology professor submitted a paper showing that he was able to uncover tens of thousands of medical files containing names, addresses and Social Security numbers for patients seeking treatment for conditions ranging from AIDS to mental health problems. ... The basic technology that runs peer-to-peer networks inadvertently exposed the files probably without the computer user's knowledge, Johnson said. A health care worker might have loaded patient files onto a laptop, for example, and taken it home where a son or daughter could have downloaded a peer-to-peer client onto the laptop to share music."
Sorry but what does one have to do with another?
Currently Doctors are using word documents with every patient's name as the title in some locations. While others are using VB apps with a Acess Database type solution.
Putting real money into a real electronic system with access controls and a audit trail is a GOOD thing and will stop things like records spreading onto P2P networks.
It is good for patients, it is good for doctors, and it is good for the general quality of healthcare.
I grant that it is expensive though. I also grant that governments are bad at large IT projects and always give it to the lowest bidder.
The issue here aren't P2P networks. The issue is government employees either loading confidential data on non-approved environments, or unauthorized software being installed on supposedly restricted environments. Both these problems must be addressed with traditional security controls that are completely independent of P2P technologies.
"Clueless docs store patient data on wide-open PCs?"
There are several things to check. 1. Do you get a receipt? 2. Do they say thank you? 3. Do you have an opportunity to fill out a customer service questionnaire? 4. Do they have a toll free number to call if you have questions about your payment?
If you cannot answer 'Yes' to all of these questions, then the people with guns are probably not a legitimate government and you should call your local sheriff to run them off. (You can find the number for your local sheriff in the telephone book under 'Government services'. The sheriff is funded by your taxes and is happy to assist in running off banditos.)
I don't read your sig. Why are you reading mine?
Comment removed based on user account deletion
If a doctor kept medical records on paper in a filing cabinet at home, would they let anybody else touch that cabinet?
The real problem here is that doctors take patient information home on a laptop, then allow somebody else to access that laptop. It's easiest to just get another laptop for the kids and not let them near your work computer.
Usage: km/h for speed (kilometers per hour); kph for very slow impulses (kilopond hours).
And part of what I needed to do was block myspace, etc., on the LAN. But the head pharmacist had some P2P running on his computer (its good to be the king). I remember thinking at the time how insecure to run P2P on a business machine with a lot of confidential information on it.
I don't think the customer data was stored locally, but that doesn't stop spyware, key loggers, etc., from still being an issue.
Free music or maintaining the integrity of customer data. That's a tough call.
transporter_ii
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
I have a friend who runs an insurance investigation business. A lot of his data includes claimants' medical, criminal, income, and other assorted records. He has several investigators working in his office, each with a PC (fortunately, no laptops) and all behind a secure(?) firewall. From time to time, I've helped him configure or repair his network and/or desktop systems. In doing so, I've noted that every system has their C: drive shared out on the LAN with read/write privileges granted to everyone else in the office. In spite of the problems with security or system corruption (why anyone would need to share out all their system .DLLs with write permission is beyond me), he insists that everyone in the office 'needs' complete access to everyone else's files. A disaster waiting to happen, IMO.
People just don't understand, or give a sh*t about the consequences of lax data security. P2P networks, or the mis-configuration of file sharing s/w is just one symptom of this.
Have gnu, will travel.
Federal law (Health Insurance Portability and Accountability Act - or HIPAA) levels serious legal liability on "any doctor who asks" (or any other person in a health-care organization who looks at a medical record outside of their job responsibilities. By definition, this, then is not "public sharing of information." XYZ company is not entitled to look at your health information.
Do errors occur? Hell, yes, they do. Laptops get stolen, people screw up. But to deny the benefits of having access to critical information in emergency situations, or to avoid repeating a test done last week, or to avoid a person getting a medication that doesn't work because another doctor recently changed another of the meds, or to get a drug that can be fatal to a person because the information wasn't available, is to say that you'd rather life be a crap-shoot.
The way for this technology to get better is for people to work on the solutions to the issues of security and privacy, not to keep medicine in the stone-age of information utility.
For an interesting read about why this is so important, read the Medicare Annual Report. Everyone's payroll taxes have to go up 3.5 percent to cover the estimated shortfall of Medicare for the next 75 years (I expect to retire sometime in that timeframe). With life expectancy increasing, and the baby boom generation in retirement for the next 40-50 years, OASDI and MMS look take a bigger bite out of everyone's paycheck.
One solution to this projected problem is to reduce the cost of healthcare by reducing errors, repeating unnecessary tests because of lack of access to a record, having technology that alerts clinical staff (doctors aren't going to be the only people providing medical care) to potential interactions, matching medications/treatments to genetic likelihood of therapeutic benefit, and enabling greater home health care. All of these opportunities require increasing use of information technology.
Good luck with that heart condition.