Americans Trust Docs, But Not Computerized Records

Lucas123 writes "A soon-to-be-released survey from CDW shows that Americans trust their physicians to use their health information responsibly, but they're very concerned that once in electronic format, their personal health information may suddenly show up on the Internet. Their fears may not be unfounded. CDW said that survey data showed 30% and 34% of doctors lack basic anti-virus software and network firewalls, respectively. Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records."

Comments

Not unfounded.

[Kenja]

People notice when their filing cabinet goes missing, they are less likly to notice the theft of digital records. This does make it more likely that employees etc will abscond with the data.

Re:Not unfounded.

[MozeeToby]

Couldn't you find ways around the problems? Encrypt the data and store it to a central DB, only the patient keeps a record of his encryption key and allow him to request a new key at any time. Maybe set it up with expiring keys to allow a doctor access for a limited period of time after he sees the patient. Obviously this kind of scheme would restrict access but it would also make bulk exportation of the raw data difficult or impossible.

Of course, there will always be holes in such a set up, but the same can be said of filing your tax returns, storing paper records of your medical files, and any number of other things we do regularly that are at least as important to keep private as medical records are.

Re:Not unfounded.

[Korin43]

But that would be hard.

Re:Not unfounded.

[maxwell demon]

Exactly. If someone photographed the contents of your filing cabinet, you'd be more likely to not notice it that if someone stole them. That's because the photograph is a copy. The original is still there. If someone stole your filing cabinet, you'd notice as soon as you want to look up something.

Re:Not unfounded.

[Bobakitoo]

Please stop with that silly, and offtopic, argument.

Medical records are not meant to be public information. In order to "steel" data, it must have been kept locked in first place. They also have no legitimate use outside of the patient doctor relationship.

And the saying is "copyright infringement is not theft", not "copying".

Re:Not unfounded.

[0123456]

Couldn't you find ways around the problems? Encrypt the data and store it to a central DB

Why would you put it in a central database when you could just carry it around with you (and back up as required to wherever you chose)?

Re:Not unfounded.

[MozeeToby]

Why would you put it in a central database when you could just carry it around with you (and back up as required to wherever you chose)?

Sure, fine, whatever. My point was that while the security and privacy concerns are certainly warranted, they can relatively easily be gaurded against using standard, commodity software and hardware solutions. It isn't as though keeping information from falling into unauthorized people's hands is a problem that has never been encountered before in computer science.

And to more directly answer your question, you might want it in a central DB so that if you're on vacation and end up in the hospital the doctor there can access your records and find out that you're allergic to such-and-such drugs, have a history of this-and-that disease, and here's what your blood pressure was when you went in for your physical 6 months ago. Personally, if it were properly secured, I would prefer the information be accessible from anywhere with an internet connection so long as I or someone I trust with it supplies you with the key.

Re:Not unfounded.

[cheekyjohnson]

It isn't theft. It's copying (or copyright infringement, depending on the situation). He just used the wrong term for it. It does, however, endanger someone's privacy.

Re:Not unfounded.

[khallow]

only the patient keeps a record of his encryption key and allow him to request a new key at any time

And what happens if the patient can't provide the key, say because they are unconscious and dying? At the least, there would have to be a somewhat centralized authority (that is, someone who is guaranteed to be there, not just a next of kin) with the power to provide a suitable key.

Re:Not unfounded.

[kullnd]

It would not be possible to do this... A healthcare org has to refer to the patient records long after your visit is over. In a hospital, there is generally reporting that takes place which requires extensive reviews and audits of the care given, and alot of these audits can take place nearly half a year after you were seen. There is also the fact that after your visit, the record will be reviewed for medical coding, which is how you, your insurance, and or the gov't are billed for the care that you were given. The idea that when you leave, your record is locked, is just not realisitic. I can also say that the latest push by the federal government, with these EHR incentives, is pretty much going to do the opposite of what you are asking for.

I have seen medical practices on both ends of the security fence, and it is sad... I've been in practices that I would never, ever, visit as a patient because I have no faith in how things are run there from an IT security view point... At the same time, I have worked with other orginazations that do take security very seriously, and do everything possible to ensure that all data is kept private... The thing that really sucks is that you really have no way of knowing what type of office you are visiting until you see the report that your record has been leaked.

Someone else posted in here that most practices are afraid of HIPAA and will do anything to keep things safe... Unfortionately I have seen alot of practices that couldnt give a crap about HIPAA and won't listen to any reasons as to why they should not run bittorrent on their office computer. The bottom line is that until HIPAA and HITECH start producing more results, busting more practices, and making everyone aware that they do have teeth this is going to continue to be a problem. HIPAA has been around for a long time, but until HITECH came around it has been a joke, and only enforced in the worst of senarios. I still think that both of the policies are too loose, and enforcement on those policies today is still largely reactive, when it's too late.

Re:Not unfounded.

[iluvcapra]

It doesn't have to be centralized authority, in this case the patient's general practitioner would hold a copy of the key and release it in such a circumstance according to the terms of a legal advance directive, like a limited power of attorney or living will. You just need a central repository of the encrypted data, and a directory service to help an ER find the patient's GP or kin, allow the keyholder to validate the patient's unconscious condition, or that their condition meets the terms of the directive, and then release the records.

If the patient is dying on the table and the communication with the referent of the "security directive" or whatever isn't available, they just have to proceed without records for the time being. Happens all the time.

Re:Not unfounded.

[khallow]

It doesn't have to be centralized authority, in this case the patient's general practitioner would hold a copy of the key

Who actually holds the key? The general practitioner can have an accident or medical emergency of their own. The key has to be reliably obtainable.

The scheme is workable, I think, but I think it's worth noting that no matter how it's implemented, there will be a number of people with access to that key ("access" not being the same thing as copying a zillion records for fun and profit). Because otherwise, the doctors treating a patient might not have access to the key.

Re:Not unfounded.

[Stregano]

It depends on what you are diagnosed with or what doctor you go to. If you have a medical marijuana card, you do not want hard copies. Many dispensaries get raided, and then the feds have your information and you get marked as a pothead. If they are digital, if there is a raid, most professional places have ways of handling digital documents properly. Something like that would be an instance where I don't want teh feds to have my records. And shut your lips, I have a condition I am getting treated for and need a way to get rid of the pain. You are not my doctor Mr. Judgy McJudgy Pants

Re:Not unfounded.

[Foobar of Borg]

That's because Copying is not Theft. Isn't that the argument used by most digital piracy apologists?

Copying is not theft. Copying medical data, however, does violate doctor-patient confidentiality. Copying other personal information can lead to actual theft, such as through fraud (stupidly referred to as "identity theft").

Re:Not unfounded.

[icebraining]

I agree. The crime is breaking into the {computer, filing cabinet} to access them in order to copy them.

Re:Not unfounded.

[Ltap]

This is a beautiful, simple solution. It's a pity it'll never be properly implemented.

Most people are just too stupid to figure out how encryption works or to try to understand why they need it. Even if they use it daily (say, as a part of their job) they will likely neglect it, passing off encryption keys to anyone and everyone. Furthermore, due to the fact that insurance companies and employers love to spy on people's medical records, they would almost certainly be given access in some way, allowing the records to be compromised by an outside source without the control of the patient. Furthermore, in many jurisdictions patient records are defined as the property of the doctor, not the patient, so it would really be doctors controlling the system rather than individual patients. Finally, many doctors are simply too arrogant due to their high-status job to puzzle out even the simplest computerized system; and if they don't screw up, clerks (as the people who will update the database) will. Even a beautiful system like yours would be hacked up, trodden on, and would have all of its secrecy compromised and destroyed. Think again.

Re:Not unfounded.

[cayenne8]

I'm currently trying to help a Dr. with some of this and HIPPA needs. The problem I'm trying to solve is...he is a radiologist...and needs to send securely...reports on patients AND images. I'd looked at a service like ZSentry for easy encrypted email...on both ends.but the service doesn't allow files as big as needs to be sent.

I'd looked into maybe setting up some kind of PGP set up for him...but would be tough to get every dr he might do business with....to get them to set up PGP, generate keys...and set up whatever email client they use......

I was trying to maybe come up with him a web server.that other dr 's could link to securely...etc....but need a quick term solution till I can set something up like that and integrate it with the system he currently has with telerad..etc...and have to make it easy for a non-tech Dr to use

Any ideas out there?

Re:Not unfounded.

[Z34107]

What you want is a PACS. These are generally expensive. I can't recommend any specific vendors, but you want to be very careful with HIPAA. They're also FDA regulated, so you also want to be careful about hacking anything together that could be functionally confused with a PACS.

That said, I'd be really surprised if a radiology clinic didn't already have one (that "telerad" you alluded to?). I'd call up the vendor and ask what they can do; any modern system will speak DICOM, and a lot (if not most) of them can grab images from outside the facility.

Re:Not unfounded.

[demonlapin]

It's not cheap, but using some Citrix product as your Web interface to any decent PACS system should provide a secure interaction. My hospital uses Citrix clients as the primary means of offsite access. If you want the remote site to be able to download, you'll probably need a VPN, as well as a better (and more expensive) PACS system. I'm not a radiologist, but Philips' iSite is the easiest one I've ever used. And it easily exports to DICOM.

Re:Not unfounded.

[demonlapin]

Photographing the entire contents of a filing cabinet takes a long time. It's silly to make obscurity your only security, but it's always a nice part of a balanced system.

Re:Not unfounded.

[demonlapin]

There's nothing hypocritical about it. He doesn't want to go to jail; he does want to smoke weed. Hypocritical would be advocating for harsher penalties for pot possession.

Re:Not unfounded.

[ElderKorean]

The scheme is workable, I think, but I think it's worth noting that no matter how it's implemented, there will be a number of people with access to that key ("access" not being the same thing as copying a zillion records for fun and profit). Because otherwise, the doctors treating a patient might not have access to the key.

Just be like many other databases in the US and use their Social Security number :-)

Re:Not unfounded.

[cowboy76Spain]

What you want is a PACS. These are generally expensive. I can't recommend any specific vendors, but you want to be very careful with HIPAA. They're also FDA regulated, so you also want to be careful about hacking anything together that could be functionally confused with a PACS.

That said, I'd be really surprised if a radiology clinic didn't already have one (that "telerad" you alluded to?). I'd call up the vendor and ask what they can do; any modern system will speak DICOM, and a lot (if not most) of them can grab images from outside the facility.

I have heard good things about K-Pacs, which is free. It also has utilities to receive HL7 with worklists and uses DICOM to comunicate with modalities (the x-ray machines). DISCLAIMER: I have just used it for a couple of personal trials, as I work in a public health administration and they are opposed to add systems for which they don't have support. But for your single organization, it might be a valid tool.

Re:Not unfounded.

[jimicus]

Millions of people manage to use encrypted systems every day for Internet banking or shopping. Encryption does not have to be hard.

What is hard is providing a user interface to a means of encryption so that the complications are reduced or eliminated while still maintaining some semblance of security. AFAICT, nobody's managed to do that in a fashion suitable for anyone to use on arbitrary streams of data that need to be encrypted and passed around as part of a batch process.

Re:Not unfounded.

[hitmark]

Dumpster diving however...

Re:Not unfounded.

[Stregano]

I don't keep any of my personal information on /. which makes it much easier to say things openly. I can't be so open outside of the internet since a random nickname is also associated to my face there

Re:Not unfounded.

[cayenne8]

Thank you for the replies.

They do have the imaging system set up to transmit images between his office and his clinics.

However, he's generating reports for the study ordering physicians..and cutting and pasting some of the images to put in the reports to the doctors..and wanting to send THAT...not the full image study.

They had been sending stuff in clear text emails with attachments and I told them that was not a good idea..so looking for a way to send this securely...and also not have to have each recipient have to install special software....that last part is the wrench thrown into the mixture...

Re:Not unfounded.

[hesiod]

Some PACS client software can burn a study to a CD, which is the way we deal with sending images to doctors offices (I work IT in a hospital). These CDs will have self-contained viewing software on them to see the images, and sometimes you can include reports with them. But that's only with the right PACS software... Trying to cut and paste DICOM images into Word sounds like a terrible idea -- not to mention tedious.

However, I know how stubborn doctors can be, and radiologists are often the worst of them... To pin down a proper solution, I'd probably need to know a lot more, mostly where the doctors are who are getting these reports. If they are employed by a hospital, that hospital probably has a PACS to which the images could be transferred. Of course, if they are in private practice that's pretty much out the window. A properly-configured PACS (that supports such access at all) would allow you to give those doctors remote access to it to only see their patients, but the Rads probably wouldn't go for it, as it may require more work on a regular basis, on top of setting up new users, etc.

I also want to reinforce what another poster said, which is to be VERY careful with HIPAA rules. If you have some kind of business agreement in providing IT services to medical staff, you may be accepting personal responsibility for privacy breaches that result from your work.

Not Too Surprising

[BJ_Covert_Action]

It seems like most of us Americans are also content to trust our eternal souls and moral decisions to an imaginary sky fairy with an epic beard.

But on a more serious, and less inflammatory note, this probably has to do with the very high incidence rate of folks in the U.S. getting their financial accounts cracked. Anyone who has had to frack about with their bank or credit agency regarding X many thousands of dollars being debited from their account due to some mysterious "hacker" that stole their identity is probably pretty suspicious of putting any important personal data on the internet period.

Re:Not Too Surprising

[|TheMAN]

Considering how EHRs are going to be required in the near future, I'm not surprised that hospitals/doctors are still getting dragged kicking and screaming into the 21st century.

HL7 was created in 1988, and over 20 years later, it still has very little penetration in the US. I had friends ask their acquaintances working at hospital IT departments, and many don't even know what HL7 is! Part of this is the government's fault (lack of incentives unlike European countries), but most of this is due to the lack of understanding and technophobia.

The other problem is HL7 is epicly hard to learn. There's a major shortage of trained/certified people to help hospitals deploy this right now. I'm trying to learn some of this so I can take on a job in Tokyo (part of getting my work visa approved involves understanding HL7). But with the lack of free resources or books, it appears to be a feat that requires divine intervention.

Re:Not Too Surprising

[Exclamation mark!]

And yet they put up all sorts of things on Facebook... go figure...

Re:Not Too Surprising

[demonlapin]

lack of understanding and technophobia

No, it's not technophobia. I'm a technophilic physician, and I know a lot of technophilic physicians, so I may be able to help you understand.

EHRs really cover several different areas. Some areas clearly benefit from computerization; lab reporting is so clearly better done via computer than phone that it makes no sense not to. Having radiology studies available for review outside the radiology department is of significant benefit. Having transcriptions of dictated reports available is tremendously useful.

Some areas are somewhat suspect. For example, nurses now often have to perform their hospital admission documentation on a computer. This is somewhat slower than using a handwritten method, and so nurses tend to dislike it - they are now doing data entry that is of only marginal benefit to them; the primary benefit is to the physician. Nonetheless, because a nurse will probably spend 20 minutes doing that admission work, the login/logout process is not usually painful (vital sign checks, on the other hand, are incredibly tedious on computer).

Finally, there are areas where the benefit is fairly small by comparison to the cost. From a doctor's perspective, a brief note in the chart is a trivially easily way to make a small update on a patient's status or convey an important point to consultants - much faster than finding a computer, logging in, waiting for Windows to load (the VA, for example, does not have generic logins to Windows - in addition to logging into the EHR, you have to log into Windows to be able to access the EHR), loading the EHR software, logging into it, and then finding the appropriate spot to enter a note. You can't flip back and forth between two pages in an EHR, the way you can with a paper chart.

With too many EHRs, doctors become data entry clerks for the hospital and insurance companies, and we don't like doing that. People are naturally resistant to changing how they do things if they bear all the cost while someone else reaps all the benefit.

Re:Not Too Surprising

[Z34107]

Vitals can be substantially easier with an EMR since the computers can talk directly to the monitoring equipment - you click a button, and you're done. I've seen nurses break down in tears when this wasn't working; taking vitals three minutes sucks if you have to key them in manually or do it on paper.

Most nurses also like the electronic MAR, since it can automagically calculate dosages and rates for continuous medications, automagically retrieve the right medication from the Pyxis, and automagically get approval from pharmacy. Most don't like the extra keyboarding involved, but being able to see normal ranges and highs and lows is nifty, as is being able to hide irrelevant documentation, or pull in required documentation. Typically physicians are the most dead set against EMRs because CPOE involves more work for them that they used to palm off to nurses. It's certainly not to make life easier for the insurance companies - hospitals couldn't care less, and insurance companies can drag out making payments for every paper claim that they "lose" or find to be "illegible" or otherwise not filled out to spec.

Bad setup or bad software can make EMRs suck as much as any IT project, but they're more or less inevitable. Federal "meaningful use" requirements mean that hospitals and practices will eventually get penalized on their Medicare and Medicaid reimbursements if they don't jump on board, which adds up quick.

Re:Not Too Surprising

[demonlapin]

Sounds like you've done most of your work in ICUs. That's one area where monitoring is a lot easier by computer, because every patient has a dedicated monitor and each nurse only has two patients.

But as I said, physicians oppose changing things in ways that increase their workload if all the benefit goes to someone else. With CPOE, the nurses aren't typically the beneficiaries - they, too, are too well paid to be doing data entry work unless it's an emergency. It's the unit secretary, whose job description is basically "data entry", who benefits. And having doctors and nurses do unit secretary work is nuts.

Re:Not Too Surprising

[Z34107]

It's not like doctors and nurses don't benefit from proper records. EMRs are very good at decision support - warning about allergies, drug interactions, wrong patient/wrong site/wrong med/wrong line (barcoding), and the like. Doctors like getting paid, and billing insurance is much easier and more reliable through an EMR.

EMRs are particularly useful in high-liability practices like obstetrics. Being able to produce a record of exactly what interventions were performed, what providers were notified when, who was in the room, how labor progressed, etc. is vitally important for a physician to be able to defend successfully defend himself in court. Or for a nurse to avoid getting sued for something a mother actually consented to.

I guess I'm beating a dead horse, but it's wrong to think of an EMR in terms of "I'm doing extra work for the bean counters." There's lots of stuff to let you work faster, make more money, and keep yourself from killing a patient. Data entry sucks, but I always hear complains about "new" bookkeeping requirements that were actually things necessary to maintain accreditation.

Re:Not Too Surprising

[cowboy76Spain]

Working in an hospital IT, too, I have a few points to make:

• It is true that the UI may be improved in many systems. Our IT manager would like to configure our system to use it with tablet pcs, but as things go now, there is not budget for neither the configuration, the tablets nor the secure Wi-Fi to use it. For a long time the main interest was in reliability / process / speed. Now that these are more or less settled, vendors and buyers are starting to focus in it.
• Apart from that, a lot of doctors need to stop thinking of themselves as Gods and get back to Earth. I mean, recognizing the care is not provided by them but by the organization they work for. And the organization needs not only their expertise as physicians, but also that they provide some data back to the organization. They need to see that the data they have may be needed later by rehab, for example, or for another physician when the pacient comes back for another or the same ailment (and no, handwritten notes in a folder is not a good way of sharing information).
• Another issue is that sometimes the trouble is due to a organizative trouble: those at the top wants all the data available, while those at the bottom do not want to spend a second filling it. And when a new system comes (and today that means a IT system), those at the top just decide to make mandatory introducing some data, ignoring if it can be done without overworking/stressing workers. Later those at the bottom blame the EHR system while it is not its fault, and the managers are just happy to have an scapegoat while changing nothing.
• Personally, as a pacient, I'll trust more a doctor who puts his orders into an EHR system that on a scrap paper with bad handwritting, that can be "lost" in case something goes wrong.

Re:Not Too Surprising

[moortak]

Even a lot of the Facebook junkies I've met have a personal line they draw around some medical information wher it won't be divulged publicly. They might tell the world about smoking a bowl and downing a fifth of whiskey before grandma's funeral, but they are a lot less likely to mention a positive STD test.

Re:Not Too Surprising

[demonlapin]

I don't know why you think that it's "thinking of yourself as a god" if you don't want to do painful data entry tasks, especially when the UI is a nightmare. Please, think of the UI. It's nearly always horrendous and painful, because even the good ones are designed by a guy who sits at the same desk every day and doesn't have to log into a different machine every ten minutes and get presented with the uncustomizable landing screen.

I've worked in hospitals with a wide variety of electronic systems. The VA, for example, has everything on the computer. It is also very secure; there are not even generic logins to Windows. However, this means that every time you want to enter an order, you have to log into Windows, wait a minute or two for it to boot up, then start CPRS, then log into it, and then find the patient and begin ordering. Finding old notes is theoretically possible - everything is preserved - but there is no compartmentalization, and you'll have to look at the title of every single note generated by anyone at the VA - from a nurses' aide documenting urine output, to a pharmacist noting that a 90-day supply of medication X has been sent, to a PT/OT note, in order to find what you want. For those in VA nursing homes, especially, that can be a lot.

At the university hospital where I trained, and at my current hospital, all lab reports and dictations (like admissions and discharges) are available in the systems for all visits after about 2000. Furthermore, the system only requires you to log into it - the Windows desktop does not have to be loaded. This is, to me, a much better system because it provides what I want - easy access to the most pertinent records - without increasing my workload appreciably. This is the crux of a lot of resistance: I can get 99% of what I want from a system that never makes me enter an order (and most order entry systems are clunky and slow) and that never makes me type a note (because the information I really need is almost always in the admission or discharge dictation). And the other 1%? I'm an anesthesiologist, and nobody ever sends the anesthesia records over. Ever.

Huh?

[thenickdude]

"30% and 34% of doctors lack basic anti-virus software and network firewalls" ... what? How is this legal?

Re:Huh?

[Anonymous Coward]

No one said anything about legal. Lot of stuff that is illegal go on around you today, you're probably guilty of at least a few crimes today if we go by the book.

Speaking from the viewpoint of someone who deals saily with HIPAA and several other standards, I can tell you that it really is a bitch to try to keep all your ducks in a row.

Re:Huh?

[modmans2ndcoming]

it's not legal.

HIPPA and HITECH make such lack security illegal on systems that hold patient data.

Quite a conundrum...

[Rooked_One]

You will always have uneducated and educated people. And you will have educated people who aren't computer savvy. This means you will end up with a percentage (probably based on region - I feel sorry for people in the midwest) of doctors who offices are completely unsecure and all it would take is a patient walking in with the appropriate thumb drive at the appropriate time.

BAM! Access to the doctor's office is now at hand and anyone's records can be had.

Very few people who would do this sort of activity in other situations are doing it for fun. I can only think doing this to make money would be something that would be a scheme, to mostly blackmail people of a region with the largest percentage of ignorant and uneducated people. Who, ironically enough, are going to be sick more and thus go to the doctor more... But how, or why, to exploit these people who have nothing to give is beyond me.

But rich people also go to doctors from time to time as well... so what then?

Re:Quite a conundrum...

[DNS-and-BIND]

Wow, way to talk out your ass and totally invent something. I especially like the looking down on people who live in a different part of the country than you do. Those people over there are all stupid!

Re:Quite a conundrum...

[DNS-and-BIND]

I can imagine a dragon that farts rainbows. Can't you?

Re:Quite a conundrum...

[moortak]

I think you may be way off base with the Midwest comment. Remember the Midwest is home to the Cleveland and Mayo Clinics. Neither of those have been slacking in the electronic health records area.

Re:Quite a conundrum...

[Buelldozer]

Wow, so very offensive to the Doctors and your I.T. brethren in the MidWest.

Not only is your assumption false, making you both wrong and ignorant, but you're a JERK to boot.

How does that grab ya'?

Re:Quite a conundrum...

[Rooked_One]

Considering I live in one of the largest cities with church to square mile ratio in the country... I really don't think I'm that far off. And, yes, its the midwest. I'll give you another hint - the only state to vote all red vs Obama. The nurse at my doctor told me this 'joke while I was getting my weight taken... "What does a farm and the white house have in common? They both have a spade and a ho."

Now would you trust that doctors office very much? The only consolation I have is that they keep paper records because they don't know how to use computers.

Amusingly?

[Daetrin]

"Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records."

It seems we can't have a week go by without some article showing up on Slashdot about how the average person don't have "sufficient" security on their various electronic devices and programs. In which case if those same average people are concerned about a particular set of records being compromised couldn't it be considered wise that they'd rather have someone else who should (theoretically) have better safeguards in place handle those records?

Re:Amusingly?

[compro01]

That's what's amusing. That they actually realize that their own security is inadequate to the task of storing that information securely.

Re:Amusingly?

[Beowulf878]

well said - oh for some mod points.

Re:Amusingly?

[laederkeps]

To be honest, I'm not amused as much as I am proud. It could just be that 25% of the respondents are the technophobic old-timers who don't trust computers because... well... they're EVIL.
A more pleasing interpretation is that the facebook generation is starting to think about data integrity and protecting their personal information. It's about time.

and passwords

[Anonymous Coward]

and probably 80% of doctors over 45 have a password of "password"

Re:and passwords

[The Grim Reefer2]

and probably 80% of doctors over 45 have a password of "password"

I work in the medical field and I'm going to call bull shit. Actually IME generally the older doctors are safer with computers than the fellows and younger drs. They bring in a MP3 player of their own, or listen to an actual radio, Where as the younger doctors tend to install all kinds of music players and other downloaded programs. Basically the older docs tend to listen to the IT guys whereas the younger ones tend to think they know what they're doing. Believing that if it was that big of a security risk the IT guys would have locked down the system better.

Now I would venture to guess that close to 80% of the systems used to read patient exams have the password taped to the bottom of the keyboard, back of the monitor, or somewhere close by; or they all use the same password.

Re:and passwords

[phantomlord]

I sit there and watch my doctor type in his password to the EMR system every time I go. The EMR requires him to change his password every 3 months and so he goes with something easy to remember. So, we get (color)(number)(item) for his passwords and so far, I've only ever seen the number change. blue1tie, blue2tie, blue3tie, etc. His username is the astoundingly difficult to remember (firstinitial)(lastname) which is further abetted by a dropdown menu of the usernames of all the medical staff in his office. Oh, and since his office is owned by the local major hospital, he has access to not only his patients, but the records, lab updates, etc of all patients in the hospital and satellite offices (though it would be a HIPPA violation for him to go snooping, which does little to stop someone else from snooping while he gets the blame since it originates from his office IPs and username).

Since the whole hospital system uses the same EMR system, it wouldn't be too hard to guess anyone's username, most doctors and nurses aren't all that great at typing while hiding their password input since they specialize in medicine, not keyboarding, and there are terminals accessible in rooms you're frequently left alone in for extended periods of time (and if that isn't convenient enough, the free wifi on hospital grounds and web based access to the EMR is). Put the three together and it would be pretty trivial to get access to records of tens of thousands, maybe hundreds of thousands, of people, not that I've ever tried to access records in ways that I don't have authorization for (you can access your own record through the web, though it is read only and patients have limited access to restrict them from seeing things like their own surgical notes or lab results, but those restrictions don't apply to medical staff accounts).

Re:and passwords

[Z34107]

Most doctors don't have access to all patients, and most systems will log every record you view anyway. It's kind of disturbing that the doctors let you shoulder surf, though.

Re:and passwords

[phantomlord]

Maybe they figure your average patient can't figure out what they're typing just by watching them from the side (I may be a touch typist, but my doctor is a two index finger hunter/pecker - again, his specialty is medicine and he's paying someone else to do his data entry for him)... and even if his access to patients are limited to the hundreds/thousands that list him as their primary care provider, it would still be trivial for me to access the medical history of people in my town that have him as a doctor (or likewise, for those people to access my history).

As for logging, what does the infiltrator care? Some offices (like my dad's neurologist) have dozens of doctors on staff with scores of patients scheduled for the same appointment times. You go to whatever exam room is open when you get called back and it would be nearly impossible for them to tie a one time access to a particular patient (multiple times and they'll compare who was scheduled those times). My own doctor's office routinely leaves the exam rooms open while the entire office takes their lunch outside (the main office and dr's personal office are locked but the exam rooms aren't), so it wouldn't be difficult to go there on a nice day (so they'll be eating outside) when you aren't scheduled to access an exam room terminal. Logging just means the doctor gets the blame, but the infiltrator gets away with it.

My mom is the secretarial administrator in the radiology department of another hospital and because of turf wars between various IT departments at the hospital, it can be difficult to get the proper credentials that techs, secretaries and per diem radiologists need to do their jobs, so people often have to piggyback on someone else's accounts to do their work (maybe they have a network login but not a login to the MRI system, so they log into windows, log into the network, then use someone else's MRI login), making logging virtually useless there too. My mom has fought with her director over it, who, in turn, has fought with the IT director, all while the board and CEO ignores the issue completely (in fact, IT at her hospital is totally fucked and the IT director has gone as far as to try to sabotage the rollout of a new EMR system because she preferred another one, meaning there have been days where critical departments didn't have much needed access to each other all because she refuses to support the chosen product, the hospital has no internet redundancy despite not having a radiologist on site 24/7 to interpret results, etc. But, that's what you get with a backwoods hospital where turf and ego wars are more important than patient care.)

I see lots of medical offices using their PCs to access the internet (many of which are using IE), some have their private networks open to wifi, etc. With everything I've seen, I simply don't trust EMR systems at all.

Re:and passwords

[Z34107]

The logging helps mitigate the privacy concerns of a doctor being able to see some/most/all of the hospital, but you're right that it wouldn't stop someone off the street from logging in and opening a record.

But, the whole situation you describe is relaly, really depressing. Usually, hospitals are pretty on-the-ball when it comes to security, or at least moreso than individual clinics are. It's particularly surprising that they're overlooking the password sharing - most CIOs/CMIOs will shriek and faint if you jump out from behind a corner screaming "HIPAA HIPAA HIPAA!"

It sounds like your hospital has really, really dysfunctional IT, but EMRs are possible to do right. And are you sure it was sabotage? There's a lot that blows up when an EMR is first installed.

Re:and passwords

[phantomlord]

But, the whole situation you describe is relaly, really depressing. Usually, hospitals are pretty on-the-ball when it comes to security, or at least moreso than individual clinics are. It's particularly surprising that they're overlooking the password sharing - most CIOs/CMIOs will shriek and faint if you jump out from behind a corner screaming "HIPAA HIPAA HIPAA!"

Maybe I should write to the CIO of the hospital with my concerns... after all, my records are stored there (and while there's nothing scandalous in my medical records, I do consider them to be some of my most private information). I don't want to get my personal doctor in trouble though, he's the 4th doctor my rural office has had in the last 8 years and I'm glad to finally have one that is competent and I feel I can trust again (the previous three were incompetent and outright assholes - one was a holy roller (literally preaching to patients) who turned me in to social services because my disabled dad ended up with an ulcer on his foot and, as it turns out, he had diabetes, which she hadn't bothered to test for/diagnose prior to that, blaming me as if I caused the ulcer out of abuse even though we didn't know he had diabetes). Anyway, I digress.

It sounds like your hospital has really, really dysfunctional IT, but EMRs are possible to do right. And are you sure it was sabotage? There's a lot that blows up when an EMR is first installed.

I'm not familiar with the two particular EMR systems involved since my mom didn't mention their names. The IT director had been wined and dined by the marketing department of the one she preferred (surprise!) and, despite the hospital choosing to go with the the other platform, she refused to learn it so she could teach and support the staff. My mom ended up having to figure everything out and then train her department as well as the ER doctors on how to use it since IT was totally uncooperative before AND after the rollout (probably in the hopes of causing enough pain that the hospital would abandon the system they chose for her (IT dir) preferred system). Clearly a case where the IT director needs to be fired for insubordination and gross misconduct (I mean, we're talking patients lives if they can't access radiology and lab work), but, due to politics, she (IT dir) somehow managed to keep her job.

Funny part, is I applied for a part time IT job there but didn't even get an interview... I wouldn't be surprised if said IT director canned my application/resume upon learning that my mom was her nemesis from radiology that actually won the EMR "battle" despite the fact that I'd be an improvement over any one of her existing staff.

Re:and passwords

[Z34107]

It sounds like between the trouble keeping doctors, the politics, and the IT director, your stress levels would probably be lower as an air traffic controller. I'm guessing the IT director is also responsible for managing peoples logins and privileges, so she's unlikely to fix them. C*Os probably won't care until you mention HIPAA, but it's not a HIPAA violation unless you mention that passwords are being shared, which implies you know who is sharing them.

Either way, that all blows chunks. I wish you and your dad the best of luck.

Not amusing. Sensible.

[BlueParrot]

Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records.

What the hell is amusing about this? I dare claim I know miles more about information security than your average patient, and I'd certainly prefer to have my medical details kept safe by the pros than trying ( and probably failing ) to do so myself. For the same reason I keep my money in a bank as opposed to underneath my mattress. Now granted some doctors may have lax security, but for myself to keep the records in addition would just open up more avenues of attacks. The only good reason I can see why I would keep such records myself is to ensure I have a backup of them if my doctor was to screw up and erase them by accident or something.

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

I dare claim I know miles more about information security than your average patient, and I'd certainly prefer to have my medical details kept safe by the pros than trying ( and probably failing ) to do so myself.

The problem is that you can't trust "the pros" to act in your best interests. Money is 100% fungible and misuse is pretty straight-forward -- a bank steals your money and its obvious what happened. But for someone doing searches of healthcare records it is much harder to tell if the intent is nefarious. Even the people doing the searches may not fully understand the implications themselves - ala netflix's "anonymised" data fiasco.

What we need is less centralisation, not more. The push for electronic records in healthcare is inexorable, so we need to develop systems that inherently limit access. Not just fancy permission bits that can be ignored with the right privileges, but actually keeping the data physically inaccessible to those who don't absolutely need it. The best way to do that is to decentralise.

For example, use the patient's smartphone to keep their records (with automated backups of the data as an encrypted blob). If a doctor needs the info, he can request it via a secured version of a text message. Make it a closed system so that when the patient responds to the request, he can set an expiration date for the copy that the doctor gets. Meanwhile the records on the phone are encrypted too prevent loss of the phone exposing records.

If we had a system where each person was responsible for their own information, then the overhead of widescale misuse would be significantly increased. You'll never stop one-off abuses, but you can design a system that (a) makes widescale abuse difficult and (b) makes it easy for individuals to safely manage their own records.

Right now are moving to the worst of both worlds - centralisation of data with protection no better than flimsy laws subject to interpretation and rewriting by people with money and interests that conflict with that of the patient.

Re:Not amusing. Sensible.

[ColdWetDog]

For example, use the patient's smartphone to keep their records (with automated backups of the data as an encrypted blob). If a doctor needs the info, he can request it via a secured version of a text message. Make it a closed system so that when the patient responds to the request, he can set an expiration date for the copy that the doctor gets. Meanwhile the records on the phone are encrypted too prevent loss of the phone exposing records.

1. I don't have a smartphone.
2. I forgot my smartphone, do I have to go back home to get it?
3. The insurance company needs to drop a bill, do they text message you to get the data?
4. Medicare wants to audit the hospital. Do they text a message to get the data?
5. Oops, my smartphone got squashed when I got run over by a bus and they need my data ASAP, now what do I do?
6. Oops, the cell phones are down again.

No, this makes no sense at all. People don't WANT to manage their information. Most people CAN'T manage their information.

Re:Not amusing. Sensible.

[ColdWetDog]

1. I don't have a smartphone.

Any widely deployed system would also support dedicated PDA type units for practically nothing.

And my 80 year old mother, who can't remember much at all is supposed to take the bus back home when she forgets her iPad? Nope, not happening in the real world.

2. I forgot my smartphone, do I have to go back home to get it?

Yes. If you forget your wallet you have to go back home and get it too.

No, not at all. I don't necessarily need anything to show up at the doctors' office. The feds make me show ID for the ER but that's their insanity showing. So, in your magic world, we keep some of the most private information we have, our medical history, on our persons at all times? Again, not in the real world.

3. The insurance company needs to drop a bill, do they text message you to get the data?

Yes, but only if you envision health insurance working exactly the way it does today. For example, a record of services rendered could be transmitted to the insurance company at point of sale with 3 parties required - doctors office, patient and insurance company.

And you're going to fund an enormous initiative to force hospitals and doctors to be able to drop bills as the patient wanders off, not twelve times in the next two weeks like they do now. I personally have no interest in getting texts every couple of days for two weeks after my colonoscopy, thank you very much.

4. Medicare wants to audit the hospital. Do they text a message to get the data?

Yes.

Right. And if you refuse, or turn your phone off, the whole survey team has to wait for you to wake up?

5. Oops, my smartphone got squashed when I got run over by a bus and they need my data ASAP, now what do I do?

No different than what happens today when they can't call up your doctor and get something faxed over.

No, in a decent EMR world (not that we have one now), it's in there. We just punch it up. From what I understand about your system, the data is held in the smartphone which has just been converted to rubble in this particular scenario.

6. Oops, the cell phones are down again.

See #5. But this is scenario is even sillier because if we have that level of infrastructure failure, medical records are not going to be a priority,

Hah. Cell phones routinely fail where I live and yet the rest of our little world wanders on.

No, this makes no sense at all. People don't WANT to manage their information. Most people CAN'T manage their information.

You suffer from a failure of imagination. Unable to conceive of a system that HELPS people to manage their information you can only see the crap that we have now. Its like someone who has only driven stick-shift completely dismissing the utility of an automatic transmission in favor of hiring a taxi.

And you suffer from an overactive imagination. That's not necessarily a bad thing, but your system has no possible way of working in any feasible way. It would take enormous amounts of money and social change merely to put the individual completely in charge of something they don't want to be completely in charge of. The system as it stands is far from perfect and really does need to be improved if digitalized medical records are going to do much useful, and individuals should indeed take more of an interest in how the data is used. But this level of control is simply not feasible.

Re:Not amusing. Sensible.

[Z34107]

Your idea isn't going to work, and it's not because of ColdWetDog's "lack of imagination.

1. Requiring everyone to own a smartphone or PDA just to have a medical record is impractical, at best.
2. You currently can't "forget" your medical record. This isn't an improvement, or even necessary.
3. You've made your entire medical record essentially patient reported. Your insurance company isn't going to write you a check just on your word, and that's now all you have.
4. If Medicare, or the Joint Commission, or AIUM, or whoever wants to audit the hospital, they now require the cooperation of every patient that hospital has seen. Hospitals see a lot of patients. Audits span years. You've just made oversight impossible.
5. The only copy of your medical record getting run over by a bus

6. is a lot different than having to get something faxed.

7. Current medical records depend on very little infrastructure. Some are still entirely on paper. You want to five nines the cell network, nationwide.

This doesn't help people "manage their information", because currently, they don't. As people increase their "management" of their medical record, the information it contains because impossible to act on, either for medical or legal reasons.

Individual control of a medical record is a nice idea, but it entirely defeats the purpose of having one.

Re:Not amusing. Sensible.

[randallman]

How about developing a standard medical record access protocol. Companies can compete to store your information. They would compete based on who guards the information best. A service is defined via URL. So if you want to grant a hospital access to your records, you supply the URL and credentials (maybe a key/certificate stored on a card). They use a standard access protocol to fetch and/or update the data. The standard may also define how the client (hospital) may access the records, preventing a leak from that side.

On the client side, a dedicated machine would be a good idea. No web browsers or email clients installed, nor any other software that isn't necessary for interfacing with the medical records services. Strip it down and guard it enough so that there's no need for AV or other half-measures. For example, at the OS level there could be a whitelist of URLs accessible by the client application.

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

And you suffer from an overactive imagination.

Actually that is precisely your problem. All of your counterpoints are nothing more than rare corner-cases blown out of proportion. No system will ever be free of corner-cases. The trick is to design for the common case and make it work as well as possible. Your blindered focus on corner cases and your desire to throw the baby out with the bathwater doesn't prove anything other than you aren't willing to give the idea more than a passing thought because you have your own predispositions.

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

Requiring everyone to own a smartphone or PDA just to have a medical record is impractical, at best.

Really? If it is practical to spend a couple of billion on national healthcare data centres it is practical to give everyone a $25 PDA.

You currently can't "forget" your medical record. This isn't an improvement, or even necessary.

Not sure what you mean here. If I go to a new doctor without doing the legwork to transfer my records from my other doctors then I certainly have "forgotten" my medical records. Maybe you mean something else, the context is not clear.

You've made your entire medical record essentially patient reported. Your insurance company isn't going to write you a check just on your word, and that's now all you have.

Digital signatures can insure the integrity of the records. You aren't even trying to make it work. If you want to poke holes you gotta at least think them through beyond the first poke.

If Medicare, or the Joint Commission, or AIUM, or whoever wants to audit the hospital, they now require the cooperation of every patient that hospital has seen. Hospitals see a lot of patients. Audits span years. You've just made oversight impossible.

Its weird how you seem to be repeating all of ColdWetDog's poorly thought out arguments. Yes auditing is harder, but far from impossible - send an automated request to the entire patient list and wait a few weeks for the responses to come back. Furthermore that's an argument against centralised healthcare payment and return to individual responsibility.

# The only copy of your medical record getting run over by a bus

Woah, you really are just repeating his points with zero added thought. Why are you doing that? Just because the PDA gets run over by a bus doesn't mean the records are gone - didn't you see the point about backing it up as an encrypted binary blob? Hell, nothing to stop a person from giving a backup viewable copy to their "emergency contact" people too.

# Current medical records depend on very little infrastructure. Some are still entirely on paper. You want to five nines the cell network, nationwide.

No this is not a five-nines case because the VAST, VAST, VAST majority of record transfers don't have to happen in anything near real-time.

This doesn't help people "manage their information", because currently, they don't. As people increase their "management" of their medical record, the information it contains because impossible to act on, either for medical or legal reasons.

Sorry you've made a couple assertions here, but haven't even providing supporting logic for them. Consequently the conclusions you've asserted are baseless.

Re:Not amusing. Sensible.

[Z34107]

OK - we have a central certificate authority and some checksums. Your device is tamper-proof, and will always be tamper-proof. It is perfectly reliable for the purposes of determining who diagnosed who with what. Here's what you're blithely ignoring:

• You cannot receive healthcare without the PDA
• You're requiring millions of people, who may not even know how to operate a computer, to keep encrypted backups
• EMR records are exchanged in real time.
• "Individual responsibility" has jack all to do with regulation, oversight, or accreditation. It is not possible to audit an organization with this system, especially if there is no central record of which patients have been seen.
• Your system will kill you if you have drug allergies and end up in an ER.
• Billing insurance requires what procedures were done for which diagnoses, both of which live on that PDA. Doctors now depend on the patient to get paid.
• Carrying around a PDA does nothing to keep hospitals from keeping their own records regardless.

We'll ignore legal problems, like the fact that hospitals are actually required to keep these records, because I assume sufficiently imaginative people will disband a half-dozen regulatory bodies in the time it takes to hand out PDAs. Say you solve the rest of those problems - what advantages does your system have over an EMR, or even over paper charts?

Re:Not amusing. Sensible.

[cowboy76Spain]

And you suffer from an overactive imagination.

Actually that is precisely your problem. All of your counterpoints are nothing more than rare corner-cases blown out of proportion. No system will ever be free of corner-cases. The trick is to design for the common case and make it work as well as possible. Your blindered focus on corner cases and your desire to throw the baby out with the bathwater doesn't prove anything other than you aren't willing to give the idea more than a passing thought because you have your own predispositions.

-And nobody will care when the corner cases drop dead? If you are a store owner and plan to go into a "pay only with card" schema, then maybe losing 1% of customers is not worth the inconvenience of working with notes. But if you system means that you lose 1% of pacients who end dead, maybe you want to improve it (and btw, if you give the bad drug to someone who is allergic to it, do not think that their relatives will say "he should have thought of carrying his PDA with him". They are going to sue you, and win)

Simply put, failure rates that are ok for other bussiness are just not acceptable to live-or-death bussiness (do you want a nuclear central with the same rate of failures that the shop at the next corner?).

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

Your device is tamper-proof, and will always be tamper-proof. It is perfectly reliable for the purposes of determining who diagnosed who with what.

Unneccessary, that's what digital signatures are for.

You cannot receive healthcare without the PDA.

Obviously not true - tons of healthcare don't require access to medical records until after the fact - routine check-ups, sore throats, even broken bones don't generally require access in order to treat. The results only need to be logged which can be done well after the fact. So in the infrequent case where the PDA isn't immediately available, treatment is going to be at least as good as walking into an urgent care clinic today.

You're requiring millions of people, who may not even know how to operate a computer, to keep encrypted backups

Obviously not true - a closed system could easily automatically backup the encrypted blob over the network automatically and in the background.

EMR records are exchanged in real time.

In this hypothetical perfect world you have dreamt up, perhaps. The NEED for them be exchanged in real-time is far from common. In the cases where it is necessary, the PDA will be physically present - no need to even rely on the external network.

"Individual responsibility" has jack all to do with regulation, oversight, or accreditation. It is not possible to audit an organisation with this system, especially if there is no central record of which patients have been seen.

Keeping a list of patients is not even remotely like keeping a list of treatments and test results. Its not a significant risk for a hospital to keep such list and use it query patients when and if an audit is necessary.

# Your system will kill you if you have drug allergies and end up in an ER.

This is different from the current situation, how? Such events are exceptionally rare today and "my system" could still reduce them. Make the PDA take a thumb-print in order to get short-term access. Make the PDA a souped up MedicAlert bracelet and you are WAY ahead of today's game.

Billing insurance requires what procedures were done for which diagnoses, both of which live on that PDA. Doctors now depend on the patient to get paid.

Again something that can be handled via a 3-way handshake between doctor, patient and payer at the point of delivery.

Carrying around a PDA does nothing to keep hospitals from keeping their own records regardless.

Now we are going in circles. Pay close attention to what I write instead of making baloney that can't stand up to even a second's worth of critical thought. As I said in my original post, in a closed system all of the computers which access the data will enforce the rules about multi-generational copies and expiration.

what advantages does your system have over an EMR, or even over paper charts?

It has EXACTLY the same functionality as a naive EMR implementation because it is an EMR system. The benefit comes from the fact that it is much more highly resistant to systemic abuse because it marries much of the privacy benefits of paper charts with the strengths of an EMR system.

I assume sufficiently imaginative people will disband a half-dozen regulatory bodies in the time it takes to hand out PDAs

See, it's dickish comments like that indicate you aren't interested in giving it any serious analysis, only in shooting it down by throwing as much shit at the wall and hoping something will stick. If you aren't going to at least think through what you write, why bother writing it?

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

Simply put, failure rates that are ok for other bussiness are just not acceptable to live-or-death bussiness (do you want a nuclear central with the same rate of failures that the shop at the next corner?).

Are you familiar with the term "false equivalence?" You should be. You just made one.

So far the best anyone has been able to do is point out extremely rare, though possible, failure modes - but you seem to think that any alternative system is 100% failure-proof and that's just not the case. There will always be failures - the goal is that any new system reduce the rate of failures. Expecting a new system to eliminate failures is just magical thinking.

Re:Not amusing. Sensible.

[Jah-Wren Ryel]

By saying set an expiration date for a copy aren't you basically asking for DRM. And we all know how DRM cannot work in reality.

The situation with medical records is different from the piracy scenario.

Piracy wins because all it takes is for one person to extract a copy and then everybody can get a copy for free. With medical records and other personal information the biggest risk is not to any specific individual but rather systemic misuse. DRM plus policy can be effective against systemic misuse because (a) individual records are of limited value to big brother and big corp and (b) swiping a ton of records at once hard to do because there is no centralisation.

I've said it a couple of times already - we will never be able to completely prevent one-offs (e.g. someone will always be able to point a camera at a computer screen), but we can design the system such that the only real vulnerability is to one-offs. As it is now, the popular EMR systems are practically begging for systemic abuse and are just as vulnerable to one-offs too.

Firewall what, exactly?

[Just Some Guy]

The majority of doctor's offices I've been around aren't connected to the Internet at all. For instance, my wife's practice has a WPA2 secured Wi-Fi network so that her laptop (whole-drive TrueCrypt) can talk to the database server that manages her records, and none of the hosts on the WLAN have any form of Internet connection. As it turns out, they do have AV programs (MS Security Essentials), but without any removable media coming into the office and no net connection, it's pretty much just a formality.

My kid's orthodontist's network has Internet access, but it's a bunch of Macs behind a firewall+NAT and a strict "no personal browsing at the office" policy. (I know this because I bartered net admin chores for dental work :-) ).

I'm certain there are insecure medical offices, but the doctors I've talked to are so terrified HIPAA that they'll take almost any security tips you give them.

Re:Firewall what, exactly?

[yuna49]

Just curious, but how many of those HIPAA-fearing doctors use plain-text email to correspond with patients? How many of them have their email addresses on their business cards? I routinely ask providers if they realize that sending patient health information via e-mail is a HIPAA violation. Most haven't ever given the question a moment's thought.

Re:Firewall what, exactly?

[demonlapin]

I'll bet I can easily find an attorney to argue that the patient's request for that information constitutes authorization to transmit in the clear.

Re:Firewall what, exactly?

[Coagmano]

In Australia, they won't tell you any information on the phone or by email. If they have some information to convey to you, you need to make an appointment to see your Doctor. No chance of privacy breach there.

HIPAA security audits?

[hawguy]

Why doesn't some organization come up with a set of standards and best practices to ensure that HIPAA protected data is actually protected as it should be? I'm thinking something like the PCI security council started by the credit card companies that mandates a set of rules and best practices that have to be followed for all merchants that handle credit cards.

Following the PCI standard doesn't guarantee data security, but it is a big step in the right direction. Doctors need the same kind of prodding to get them to implement real security controls and not just say "Oh, well i checked the WEP encryption box on my Wifi router, so all of my data is encrypted and safe - I know it's safe because I backed up my patient records to my iPhone".

Re:HIPAA security audits?

[modmans2ndcoming]

HIPPA and HITECH cover more than just protecting data. It covers communication of the data as well, both digital communication and analog communication. it is hard to come up with a test suite for that.

Re:HIPAA security audits?

[hawguy]

PCI is not just about protecting computers and networks, but is about policies that companies are required to have in place to protect cardholder data (i.e. don't write a card number on scrap paper and toss it in the trash). Network vulnerability testing is a part of the compliance process, but developing policies and procedures for keeping the data safe is a large part of it.

Does HIPAA cover having network firewalls and anti-virus software? If it does, then the law has no teeth since 30% of doctors were found to be missing one or the other (or both). 100% of PCI compliant merchants will have both firewalls and anti-virus on any computer that touches cardholder data.

Why is it that private industry appears to be taking more steps to protect credit card numbers than the healthcare industry is taking to protect health information?

I'm not saying that the PCI-DSS is the best model to follow, and it's certainly not perfect, but that's the one I'm most familiar with.

Re:HIPAA security audits?

[The Grim Reefer2]

The problem is that HIPAA is severely broken. Most hospitals violate some part of HIPAA countless times per day as it's not even possible to operate within it's guidelines and be able to realistically treat patients. Another issue is the FDA understands how to deal with IT about as much as it knows how to building a Saturn 5 rocket.

Here's an example that I've witnessed many times over the years. A vendor installs an MRI system in a hospital, the control computer the technologist uses to scan patients is Windows based. Obviously the system needs to at least be on the local hospital network so that the patient scans can be sent to a reading station so that a Dr. can look at the images. Neither of these systems can have any software installed on them that is not FDA approved. So by law, unless you have an FDA approved security program you cannot install it on either of these systems, or any system that contains patient data for that matter. If you do have an FDA approved program you need to prove that it will not affect any of the calculations that are made for determining a diagnosis as well. It gets even better though. If you do find a security suite that you can use, the vendor is not responsible for worrying about it in the case of system updates. So when an update comes out the vendor sends in an engineer who generally will simply re-image the drive with the new update, thereby wiping out your security programs.

Re:HIPAA security audits?

[cbope]

Sorry, you are incorrect in stating that non FDA-approved software may not be installed in a medical device. It depends on the function of the software within the system and whether it deals directly with PHI (patient healthcare information) or not. Both security (anti-virus) software and the OS itself fall under COTS, or commercial off-the-shelf software. The only software required to comply with FDA and/or HIPAA is the software that deals directly with patient and medical data. Neither the OS nor the security software has direct access to the protected PHI within the medical FDA-approved software, so approval by FDA is not required.

Now, some vendors do lock-down their systems tightly, but for different reasons. It is to prevent installation of 3rd party software not provided with the system, but this has nothing to do with HIPAA, FDA or PHI data protection. This is mainly done to minimize support issues and to prevent tampering with the installed software by installation of 3rd party software which could interfere or conflict with the vendor supplied software.

I have worked in this field over 20 years and I participate in multiple organizations and standards groups in the medical software field, so I am qualified and informed to be able to make these statements.

What's the point of all the worry?

[blair1q]

Why are people so worried about their medical information going public?

First of all, you can't get most people to shut up about what happened at the doctor's office. (And the older the person, the more likely this will dominate their idea of interesting conversation.)

And if this guy can't get a few days' quiet time to himself before he dies, then just who the fuck do the rest of us think we are?

Frankly, I'm going to start posting the boroscope videos of my colonoscopies. Hopefully the karma buildup will mean -- when the time comes to hole up in the hospice eating ring-dings by the boxful and watching DVDs of Firefly in my last few days -- that nobody will even think to bother me.

Re:What's the point of all the worry?

[0123456]

Why are people so worried about their medical information going public?

I think your comment about Steve Jobs would be enough to explain why people don't want everyone to have access to their medical records.

Re:What's the point of all the worry?

[maxwell demon]

First of all, you can't get most people to shut up about what happened at the doctor's office.

Even those people will generally be selective about what they tell you. I doubt many speak about their STDs. Or about what they talked with their psychiatrist.
And the fact that most people speak openly about it (is it actually really most, or does it only feel like that?) doesn't invalidate the rights of those who don't want others to know about their illnesses or other medical conditions.

Re:What's the point of all the worry?

[Jah-Wren Ryel]

And the fact that most people speak openly about it (is it actually really most, or does it only feel like that?) doesn't invalidate the rights of those who don't want others to know about their illnesses or other medical conditions.

Yeah, he was making the Zuckerberg argument - most people use facebook so we should all just make our lives an open book to anyone and everyone.

Re:What's the point of all the worry?

[cbope]

The reason why this information should not be public is because it's open to abuse and discrimination. What about the employer who chooses not to hire you because you have a rare disease that may cause their insurance costs to increase? Is it fair to allow them to use this information against you in this manner?

No, it is not. You should be hired based upon your qualifications for the job and your previous references. US companies are increasingly turning to this type of information for job discrimination and the longer you let them get away with it, the worse the situation will become. Before long, companies will only hire young healthy workers who have passed their DNA "clean bill of health". Anyone unfortunate enough to be born with an congenital disease or heath problem will essentially become unemployable.

Is that the kind of society we really want to live in?

Americans Are Idiots, news at eleven

[h4rr4r]

Drs fail more than machines. These are the same folks who have tried to kill me several times, often have no idea about me when I visit because they fail to read charts, and prescribe medicine they feel comfortable with instead of checking actually studies.

Re:Americans Are Idiots, news at eleven

[demonlapin]

they fail to read charts

Hard to read information that isn't there. Asking people what's wrong with them, in their own words, is a very useful guide to dealing with them, because it gives you a good idea from the start how well they understand what is going on.

Sorry you've had such bad experiences with my profession. There are some inexcusable jackasses out there, and I regret them.

Re:Americans Are Idiots, news at eleven

[h4rr4r]

I mean when they don't even know the fact that while my serum potassium is on the low side of the average that is a huge improvement for me.

If I showed up to work as unprepared as these folks I would have been fired long ago.

This is information that is there, it is not subjective either, it is written in black and white by the lab.

Re:Americans Are Idiots, news at eleven

[demonlapin]

Assuming it makes it. Medical records forwarding is an utter travesty, vast amounts of shit just never makes it over and what does is often the least relevant information.

Re:Americans Are Idiots, news at eleven

[h4rr4r]

These records are from the same fucking doctor. I end up showing it to them in the record they are holding. Apparently flipping a couple pages is too hard for some Drs.

pre existing conditions and job discrimination

[Joe The Dragon]

pre existing conditions and job discrimination are the big fears with Computerized Records.

Re:pre existing conditions and job discrimination

[jmcharry]

I don't think there is a defense against that. You have to sign a third party release for your current insurance, and the insurance companies pool data. Physicians have to code diagnoses and treatments and key them into the system to get paid. Your nosey friends might not have access, but the people you most worry about do.

Re:data is still not safe

[Just Some Guy]

On the other end of what? Her records never leave her office network, which is the most common arrangement I've seen.

The Smart Ones

[keckbug]

"Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records." These are the smart ones.

I'm not worried about "the internet"...

[swb]

...or Betty in Records getting snoopy.

What I worry about are the 23872832387 "health information sharing authorization" forms I'm basically required to sign every time I do anything remotely related to my health care, whether in the physician's office, renewing benefits at work, etc.

With paper records, the insurance companies, employers, and others who are constantly looking for a way to use your health status against you had to work a damn sight harder to get their hands on this info.

With electronic records, it makes it much easier for people who formerly wouldn't be able to make sharp-pencil decisions about coverage or other tangential decisions to make your life harder.

I'm sure somehow electronic records make healthcare "more efficient" but at the same time the controls and aggregation of this data in the hands of people whose mission is to make Lloyd Blankfein richer scares me. I'm sure it's a problem long-term, but there are a number of issues I won't discuss with my doctor because once into the computer, I'm afraid of where they'll go.

Dr's are tech idiots

[Ludedude]

I work for a large regional provider of EMR hardware and software and I can tell you first hand that you should be afraid, very afraid, of anything your Dr. does with health records that involve a computer. Anti-virus is the tip of the iceberg. You install it for them and their brother in law who's a burger flipper helpfully uninstalls it to "speed things up." Hilarity ensues. Entire offices are implementing EMR that refuse separate usernames and passwords because it's "just too damn hard to remember all that" so everyone logs in as user with some simple password; that's if they even bother to log in or off at all. Of course they have to have admin rights because it's their hardware and they know what's best.

Since most of the offices that are being force-fed EMR because of the lure of up to $44,000 in "stimulus" funds are smaller practices, they don't have domains that can be used to enforce universal security policies.

The larger ones, sure, but most of them already use EMR and have on site servers etc. along with the requisite firewalls and VPNs. The vast majority of the new ones though are being sold "cloud" based systems with no local servers at all, so it's a friggin' free for all in terms of security (or lack thereof). They're just lining up for a swipe at the stimulus golden ring but half of them shouldn't even be entrusted with anything as complicated as a TV remote, let alone computer systems.

Re:Dr's are tech idiots

[fl!ptop]

A-freakin-men to your whole post, you took all the words right out of my mouth. I'm often shocked at how lax the doctors and staff are even with simple stuff like Windows updates. Just today I found 3 computers at a client's office that were running WinXP SP2!

34% Percent have no antivirus

[dbIII]

Perhaps that number is completely meaningless. I've noticed anecdotally that many doctors have Macs, perhaps 34% have Apple computers and don't need antivirus?
Also for firewall do they mean a separate dodgy product and are they ignoring the quite reasonable Ms Windows and Apple firewalls? How about the situation where just about every modem or router made after about 2005 has half decent firewall rules as a default?
It's not as if 34% of these computers are actually naked to the net.

Re:34% Percent have no antivirus

[Buelldozer]

I hope you don't manage the infrastructure at a medical practice. Based on your comments you'd be part of the problem.

Re:34% Percent have no antivirus

[dbIII]

If you are going to hand out such insulting bullshit you need to either say why or get filed under insulting loonie that spouts off after reading such key words as Apple.
Prove you can pass a Turing test and that it's not just a reflexive insult that could be handed out by a machine - look at my post above and then tell me WHY MY QUESTIONS INDICATE THAT I AM PART OF THE PROBLEM..
It is of course not possible based on the little written above which makes it either a failure of education or character - I'll assume the latter.
You really should apologise but I'll settle for you growing up just a little if you are capable of doing so.

Re:34% Percent have no antivirus

[Buelldozer]

I'm not going to apologize because you don't know what you're doing and now your feelings are hurt.

Let me break it down for you.

"I've noticed anecdotally that many doctors have Macs, perhaps 34% have Apple computers and don't need antivirus?"

Just because someone has a Mac doesn't mean they don't need A/V. Quite honestly most medical applications are written for Windows so if they are being run a Mac that mans you're either running Parallels or Bootcamp. That means your Mac is in a Windows environment and requires A/V.

"Also for firewall do they mean a separate dodgy product and are they ignoring the quite reasonable Ms Windows and Apple firewalls? "

The Windows and Apple firewalls may be sufficient for basic machine protection but you cannot rely on them to protect a network from the Internet.

"How about the situation where just about every modem or router made after about 2005 has half decent firewall rules as a default?"

Half-decent firewalls are just that. Half decent. When running an EHR and piling up patient information it's nowhere NEAR enough.

Anyone with smarts is running a firewall with REAL rules that can, and will, do SPI on outbound and as well as inbound traffic. You WILL be running IPS / IDS and gateway antivirus and antispyware. You will NOT trust your outbound traffic.

The crappy firewall in a DSL modem is nowhere near capable of handling all of this and frankly if you're not doing this then you're not doing your JOB.

So yeah, you're part of the problem. You're sloppy, ignorant of security threats, and lazy.

Re:34% Percent have no antivirus

[dbIII]

Anyone with smarts

Some of us have intelligence instead, which is why we can understand what two word combinations such as "half decent" really mean. How the fuck did you twist that into advocacy of it being the only measure?
It is amusing seeing your squirming justification involving virtual machines but it's just a pile of crap that sounds vaguely correct which you are using in an attempt to appear to be less than just an idiot insulting people at random. You are vastly underestimating what the average reader here knows about computer systems if you thought that would work.
That's a pretty major insult you were putting out there in the first post with ZERO justification considering I wasn't actually advocating anything. Care to pull out the racist jokes next or are you going to go after my mother?
If you want top spout off at people to make yourself feel big at least choose some topic you have a clue about - or even better, yell at imaginary people in video games instead. All we're getting from this pile of crap is that you don't like having your nose rubbed into your insults. Be a man and take responsiblity for your actions instead of acting like an eight year old problem child.
You've made all kinds of extremely stupid assumptions about how I run my networks based on very limited information and pretending I've written something different to what is actually there. You should be extremely ashamed of yourself.
You really do need to make an apology now that you are accusing me of not filtering outbound traffic and plenty of other accusations of idiocy. Prove that you are not a blubbering child and apologise.

Re:inaccurate

[Anonymous Coward]

Damned "Lupe." If only everyone were white there would be no problems, right?

what about all the vender systems / medical device

[Joe The Dragon]

what about all the vender systems / medical device that run windows but are no installing updates and the venders say you are not to install them or they just lock you out of the admin password.

Re:data is still not safe

[Jah-Wren Ryel]

On the other end of what? Her records never leave her office network, which is the most common arrangement I've seen.

If she takes health insurance, then yes, plenty of data about her patients and up far beyond her control.

Perhaps doctors should not hold the info locally.

[cstanley8899]

Maybe all the info should be stored on some "cloud" somewhere.

Not amusing, more like enlightening

[The Grim Reefer2]

Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records.

I find this statement damn interesting, certainly more so than amusing. This sounds like the general public is becoming more knowledgeable than I would have guessed.

Re:Never visit because of IT

[TaoPhoenix]

There may be weird cases where you evaluate the only 4 network providers within 40 miles of you, and 3 have good IT and sloppy care, and the last one has good care and sloppy IT. Med is a weird profession, I'd grudgingly take the good care with bad IT in a pinch.

Common Law

[Gonoff]

In the UK, and therefore probably the USA too, there is a Common Law expectation of privacy in this situation.

If I tell my neighbour over the garden fence that I am going in for a prostate examination tomorrow, there is not necessarily a legal duty on the part of my neighbour to keep this confidential,If a different neighbour is my doctor it is very different. I can reasonably expect that they will not blab about it at a party.

That common law duty extends to keeping the matter private as best they can. They should not leave printed notes on display. They should not send it around by insecure fax, unencrypted email or put it on Twitter.
They should, in fact, take every reasonable precaution to ensure that this matter stays secret until I choose to let it be known. Reasonable precautions include things like having firewalls and controlled access to my data.

If a doctor, hospital or any other medical organisation, does not take suitable actions to protect such patient information, there are specific laws in developed countries (and most undeveloped ones) which will penalise them even if no information leaks out. My earlier comments on Common Law are because we don't even need written laws to deal with this. Common law is the effect of all those books full of legal precedents that lawyers have on their walls.
If the doctors don't even have firewalls and a patient finds out lawyers could get busy...

Not what I'm worried about

[glwtta]

I know the popular thing is to constantly cry about our precious privacy, but I'm more worried about my medical records not showing up when they are needed, not the other way around. I'm thinking of allergies, drug interaction, and relevant medical history during emergencies, and the like.

Re:Not what I'm worried about

[el_tedward]

The doctors office I work at still has paper records.. There are so many freaking errors that I end up finding while filing. For some reason checking the date of birth is just way too much of an exercise for people to both themselves with. I find records that get put in the wrong folder all the time because of this, as well as other filing errors, etc.

If we had fully digital records, this likely wouldn't be a problem. Of course, software can epic failz just hard as a human, but it tends to be more consistent when it decides to fail or not.

As far as security goes, it's a joke. Virus whack a mole is getting to be a daily task :D I don't think we should shy away from things like this just because of the security challenge. Security will improve eventually, and life will move on.

Re:Not what I'm worried about

[demonlapin]

But you find errors because every sheet has a patient label on it, right? That's the real concern with EHR - if you accidentally enter information on the wrong patient, you often can't just rip it out and move it to the correct chart (the way you can rip a piece of paper out of a paper chart) because of auditing.

Re:Not what I'm worried about

[Jah-Wren Ryel]

I know the popular thing is to constantly cry about our precious privacy, but I'm more worried about my medical records not showing up when they are needed, not the other way around. I'm thinking of allergies, drug interaction, and relevant medical history during emergencies, and the like.

That's a strong argument for each person to keep a copy of their records physically with them - like on their smartphone, ipod or a MedicAlert bracelet souped up with flash-storage.

Re:Not what I'm worried about

[orangebox]

Back home, the two large hospital chains use different products for their EMR. They got together for a joint-venture to share patient data. The two vendors are working together so data from one system can transfer and be available in the other.

If the patient decides he/she wants to use another hospital for work, her information and history is already available. Not every day you see hospitals working to ensure patients are taken care of before their wallet.

I was a skeptic too, until I had them

[Gim Tom]

At the time my health care provider began implementing Electronic Medical Records I was working as the network engineer and Information Security Officer for a fairly large organization that was also subject to HIPAA I also was on the HIPAA technical implementation team for the organization. I was very concerned as to whether it would be done right and securely. Although I had no access to what back end controls the provider implemented, the front end I used to interact with it greatly exceeded my expectations. The advantages of such a system in terms of patient care and coordination among different doctors is something that anyone who has not been a part of such a system can not really appreciate. Whether I went to my regular primary care doctor, an alternate doctor since I needed to see a doctor NOW since I was sick, or when I had to go to either a routine specialist appointment or for a diagnostic procedure the doctors and medical personnel had ALL my medical records available. Think of how many times you have to list what medications you are taking whenever you see a different doctor. Think of how useful it might be to a doctor to see your detailed medical history to know whether something he or she was considering might be contraindicated by something in that history. Also when I had lab work done, I would get an email telling me to check the secure web site for results often on the same day as the tests! Also I could send private emails on that site to my doctor and medical team and they could reply for routine questions. It was wonderful. Now, this was probably a special case since it was a closed HMO to be specific, it was Kaiser Permanente in Georgia -- and it worked and worked well. Unfortunately my employer dropped them as an option last year and I am now back with whatever doctors are on the current plan and none are anywhere near this point technically. Electronic Medical Records are not a panacea and they have to be done right or really could put you at risk. I still question whether this can be done the way medicine is practiced in this country. It has become a three way adversarial contest with the interests of the patients, the doctors and the insurance companies all going in different directions. In a three person zero sum game there are no winners.

Re:inaccurate

[fl!ptop]

the systems that record patient information are highly governed and regulated. HIPAA provides strict guidelines on access control, how data can be managed remotely

Yes, HIPAA does provide "strict guidelines," but how often do they audit? Guidelines are useless when not followed. I have several clients who are doctors/dentists and I know more about HIPAA than they do. To them, it's just a piece of paper w/ rules written on it.

For someone looking to 'steal' records, it would be much easier to break a window, and jimmy a file cabinet and run off with records than 'hack' into a online patient registry and steal information.

Much easier than parking in the lot, cracking a weak WEP key and having a field day on the network? I think not.

What can go wrong?

[ashvin213]

I mean it, seriously! What is wrong with your medical history showing up online? How can anyone monetize it?

Seriously, what is with you privacy folks?

I actually want my medical history to be online so that different doctors can view it and suggest if something different could be tried. Honestly, I never trust the doctor. Doctors have vested interest to push for a option in which they are good at. This happens very subtly and people may not notice it.

I have seen two common complaints about unlimited access to medical data. In my opinion both lack any merit.

1. Insurance rates go up: Sure they do. Its better that your insurance rates go up (if you have a problem that is), as opposed to the entire community's. You are at fault so you pay for it.

2. Employer Screening: This is even better. The employer is the best judge (at least before hiring) on what the job takes. If you have a problem and you wanna hide it, how will it help you while you are performing the duties. It is better for the employer and the employee to have the access to medical records. For example, if you are a former drug addict, I wanna know that before I hire you.

Re:what about all the vender systems / medical dev

[cbope]

You isolate them and do not allow access to those systems from the outside. Inside the network, you allow only carefully selected access and block everything else. It's not rocket science.

I would not say actual, but news fed fear

[Shivetya]

is probably the basis for most of it. You can't go a day without a news story or advertisement related to financial records being stolen. As with anything else, if you repeat it enough people are going to start to believe it.

On the internet?

[chickenmcnoggin]

Why are mission critical (to a physician) servers on the internet?

Yawns

[ikeman32]

Not to down play the implications, but just how visible are these medical records servers on the internet?

Medical Records

[lsatenstein]

My doctor does not own a computer. He keeps everything in filefolders. I think that one full room of his office is just filled with filing cabinets containing patient records. He doesn't eveng Google for possible diagnosises