Slashdot Mirror
British NHS Patient Records Go To the Cloud
smitty777 writes "The Telegraph is reporting on an effort by the NHS to put a London hospital's patient records in the cloud. One of the more interesting aspects of this is the suggestion that patients would have control over who has access to their medical data. Many have understandable security concerns, which are even more relevant considering the recent issues with Dropbox cloud storage."
It's only a matter of time before somebody gets into it...
The failure of the London experiment may keep entities in the U.S. from trying the same thing.
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
How is that at all relevant?
XML is a known as a key material required to create SMD: Software of Mass Destruction
The NHS adminstrators are pendejos
Yours In The Cloud,
K. Trout
What's wrong with simply saying "online"? They're putting the patient records online. Medical staff will be able to access them through the internet.
Alright, now I'll hit the submit button and send this text to the cloud!
"A week in the lab saves an hour in the library"
Clayton Christen et al predicted this type of move in "The Innovator's Prescription" published a few years ago.
Its a key part of reducing costs in health care - having the patient record belong to the patient and be readily usable and update-able by different health providers (public, private, not for profit) that the patient sees.
The security issues are a necessary issue that comes with doing it this way. You can't rely on anyone let alone "Mr Average" to not mislay their DVD-RW or USB thumb stick, so in the cloud the data has to go.
What could possibly go wrong?
the transition from paper records to online electronic records. This will totally solve the massive problem of theft of medical records from the wards where patients are treated and reomve all chance of the records being lost or changed maliciously. After all, I trust the banks with my online bank accounts, which have proven to be much less susceptible to identity fraud than paper records.
Aside from security, who is going to do the data conversion?
I don't know what software packages they have for medical, not my forte in IT, but assuming there are 5-10 major packages, with 3 or more revisions, who will they get all that data into the system, and verified for accuracy.
Considering the incompetence of credit agencies, I'm sure my medical records will somehow get uploaded and somehow I'll be marked as pregnant.
Clinical software providers have been pushing this style of system for months now, it's hardly a "cutting edge pilot scheme"; EMIS & SystmOne are probably the furthest ahead with a lot of GP practices already using their hosted solutions for their patient records (in the case of EMIS with a caching server locally in case their link goes down).
Doctors get R/W access over N3 (The NHS "private" network, similar to JANET) and doctors & patients can get read access over the internet if they want to.
It's not "in the cloud" or "let's upload all our patient records to Rapidshare", it's a fucking hosted software solution, running out of a datacentre (in Leeds, in EMIS' case) on some servers, just like any other.
The Telegraph is not a reasonable source of information, commonly known as the Torygraph they hold right wing views and will post scare stories about the NHS, public sector workers and immigrants on a regular basis.
The NHS has no intention of putting it's patient data in the 'cloud' it is taking every effort to protect and encrypt. it.
That's just another way of saying: "Whoops, someone has uploaded this data on ThePirateBay".
Quite. The article is very misleading. It is not 'the cloud', it is a well defined data centre running the specific app on dedicated machines under the control of a dedicated ASP, with dedicated private WAN connectivity (i.e. most usage is not via internet, but over the private NHS net).
Of course, there have been a number of problems:
1. Lack of control - a number of hospitals run highly specialist one-of-a-kind services for rare diseases, or offer highly specialised treatments, which are poorly supported by the off-the-shelf software, and they have been severely hampered by lack of flexibility. Similarly, the service providers may be required to adhere to national policies for user rights - this means hospitals cannot assign security permissions to users as required. E.g. When PACS (digital X-ray storage) was first installed in the UK using hosted servers, the national policy was that doctors should not be able to alter the brightness/contrast/levels of an image while viewing it (if the image was too dark, too bright, etc.). As a result, all doctors (including radiologists who read the X-rays) were unable to perform basic image manipulation because access to the tools was denied by the ASP. The hospitals could not change this, because they couldn't allocate user rights or accounts. The software vendor could not change it; indeed, even their tech support staff could not even get admin or debug access because the national policy denied them access. The ASP could not because they were bound by contract to adhere to the national policy. It took 6 months before the national policy was changed.
2. Lack of reliability - there have been a number of issues where connectivity has been lost causing serious problems. There were numerous issues with loss of connectivity to the ASP where the 'secure smartcard login' system was hosted. When the link was down, there was no access to PACS, laboratory results, electronic letter and correspondence archives, etc. This was made worse by very poor quality software (which, in my opinion was worse than pre-alpha testing level stability). Technically, there was local caching of user credentials - in practice it was unusable and had to be switched off, for risk of crashing the local auth servers. While this had been fixed in a service release, the service release broke numerous other features, including warnings about expired or expiring passwords/certificates - so users would simply find themselves unable to log in due to an 'unknown error', and of course, the error logging was borked, so there was no indication that tech support could find out what the cause of the failed authentication was. When this happened to me, it took nearly a week to debug the cause as an expired certificate, and required me to visit an office of the ASP in person with my smartcard.
A more recent example was at a major agglomeration of hospitals in London - they had all their core IT systems at a distant datacenter. One day, they lost connectivity. Almost all IT functions (internal e-mail, shared drives, intranet, PACS, EPR, documents, operating room record software, medical laboratory results, blood transfusion databases, etc.) went down for 24 hours until the link was repaired - the only functions that actually worked were internal only e.g. VOIP phones, and peer-to-peer networking of some medical equipment. The result - all surgery except dire emergencies cancelled, routine admissions cancelled, ER closed and ambulances diverted, routine appointments/clinics cancelled
3. Speed. Many users of IT systems (especially those which are demanding on IT resources e.g. PACS) noticed major performance problems after the move to hosted solutions. Routine oracle queries taking 30-50 seconds to run; images taking 10-15 seconds to load, or simply timing out. I'd managed to get various excuses from the ASP - however, 'virtualization' was quoted a couple of times - presumably, the ASP had simply loaded a single server to the gills with VMs - when in reality, each app (or even each hospital) would have wa
Cant' wait till we get it here. I'll be great.
Seems appropriate. NIH patients tend to go to the clouds quickly anyway. Why not their records?
Got a letter from my GP asking if my records can be computerised and shared around the country. I ticked the 'No' box and everyone thought I was being an idiot. The government has a glorious record of data stupidity and this continues that trend so I'm feeling pretty much vindicated at this point.
I want a list of atrocities done in your name - Recoil
Nationalized medical care and pharma are really efficient. Governments strongarm pharmaceuticals to provide pills, drops, gels, etc. at little profit over cost and doctors work for wages, rather than profits of their own enterprise. Some 99%+ of the population gets tread for any health problems that arise, not always convenient in circumstances, but the job is done. Those, who despise the masses can always fund treatment in single bed roomed hospitals with personalized doctor contact, from their own pockets. USA is extremely behind and retrograde in this aspect.
I think it makes USA vulnerable, because lack of health access for an increasing part of the population may lead to a social explosion. Yet, the USA could different herself from mainland China by introducing a nationalized total healthcare system now. China, while communist governed in name, actually provides zero healthcare to citizens, it's literally pay or die to the extreme. Medical poverty of the masses and the extreme coal gas air pollution kills so many chinese in their early 50s.
"This would include mobile phone identity checking, as well checks through Facebook or the Paypal secure online payment system."
To be honest, Facebook isn't trusted at all.
Feel glad that they asked you. Labour were just going to upload it for a million NHS employees, MI5 and hackers to gawk at... no opt-out.
http://www.thebigoptout.com/