Slashdot Mirror
British NHS Patient Records Go To the Cloud
smitty777 writes "The Telegraph is reporting on an effort by the NHS to put a London hospital's patient records in the cloud. One of the more interesting aspects of this is the suggestion that patients would have control over who has access to their medical data. Many have understandable security concerns, which are even more relevant considering the recent issues with Dropbox cloud storage."
It's only a matter of time before somebody gets into it...
The failure of the London experiment may keep entities in the U.S. from trying the same thing.
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
How is that at all relevant?
XML is a known as a key material required to create SMD: Software of Mass Destruction
What's wrong with simply saying "online"? They're putting the patient records online. Medical staff will be able to access them through the internet.
Alright, now I'll hit the submit button and send this text to the cloud!
"A week in the lab saves an hour in the library"
Clayton Christen et al predicted this type of move in "The Innovator's Prescription" published a few years ago.
Its a key part of reducing costs in health care - having the patient record belong to the patient and be readily usable and update-able by different health providers (public, private, not for profit) that the patient sees.
The security issues are a necessary issue that comes with doing it this way. You can't rely on anyone let alone "Mr Average" to not mislay their DVD-RW or USB thumb stick, so in the cloud the data has to go.
the transition from paper records to online electronic records. This will totally solve the massive problem of theft of medical records from the wards where patients are treated and reomve all chance of the records being lost or changed maliciously. After all, I trust the banks with my online bank accounts, which have proven to be much less susceptible to identity fraud than paper records.
Clinical software providers have been pushing this style of system for months now, it's hardly a "cutting edge pilot scheme"; EMIS & SystmOne are probably the furthest ahead with a lot of GP practices already using their hosted solutions for their patient records (in the case of EMIS with a caching server locally in case their link goes down).
Doctors get R/W access over N3 (The NHS "private" network, similar to JANET) and doctors & patients can get read access over the internet if they want to.
It's not "in the cloud" or "let's upload all our patient records to Rapidshare", it's a fucking hosted software solution, running out of a datacentre (in Leeds, in EMIS' case) on some servers, just like any other.
Every GP in the NHS already has their patient records stored electronically on local clinical systems (EMIS, INPS, iSoft & SystmOne are the key players); a lot of them still use paper records as well but they're all duplicated.
Most of the providers are pretty good at data conversion these days because it's hard to sell doctors on migrating to your system if you tell them they'll lose half their patient data when they do it.
That's just another way of saying: "Whoops, someone has uploaded this data on ThePirateBay".
Quite. The article is very misleading. It is not 'the cloud', it is a well defined data centre running the specific app on dedicated machines under the control of a dedicated ASP, with dedicated private WAN connectivity (i.e. most usage is not via internet, but over the private NHS net).
Of course, there have been a number of problems:
1. Lack of control - a number of hospitals run highly specialist one-of-a-kind services for rare diseases, or offer highly specialised treatments, which are poorly supported by the off-the-shelf software, and they have been severely hampered by lack of flexibility. Similarly, the service providers may be required to adhere to national policies for user rights - this means hospitals cannot assign security permissions to users as required. E.g. When PACS (digital X-ray storage) was first installed in the UK using hosted servers, the national policy was that doctors should not be able to alter the brightness/contrast/levels of an image while viewing it (if the image was too dark, too bright, etc.). As a result, all doctors (including radiologists who read the X-rays) were unable to perform basic image manipulation because access to the tools was denied by the ASP. The hospitals could not change this, because they couldn't allocate user rights or accounts. The software vendor could not change it; indeed, even their tech support staff could not even get admin or debug access because the national policy denied them access. The ASP could not because they were bound by contract to adhere to the national policy. It took 6 months before the national policy was changed.
2. Lack of reliability - there have been a number of issues where connectivity has been lost causing serious problems. There were numerous issues with loss of connectivity to the ASP where the 'secure smartcard login' system was hosted. When the link was down, there was no access to PACS, laboratory results, electronic letter and correspondence archives, etc. This was made worse by very poor quality software (which, in my opinion was worse than pre-alpha testing level stability). Technically, there was local caching of user credentials - in practice it was unusable and had to be switched off, for risk of crashing the local auth servers. While this had been fixed in a service release, the service release broke numerous other features, including warnings about expired or expiring passwords/certificates - so users would simply find themselves unable to log in due to an 'unknown error', and of course, the error logging was borked, so there was no indication that tech support could find out what the cause of the failed authentication was. When this happened to me, it took nearly a week to debug the cause as an expired certificate, and required me to visit an office of the ASP in person with my smartcard.
A more recent example was at a major agglomeration of hospitals in London - they had all their core IT systems at a distant datacenter. One day, they lost connectivity. Almost all IT functions (internal e-mail, shared drives, intranet, PACS, EPR, documents, operating room record software, medical laboratory results, blood transfusion databases, etc.) went down for 24 hours until the link was repaired - the only functions that actually worked were internal only e.g. VOIP phones, and peer-to-peer networking of some medical equipment. The result - all surgery except dire emergencies cancelled, routine admissions cancelled, ER closed and ambulances diverted, routine appointments/clinics cancelled
3. Speed. Many users of IT systems (especially those which are demanding on IT resources e.g. PACS) noticed major performance problems after the move to hosted solutions. Routine oracle queries taking 30-50 seconds to run; images taking 10-15 seconds to load, or simply timing out. I'd managed to get various excuses from the ASP - however, 'virtualization' was quoted a couple of times - presumably, the ASP had simply loaded a single server to the gills with VMs - when in reality, each app (or even each hospital) would have wa
Got a letter from my GP asking if my records can be computerised and shared around the country. I ticked the 'No' box and everyone thought I was being an idiot. The government has a glorious record of data stupidity and this continues that trend so I'm feeling pretty much vindicated at this point.
I want a list of atrocities done in your name - Recoil
How lucky you are to live in the US where you have the freedom to pay up, or push off and die of untreated disease.
Feel glad that they asked you. Labour were just going to upload it for a million NHS employees, MI5 and hackers to gawk at... no opt-out.
http://www.thebigoptout.com/