Slashdot Mirror
Patient Just Wants To See Data From His Implanted Medical Device
An anonymous reader writes "Hugo Campos got an implanted cardiac defibrillator shortly after collapsing on a BART train platform. He wants access to the data wirelessly collected by the computer implanted in his body, but the manufacturer says No. It seems weird that a patient can't get access to data about his own heart. Hugo and several medical device engineers are responding to live Q/A on Sunday night on such topics via ACM MedCOMM webcast at ACM SIGCOMM."
Here's a link to the actual post.
Your hair look like poop, Bob! - Wanker.
Not to sound against it, but
a) Would he understand what the data meant?
b) Maybe the software and what not is proprietary?
Just some thoughts that come to mind
It seems weird that a patient can't get access to data about his own heart.
No more weird than your stem cells and DNA being patented. In fact, according to intellectual property law, you don't own your body, or any of the parts implanted in it... it's all covered by a patchwork of patents on genetic materials and derived medical uses. You should be careful with yourself... it's a felony to damage government property... Or was that corporations? I confuse the two so much these days... (-_-)
#fuckbeta #iamslashdot #dicemustdie
Someone will have the data in a matter of minutes, and you might even live long enough to see it yourself.
While security through obscurity isn't a good approach I figure with something such as a that you'd want to take every step you can to make sure as little information gets out about it as possible.
Next year on defcon - learn how to hotwire your neighbour! Literally! From your android device! (or iphone, but you have to be jailbroken and pay 99c for the app. But it comes with a jump-o-meter to measure how high he jumps.)
...it is available to anyone with a receiver.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Not very useful if it's encrypted unless you have the private key or can crack it.
Any entity that collects medical data on you MUST provide a way to get you copies of that information. If he really wants the data that badly, I'd contact a lawyer and pursue it from the HIPAA angle. Chances are very good there's probably not a hell of a lot of information in it. If he's really worried about it, he should contact his cardiologist and have them order an interrogation the pacer. Pretty simple stuff really and that way its covered under insurance..(probably unless there's no medical reason to do so). They probably aren't going to come out and interrogate it in the home, because they fiddle with the settings to make sure its working right and for that reason it needs to be done only in a setting where he's on telemetry and has medical staff standing by.
(To be clear, I didn't RTFA yet so I dunno if it is or not.)
Not knowing his specific one I can't say for sure. But I can say MOST medical devices have very little in the way of security... its really pitiful how far back the medical field is.
I get the feeling that cracking your own defibrillator isn't the best idea in the world.
the dude is probably thinking of tampering with the device's firmware settings and increasing his own pulse so he can go on a rampage around town like in that movie "Crank"
This might be the reason they don't want to provide that information. Security through obscurity you know.
Website Just Down For Me? Find out
There are legitimate medical reasons why some patients shouldn't have access to all raw medical data.
This is particularly true in psychiatric medicine, where past therapists are required to pass on notes to future therapists, but patients don't necessarily have the right to read the notes themselves.
Now, if the company is refusing to share the raw data with the patient's doctor, that's just plain wrong and it should be illegal. Likewise, if they are refusing to share it with the patient's attorney, then the attorney should have an absolute right to subpoena it.
Likewise, if the doctor doesn't have a bona fide medical reason for refusing to pass that data on to the patient, that should be called medical malpractice.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You are probably just licensing your heart, the Company still owns it.
A gas can maker was recently forced out of business when a jury found the maker 70% liable in the death of a 4-year-old that perished in a camper when her father poured gasoline into a wood burning stove.
Someone can pour gasoline from a can onto a fire and a jury will still blame the maker of the can.
Do you really think the maker of this device is going to take a chance of losing everything through potential misuse of this wireless capability?
Anyone in business needs to understand that they're seen at best by jurors as a necessary evil and as a source of money to help someone they sympathize with. Additional unnecessary features are just additional opportunities for big judgments against you and your firm.
so his heart will go pitter-patter like a 20 year old in love
Politics is Treachery, Religion is Brainwashing
I can imagine that buried within the 'User' agreement are words like, ...
'installation of the device makes the 'User' a medical subject. Medical subjects are not classified as human beings, lose all rights including under local, state, federal and international laws particularly to the treatment of prisoners of war and all human rights in general for the term of the installation.'
sol
Kramer at doctor's
Kramer : I like what you've done with that .
Attendant : May I help you ?
Kramer : Yes , yes . I am Dr. Vanostran from the clinic . I need Elaine Benes
chart . She's a patient of mine and she's not going to make it . It's uh very
bad very messy .
Attendant : I see and what clinic is that again ?
Kramer : That's correct .
Attendant : Excuse me .
Kramer : From The Hoffer-Mandale Clinic in Belgium .
Attendant : Really ?
Kramer : The Netherlands ?
There are legitimate medical reasons why some patients shouldn't have access to all raw medical data.
This is particularly true in psychiatric medicine, where past therapists are required to pass on notes to future therapists, but patients don't necessarily have the right to read the notes themselves.
Now, if the company is refusing to share the raw data with the patient's doctor, that's just plain wrong and it should be illegal. Likewise, if they are refusing to share it with the patient's attorney, then the attorney should have an absolute right to subpoena it.
Likewise, if the doctor doesn't have a bona fide medical reason for refusing to pass that data on to the patient, that should be called medical malpractice.
He is not a psych patient so all his healthcare info legally belongs to the him...
And perhaps the other people with this kind of implant would prefer this guy not be given the private key.
Duplicates removed and sorted: 0 1
Good enough?
How often have you seen a device that transmits *something* wireless being properly secured when the companies goes "No, we can't give you access to that...because...it is too complex for you to understand!" or "Why should we give you that data?"?
Fucking DRM on our tickers now!
-AI
For me, it is far better to grasp the Universe as it really is than to persist in delusion
...it is available to anyone with a receiver.
Available, yes, but if you decrypt it, you have broken the law.
According to Karen Sandler, a lawyer with an implant, "I don’t want to rely on one company for any part of my life. I don’t want to rely on Medtronic for my heart, and I don’t want to rely on any other company for any other thing." Fine. Go have it taken out. Unless you were unconcious you agreed to have it put in. Make up your mind.
20120420 08:00:22 CARDIAC SYSTEM INIT
20120420 08:00:24 VENTRICLE TEST OK
20120420 08:00:25 AORTA TEST OK
20120420 08:00:26 BATTERY TEST OK
20120420 08:00:27 0MG GR0W B1GG3R P3N1$ 1N 3 W33K$!
20120420 08:00:27 CHINA HANDBAG SHOES FASHION LOWEST PRICE
20120420 08:00:27 MEET SEXY SINGLES IN UR AREA
20120420 08:00:27 URGENT FROM WELLS FARGO BANK ACCOUNT RESET!
Come on even Bacardi 151 has a flame arrestor on the bottle. Get with the times other companies can make a better gas can so you better do so as well or you will lose your company. It is called the American Dream or Capitalism.
If it's encrypted, then this would give them access to both the cyphertext and cleartext of the data, which is the essentials of what you need to reverse engineer the cryptography.
Now ideally, the control and reporting cryptography would use different keys, but there is only so much code you can fit into a small embeddable medical devices, and it's likely they are the same code, if not the same key pair.
In this case, it's reasonable to not give samples of both sets of data out to prevent reverse engineering of the control channel which could then be used on someone else's implanted medical device.
If you want to know anything about yourself... not so free.
Boy are we the rest of the world jealous.
If the same control codes for device A implanted in patient Q would work with device B implanted in patient R. Specifically, disclosing the information to patient Q would disclose private health information for patient R, since the health information in this case is common to everyone with the same implant.
See my other posting relative to cryptography to see ow giving both cleartext and cyphertext to the same person would be tantamount to providing similar HIPAA protected information about another patient, if the control and/or reporting channel keys and algorithms were disclosed.
This is probably a case where "security through obsurity" is in line with Federal law, based on their (arguably poor, yet approved by the FDA) design choices.
This is particularly true in psychiatric medicine, where past therapists are required to pass on notes to future therapists, but patients don't necessarily have the right to read the notes themselves.
I don't see how that would help a paranoiac.
Give me Classic Slashdot or give me death!
He is not a psych patient so all his healthcare info legally belongs to the him...
How do you know? May be, he was just having a panic attack and they implanted an Altoids Tin Can into his chest to trigger the Placebo effect.
For the last time -- off my couch!
Don't tell that to your doctor...
Why can't
I had a friend a similar position. Difference being, he was a an IT professional and relatively young for a person to receive such a device. So he got the data and knew exactly what it was doing to his heart, because the doctors where very interested in his condition and he knew exactly how to interpret what they told him, and he could tell them that. He called it "learning how to hack his heart".
There are numerous issues with this. Firstly, an ICD has firmware that can be reprogrammed remotely (i.e. through skin, without the need for surgery). Which is good - kudos to the ICD manufacturers for implementing it. Secondly, ICDs are not dumb devices, Thirdly, because he was young (under 40), the data from his device was of interest to essentially everyone in the medical field, because they had very little data from that age group. I can understand it being valuable.
Caveat: He was in the UK, with a national health service. There may be different conditions on how much data can be revealed under such a system.
psychology != psychiatry
A therapist is not a medical doctor.
I usually avoid hospitals and the medical profession in general unless it is needed, ie, broken bones or donating a kidney (Which I did recently.) A couple years ago while camping my some broke a bone. I put it in a splint then took him to the hospital to get a get it set and placed in a cast. This was on a Saturday in a very "out-in-the-boonies" location. Before the staff would even look at my son, I had to sign a patient's "Bill of Rights." indicating that I had read the items on their list... There were around a dozen items and I don't remember what they were except for the first one. "The Patient has a Right to all medical records assembled during the visit." Maybe this is enforced in other hospitals. I don;t know.
.)
Anyway, My son was X-Rayed and dealt with and released.
On the way out, I asked the secretary, who made me sign the "Patient's Bill of Rights," for a copy of my sons X-Rays and a print out of the Vitals they recorded. I was told "No, Those are not for you." I put on my "Contrary-Old-Bastard Hat" and stated that I have a "right" to those and read back the 1st item on theh "Patient's Bill of Rights." I explained that the X-Ray and vitals were records of the visit and that the hospital, before my son was allowed any medical attention, made me sign a form to acknowledge that I have a right to those records. I was told that I had to go through the Records department and Billing in order to get the records. These offices would not be open until the following Tuesday (due to a Holiday.) Not wanting to get mad at the secretary for doing her job, I asked to talk to her boss or whoever was in charge of the hospital that day. She informed to me with all of her arrogance that since it was the weekend, she was in charge. So I ranted to her for a while and then read the entire "Patient's Bill of Rights" to her. I strongly emphasized that nowhere in this document, which we both signed, did is mention that I should go through Billing and records. After ranting a bit more she let me know that my son's doctor can request the records and the records will be sent without charge. I explained more how I am his parent/Guardian and in charge of his primary care and that I want the records to that I can hand deliver the records when I can return and set an appointment for cast removal. Again I read the entire "Patient's Bill of Rights" to her and then explained that nowhere on it did it say that my doctor was to get the records. I asked her bluntly to obtain a copy of the records. She actually stomped her foot and said, "No."
"OK," I said, "since I have been forced to acknowledge that I have a right to my son's records, I am going to sit right here in the middle of this hallway until I get them." And I did; I sat down in the middle of the hallway. (My son was looking at me in a state of shock -- He was at that Jr. High age when anything a parent does is considered embarrassing
The secretary stared at me for about 30 seconds. then left. A minute after that she came out with a doctor and he asked what was up. I mentioned that I was waiting for a copy of my son's medical records. He nodded, went behind the counter and gave me the X-Rays and vitals papers. I said "Thank you" and left.
This anecdote is not so that I can say I am an old cantankerous fart, it it to illustrate that even though people have rights to information, the ones that hold the information feel compelled not to give it up. THis is true with software, medical data, music... I don;t know where this attitude comes from.
[off my soapbox]
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
"First things first -- but not necessarily in that order"
-- The Doctor, "Doctor
There are legitimate medical reasons why some patients shouldn't have access to all raw medical data.
You never know, he could get stuck in a feedback loop. He sees that his heart is beating a little fast because he's anxious about what his heart rate is. This causes more anxiety which causes his heart to beat faster. Seeing that it is out of control sends him into a panic and pushes the rate even higher, etc. Eventually he has a heart attack and sues the company.
the dude is probably thinking of tampering with the device's firmware settings and increasing his own pulse so he can go on a rampage around town like in that movie "Crank"
Computer says no.
Companies want to see data from fheir patients?
Why? Only make money? No.
Still, it is a serious moral contender to why Romney is so very much morally wrong.
For once, let the Moral Majority speak up - Dont Put A Price On My Child's Life.
How much is a Texan child worth compared to someone from Massachusetts?
HIPPA
U.S. Department of Health and Human Services
Office of Civil Rights
200 Independence Avenue, S.W.
Washington, D.C., 20201
Phone: (866) 627-7748
Web: www.hhs.gov
The Center for Medicare & Medicaid Services
toll free HIPAA Hotline: 1-866-282-0659
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
You chose not to exercise that right. If it was me, I would have given you the records but along with them a little speech about how civilized people act in a civilized society. The speech wouldn't be for you--it would be for the benefit of your poor embarrassed son in the hope that he wouldn't grow up to be a huge dick like you.
you can't even see the raw data from the water temperature gauge, so of course we are all too dumb to see complex health data. The temp data is manipulated so the gauge needle stays in the middle nearly all the time. Exceptions are when the engine is very cold or when it overheats. Normal fluctuations are not shown because they cause unnecessary service calls. There was a recall on Jag sedans to put a resistor in series with the temp sender to damp out needle fluctuations. My MINI does the same thing (checked with data from the OBDII port).
Sorry, but gray text on gray background is making my eyes bleed.
Defibrillator app error message: "Your heart has unexpectedly quit. OK?"
Sorry, but gray text on gray background is making my eyes bleed.
The only reason this isn't happening is that the manufacturers want more money. The patients are basically asking for the data so that they can go wherever with it, do whatever with it, and that looks like dollar signs flying out the window to the manufacturers. What the patients might achieve with the data is irrelevant.
So then, it should be ok to give him the data once it's read from the device, no ?
"Hugo Campos got an implanted cardiac defibrillator shortly after collapsing on a BART train platform. He wants access to the data wirelessly collected by the computer implanted in his body, but the manufacturer says No.
If he wants information about his heart, why isn't he talking to his cardiologist?
Someone who knows his medical history? Someone who can interpret the data correctly?
Does the manufacturer have the data he wants?
What Is Follow-Up Like with ICDs?
After your ICD is implanted, the doctor will want to see you four to six weeks after surgery to make sure the surgical site is fully healed and to answer any additional questions that may have occurred to you in the interim. Afterward, the doctor will usually want to see you in the office two to four times per year. During all these visits, your ICD will be wirelessly "interrogated" using the programmer. This interrogation gives the doctor vital information on how the ICD is functioning, the status of its battery, the status of the leads and whether and how often the ICD has needed to deliver therapy - both pacing therapy and shocking therapy.
Some modern ICDs have the capacity to wirelessly send this kind of information to the doctor from your home, through the Internet. This "remote interrogation" feature allows the doctor to evaluate your ICD whenever needed, without requiring you to come to the office. Even if your ICD has this remote feature, however, the doctor will want to see you in the office at least once a year.
The Implantable Defibrillator
The delightful FOSS advocate & lawyer who is the current legal head of GNOME has the same issue.
Her talk 'From My Heart to the Desktop (https://www.youtube.com/watch?v=nFZGpES-St8) is really worth watching.
The FDC doesn't even require any company to submit sourcecode to them...because, you know, bugs are only 1 in every 100 lines of code aka 'nothing to worry about!'.
Call again later when someone more senior is available. Contact the patient's advocate at the hospital to lodge your complaint for the bureaucratic hoops you were forced to jump through. Move on with your life.
These are white people problems--get over it. The guys isn't Rosa Parks.
Health Information Privacy and PORTABILITY Act,
Sort of growing tired of fines being thrown around for the Privacy portion of this $@# piece of paper, where is the Portability enforcement?
Health Information Privacy and PORTABILITY Act,
Sort of growing tired of fines being thrown around for the Privacy portion of this $@# piece of paper, where is the Portability enforcement?
Disclosure: I am a doctor, and I work with patients with pacemakers on a frequent basis.
If he wants a raw printout of the data generated, he should make an appointment, stop by his cardiologist's office, and ask the cardiologist. I've been asked a few times by curious patients to see the readouts. I always show it to them, give them the clinical interpretation of the data, and let them keep it if they want. Most don't; it's several hundred small pages of gibberish to an untrained eye, linked together like the old dot matrix printer pages.
If he feels uncomfortable with having a machine in his body that he can't check out himself every second of every day, he can ask to have it turned off ("turned off" being simplistic) or for a surgeon to remove it. [Insert belief system here] didn't give him the pacemaker growing in him when he was born - he can choose to use it as designed or choose not to use it, which is a valid choice. There are real potential harms to widely propogating machines that could decrypt the data; the exact same machines allow us to reprogram the device, including settings that could harm or kill the patient. The encryption IS the security on implantable, reprogrammable medical devices; password, 2 step authorization or the like is not possible due to the existence of medical emergencies in which prompt access by medical personnel not normally involved in his care to the input and output of the device can mean the difference between life and death.
Light a fire for a man and he'll be warm for a day. Light a man on fire and he'll be warm for the rest of his life.
That could explain his curious increase in strength...
I was thinking along the lines of Gattaca. "Jerome, Jerome, the metronome."
...it is available to anyone with a receiver.
If and only if that receiver is within 15 feet of the device, according to the makers of my ICD (Medtronics). The wireless feature has a deliberately limited range; I have to use a magnetic pickup every 90 days to provide a detailed report to my cardiologist -- and he makes all the information available to me whenever I ask for it. For that matter, my primary care physician puts all my test results on a web-based system that's as secure as my banking or shopping software, which is to say that it uses SSL for full encryption and accounts have to be created by the doctor, not the patient. Not all healthcare providers treat their patients like children...
More from Karen Sandler... IT Conversations has an interesting podcast featuring Karen Sandler talking about her efforts to get source code for her defibrillator.
Signatures are a waste of bandwi (buffering...)
We cant sell you a bunch of bull shit.
http://www.youtube.com/watch?v=5XDTQLa3NjE
"I don't see how that would help a paranoiac."
Who said they were actually there to help him, huh?
I've had 5! Count 'em 5 ICDs. When they do the reading, you can always get a copy of the readout. They print them up, and clear the memory.
Every time, without exception no matter the technician, over the course of at least a hundred of these data dumps did I NEVER get a copy and I still have quite a few of them. They even go over them with you. You do have to have a modicum of cardiac AND electric knowledge or it's pointless of course. I have plenty of both so it wasn't an issue. EVER.
This is particularly true in psychiatric medicine, where past therapists are required to pass on notes to future therapists, but patients don't necessarily have the right to read the notes themselves.
Since psychiatric diagnoses are used to detain and forcibly treat people I don't see how it can possibly be justified to deny patients the same access rights as anyone else. Especially when they are not in an acute stage of their illness.
http://marriedmansexlife.com/
It is not the doctor's job to decide what's "better" for a legally competent person. For example, a doctor may guess that a medical test result may make it likely that a patient will commit suicide, but the suicide is the patient's choice and the doctor has no moral right to interfere with it.
The outcome will be a the Blue Skin of Death.
I had a similar problem with my wife's insulin pump manufacturer. The unit is controlled by a wireless PDA. I read everything I could about the unit, but as a penetration tester, I was concerned that their security was not up to standard. I emailed and phoned the company, who flatly refused to disclose the details of their wireless technology or how it was secured. I even offered to sign a non-disclosure agreement. They just said "trust us, it's really complicated stuff". Fast forward a couple of years, and it appears that someone has indeed, broken their layer of obscurity. I've seen papers detailing how it may be possible to send commands to the pump to deliver the entire insulin reservoir. I again contacted the company, one of their managers answered "Who would want to do a thing like that?". I guess he never heard of 'For the Lulz'.
I can see your little mind bouncing around the paradigm we set for it, kind of like an 1980 Atari Pong,
where we supply the paddles and you're that little white square. Yes we did start this idea that
people can have their medical records withheld from themselves in psychiatry but we have since
expanded this concept.
Our basic premise is, you can not know better than our specialists and you should not have the access
to even attempt it. This is why we have made access to medical journals unaffordable to read
for the general public. Unaffordable unless you're willing to pay $1500 for a yearly subscription or
$35 per article. Incidentally did you know we author most of what you'll find in there ourselves and
in many cases we even reserve this information to medical professionals in the first place so you can't
get it unless you're certified regardless of how much you are willing to pay.
Here I'll toss you a freebie, statins cause diabetes and accelerate arteriosclerosis. We admitted
that in our publications this summer but we'll tell you to keep taking them because they're good for you.
We have a plan for you and it isn't pretty but has to be done. The less you know, the less you will make
a fuss.
OMG to state that somehow someone could capture the WIFI data (Cypher text ) then get the actual data ( Clear text ) and then use that to reverse engineer the device and then affect someone else's implanted medical device is ridiculous and sounds more like a late night Science Fiction movie more that logic. I suggest actually learning about encryption before making such a statement. What makes you believe that the device actually transmits WIFI? Do you really believe that every implantable pacemaker patient is also a WIFI hot spot ???? WIFI data is WPA or WEP encrypted and the actual device data is encrypted differently.
I am embarrassed.... Having the decoded message ( clear text ) and the Cyper text does allow you to decode future messages... Obviously the "public key" technology is not known here.
Moderator: You should check this before stamping this Insightful.
The poster obviously has no idea of cryptography. I suggest listening to the podcast Security Now to get an idea if you can't attend a local college.
If so, then it is going to be copyrighted down to the last bit. Can you imagine the fuss it would cause if somebody found out they were being kept alive by broadcasts emanating from the inner planetary broadcasting XENU channel? Enjoy.
This ain't no upwardly mobile freeway This is the road to hell
Slashdot is unusable without noscript.
If you aren't logged in, you are absolutely right.
At least "classic" mode gives you some of the usability of the older user interface.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
donating a kidney (Which I did recently.)
On behalf of everyone who has needed or who may need a donated organ, let me say THANK YOU.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The bill of rights doesn't say you are entitled to such records immediately.
I wonder how long before they update their paperwork to clarify that most of the right you have can only be enforced during normal business hours.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What part of "wireless" implies WiFi frequencies or protocols? The Medtronic Minimed Paradigm insulin pump, and the Deltec Cozmo, Animas Ping, Insulet OmniPod, Accu-chek Spirit Combo, and Sooil DiabecareIIS pumps all communicate wirelessly (one via infrared) and a couple will adjust dosing automatically based on an unencrypted wireless signal from a glucose meter (basically: lie about the glucose level to the pump until it empties its 200 dose unit cartridge into the wearer, or lie about it so they don't get any insulin whatsoever).
http://www.startribune.com/business/128427593.html?refer=y
Demonstrated at Black Hat in 2011: wireless forced shutdown of the device.
http://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-turn-off-your-pacemaker/
A similar turn-off attack on Legend RF controlled pacemakers was shown at Defcon in 2008, and which demonstrated the ability to pull out HIPAA protected information from the device itself, including the identity of the patient, the doctor, the diagnosis, and the pacemaker instructions.