Slashdot Mirror
2015 Could Be the Year of the Hospital Hack
schwit1 writes After Obamacare required hospitals to convert all health records into electronic files, those records are now very vulnerable, and experts expect hackers to target them in the coming years. From the article: "Along with vast troves of credit card information and celebrity snapshots, hackers stole a record number of medical records from U.S. health-care facilities this year. In 2015, attacks targeting health data will become even more common, according to security researchers....The cause of the uptick isn't hard to diagnose. Medical organizations across the world are switching to electronic medical records, and computer security is not always a high enough priority during the process, says Leonard. Besides that, he says, easy and fast access to medical information often trumps security."
EHRs in general are so fucked up that even legitimate users can't figure out what the hell is going on most times.
I tell you what guys. If you do manage to hack into a bunch of systems, could you gin up some code that allows you to get the information out of all of them and put them in one useable place? Despite millions of dollars and countless lines of code, the vendors have yet to make that happen.
Faster! Faster! Faster would be better!
electronic medical records were basically mandated by insurance companies and hospital executives in an effort to reduce overhead in paper, postage, and ancillary staff related to records processing. If you've never heard of companies like ACS, its hard to imagine a workforce of almost 3000 people standing over banks of scanners, feeding paper records into a hopper, for $9 an hour in 3 shifts. Electronic medical records would have been a thing with or without the ACA. Mandating them was just icing to get insurance companies to go along with the act.
what we at slashdot can agree on is that, ostensibly, this should mean an increase in IT staff. qualified professional network and systems administrators to secure and protect patient data. But thats not mandated in the ACA, and anyone working in IT for a hospital can attest wages are stagnant. But you can expect obama to be a lightning rod for shit like this because thanks to a fervent neoconservative effort most people cant even remember the Affordable Care Act. All they hear is "Obamacare"
Good people go to bed earlier.
In fact my medical records folder comes home with me from my visits and does not even physically stay in his office.
No, it doesn't. At least in the US, the original stays in the office. You might get a copy but even here in Nuttville we're not crazy enough to let the patient have the canonical record.
Besides, you do realize that your pharmacy sells your prescription information to mining companies and that the states typically monitor any restricted drug with a system of your own?
The only way to stay perfectly anonymous is to get care out of the country or stay healthy.
Faster! Faster! Faster would be better!
Obamacare or ACA did not mandate the use of EHR. This was in legislation long before ACA, it was part of the American Recovery and Reinvestment Act (ARRA). It was specifically called Meaningful Use. it mandates a series of electronic use requirements over three phases with initially payments for use and later penalties by CMS. The vast majority of MU certified vendors were producing EHRs long before ARRA and have reasonable security in place. Clearly though some vendors, and hospitals need some shoring up though.
Hospitals are a pretty stupid target in comparison to banks, physical retail environments, and online stores. A hospital DB might contain a social security number, addresses, illnesses, and birthdate. So what?
If you can get into a bank, you get money account info, credit scores, security tips, former trades, credit cards, all sorts of good stuff. If you get into a retail environment or online store, it's almost as good. Basically, you get money to spend. In a hospital though, the only unique thing you find out is if someone is sick and with what. That's a pain in the ass to work with. You can try to get more info from all that PII, but again, it's a pain in the ass and available elsewhere. Other stuff is more lucrative for the investment of time, criminal risk, and energy.
If you were a terrorist, a hospital might be a bit more interesting, but the various hospital disasters I have read about demonstrate that there isn't much a hacker can really do to hurt people. Nurses at the end of the day don't do stupid things and doctors aren't much worse.
No, hospitals are a stupid place to expend effort.
Hoist Number One and Number Six.
And the minute his malpractice carrier sees that, he will never be insured again.
You both may be big boys, but you're not lawyers. And lawyers trump big boys in this system.
Faster! Faster! Faster would be better!
That would be entirely up to that doctor
No, it's not. For example, the State of New Jersey requires that doctor's keep the original records.
Do I have a right to my medical records?
In most instances, the patient has a right to receive a copy of his or her medical records, not the original. Although most patients assume that the records belong to them, the Board requires that the physician to maintain the original to ensure that the patient’s medical history is available to any subsequent treating physician or health care provider. Copies may be given to the patient, another doctor, your attorney, your insurance company or another family member if the patient expressly authorizes it. If a patient is deceased, the duly appointed executor or administrator of the estate may obtain copies also. Medical records cannot be released to a spouse, family member (except in the case of a child), attorney or any other person unless the patient gives his/her express consent to release them to that specific person.
http://www.state.nj.us/lps/ca/...
So it's highly likely that if that situation is true that the doctors he is dealing with could be breaking the requirements of their medical license.
You have a small practice and you get the system meant for a large hospital.
That's typically because they work closely with a particular hospital and desire compatibility with the hospital's EMR system. Not always but often.
There are a lot of small EMR systems that are fast and easy to use, but doesn't cover everything under the sun.
And there are many that cannot exchange records with other systems which defeats 99% of the purpose of having an EMR system in the first place. Just because it is smaller doesn't make it necessarily a better fit. Granted, many of them don't really examine the options closely enough but it would be pretty easy to get siloed into a small package that doesn't really fit the practice.
They start shopping with a fixed price in their head... Often buying not on features but the one closest to the price.,
That's generally because they have a finite budget for the EMR system and they know they are probably going to take a bath on it financially for several years at best. EMR systems are VERY expensive. Just because a different system would fit their needs better doesn't mean they can necessarily afford it.
Once you get the data digital, there is so much more you can do with the data. Statistical Analysis on effectiveness of procedures. Being able to request and get back results electronically, getting alerts from the hospital. etc....
I think you greatly overestimate the amount of time available to a typical practice to do such things like statistical analysis. I think you also overestimate how compatible EMR systems are with each other. Unless you happen to use the same system from the same vendor as the place you are exchanging records with you probably are out of luck doing it electronically.
Seriously, they're about me. They should give me full and complete access to them, I should have control over them.
They are NOT solely about you. They are about the actions taken to treat you. They are business records in addition to being health records and as such you should have some amount of of access but a practice would be insane to give you full control of them. You certainly should not have the right to modify medical records or delete them. You should not have the right to withhold the records from the practice in the event of the dispute. The practice is required by law to keep them stored safely for a number of years (in general) after you have been treated. You have no such legal requirement. In many countries the medical records are explicitly the property of the health service and not yours in any way.
Yet...it's like pulling teeth to get records of my tooth extraction.
It's generally not all that hard to get copies of medical records, particularly if you as at the time of service. Some places are more cooperative than others but it's doable.
easy and fast access to medical information often trumps security."
That's the attitude of a lot of corporations, and that's why there is so much successful hacking going on.
In a medical situation, that might be the right decision. If your patient turns up unconscious in the ER at 2am, or if you're covering for your partner and his patient turns up unconscious in the ER at 2am, easy and fast access might trump security.
There was a study a few years ago in which a hospital tried an electronic records system in a pediatric ICU, and the death rate went up. The system was too hard to use. Instead of just writing a prescription on a prescription pad, they had to log into the system and go through screens.
I don't think there's a practicing pediatrician in the country who would let a patient die in order to improve security.
Thats just bullshit.
Meaningful Use is NOT a requirement. It is NOT Obamacare.
It is an incentive that actually gives money to organizations to help them implement EHR infrastructure.
In order to qualify, and to make sure that money is NOT WASTED, there are a number of requirements that must be met. Stage 1 MU is bone-headedly simple, and Stage 2 is pretty straight-forward. Stage 3 is not even written yet, but is likely to include reporting to show how it affects patient outcomes.
The idea of it all is to actively manage your patient population and to use analytics to improve patient outcomes. -And by doing so, you can actually reduce the total cost of healthcare.
The problems are 1: blood-sucking EHR vendors that charge millions and provide crap products. 2: dumbass healthcare administrators who are so involved with political back-stabbing that they totally fail to even attempt to get the free money available from MU
I've worked for a number of healthcare organizations over the last 10 years, and I've seen organizations both large and small not only succeed in MU funding, but thrive as well. (I've also witnessed others utterly fail)
I'm lucky to be part of one of the good organizations right now. yay!
oldhack: "Security is a waste of money until shit hits the fan. 5 minutes later, it becomes waste of money again. "