Slashdot Mirror


1 in 3 Patients Will Have Their Healthcare Records Compromised (computerworld.com)

Lucas123 writes: A legacy of lackluster electronic security in healthcare and an increase in the amount of online patient data will lead to an increase in the number of consumers who will have their healthcare records compromised by cyberattacks in 2016, according to a new report from IDC Health Insights. The report, which includes 10 future predictions about the healthcare industry, also predicted that by 2018, cognitive computing would play an increasingly important role in helping physicians to identify the most effective treatment for 50% of patients resulting in a 10% reduction in mortality and a 10% cut in costs. Also by 2018, 30% of worldwide healthcare systems will employ real-time cognitive analysis to provide personalized care leveraging patient's clinical data, directly supported by clinical outcomes and "real world evidence" data — information pulled from patient studies and treatment results. That same year, IDC expects virtual healthcare and computer-assisted surgery to be the norm. Surgeons will use computer-assisted or robotic surgery techniques to assist in planning, simulating, and performing 50% of the most complex surgeries. Conversely, patients will be communicating with physicians via messaging, email and video chat sessions far more often, which will reduce costs and increase convenience.

42 of 68 comments (clear)

  1. Look on the bright side by Anonymous Coward · · Score: 2, Funny

    2 out of 3 won't!

    1. Re:Look on the bright side by fuzzyfuzzyfungus · · Score: 1

      Probably only because electronic medical record interoperability is such a clusterfuck that the attackers won't be able to make sense of the data they've dumped, rather than because it will remain secure.

    2. Re:Look on the bright side by FatdogHaiku · · Score: 1

      I've seen one system where the data is printed (or received by FAX), scanned into the patient record (as page images, i.e., TIFFs), and then a database of descriptors about the scans is what the medical personal can access... they then click a link (is this sounding like an intranet setup?) to pull up the scanned image in a new window... It's a bit scary... But on the other hand stealing a bunch of image files and then having to OCR and sort them does make for a less desirable target.

      --
      You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
    3. Re:Look on the bright side by dasgoober · · Score: 1

      They'll get to them in the next 2 years.,

  2. I take these with... by EmeraldBot · · Score: 2

    We were fortold to grow vital organs in the 90's. We would have a cure for death itself and become immortal by 2000. We were forcasted to all work in robotic lifting suites and fly in jetpacks and have self-flying cars decades ago.

    There's no doubt the cybersecurity breaches will become more and more common. To say you have an exact figure though is ridiculous. Maybe more, maybe less, but there's no way we can possibly predict what'll happen 20, 30 years down the road. people far overestimate the changes in 20 years and far underestimate the changes in 2.

    And lastly, I'd like to finish with this little bit...

    Elderly patients and patients convalescing with mobility issues, in particular, will find an advantage in using virtual doctor visits so that they won't be forced to commute to and from healthcare facilities.

    We were supposed to have this universally in the 70's, I don't know why people still beat this dead horse. Many places already have it, and it's not some lofty goal that's difficult to implement. It's a guy in a laboratory coat on Skype (or more realistically, some proprietary health application, but you get the idea).

    --
    "Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
    1. Re:I take these with... by KGIII · · Score: 2

      I owned a medium sized business and that required that I do lots of things. One of those things was reading things like white-papers, market predictions, analytics, etc... I never thought to crunch the numbers but I did reach a few conclusions. I'll share to of them...

      They're lying.
      They're trying to sell you something.

      Again, I didn't crunch the numbers but I suspect a good 90% of them were inaccurate in some meaningful way. There were some good ones about clustering and virtual machines and a few predictions that came true but I don't know if I'd have been able to winnow them out of the mix without some help - we were already moving in some direction and they just happened to say we were going in the right direction.

      Gartner, bless them, is among the worse. Pew might be tied with them if memory serves. Anyhow, I did not read the article.

      --
      "So long and thanks for all the fish."
    2. Re:I take these with... by weszz · · Score: 1

      We gave video doctors a shot... flopped.

      Patients don't want to use it... they don't trust it, You don't think about using video chat for anything important as diagnostics are hard because you have a terrible camera that can't get things like feeling for lumps or something that isn't right through a video chat.

      Doctors aren't thrilled for the same reasons. There is just too much that can be missed through a webcam (assuming the equipment actually works when you go to use it)

      In person will be the best way to see a doc for a long time yet.

  3. GOOD by Anonymous Coward · · Score: 1

    Maybe fines and regulations will ensure patients aren't victimized by sloppy security anymore then.

  4. We told them so by dbIII · · Score: 2

    Outsourcing important stuff with sensitive information obviously leads to fuckups, but some people cannot see the obvious until it knees them in the balls and spits in their eye. The "bad things only happen to other people" view is prevalent among those managers who spent their education time on "networking" - (as in getting drunk with students with rich parents)

    1. Re:We told them so by AK+Marc · · Score: 2

      Nah, this is just a slashvertisement for a consulting company that provides security to doctors. Note, they don't detail how many security breaches there were last year, nor the total sum of HIPAA fines for poor online security (Still $0 last I looked). But they talk FUD about how many there "will be" unless you subscribe to their snake oil, and when their prediction is way off, they'll imply their efforts had something to do with it. Their numbers are insane. And they have nothing backing up their position. But they are happy to take your money.

    2. Re:We told them so by hesiod · · Score: 2

      how many security breaches there were last year, nor the total sum of HIPAA fines for poor online security (Still $0 last I looked).

      New York Presbyterian was fined $4.8 million last May, and that's just the first one I found: patients' medical information showed up on Google.

    3. Re:We told them so by AK+Marc · · Score: 1

      That's the largest breach, and one of the few where the information ended up on a search engine. There were a few smaller fines I found, generally for careless sharing, with no specific breach found. Though, I could find none before 2014, which is about when I stopped following it, as it no longer mattered to my career or interests.

      I'd already made plenty of money violating HIPAA to give the doctors what they ask for. All the HIPAA consultants are crooked, and over-sold worthless and not legally compliant solutions. Though, as someone who wasn't in the medical field, I was happy to give the customer what they wanted, even if it isn't what they should have wanted. The overpriced crooks pushing bad solutions often couldn't even correctly build what they sold, or were priced so high the doctors shopped around for someone different to implement the solution. And yes, I advised the doctors against the improper solution, but when a paying customer insists, I'm happy to take their money.

      Doctors, lawyers, and engineers are universally incapable of accepting help from others. They are all experts in their field, so they think they are experts in everything.

  5. Most complex surgeries by Etherwalk · · Score: 2

    FYI, if it is really a difficult surgery, go to an expert. (e.g. Pancreatic surgery). Even if you have to pay out of pocket. The guy who wants your case so he can write it up is not necessarily as good as the guy who does lots of hard surgeries and doesn't publish as much.

    Also, read the research papers yourself if you are smart enough. Your doctor may know the field but hasn't always read everything you'll find, and that way you'll be working with good enough information that you can make an informed choice between different viable treatments with more information than you would get from the doctor. You'll also understand enough that you can bring his attention to a question he doesn't notice if, for example, a lab writes up a report badly and without highlighting the issue.

  6. Convenience or profits. Pick one. by geekmux · · Score: 1

    "...Conversely, patients will be communicating with physicians via messaging, email and video chat sessions far more often, which will reduce costs and increase convenience."

    So, the doctors office that requires an initial visit, a follow-up visit, a follow-up to the follow-up visit, and every report and test result also requiring a visit, care to tell me how you're suddenly going to convince a corrupt system hell-bent on extracting a co-pay each and every time they do work for you with a forced visitation policy to step away from that easy revenue stream? (Ironically, using even more electronic communications will likely force us to modify the title of this article to 1-in-2.)

    Convenience or profits. You tell me which one you already know they'll choose based on history. You think the meth addict is hooked bad? Greed is far more addictive and widespread in THE capitalist industry. Looking at how things work today, I wouldn't be surprised in the "grand" future of things that physicians won't want to charge per email. They're probably already lobbying for standardized insurance codes for it.

    There's only one true way you're going to reduce your medical costs. It's called eating right, exercising, and avoiding the medical industry altogether until absolutely necessary, because nothing about it is ever cheap, nor will it be.

  7. Re:Why should I care? by geekmux · · Score: 2

    Since health insurance can no longer be denied based on pre-existing conditions, why should I care if my health records are compromised? What do I have to lose?

    Sure, no one is going to be denied insurance, but that doesn't mean certain entities (i.e. any potential future employer) won't want to discriminate if they are aware of your history and how much of a financial burden you might be in the future (insurance costs, lost time at work due to illness, etc.)

    Often times, knowing someone's medical past helps paint the future. You can and will be discriminated for it, especially if you've been lucky enough to survive a life-threatening illness or disease (e.g. cancer.)

  8. Re:Why should I care? by penguinoid · · Score: 1

    Your insurance might cost more, or they might "encourage" you to use a different insurance company. And prospective employers might decide you're too sick to invest in. Or people might find out you have an STD, and declare you to be immoral or not want to date you. Life insurance companies might decide to charge you higher premiums, or if you're extra healthy they might send salesmen to try to convince you you're about to die. There's probably plenty more I can't think of.

    --
    Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
  9. Accurate data needed by symes · · Score: 1

    Ok - a couple of things. First, this cognitive computing will presumably need pretty accurate data. Anyione with any expoerience of health record data will attest that clinicians are not always locquatious and even simpe stuff, possibly important contextual data, is simply ignored.

    Second - it bugs me that scare stories about data security being breached could stop very valuable research that makes use of these data. If we are going to get cognitive computing in the future then analysts need access to these data. Telling people that this will mean data breaches, insurance being refused, could dissuade people from giving their consent.

    IDC claim they undertake research to aid decision making - how have they researched the future and come up with this rather jaded view? They seem to have completely ignored what we would need to realise the potentials of research using health data.

  10. If you have nothing wrong with you... by Voxol · · Score: 3, Informative

    If you have nothing wrong with you...

        you have nothing to hide!

  11. Re:Why should I care? by ShanghaiBill · · Score: 2

    And prospective employers might decide you're too sick to invest in. Or people might find out you have an STD

    I am not sick, and I have never had an STD. I am actually very healthy. So if unhealthy people are harmed by disclosure, then logically, I should benefit if mine are disclosed. I should get better job offers, and women will want to date me. So how do I ensure that my medical records are among the 1/3 that are compromised?

  12. 10% reduction in costs... by Anonymous Coward · · Score: 1

    to *provide* the care... but a 200% increase to *receive it*... why not. most people have insurance now.. so jack the rates up.. let the insurance companies deal with the blowback from increased premiums instead.

    must have single payer system with uniform set rates for services... based on the scope of the facility and region its located in (e.g. a top tier hospital in nyc should get a few more bucks for services than a community hospital in bismark nd).

    1. Re:10% reduction in costs... by hesiod · · Score: 2

      a top tier hospital in nyc should get a few more bucks for services than a community hospital in bismark nd

      Why? The Top-tier hospital has higher volumes and can afford better equipment, not to mention larger donation possibilities. Because of patient volume, they can purchase supplies in larger volumes, leading to cost savings and can deliver the same tests far cheaper than the smaller hospital in Bismark, or even more importantly, rural/critical access hospitals that can't afford the equipment for the high-value or elective procedures.

      You have it backward: the smaller independent locations should be getting higher reimbursement rates than the huge metropolitan health systems.

    2. Re:10% reduction in costs... by jedidiah · · Score: 1

      The top-tier locations are contributing to the state of the art and able to provide better outcomes. They are BETTER. Just like you would pay for the better car or better PC, it makes sense to pay more for the better doctor.

      Even at the lower end, some facilities are clearly doing better and more deserving of anyone's money.

      Also, the top facilities aren't always in glamour cities.

      If the hospital in Bismark doesn't have it's own lab then you are in a world of hurt if you end up there.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    3. Re:10% reduction in costs... by weszz · · Score: 1

      This is also leading to the healthcare consolidation that is going on. Larger providers are buying up smaller ones like crazy to improve the economics.

      It's happening across the country and was predicted due to the reimbursement changes and everything else going on.

  13. Re:Why should I care? by Mike+Frett · · Score: 1

    Because almost ALL Doctors and Hospitals use some form of Windows to keep track of everything. The worst part is no one is managing these Computers, that means no updates or anything. Nine times out of Ten they are even using a version of Windows no longer supported.

    I'm an advocate for switching these people over to custom versions of Linux or similar. Windows shouldn't be used for critical tasks, heck even Microsoft admits that. What's worse is that these systems usually rely on WiFi that is NOT encrypted. I'm not making this stuff up, I've been in enough Doctors offices and Hospitals to know this, look next time you go.

  14. Re:Convenience or profits. Pick one. by drinkypoo · · Score: 1

    So, the doctors office that requires an initial visit, a follow-up visit, a follow-up to the follow-up visit, and every report and test result also requiring a visit, care to tell me how you're suddenly going to convince a corrupt system hell-bent on extracting a co-pay each and every time they do work for you with a forced visitation policy to step away from that easy revenue stream?

    Where did you get the idea that they're not going to charge just as much for a video consultation?

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  15. Re:Why should I care? by sumdumass · · Score: 4, Insightful

    I just ensured that your medical records have been compromised. Btw, as of now, you have been pregnant twice ending with abortions, have had the clap and are still being treated for syphilis. Looks like you tested positive for cocaine and heroin recently too but have yet to receive any treatment.

    Oh, and yes, i understand how being pregnant could present something of a mystery so it is clear that you are a male "now". Nothing for you to worry about though. I bet you could create a fabulous backstory that all your friends would love but unfortunately prospective job opportunities would never hear because they would either care or not care long before giving you a chance to explain it away.

  16. Re:Convenience or profits. Pick one. by geekmux · · Score: 1

    So, the doctors office that requires an initial visit, a follow-up visit, a follow-up to the follow-up visit, and every report and test result also requiring a visit, care to tell me how you're suddenly going to convince a corrupt system hell-bent on extracting a co-pay each and every time they do work for you with a forced visitation policy to step away from that easy revenue stream?

    Where did you get the idea that they're not going to charge just as much for a video consultation?

    I don't doubt they will, but that will be rather limited. I doubt that medical diagnosis or other critical analysis will go on over phone or video chat without a misdiagnosis happening at some point causing a death and blaming the lack of physical presence for the oversight, establishing the precedent that you must go see your doctor in person to avoid that liability, which brings us right back to square one.

    And in today's litigious society, that scenario isn't far-fetched at all.

  17. Re:Why should I care? by StatureOfLiberty · · Score: 1

    I am actually very healthy. So if unhealthy people are harmed by disclosure, then logically, I should benefit if mine are disclosed. I should get better job offers, and women will want to date me. So how do I ensure that my medical records are among the 1/3 that are compromised?

    People's heath situation does change.

    From further above:

    And prospective employers might decide you're too sick to invest in

    This is what I fear. One of the more important factors in hiring will be impact on the company's health insurance plan. The organization I work for is self insured. I know that they know who in the organization is significantly impacting health care costs (maybe not specific individuals, but in general certainly). Wouldn't it be great to keep the high risks out? You might be perfectly healthy. You would never know that you were not hired because your family had a history of cancer.

  18. Re:Why should I care? by clovis · · Score: 1

    Since health insurance can no longer be denied based on pre-existing conditions, why should I care if my health records are compromised? What do I have to lose?

    It does not matter of you care because it was never about you, nor about me.

    The whole patient privacy thing grew out of what happened in some political campaigns back in the 1970's, perhaps even before.
    It seemed like the medical history of numerous candidates was being revealed during the election, so you learned the congressman Bob took Valium a few years ago. Do you want to vote for the mentally unstable Bob?
    And senator Joe was in the hospital for a treadmill test. How can the country depend upon Joe in these dangerous times when he's obviously going to drop dead of a heart attack when a crisis hits?
    So, the powers that be instantly discovered the need for "patient privacy" and wrote laws to fix that problem.

    Nobody that matters ever gave a hoot about my medical record, nor yours.

  19. Re:Thanks Obama by Anonymous Coward · · Score: 1

    You'll notice that HIPAA contains numerous exceptions that allow government entities to collect heathcare data, including those records that are personally identifiable. The move towards EMRs in the ACA was never about helping treat individual patients, but about facilitating this data collection.

  20. If you like your records you can keep your records by RogueWarrior65 · · Score: 1

    Ya know, I liked my insurance...back when it was one quarter of what it is now. Rat bastards.

  21. Re: Why should I care? by ranton · · Score: 2

    even thou medicare pays more then private insurance.

    I have never heard anyone say medicare pays more than private insurance, not even proponents of medicare. They may claim Medicare is more efficient, but from everything I have read or heard what you said above is simply false. Medicare seems to pay about 80% of what private insurance pays.

    --
    -- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
  22. Re: Why should I care? by jedidiah · · Score: 1

    80%? It's probably more like 20%. Even private insurance reimbursement rates tend to vary by quite a lot.

    Anyone that thinks that Medicare pays more is on crack.

    --
    A Pirate and a Puritan look the same on a balance sheet.
  23. Re:Identity Fraud by jedidiah · · Score: 1

    People already make mad money sending out bogus bills. They don't need anything more than address for that. They can thrive now because they are a minor nuissance. If they get much beyond that, law enforcement might start to actually care.

    The same goes for legit providers that merely engage in abusive billing. HELL, those jack*sses will send you straight to collections without a late notice. Again, it doesn't rise to a level of serious fraud so they get away with it.

    I would settle for competent modern IT practices first. Once medical providers have gotten out of the stone age, then you can get hysterical about data security.

    I'm waiting for it to get portable enough for ME first.

    --
    A Pirate and a Puritan look the same on a balance sheet.
  24. Re: Why should I care? by demonlapin · · Score: 1

    Medicaid is an awful payer, but Medicare isn't that bad.

  25. Re: Why should I care? by weszz · · Score: 1

    This is from a Catholic healthcare company in Wisconsin, Illinois and Iowa

    http://www.wfhealthcare.org/wf... [wfhealthcare.org]

    Unreimbursed Cost of Government-Sponsored Programs $115,878,726
    Shortfall experienced when payments received are below the cost of treating public beneficiaries through Medicaid and Medicaid HMO.

    Charity Care $34,472,456
    Free or discounted health services provided to those who cannot afford to pay and who meet all criteria for financial assistance. Charity care is based on actual costs, not charges, and does not include bad debt.

    Subsidized Health Services $10,016,482
    The negative margin for clinical services that are provided despite a financial loss because of an identified community need that would need to be met by the government or another not-for-profit if it was not offered. The financial losses are so significant that negative margins remain after removing the effects of charity care, bad debt, and Medicaid shortfalls.

  26. and soon Windows Phone will dominate the market by sribe · · Score: 1

    This is IDC we're talking about...

  27. Re: Why should I care? by weszz · · Score: 1

    There is a negotiation that happens with private insurance, how about we pay this for this? no? how about this?

    with medicare - We will pay this for this. don't like it? okay you get nothing.

  28. Just got my first Phishing attempt using this toda by Jonah+Hex · · Score: 1
    Odd coincidence, I got two emails today from https://web.healthdataexchange... that both passed GMail's filters and ended up in my inbox but look like classic phishing attempts. The site itself doesn't inspire confidence despite coming up "clean" when looking for info on it on the web. Links removed from examples Attempt One:

    Statement View your messages and documents: Click Here Sent 12/9/2015 11:04 PM

    Attempt Two:

    Thanks for signing up for the Secure Patient Portal! With this tool, you will be able to view messages from your doctor or clinic regarding your health information. To set up your account, please click on the link below to verify your information. P.S. To ensure you receive updates, please white list the From Address of this email. Also, keep your account login info handy; you will need it to view messages in the future. Confidentiality Notice: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain privileged and confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender and destroy all copies of the original message. Verify Your New Account: Click Here Sent 12/9/2015 11:04 PM

  29. Re: Why should I care? by david_thornley · · Score: 1

    I have a doctor friend who was complaining about Medicare. She said that it didn't cover her costs not counting any money she'd get. She still treated the recipients, but even if she decided she was just donating her time and expertise she was losing money on Medicare recipients.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  30. Re:Thanks Obama by LessThanObvious · · Score: 1

    There of course is no opt-out for having EMR even though it's perfectly reasonable to believe that the medical and insurance industries are completely unprepared to secure patient records from theft. Someone can break into my doctor's office and steal paper records, but they can't steal 5 million at once, they sure can't do it from the other side of the planet and corporate and government Big Data information leaches can't analyze what is not online. I know statistically EMRs will save lives, but the consumer should have a choice. As it stands I avoid the doctors, I avoid medication that could hurt my reputation and I have no faith in pharmacies not to share data about patients.

  31. Re: Why should I care? by demonlapin · · Score: 1

    And that's when doctors stop taking new Medicare patients.