Slashdot Mirror
Ask Slashdot: Should You Store Medical Details In The Cloud? (caremonkey.com)
"Paper forms are a security risk", warns the web site for CareMonkey, which maintains digital and up-to-date medical information in the cloud "for any organization with a duty of care". This is raising concerns for long-time Slashdot reader rolandw, who says he's being asked by his daughter's school to approve using the site to store "her full medical details".
CareMonkey say that this data is stored on AWS and their security page says that it is secured by every protocol ever claimed by AWS (apparently). As a sysadmin and developer who has used AWS extensively for non-secure information my alarm bells are sounding.
Should he ignore those alarm bells and approve the storage of his daughter's medical history in the cloud? And if not, what specific reason would you give for refusing?
Should he ignore those alarm bells and approve the storage of his daughter's medical history in the cloud? And if not, what specific reason would you give for refusing?
Q: Should you store anything in the cloud?
A: Only if you don't care if everyone in the world sees it and tries to use it against you.
Cloud storage can certainly be done secure. Consider tarsnap for a service doing exactly that. It also shows the central issue that must be addressed: full client side encryption. The cloud provider should have no access to identifying information and no access to the keying material itself. As long as that is ensured, cloud storage can be secure.
No.
The fact that "everybody is doing it" does not imply it is in any way or form a good idea.
What HIPAA guarantees does CareMonkey make?
Read the fine print carefully, I'm sure there are loop holes the size of Montana.
What HIPAA guarantees does CareMonkey make?
Who's going to be viewing your daughters medical records - Do you trust everyone in CareMonkey, everyone in AWS?
Read the fine print I'm sure there are loopholes the size of Montana.
Why is he required to give a specific reason ? Either give your authorization a withhold it, and do not volunteer a specific reason for or against the use. I personally don't see a reason why not IF the storage vendor can qualify as HIPAA complaint it seems like a decent idea, but I can see where the possibility of leaked data can have a negative impact on continued health care coverage as well as the impact on future coverage in both healthcare and life insurance, not to mention employment issues.
errr....umm...*whooosh* *whoosh* Is this thing on ?
No.
There is already something called MedicAlert, run by the MedicAlert foundation. It's those little bracelets that have a number on the back and EMTs and other emergency professionals seeing these are trained to do a lookup.
It's a system that works that doesn't need "the cloud." You don't even need a computer or smartphone to access the system. Just a phone. Which means it will work where there is no cell service and can work where there isn't even phone lines - radio operators can do a phone patch.
It's /better/ than "cloud based systems" that needs fancy hardware to access which we have seen to be poorly run and insecure.
--
BMO
We can all stop pretending we have any privacy. I like the idea of a doctor having access no matter where I am.
“He’s not deformed, he’s just drunk!”
Replace "the cloud" in everything written with "some virtual machine(s) somewhere within an amazon data centre in a specified location", otherwise known as, a virtual private server.
The cloud is a fancy sales word for a set of scripts that a VPS provider uses to make it easier to deploy to and manage their VPS system. Nothing more, there is no more risk in putting medical info on a "cloud" server than there is on any other internet facing server, not that all cloud servers are cloud facing.
For example, i have several azure mssql cloud instances, none are internet facing, but still afford the scaling that "cloud" services give.
portfolio
And the reason I'd give is 'I don't think I can trust you'. Because that's what this comes down to - you have NO idea who these people are, really, and from what I've seen of school related software (I've got two kids in one district, and my wife teaches in another), most places selling to schools hire the people who underbid the lowest bidder.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
.
A treasure trove of medical information "in the cloud" is lusted after by too many corporate entities who have little or no regard for privacy, they just want access to more data.
What business arrangements are being made with the school by CareMoney? What data, besides medical information, is the school sharing with CareMonkey?
If it were my children, I'd run fast and far from this data harvesting Trojan horse.
Unless your daughter has a condition that requires very specific knowledge
Then it would be even worse to risk having one's health data stolen. Imagine when she's grown up and is surruptitiously denied employment over it.
Paper forms are 1000x more secure than electronic records. Put them in a locked filing cabinet and all you have to worry about is someone in your office getting the key. Put them on a networked computer and now you have to worry about EVERY hacker on the entire fucking internet.
We need to go back to using paper. 99% of the data on medical forms is write-once read-never. File that shit under lock and key and just keep the bare minimum online for regular access.
Say they can store it if they sign a legal document that will make them 100% liable for unlimited damages if *any* of the data is ever hacked or otherwise made available to unauthorised parties.
Then watch them run.
Hell no. I wouldn't even store a backup of my funny cat pictures in "the cloud".
Sure, with a company name like that, they just reek of credibility.
as CEO of Quacks R US medical group, caremonkey sounds like an excellent partnership for our distinguished Quackers.
We partner with the best technology and services companies, just look at all the fellow Quacks we do business with:
Dewie,Cheethem and Howe Law Partners
CareMonkey
CrazyClown Airlines
Dr. Seymore Butts Protology
Crazy Joe's Clown College and Medical School
Cray Z Persons psychiatry group
Drugs R Us pharmacists
Loan Sharks R Us financial services
... to advertisers and whoever else is willing to pay. Storing your data on Amazon premises is like tasking a fence to store your valuables.
Why does the school have her medical data? They should have only the bare minimum absolutely necessary. The rest of it is none of their business.
How about a moderation of -1 pedantic.
The Safe Network project is reaching its first alpha version, but it is the culmination of 10 years of research and planning.
Skeptical? It is healthy to have some skepticism, more info here:
Youtube: https://www.youtube.com/watch?...
Article at Techcrunch: https://techcrunch.com/2014/07...
Maidsafe explained for bitcoin lovers: https://safe-network-explained...
Maidsafe presentation on Google Techtalks (June 2008): https://www.youtube.com/watch?...
Maidsafe forums: https://forum.safenetwork.io/
Would you store your naked pictures in the cloud? Probably no.
The same way, probably, men and women would not like to store certain type of information:
- Abortion,
- STD testing
- Sterilization
- STD's
- Genetic Abnormalities
- Addiction
- Health Risk Assessment
Every one of these items, if leaked, have serious ramifications to personal and professional life.
The answer is No.
AWS signs HIPAA Business Associate Agreements with covered entities every day. There is a subset of services (EC2, S3, EBS, etc.) that meet HIPAA requirements and I know for fact that CMS approves of such systems. So, whatever your notion of "HIPA" (sic) compliance is, there is plenty of HIPAA covered PHI on at least one major cloud provider.
Maw! Fire up the karma burner!
AWS is HIPPA-compliant, which is why the company in TFA is able to use them at all.
Your data is no less secure at AWS, than in any Internet-connected hospital — though that in itself is not saying much.
If you can not store it yourself, trusting a company like CareMonkey, whose entire business model is predicated on the security of customers' data, probably, makes more sense, than trusting someone, for whom it is but a side-show. Such companies may still experience a problem — nothing is safe — but they are less likely to.
And if you worry about government, well, to the delight of Statists, our "democratically controlled" "strong government" already has access to your medical history. And will get more, when the "single-payer" system, so beloved by those same Statists, replaces the designed to fail — and failing — Obamacare.
In Soviet Washington the swamp drains you.
caremonkey seems to be a start up. look at medicalert. I think I'd trust them more
Ask Slashdot: Should You Store Medical Details In The Cloud?
Me? Definitely not. I have no idea what I'm doing, so why would anyone give me their medical details? Crazy.
systemd is Roko's Basilisk.
2. If in doubt see rule 1
It is happening http://www.hrsa.gov/healthit/t...
No.
This is entirely obvious to anyone not trying to sell "cloud services."
The majority of controls they note on their website [https://www.caremonkey.com/security-2/] are standard AWS controls that anyone with an EC2 instance can claim for themselves. Likewise their 3PAO attestations all appear to have been inherited from AWS. Perhaps they did their own PCI compliance audit but I doubt it based on the write-up presented.
I also find the lack of details on their application security practices a bit disconcerting. Why do they specifically call out encrypting password data but say nothing of encrypting user content. They even note that they encrypt the data on the mobile app but are interestingly silent about this on their web database, why is that? Also I find it curious they don't note anything about utilizing AWS's dedicated hosts and storage options which is one of the major requirements by Amazon for meeting HIPAA compliance, I know this is one of the many rules, because we had to sign contracts for our systems agreeing to this stipulation.
Another question is, is caremonkey even legally bound by HIPAA regulations? Do they have legally binding agreements with any covered entity or hybrid entities that subject them to HIPAA regs? It is one thing to say you are HIPAA compliant but if the rules don't apply to you then that really doesn't mean much does it...
Nuclear war would really set back cable. - Ted Turner
Wherever the data is stored, in the cloud or at a terminal accessed by employees or printed on paper en route to a shredder, it's potentially exposed. The important thing is how it is stored. There should be a program to "camouflage" the data, give false positives or false negatives to everyone for everything, and create a million fake names to boot. The computer accessing could have a program filter key to remove the fake information. Maybe someone can think of something even more effective. What they should also be doing is selling fake and bad data anyplace data is being traded. Nature evolves camouflage, not invisibility, and that's probably good enough for my medical data.
Banning computing methods to hospitals just raises the cost of health care. Hospitals have already been sold a bill of goods on destruction of hard disks and paper shredding, or at least I've never seen evidence that the risk of data leakage from old hard drives and paper is anywhere close to the billions of dollars being spent on "certified" destruction. The point being, whenever there is a scintilla of a risk, there is a potential billion dollar industry to be created out of rigamarole. I'm not saying HIPPA isn't without value, but hospitals could save billions by hosing the paper records (soaking them to clunky clods) rather than shredding them, or by dropping the hard drives from 4 feet in the air. You don't have to ensure the data is safe from the Soviet spy who would access the POTUS computer, you have to ensure that the cost and time of accessing it is not economical. Thieves are rather more attuned to cost benefit than spies are, which is why spies are only after a fraction of a percentage of user data.
Gently reply
"Should You Store Medical Details In The Cloud?"
The answer is "No".
Just cruising through this digital world at 33 1/3 rpm...
Where they store the medical data is a secondary consideration.
What they are storing would be a major concern, and also for how long they are storing it.
Also, I'd want to know whether the records will be destroyed after graduation.
I assume that it's not a college or university.
I would ask why the school is storing any medical data on the student. I also assume that the child would be getting their medical care from a hospital or clinic and not the school. The school cannot be doing anything more than the most trivial medical care, so there's no need for school records of that.
I can imagine needing for some students to have some record of life-threatening allergies, vaccinations, or special needs such as diabetes.
And I'm not sure that data even needs to be in a medical record format.
Also, such data does not need to be accessed anywhere off-campus, and it has no need to exist after graduation.
For example, consider dietary restrictions. Is the school cook going to be access the student's medical records to get that information? I don't think that would be a good idea.
If you have a child with problems that the school must know about for safety reasons, then you'll want to participate in whatever program they have. It may suck, but this is a case of small danger (loss of privacy) vs large danger (loss of health/life).
But if you have a healthy kid, here is what I would worry about if they're keeping medical records on the kids. It's mental health statements.
I'd worry whether school "medical" personnel are making diagnoses of mental problems and putting in the schools medical record. For one thing, it's likely to be a poorly done diagnosis, and the other is that is something that could turn up later to haunt her if the records are later shared with some other institution.
I suspect that HR people would be more likely to overlook a missing arm before overlooking a school psychologist's suspicion of of manic-depressive behavior or schizophrenia.
Population health is the current big thing. Where you health info is being sent to many institutions and shared. Most hospitals do not have the resources for such an undertaking so they may fall to venders who may use the cloud for their services. As far as the hospital is conserved if there is a breach, the fault will go to the vender who will pay the fines.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Your doctors likely already use cloud services to store your medical data. They transmit it via the Internet to other medical providers and to insurance companies, who in turn store much of their data in the cloud.
The cloud is neither here nor there, when it comes to security. There are secure cloud providers, and insecure ones. Doctors who do not store their data in the cloud, likely store it on their own servers, which are probably much LESS secure than AWS.
You can't really win. Your data is out there, whether you like it or not. The questions you need to ask yourself are:
- How critical is security to me?
- What will really happen if someone sees this information in an unauthorized manner?
- Do I trust my providers to keep my data private?
There are no right or wrong answers, nor is there a such thing as 100% secure. If somebody REALLY wants your data, they will get it.
heck if CareMonkey had any smart chimps they would hook into the Major Providers to get hot copies of the data (after getting the perms from the guardians).
why doesn't CareMonkey do linkups with Epic here in the US??
US /.ers raise your hand if your local medical system use something called MyChart for E-Records??
... but hospitals could save billions by hosing the paper records (soaking them to clunky clods) rather than shredding them...
This idea I like! A giant kettle down in the basement, where all the old records go. simmer, press into small bricks, and let air-dry. Turn them into building materials!
on whether or not you want your daughter to be allowed to attend school. Sure it might be optional now, but once a majority of uninformed parents get on board, they'll surely make it mandatory.
Stasis is death. Embrace change.
HIPAA means nothing and does not restrict putting the data online. HIPAA doesn't even enforce or require encryption, hell, you could even put it on the linux.org FTP servers, as long as you make sure nobody downloads it, it would be fine to HIPAA.
The way your hospital(s) handle the data, as much as they are compliant with HIPAA is atrocious from a security viewpoint.
Custom electronics and digital signage for your business: www.evcircuits.com
The controlling regulatory authority for medical records in the U.S. Is HIPAA. Amazon's AWS can be made HIPAA-compliant, but only by the cloud-based medical provider, not Amazon itself. Achieving HIPAA compliance in AWS is quite complex -- and costly -- requiring a separate virtual instance for every covered entity (e.g., insurance company or medical provider) and a slew of other sophisticated security measures.
I'm a HIPAA IT security auditor, and have been amazed at how many cloud-based medical startups claim HIPAA compliance just because they use AWS. These companies are either too incompetent to understand that they have the burden for compliance, not AWS, or they are consciously lying to the public. Unfortunately, there are few enforcement mechanisms for HIPAA fraudsters because, ironically, they don't actually have a legal requirement to be compliant. That's up to the covered entity.
So ask any cloud medical provider to give you documented proof that they have actually implemented all HIPAA security measures. I ask for screen shots of the AWS provisioning pages. And don't let them claim confidentiality.
Any company which claims that a paper medical record is less secure than a medical record stored on the cloud clearly does not understand security (or is willing to lie about it) and none of their claims about keeping your information secure is to be trusted. Any method of gaining access to the contents of paper medical records other than having to go to the office where they are stored and physically handle them can be used to gain access to electronic forms of those same records (including electronic records on the cloud). In addition, there are many ways of gaining access to electronic records stored on the cloud which will not work for paper records.
The truth is that all men having power ought to be mistrusted. James Madison
Some companies use AWS in a HIPAA-compliant fashion, but many more don't. Achieving HIPAA compliance in AWS is quite complex -- and expensive -- requiring a separate virtual instance for every covered entity (e.g., insurance company or medical provider) and a slew of other sophisticated security measures. And it's not Amazon's responsibility to police companies claiming compliance. Amazon just provides APIs and services that can be built into a software company's infrastructure. But nobody is checking to make sure they do.
From the caremonkey security page:
All data in the CareMonkey mobile apps for smartphones or tablets is stored in an encrypted format using SHA3 (512bit). An essential requirement is that if a device is lost/stolen or someone gains access to the data files on the device that they are not be able to access any personal data.
SHA3 is not an encryption algorithm, it's hash function (it's right there in the name, SHA= Secure Hash Algorithm).
That is all.
Of if you need more details, no, no.. fuck no, no fucking way, NO GODDAMNIT -- NO !!!!
'The unexamined life is not worth living' - Socrates
If you leave your paper records lying around in view of your internet-connected-and-still-using-the-default-password security cameras ....
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
There is only "other peoples' servers".
This is true of both physical and virtual machines.
Chas - The one, the only.
THANK GOD!!!
To quote the Free Software Foundation Europe...
"There is no cloud...
...just other people's computers."
An effective "democracy" creates the illusion the people have a say in their government.
What HIPAA guarantees does CareMonkey make?
Would you trust any security guarantee from a company who thinks that putting documents in the cloud is less of a security risk than a paper document? These guys are clearly idiots who have no idea of the type of security problems they are going to be dealing with.
The quote "To err is human, to really screw up things you need a computer" comes to mind.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Their using something called MyVCM to "to ensure we operate a robust information security and privacy program", whatever that actually means. I found this, which at least mentions " HIPAA, NIST, FedRAMP, COBIT, COPPA, ISO/IEC, and PCI DSS". Not sure just what particular NIST their referring to, but any company that actually pays attention to the 800 series and doesn't just go by the scant HIPAA security "regulations" is at least looking in the right direction. All of this is straight off the HIPAA Security ruling. Caremonkey won some award. Their based out of Australia.
I wouldn't use them. Because CodeMonkey comes from Australia, and, as everyone knows, Australia is entirely peopled with criminals. So you can clearly not choose the cloud-based provider in front of you.
In the 1990s, there was a hydropulper (paper mill tech) in the basement of the Pentagon. Unfortunately they didn't have the rollers etc to produce recycled content paper out of it, but were halfway there.
Gently reply
What happens when the patient shows up unconscious in the emergency room?
At least not without encrypting all the data before it gets transmitted to the cloud. The cloud is unsuitable for the storage or processing of any remotely sensitive data.
Perhaps to minimize the amount of risk? If both you and your insurance company keep your medical records in the cloud, your exposure and risk has doubled.
If you have to ask, then you might want to find a new career.
Anyone knows that anything on the web is ultimately vulnerable and very likely accessed by someone unintended. Why even chance it?
On further thought, why am I even wasting time replying?! (That's rhetorical, if you haven't figured that out yet.)
Perhaps the P/C answer is: It depends on your capacity for risk of being exposed.
Self-importance and self-indulgence is the root of ALL evil.
Anybody who said that, esp. when they're offering a cloud solution, should be instantly classified in the same category as that Nigerian prince who wants to make you rich helping him.
So, provider, tell me: how much more likely is it that the paper forms or their copies could be stolen - that's how many hundreds or thousands of pounds of paper - or that somebody or some group cracks the cloud security and d/l *all* of them? 100k times more likely the latter? A million times more likely?
Bull. Nothing wrong with computerized records... and local records d/l with security from the central repository, and that should *NOT* be a cloud. And SPEND THE DAMN MONEY AND HIRE A REAL SECURITY PROFESSIONAL TO LOCK IT ALL UP.
Alternatively, how big is your budget when it gets cracked, and all the parents file a class-action lawsuit for $100M US...?
mark
Ask yourself this: When is the last time you read about identity thieves stealing PAPER records of 50,000 people?
If given the choice between my medical data being on a server in a hospital or whatever managed by a grumpy sysadmin who also needs to take care of peoples desktops or stored on a server that happens not to be in a hospital, managed by people that do only that, I'd go for the cloud hands down.
However, one should be picky about the country and jurisdiction of your cloud. I suggest not to store your medical data on a US server (or a US company server) if you're not in the US.
Fear of the cloud is a bit like fear of flying. "OMG I'M NOT IN CONTROL", totally ignoring reality.
0x or or snor perron?!