Slashdot Mirror
UK Just Banned the National Health Service From Buying Any More Fax Machines (qz.com)
The UK's NHS will be banned from buying fax machines from next month -- and has been told by the government to phase out the machines entirely by 31 March 2020. From a report: More than 9,000 fax machines are in use by the NHS, a July survey found. All will be replaced by email, according to a report from the BBC. The shift, ordered by UK health secretary Matt Hancock, is intended to improve patient safety and make communications more secure. Rebecca McIntyre, a cognitive behavioral therapist, told the BBC that using fax machines made it difficult to ensure patient's information was actually sent to the right place, and that it wasn't being seen by non-authorized people. "You would not believe the palaver we have in the work place trying to communicate important documents to services (referrals etc)," she said. "We constantly receive faxes meant for other places in error but this is never reported." Further reading: The Fax is Not Yet Obsolete.
The fascinating part is that, at least in the health care facilities with which I am familiar, the explanation given for not using fax machines in the UK is the same reason for not using email in the US: Just change "using fax machines made it difficult to ensure patient's information was actually sent to the right place, and that it wasn't being seen by non-authorized people" to "using email made it difficult to ensure patient's information was actually sent to the right place, and that it wasn't being seen by non-authorized people."
The privacy of a phone call used for a fax is seen by these institutions as greater than the multi-hop routing of Internet email. (It used to be true that one knew (or could find out) a defined physical location for the ends of a phone call, but that, of course, is no longer true.)
But email is not secure.
My wife works at a hospital in the US, where the hospital still uses paper charts, and sends faxes *internally* to different departments.
The problem has never been technical. Email + Smart Card + Encryption is simple to set up, and baseline simple to use. The resistance is administration, staff, doctors, coworkers, etc. You've got to remember, that medical people are generally smart and capable, but figuratively suck-ass-at tech. I'm talking rebooting-a-computer-is-hard suck-at-tech. Think about training your grandma to use an iphone suck-at-tech. Another problem is replacing a system that works.
You've pretty much got to replace every component wholesale in one attempt. There is no piecemeal replacement these type of systems. It has to go live, it has to work, and it has to be easy, and it has to be cheap, and people have to want it, and people have to want to use it, and probably 100 other conditionals that must be TRUE for everything to work. It's a hard problem, it never works well in less than a year.
Med people will retire in the face of learning something new. I've seen it first hand now, IRL. Introduce a new system and that doc who's 65 and working because 'why not' will just decide to retire. Now there's a shortage, now we went from understaffed to 'oh shit, y'all don't mind working *more* weekends until we *never* hire anyone back, right?'
There are ripples to this type of thing, not a easy problem to solve.
Maybe someone will revive Google Health?
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
I do not disagree. But practically speaking this seems like an impossible goal.
Given the fractured nature of healthcare in the U.S., getting everyone on the same page regarding encryption and certificates is more or less impossible. And as soon as one medical provider faces the least bit of inconvenience in getting information through encrypted channels, they will immediately (and probably forevermore) fall back on unencrypted channels. Stupid human nature.
The only saving grace is that, if such encrypted procedures are mandated in most places most of the time, the attack surface is dramatically reduced compared to the present time.
At least in the UK's NHS they have a bit more control over the infrastructure and procedures - both in specifying them and in ensuring uniformity. I'm not saying that it is then easy or guaranteed to work, but it is at least in the realm of practical feasibility.
As someone who now works in health care (not the UK), I can say that this is dumb. Fax machines are actually very convenient since most documents are still filled at least partially by hand. In order to email, I would have to log onto a computer, wait for it to secure-boot then scan the doc in then open email, attach and send. For privacy reasons every time I walk away from a computer, it must be logged off. The other issue with sites that use email is that any documents with personal information (that would be all of them) must be encrypted using a unique password that must be pre-arranged with the recipient. Therefore, before I can email someone their document, I must call them and work out a password with them This would not be any great burden if it was only once a day but with the amount of documents flying around, the simplicity of dropping a document in the feeder and pushing a single button is invaluable.
The other reason that email is frowned upon in the healthcare industry is that it's far too easy to print multiple identical copies of documents. Patients more and more often want their prescriptions emailed to them and I have to tell them no. How great would it be to get a prescription for Oxy over email and then print a hundred copies, one for each pharmacy in the city?
eFax would make their heads explode.
The UK civil servantry has no trouble sending sensitive data every which wrong way, regardless of medium.
Fax sent wrong, email accidentally the whole contact list, dvds lost in the mail, usb left on the bus, papers left in taxis, laptops stolen from cars, briefcases left on trains, it's all been sent wrong, left behind, lost, stolen, or whatever else, at one time or another. Usually unencrypted, of course.
So this is just a big fat gesture in lieu of doing something useful. Like "banning all diesels", "banning all faxes" is going to cost a lot and do very little. As is usual when you let idiots run the show -- whether political idiots hungry for being seen to be doing *something*, or neophile idiots chasing the latest appses for grateness. The kind of idiot changes, the constant presence of idiocy does not.
Good thing the UK is an EU member state...
It amazes me that there is even any need to fax patient information at all in the UK. They have had centrally run and managed and funded healthcare since the end of WWII ! I would have thought they would have some terminal text-based records system from the 1980's that was universally deployed. I mean the closest thing I have experienced to the UK system is the US military's system, which has been computerized with centralized records since I was a baby in the 80's (parents were in air force). Sure, there used to be physical records as well, but I remember them being things like x-rays and notes about x-rays, things that you couldn't really digitize at that time. I really doubt they are faxing x-rays, so the UK situation is extremely confusing. WTF is going on there?
Both methods of Faxing and Emails are bad options for sharing Medical Data.
The better method which would actually require strong IT in healthcare would be appropriate HL7 communications either via Clearing House or direct VPN connection between systems.
This technology isn't new, but it better for sending healthcare info, as the data can be parsed and categories more easily into the EHR and EDM systems.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The Stock Market only turned downward when it became obvious that the Dems would take the House. It's been positive for two years, and suddenly it starts tanking, mostly after the midterms handed the purse to the dems.
Wrong. Try again.
Stock markets hate uncertainty. There's loads of uncertainty right now coming from Trump's trade wars and a teetering Brexit. There is no uncertainty regarding who has the House. In fact, the market has expected it for months, and whatever effect it was going to have happened months ago.
If it weren't for deadlines, nothing would be late.
Given the fractured nature of healthcare in the U.S., getting everyone on the same page regarding encryption and certificates is more or less impossible.
It's only impossible in the sense that it would require an act of our currently dysfunctional congress. Congress could make a standard required with the stroke of a pen and everyone would have to get on board. It really wouldn't be all that hard. But of course we have elected a quorum of of asshats who think that somehow this would be a bad thing.
Only a fax provides positive confirmation that a message was received in good order.
No it does not. It provides confirmation that the message was delivered to a particular fax machine but provides no information beyond that, including whether or not it printed legibly on the other end.
When a person is making a six figure investment both sides need to have the confidence that information was sent AND received as intended.
If that's the goal a fax is definitely not the technology you want. You have absolutely no idea who picked up that piece of paper on the other end and what they did with it. Might have gone straight to the trash for all you know. Pretending that a fax is some sort of reliable means of logging communications is absurd.
"They don't really need to stop this, as all modern, 2018 medical facilities are happy with fax machines," said a representative for the firm contracted to supply fax machines, The McFly Corporation.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Industries that still rely on fax machines usually have little incentive to improve productivity, especially if the status quo can be deemed good enough. This is particularly true for government agencies. When politicians attempt to foist productivity improvements on the bureaucrats the outcome often doesn't bode well. It typically takes some kind of crisis for such improvements to be implemented.
Yes! They should upgrade to Vista!
They can be secured and their firmware can be conscientiously updated whenever a CVE comes out, but don't count on it.
But, it's not "on a computer", so it's safe.
I see it as an essential abject failure of the tech industry that most people have no way to securely send a simple document to someone else they know or have a real-world relationship with (doctor/patient, vendor/customer, service/client). Thinking about it, the closest I can come to a genuinely accessible solution is Signal. What's even more sad is that the reason that this problem is unsolved is that the major tech players are so addicted to spying on their customers that they can't bring themselves to actually provide a secure communication solution.
PGP can handle multiple recipients
Most healthcare providers around here already have electronic records (EPIC being dominant platform). Why not some open, standardized protocol for exchanging health data between systems? Records could be shared just like sharing a file in Owncloud/Gdrive/Dropbox....It would provide an audit log of every access and could be simpler than faxing