Forgot your password?
typodupeerror
Privacy Medicine Security IT Your Rights Online

Americans Trust Docs, But Not Computerized Records 162

Posted by timothy
from the and-scarcely-themselves dept.
Lucas123 writes "A soon-to-be-released survey from CDW shows that Americans trust their physicians to use their health information responsibly, but they're very concerned that once in electronic format, their personal health information may suddenly show up on the Internet. Their fears may not be unfounded. CDW said that survey data showed 30% and 34% of doctors lack basic anti-virus software and network firewalls, respectively. Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records."
This discussion has been archived. No new comments can be posted.

Americans Trust Docs, But Not Computerized Records

Comments Filter:
  • by Kenja (541830) on Thursday February 17, 2011 @06:34PM (#35238130)
    People notice when their filing cabinet goes missing, they are less likly to notice the theft of digital records. This does make it more likely that employees etc will abscond with the data.
    • Couldn't you find ways around the problems? Encrypt the data and store it to a central DB, only the patient keeps a record of his encryption key and allow him to request a new key at any time. Maybe set it up with expiring keys to allow a doctor access for a limited period of time after he sees the patient. Obviously this kind of scheme would restrict access but it would also make bulk exportation of the raw data difficult or impossible.

      Of course, there will always be holes in such a set up, but the same

      • by Korin43 (881732)

        But that would be hard.

      • by 0123456 (636235)

        Couldn't you find ways around the problems? Encrypt the data and store it to a central DB

        Why would you put it in a central database when you could just carry it around with you (and back up as required to wherever you chose)?

        • Why would you put it in a central database when you could just carry it around with you (and back up as required to wherever you chose)?

          Sure, fine, whatever. My point was that while the security and privacy concerns are certainly warranted, they can relatively easily be gaurded against using standard, commodity software and hardware solutions. It isn't as though keeping information from falling into unauthorized people's hands is a problem that has never been encountered before in computer science.

          And to more directly answer your question, you might want it in a central DB so that if you're on vacation and end up in the hospital the doct

          • by Ltap (1572175)
            This is a beautiful, simple solution. It's a pity it'll never be properly implemented.

            Most people are just too stupid to figure out how encryption works or to try to understand why they need it. Even if they use it daily (say, as a part of their job) they will likely neglect it, passing off encryption keys to anyone and everyone. Furthermore, due to the fact that insurance companies and employers love to spy on people's medical records, they would almost certainly be given access in some way, allowing th
            • by cayenne8 (626475)
              I'm currently trying to help a Dr. with some of this and HIPPA needs. The problem I'm trying to solve is...he is a radiologist...and needs to send securely...reports on patients AND images. I'd looked at a service like ZSentry for easy encrypted email...on both ends.but the service doesn't allow files as big as needs to be sent.

              I'd looked into maybe setting up some kind of PGP set up for him...but would be tough to get every dr he might do business with....to get them to set up PGP, generate keys...and set

              • by Z34107 (925136)

                What you want is a PACS [wikipedia.org]. These are generally expensive. I can't recommend any specific vendors, but you want to be very careful with HIPAA. They're also FDA regulated, so you also want to be careful about hacking anything together that could be functionally confused with a PACS.

                That said, I'd be really surprised if a radiology clinic didn't already have one (that "telerad" you alluded to?). I'd call up the vendor and ask what they can do; any modern system will speak DICOM [wikipedia.org], and a lot (if not most) of th

                • What you want is a PACS [wikipedia.org]. These are generally expensive. I can't recommend any specific vendors, but you want to be very careful with HIPAA. They're also FDA regulated, so you also want to be careful about hacking anything together that could be functionally confused with a PACS.

                  That said, I'd be really surprised if a radiology clinic didn't already have one (that "telerad" you alluded to?). I'd call up the vendor and ask what they can do; any modern system will speak DICOM [wikipedia.org], and a lot (if not most) of them can grab images from outside the facility.

                  I have heard good things about K-Pacs, which is free. It also has utilities to receive HL7 with worklists and uses DICOM to comunicate with modalities (the x-ray machines). DISCLAIMER: I have just used it for a couple of personal trials, as I work in a public health administration and they are opposed to add systems for which they don't have support. But for your single organization, it might be a valid tool.

                • by cayenne8 (626475)
                  Thank you for the replies.

                  They do have the imaging system set up to transmit images between his office and his clinics.

                  However, he's generating reports for the study ordering physicians..and cutting and pasting some of the images to put in the reports to the doctors..and wanting to send THAT...not the full image study.

                  They had been sending stuff in clear text emails with attachments and I told them that was not a good idea..so looking for a way to send this securely...and also not have to have each reci

                  • by hesiod (111176)

                    Some PACS client software can burn a study to a CD, which is the way we deal with sending images to doctors offices (I work IT in a hospital). These CDs will have self-contained viewing software on them to see the images, and sometimes you can include reports with them. But that's only with the right PACS software... Trying to cut and paste DICOM images into Word sounds like a terrible idea -- not to mention tedious.

                    However, I know how stubborn doctors can be, and radiologists are often the worst of them

              • It's not cheap, but using some Citrix product as your Web interface to any decent PACS system should provide a secure interaction. My hospital uses Citrix clients as the primary means of offsite access. If you want the remote site to be able to download, you'll probably need a VPN, as well as a better (and more expensive) PACS system. I'm not a radiologist, but Philips' iSite is the easiest one I've ever used. And it easily exports to DICOM.
            • by jimicus (737525)

              Millions of people manage to use encrypted systems every day for Internet banking or shopping. Encryption does not have to be hard.

              What is hard is providing a user interface to a means of encryption so that the complications are reduced or eliminated while still maintaining some semblance of security. AFAICT, nobody's managed to do that in a fashion suitable for anyone to use on arbitrary streams of data that need to be encrypted and passed around as part of a batch process.

      • by khallow (566160)

        only the patient keeps a record of his encryption key and allow him to request a new key at any time

        And what happens if the patient can't provide the key, say because they are unconscious and dying? At the least, there would have to be a somewhat centralized authority (that is, someone who is guaranteed to be there, not just a next of kin) with the power to provide a suitable key.

        • by iluvcapra (782887)

          It doesn't have to be centralized authority, in this case the patient's general practitioner would hold a copy of the key and release it in such a circumstance according to the terms of a legal advance directive, like a limited power of attorney or living will. You just need a central repository of the encrypted data, and a directory service to help an ER find the patient's GP or kin, allow the keyholder to validate the patient's unconscious condition, or that their condition meets the terms of the directi

          • by khallow (566160)

            It doesn't have to be centralized authority, in this case the patient's general practitioner would hold a copy of the key

            Who actually holds the key? The general practitioner can have an accident or medical emergency of their own. The key has to be reliably obtainable.

            The scheme is workable, I think, but I think it's worth noting that no matter how it's implemented, there will be a number of people with access to that key ("access" not being the same thing as copying a zillion records for fun and profit). Because otherwise, the doctors treating a patient might not have access to the key.

            • The scheme is workable, I think, but I think it's worth noting that no matter how it's implemented, there will be a number of people with access to that key ("access" not being the same thing as copying a zillion records for fun and profit). Because otherwise, the doctors treating a patient might not have access to the key.

              Just be like many other databases in the US and use their Social Security number :-)

      • Re:Not unfounded. (Score:4, Informative)

        by kullnd (760403) on Thursday February 17, 2011 @07:54PM (#35239102)
        It would not be possible to do this... A healthcare org has to refer to the patient records long after your visit is over. In a hospital, there is generally reporting that takes place which requires extensive reviews and audits of the care given, and alot of these audits can take place nearly half a year after you were seen. There is also the fact that after your visit, the record will be reviewed for medical coding, which is how you, your insurance, and or the gov't are billed for the care that you were given. The idea that when you leave, your record is locked, is just not realisitic. I can also say that the latest push by the federal government, with these EHR incentives, is pretty much going to do the opposite of what you are asking for.

        I have seen medical practices on both ends of the security fence, and it is sad... I've been in practices that I would never, ever, visit as a patient because I have no faith in how things are run there from an IT security view point... At the same time, I have worked with other orginazations that do take security very seriously, and do everything possible to ensure that all data is kept private... The thing that really sucks is that you really have no way of knowing what type of office you are visiting until you see the report that your record has been leaked.

        Someone else posted in here that most practices are afraid of HIPAA and will do anything to keep things safe... Unfortionately I have seen alot of practices that couldnt give a crap about HIPAA and won't listen to any reasons as to why they should not run bittorrent on their office computer. The bottom line is that until HIPAA and HITECH start producing more results, busting more practices, and making everyone aware that they do have teeth this is going to continue to be a problem. HIPAA has been around for a long time, but until HITECH came around it has been a joke, and only enforced in the worst of senarios. I still think that both of the policies are too loose, and enforcement on those policies today is still largely reactive, when it's too late.
        • There may be weird cases where you evaluate the only 4 network providers within 40 miles of you, and 3 have good IT and sloppy care, and the last one has good care and sloppy IT. Med is a weird profession, I'd grudgingly take the good care with bad IT in a pinch.

    • Re:Not unfounded. (Score:4, Insightful)

      by Stregano (1285764) on Thursday February 17, 2011 @08:48PM (#35239518)
      It depends on what you are diagnosed with or what doctor you go to. If you have a medical marijuana card, you do not want hard copies. Many dispensaries get raided, and then the feds have your information and you get marked as a pothead. If they are digital, if there is a raid, most professional places have ways of handling digital documents properly. Something like that would be an instance where I don't want teh feds to have my records. And shut your lips, I have a condition I am getting treated for and need a way to get rid of the pain. You are not my doctor Mr. Judgy McJudgy Pants
    • by hitmark (640295)

      Dumpster diving however...

  • Not Too Surprising (Score:3, Insightful)

    by BJ_Covert_Action (1499847) on Thursday February 17, 2011 @06:36PM (#35238144) Homepage Journal
    It seems like most of us Americans are also content to trust our eternal souls and moral decisions to an imaginary sky fairy with an epic beard.

    But on a more serious, and less inflammatory note, this probably has to do with the very high incidence rate of folks in the U.S. getting their financial accounts cracked. Anyone who has had to frack about with their bank or credit agency regarding X many thousands of dollars being debited from their account due to some mysterious "hacker" that stole their identity is probably pretty suspicious of putting any important personal data on the internet period.
    • by |TheMAN (100428)

      Considering how EHRs are going to be required in the near future, I'm not surprised that hospitals/doctors are still getting dragged kicking and screaming into the 21st century.

      HL7 was created in 1988, and over 20 years later, it still has very little penetration in the US. I had friends ask their acquaintances working at hospital IT departments, and many don't even know what HL7 is! Part of this is the government's fault (lack of incentives unlike European countries), but most of this is due to the lack of

      • lack of understanding and technophobia

        No, it's not technophobia. I'm a technophilic physician, and I know a lot of technophilic physicians, so I may be able to help you understand.

        EHRs really cover several different areas. Some areas clearly benefit from computerization; lab reporting is so clearly better done via computer than phone that it makes no sense not to. Having radiology studies available for review outside the radiology department is of significant benefit. Having transcriptions of dictated reports available is tremendously useful

        • by Z34107 (925136)

          Vitals can be substantially easier with an EMR since the computers can talk directly to the monitoring equipment - you click a button, and you're done. I've seen nurses break down in tears when this wasn't working; taking vitals three minutes sucks if you have to key them in manually or do it on paper.

          Most nurses also like the electronic MAR, since it can automagically calculate dosages and rates for continuous medications, automagically retrieve the right medication from the Pyxis, and automagically get a

          • Sounds like you've done most of your work in ICUs. That's one area where monitoring is a lot easier by computer, because every patient has a dedicated monitor and each nurse only has two patients.

            But as I said, physicians oppose changing things in ways that increase their workload if all the benefit goes to someone else. With CPOE, the nurses aren't typically the beneficiaries - they, too, are too well paid to be doing data entry work unless it's an emergency. It's the unit secretary, whose job description
            • by Z34107 (925136)

              It's not like doctors and nurses don't benefit from proper records. EMRs are very good at decision support - warning about allergies, drug interactions, wrong patient/wrong site/wrong med/wrong line (barcoding), and the like. Doctors like getting paid, and billing insurance is much easier and more reliable through an EMR.

              EMRs are particularly useful in high-liability practices like obstetrics. Being able to produce a record of exactly what interventions were performed, what providers were notified when,

            • Working in an hospital IT, too, I have a few points to make:

              • It is true that the UI may be improved in many systems. Our IT manager would like to configure our system to use it with tablet pcs, but as things go now, there is not budget for neither the configuration, the tablets nor the secure Wi-Fi to use it. For a long time the main interest was in reliability / process / speed. Now that these are more or less settled, vendors and buyers are starting to focus in it.
              • Apart from that, a lot of doctors need to
              • I don't know why you think that it's "thinking of yourself as a god" if you don't want to do painful data entry tasks, especially when the UI is a nightmare. Please, think of the UI. It's nearly always horrendous and painful, because even the good ones are designed by a guy who sits at the same desk every day and doesn't have to log into a different machine every ten minutes and get presented with the uncustomizable landing screen.

                I've worked in hospitals with a wide variety of electronic systems. The VA,
    • is probably the basis for most of it. You can't go a day without a news story or advertisement related to financial records being stolen. As with anything else, if you repeat it enough people are going to start to believe it.

  • "30% and 34% of doctors lack basic anti-virus software and network firewalls" ... what? How is this legal?
  • by Rooked_One (591287) on Thursday February 17, 2011 @06:39PM (#35238192) Journal
    You will always have uneducated and educated people. And you will have educated people who aren't computer savvy. This means you will end up with a percentage (probably based on region - I feel sorry for people in the midwest) of doctors who offices are completely unsecure and all it would take is a patient walking in with the appropriate thumb drive at the appropriate time.

    BAM! Access to the doctor's office is now at hand and anyone's records can be had.

    Very few people who would do this sort of activity in other situations are doing it for fun. I can only think doing this to make money would be something that would be a scheme, to mostly blackmail people of a region with the largest percentage of ignorant and uneducated people. Who, ironically enough, are going to be sick more and thus go to the doctor more... But how, or why, to exploit these people who have nothing to give is beyond me.

    But rich people also go to doctors from time to time as well... so what then?
    • Wow, way to talk out your ass and totally invent something. I especially like the looking down on people who live in a different part of the country than you do. Those people over there are all stupid!
    • by moortak (1273582)
      I think you may be way off base with the Midwest comment. Remember the Midwest is home to the Cleveland and Mayo Clinics. Neither of those have been slacking in the electronic health records area.
      • Considering I live in one of the largest cities with church to square mile ratio in the country... I really don't think I'm that far off. And, yes, its the midwest. I'll give you another hint - the only state to vote all red vs Obama. The nurse at my doctor told me this 'joke while I was getting my weight taken... "What does a farm and the white house have in common? They both have a spade and a ho."

        Now would you trust that doctors office very much? The only consolation I have is that they keep pap
    • Wow, so very offensive to the Doctors and your I.T. brethren in the MidWest.

      Not only is your assumption false, making you both wrong and ignorant, but you're a JERK to boot.

      How does that grab ya'?

  • Amusingly? (Score:4, Insightful)

    by Daetrin (576516) on Thursday February 17, 2011 @06:41PM (#35238210)
    "Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records."

    It seems we can't have a week go by without some article showing up on Slashdot about how the average person don't have "sufficient" security on their various electronic devices and programs. In which case if those same average people are concerned about a particular set of records being compromised couldn't it be considered wise that they'd rather have someone else who should (theoretically) have better safeguards in place handle those records?
    • by compro01 (777531)

      That's what's amusing. That they actually realize that their own security is inadequate to the task of storing that information securely.

  • by BlueParrot (965239) on Thursday February 17, 2011 @06:42PM (#35238232)

    Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records.

    What the hell is amusing about this? I dare claim I know miles more about information security than your average patient, and I'd certainly prefer to have my medical details kept safe by the pros than trying ( and probably failing ) to do so myself. For the same reason I keep my money in a bank as opposed to underneath my mattress. Now granted some doctors may have lax security, but for myself to keep the records in addition would just open up more avenues of attacks. The only good reason I can see why I would keep such records myself is to ensure I have a backup of them if my doctor was to screw up and erase them by accident or something.

    • by Jah-Wren Ryel (80510) on Thursday February 17, 2011 @07:48PM (#35239054)

      I dare claim I know miles more about information security than your average patient, and I'd certainly prefer to have my medical details kept safe by the pros than trying ( and probably failing ) to do so myself.

      The problem is that you can't trust "the pros" to act in your best interests. Money is 100% fungible and misuse is pretty straight-forward -- a bank steals your money and its obvious what happened. But for someone doing searches of healthcare records it is much harder to tell if the intent is nefarious. Even the people doing the searches may not fully understand the implications themselves - ala netflix's "anonymised" data fiasco.

      What we need is less centralisation, not more. The push for electronic records in healthcare is inexorable, so we need to develop systems that inherently limit access. Not just fancy permission bits that can be ignored with the right privileges, but actually keeping the data physically inaccessible to those who don't absolutely need it. The best way to do that is to decentralise.

      For example, use the patient's smartphone to keep their records (with automated backups of the data as an encrypted blob). If a doctor needs the info, he can request it via a secured version of a text message. Make it a closed system so that when the patient responds to the request, he can set an expiration date for the copy that the doctor gets. Meanwhile the records on the phone are encrypted too prevent loss of the phone exposing records.

      If we had a system where each person was responsible for their own information, then the overhead of widescale misuse would be significantly increased. You'll never stop one-off abuses, but you can design a system that (a) makes widescale abuse difficult and (b) makes it easy for individuals to safely manage their own records.

      Right now are moving to the worst of both worlds - centralisation of data with protection no better than flimsy laws subject to interpretation and rewriting by people with money and interests that conflict with that of the patient.

      • by ColdWetDog (752185) on Thursday February 17, 2011 @08:18PM (#35239300) Homepage

        For example, use the patient's smartphone to keep their records (with automated backups of the data as an encrypted blob). If a doctor needs the info, he can request it via a secured version of a text message. Make it a closed system so that when the patient responds to the request, he can set an expiration date for the copy that the doctor gets. Meanwhile the records on the phone are encrypted too prevent loss of the phone exposing records.

        1. I don't have a smartphone.
        2. I forgot my smartphone, do I have to go back home to get it?
        3. The insurance company needs to drop a bill, do they text message you to get the data?
        4. Medicare wants to audit the hospital. Do they text a message to get the data?
        5. Oops, my smartphone got squashed when I got run over by a bus and they need my data ASAP, now what do I do?
        6. Oops, the cell phones are down again.

        No, this makes no sense at all. People don't WANT to manage their information. Most people CAN'T manage their information.

      • How about developing a standard medical record access protocol. Companies can compete to store your information. They would compete based on who guards the information best. A service is defined via URL. So if you want to grant a hospital access to your records, you supply the URL and credentials (maybe a key/certificate stored on a card). They use a standard access protocol to fetch and/or update the data. The standard may also define how the client (hospital) may access the records, preventing a leak from

  • by Just Some Guy (3352) <kirk+slashdot@strauser.com> on Thursday February 17, 2011 @06:43PM (#35238238) Homepage Journal

    The majority of doctor's offices I've been around aren't connected to the Internet at all. For instance, my wife's practice has a WPA2 secured Wi-Fi network so that her laptop (whole-drive TrueCrypt) can talk to the database server that manages her records, and none of the hosts on the WLAN have any form of Internet connection. As it turns out, they do have AV programs (MS Security Essentials), but without any removable media coming into the office and no net connection, it's pretty much just a formality.

    My kid's orthodontist's network has Internet access, but it's a bunch of Macs behind a firewall+NAT and a strict "no personal browsing at the office" policy. (I know this because I bartered net admin chores for dental work :-) ).

    I'm certain there are insecure medical offices, but the doctors I've talked to are so terrified HIPAA that they'll take almost any security tips you give them.

    • by yuna49 (905461)

      Just curious, but how many of those HIPAA-fearing doctors use plain-text email to correspond with patients? How many of them have their email addresses on their business cards? I routinely ask providers if they realize that sending patient health information via e-mail is a HIPAA violation. Most haven't ever given the question a moment's thought.

      • I'll bet I can easily find an attorney to argue that the patient's request for that information constitutes authorization to transmit in the clear.
  • by hawguy (1600213) on Thursday February 17, 2011 @06:46PM (#35238268)

    Why doesn't some organization come up with a set of standards and best practices to ensure that HIPAA protected data is actually protected as it should be? I'm thinking something like the PCI security council started by the credit card companies that mandates a set of rules and best practices that have to be followed for all merchants that handle credit cards.

    Following the PCI standard doesn't guarantee data security, but it is a big step in the right direction. Doctors need the same kind of prodding to get them to implement real security controls and not just say "Oh, well i checked the WEP encryption box on my Wifi router, so all of my data is encrypted and safe - I know it's safe because I backed up my patient records to my iPhone".

    • HIPPA and HITECH cover more than just protecting data. It covers communication of the data as well, both digital communication and analog communication. it is hard to come up with a test suite for that.

      • by hawguy (1600213)

        PCI is not just about protecting computers and networks, but is about policies that companies are required to have in place to protect cardholder data (i.e. don't write a card number on scrap paper and toss it in the trash). Network vulnerability testing is a part of the compliance process, but developing policies and procedures for keeping the data safe is a large part of it.

        Does HIPAA cover having network firewalls and anti-virus software? If it does, then the law has no teeth since 30% of doctors were fo

        • by The Grim Reefer2 (1195989) on Thursday February 17, 2011 @08:28PM (#35239366)

          The problem is that HIPAA is severely broken. Most hospitals violate some part of HIPAA countless times per day as it's not even possible to operate within it's guidelines and be able to realistically treat patients. Another issue is the FDA understands how to deal with IT about as much as it knows how to building a Saturn 5 rocket.

          Here's an example that I've witnessed many times over the years. A vendor installs an MRI system in a hospital, the control computer the technologist uses to scan patients is Windows based. Obviously the system needs to at least be on the local hospital network so that the patient scans can be sent to a reading station so that a Dr. can look at the images. Neither of these systems can have any software installed on them that is not FDA approved. So by law, unless you have an FDA approved security program you cannot install it on either of these systems, or any system that contains patient data for that matter. If you do have an FDA approved program you need to prove that it will not affect any of the calculations that are made for determining a diagnosis as well. It gets even better though. If you do find a security suite that you can use, the vendor is not responsible for worrying about it in the case of system updates. So when an update comes out the vendor sends in an engineer who generally will simply re-image the drive with the new update, thereby wiping out your security programs.

          • by cbope (130292)

            Sorry, you are incorrect in stating that non FDA-approved software may not be installed in a medical device. It depends on the function of the software within the system and whether it deals directly with PHI (patient healthcare information) or not. Both security (anti-virus) software and the OS itself fall under COTS, or commercial off-the-shelf software. The only software required to comply with FDA and/or HIPAA is the software that deals directly with patient and medical data. Neither the OS nor the secu

  • Why are people so worried about their medical information going public?

    First of all, you can't get most people to shut up about what happened at the doctor's office. (And the older the person, the more likely this will dominate their idea of interesting conversation.)

    And if this guy [slashdot.org] can't get a few days' quiet time to himself before he dies, then just who the fuck do the rest of us think we are?

    Frankly, I'm going to start posting the boroscope videos of my colonoscopies. Hopefully the karma buildup will m

    • by 0123456 (636235)

      Why are people so worried about their medical information going public?

      I think your comment about Steve Jobs would be enough to explain why people don't want everyone to have access to their medical records.

    • Common Law (Score:4, Insightful)

      by Gonoff (88518) on Thursday February 17, 2011 @08:12PM (#35239258)

      In the UK, and therefore probably the USA too, there is a Common Law expectation of privacy in this situation.

      If I tell my neighbour over the garden fence that I am going in for a prostate examination tomorrow, there is not necessarily a legal duty on the part of my neighbour to keep this confidential,If a different neighbour is my doctor it is very different. I can reasonably expect that they will not blab about it at a party.

      That common law duty extends to keeping the matter private as best they can. They should not leave printed notes on display. They should not send it around by insecure fax, unencrypted email or put it on Twitter.
      They should, in fact, take every reasonable precaution to ensure that this matter stays secret until I choose to let it be known. Reasonable precautions include things like having firewalls and controlled access to my data.

      If a doctor, hospital or any other medical organisation, does not take suitable actions to protect such patient information, there are specific laws in developed countries (and most undeveloped ones) which will penalise them even if no information leaks out. My earlier comments on Common Law are because we don't even need written laws to deal with this. Common law is the effect of all those books full of legal precedents that lawyers have on their walls.
      If the doctors don't even have firewalls and a patient finds out lawyers could get busy...

    • by cbope (130292)

      The reason why this information should not be public is because it's open to abuse and discrimination. What about the employer who chooses not to hire you because you have a rare disease that may cause their insurance costs to increase? Is it fair to allow them to use this information against you in this manner?

      No, it is not. You should be hired based upon your qualifications for the job and your previous references. US companies are increasingly turning to this type of information for job discrimination an

  • Drs fail more than machines. These are the same folks who have tried to kill me several times, often have no idea about me when I visit because they fail to read charts, and prescribe medicine they feel comfortable with instead of checking actually studies.

    • they fail to read charts

      Hard to read information that isn't there. Asking people what's wrong with them, in their own words, is a very useful guide to dealing with them, because it gives you a good idea from the start how well they understand what is going on.

      Sorry you've had such bad experiences with my profession. There are some inexcusable jackasses out there, and I regret them.

      • by h4rr4r (612664)

        I mean when they don't even know the fact that while my serum potassium is on the low side of the average that is a huge improvement for me.

        If I showed up to work as unprepared as these folks I would have been fired long ago.

        This is information that is there, it is not subjective either, it is written in black and white by the lab.

  • pre existing conditions and job discrimination are the big fears with Computerized Records.

    • by jmcharry (608079)

      I don't think there is a defense against that. You have to sign a third party release for your current insurance, and the insurance companies pool data. Physicians have to code diagnoses and treatments and key them into the system to get paid. Your nosey friends might not have access, but the people you most worry about do.

  • ...or Betty in Records getting snoopy.

    What I worry about are the 23872832387 "health information sharing authorization" forms I'm basically required to sign every time I do anything remotely related to my health care, whether in the physician's office, renewing benefits at work, etc.

    With paper records, the insurance companies, employers, and others who are constantly looking for a way to use your health status against you had to work a damn sight harder to get their hands on this info.

    With electronic record

  • Dr's are tech idiots (Score:5, Interesting)

    by Ludedude (948645) on Thursday February 17, 2011 @07:09PM (#35238624)

    I work for a large regional provider of EMR hardware and software and I can tell you first hand that you should be afraid, very afraid, of anything your Dr. does with health records that involve a computer. Anti-virus is the tip of the iceberg. You install it for them and their brother in law who's a burger flipper helpfully uninstalls it to "speed things up." Hilarity ensues. Entire offices are implementing EMR that refuse separate usernames and passwords because it's "just too damn hard to remember all that" so everyone logs in as user with some simple password; that's if they even bother to log in or off at all. Of course they have to have admin rights because it's their hardware and they know what's best.

    Since most of the offices that are being force-fed EMR because of the lure of up to $44,000 in "stimulus" funds [allscripts.com] are smaller practices, they don't have domains that can be used to enforce universal security policies.

    The larger ones, sure, but most of them already use EMR and have on site servers etc. along with the requisite firewalls and VPNs. The vast majority of the new ones though are being sold "cloud" based systems with no local servers at all, so it's a friggin' free for all in terms of security (or lack thereof). They're just lining up for a swipe at the stimulus golden ring but half of them shouldn't even be entrusted with anything as complicated as a TV remote, let alone computer systems.

    • by fl!ptop (902193)

      A-freakin-men to your whole post, you took all the words right out of my mouth. I'm often shocked at how lax the doctors and staff are even with simple stuff like Windows updates. Just today I found 3 computers at a client's office that were running WinXP SP2!

  • by dbIII (701233) on Thursday February 17, 2011 @07:17PM (#35238728)
    Perhaps that number is completely meaningless. I've noticed anecdotally that many doctors have Macs, perhaps 34% have Apple computers and don't need antivirus?
    Also for firewall do they mean a separate dodgy product and are they ignoring the quite reasonable Ms Windows and Apple firewalls? How about the situation where just about every modem or router made after about 2005 has half decent firewall rules as a default?
    It's not as if 34% of these computers are actually naked to the net.
    • I hope you don't manage the infrastructure at a medical practice. Based on your comments you'd be part of the problem.

  • what about all the vender systems / medical device that run windows but are no installing updates and the venders say you are not to install them or they just lock you out of the admin password.

    • by cbope (130292)

      You isolate them and do not allow access to those systems from the outside. Inside the network, you allow only carefully selected access and block everything else. It's not rocket science.

  • Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records.

    I find this statement damn interesting, certainly more so than amusing. This sounds like the general public is becoming more knowledgeable than I would have guessed.

  • by glwtta (532858) on Thursday February 17, 2011 @08:32PM (#35239400) Homepage
    I know the popular thing is to constantly cry about our precious privacy, but I'm more worried about my medical records not showing up when they are needed, not the other way around. I'm thinking of allergies, drug interaction, and relevant medical history during emergencies, and the like.
    • I know the popular thing is to constantly cry about our precious privacy, but I'm more worried about my medical records not showing up when they are needed, not the other way around. I'm thinking of allergies, drug interaction, and relevant medical history during emergencies, and the like.

      That's a strong argument for each person to keep a copy of their records physically with them - like on their smartphone, ipod or a MedicAlert bracelet souped up with flash-storage.

Theory is gray, but the golden tree of life is green. -- Goethe

Working...