5 ms·

I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in ac

I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in account? I'd think that the security concerns would be functionally identical.

userbinator 11y ago
They are forbidden from disclosing confidential data to those services, which is still somewhat under their control, as opposed to the OS deciding to disclose all the data for them.
- fixermark 11y ago
  So would a logged-in search for, say, "rheumatoid arthritis" or specific drug names be out of the question if it's in the context of finding treatments for a patient? And does HIPAA also block a family practitioner from using Drive to track patient histories?
  - dogma1138 11y ago
    Yes you can't store patient data on google drive. There are plenty of practice management cloud solutions with cloud storage support which are hipaa compliant.
    - fixermark 11y ago
      Thank you for the clarification! Swinging back to topic: Microsoft has traditionally had a good rapport with the business / government space, so I'll be shocked if they don't already have a plan for addressing the need to protect private data. Maybe the enterprise solution version of Windows 10 will have this feature off by default?
      - soneil 11y ago
        There is a nod to Enterprise. The minimum value for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry is 0 on win10 Enterprise, and 1 on consumer editions. (I believe the default value is 3. Lower is more private, but lowest is not offered to consumers)
      - dogma1138 11y ago
        Like people mentioned there are different settings for Enterprise SKU's including different settings for different verticals (e.g. education or health industry). For example Office 365 for Healthcare which is HIPAA compliant has probably quite a different privacy policy and out of the box authentication, encryption and right management settings than what you would get as an individual or even by buying Office 365 for business editions. http://www.microsoft.com/en-us/health/products/office365/default.aspx#fbid=oDT3c4IzHmR http://www.microsoft.com/en-us/health/products/office365/def... Not saying that's right, but most companies that provide free/subsidizes consumer services including companies like Google tend to have quite a different SLA and service terms for corporate customers.
dragonwriter 11y ago
> I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in account? Android voice recognition might raise similar problems; the Google search engine less so. You can use Google Search without putting any protected information into it; OTOH, if an OS is capturing all of your typing and inking and sending it to another party, anything you do by typing or inking that involves protected information is being sent, so (in the HIPAA case) unless you have a BAA in place, and both parties have both the technical and administrative safeguards required under HIPAA, using it for PHI is going to involve regular illegal disclosures.
deleted 11y ago
[deleted]
ionised 11y ago
They are probably not putting sensitive and confidential patient information into Google searches though. Windows 10 is harvesting and relaying every-fucking-thing you type on your operating system.
- llama052 11y ago
  According to an article that isn't even slightly credible. I love how people read something on the internet and instantly believe it as fact.
  - vetinari 11y ago
    You know, some of us observed the same behavior on our own machines. I love apologists who have no idea what they fight for.
    - Oletros 11y ago
      Then it will be easy to provide proof of those claims, isn't?
      - vetinari 11y ago
        For example: http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ http://arstechnica.com/information-technology/2015/08/even-w...
        Oletros 11y ago
        Can you point where in that article is proved that microsoft send every typed thing to their servers?
        vetinari 11y ago
        Microsoft has no business to send out anything without consent. I will not waste my time to MITM SSL traffic and break down binary blobs to find out, whether it contains something I just typed. It sends out unwanted traffic when I type into start menu --> onus is on Microsoft to be transparent, what it sends out. And to allow user to disable that behavior.
Lawtonfogle 11y ago
The major difference is if I'm looking up drug Apraximine to give to fixermark for his PTSD resulting from embarrassing secret, I would just google (or whatever professional service they use) Apraximine. Google only sees that and know knows I have some interest in this drug. It can't even attach your name to it. But if I write in an electronic file that fixermark is being given Apraximine for PTSD resulting from embarrassing secret, Microsoft know has all that information. More so, hackers have a much easier time getting such information.
yellowapple 11y ago
They would be if they're entering actual patient data into Google, which would be silly (Android voice recognition would be less silly, since doctors do use voice recognition software for dictation, though in my experience this is usually something locally-installed on a PC, like DragonSpeak). The problem is that, by way of Windows 10 effectively having a keylogger installed, pretty much any EMR accessed via a Windows 10 machine is automatically insecure, since the data entered into said EMR is being sniffed and sent to a third party. If Microsoft experiences any sort of data breach, hospitals throughout the U.S. will be having a HIPAA/HITECH hell-day.

userbinator 11y ago

They are forbidden from disclosing confidential data to those services, which is still somewhat under their control, as opposed to the OS deciding to disclose all the data for them.

fixermark 11y ago
So would a logged-in search for, say, "rheumatoid arthritis" or specific drug names be out of the question if it's in the context of finding treatments for a patient? And does HIPAA also block a family practitioner from using Drive to track patient histories?
- dogma1138 11y ago
  Yes you can't store patient data on google drive. There are plenty of practice management cloud solutions with cloud storage support which are hipaa compliant.
  - fixermark 11y ago
    Thank you for the clarification! Swinging back to topic: Microsoft has traditionally had a good rapport with the business / government space, so I'll be shocked if they don't already have a plan for addressing the need to protect private data. Maybe the enterprise solution version of Windows 10 will have this feature off by default?
    - soneil 11y ago
      There is a nod to Enterprise. The minimum value for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry is 0 on win10 Enterprise, and 1 on consumer editions. (I believe the default value is 3. Lower is more private, but lowest is not offered to consumers)
    - dogma1138 11y ago
      Like people mentioned there are different settings for Enterprise SKU's including different settings for different verticals (e.g. education or health industry). For example Office 365 for Healthcare which is HIPAA compliant has probably quite a different privacy policy and out of the box authentication, encryption and right management settings than what you would get as an individual or even by buying Office 365 for business editions. http://www.microsoft.com/en-us/health/products/office365/default.aspx#fbid=oDT3c4IzHmR http://www.microsoft.com/en-us/health/products/office365/def... Not saying that's right, but most companies that provide free/subsidizes consumer services including companies like Google tend to have quite a different SLA and service terms for corporate customers.

dragonwriter 11y ago

> I'm curious: Are doctors, psychologists, and anyone under an NDA forbidden from using the Google search engine or Android voice recognition under a logged-in account? Android voice recognition might raise similar problems; the Google search engine less so. You can use Google Search without putting any protected information into it; OTOH, if an OS is capturing all of your typing and inking and sending it to another party, anything you do by typing or inking that involves protected information is being sent, so (in the HIPAA case) unless you have a BAA in place, and both parties have both the technical and administrative safeguards required under HIPAA, using it for PHI is going to involve regular illegal disclosures.

deleted 11y ago

[deleted]

ionised 11y ago

They are probably not putting sensitive and confidential patient information into Google searches though. Windows 10 is harvesting and relaying every-fucking-thing you type on your operating system.

llama052 11y ago
According to an article that isn't even slightly credible. I love how people read something on the internet and instantly believe it as fact.
- vetinari 11y ago
  You know, some of us observed the same behavior on our own machines. I love apologists who have no idea what they fight for.
  - Oletros 11y ago
    Then it will be easy to provide proof of those claims, isn't?
    - vetinari 11y ago
      For example: http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ http://arstechnica.com/information-technology/2015/08/even-w...
      - Oletros 11y ago
        Can you point where in that article is proved that microsoft send every typed thing to their servers?
        vetinari 11y ago
        Microsoft has no business to send out anything without consent. I will not waste my time to MITM SSL traffic and break down binary blobs to find out, whether it contains something I just typed. It sends out unwanted traffic when I type into start menu --> onus is on Microsoft to be transparent, what it sends out. And to allow user to disable that behavior.

Lawtonfogle 11y ago

The major difference is if I'm looking up drug Apraximine to give to fixermark for his PTSD resulting from embarrassing secret, I would just google (or whatever professional service they use) Apraximine. Google only sees that and know knows I have some interest in this drug. It can't even attach your name to it. But if I write in an electronic file that fixermark is being given Apraximine for PTSD resulting from embarrassing secret, Microsoft know has all that information. More so, hackers have a much easier time getting such information.

yellowapple 11y ago

They would be if they're entering actual patient data into Google, which would be silly (Android voice recognition would be less silly, since doctors do use voice recognition software for dictation, though in my experience this is usually something locally-installed on a PC, like DragonSpeak). The problem is that, by way of Windows 10 effectively having a keylogger installed, pretty much any EMR accessed via a Windows 10 machine is automatically insecure, since the data entered into said EMR is being sniffed and sent to a third party. If Microsoft experiences any sort of data breach, hospitals throughout the U.S. will be having a HIPAA/HITECH hell-day.