4 ms·

Maybe it's too obvious or maybe I'm completely missing something, but seems a "fatal flaw" in this scheme is the fact that not everyone owns a smartphone, or ev

by jrapdx3 11y ago

Maybe it's too obvious or maybe I'm completely missing something, but seems a "fatal flaw" in this scheme is the fact that not everyone owns a smartphone, or even uses web services enough to develop much of an identifiable "profile". Smartphones are fragile, easily lost, not always available or reliable, making their use for the purpose seem far less than optimum. Furthermore, how high a level of security is needed depends on the situation. Sometimes passwords guard fairly trivial risk exposure, like belonging to some newsgroup to make occasional comments. Hardly any personal info to leak in such cases and simple measures will do just fine. OTOH my health records needs to be protected far more vigorously, but why would I trust that security to a third party entity like Google? I'd much rather have security for the EHR managed within the EHR system itself, and whatever is adopted, I doubt it would look a whole lot like what's proposed in the article.

eternalban 11y ago
> ... not everyone owns a smartphone Relax. We'll chip anyone without a smart device companion.
FLUX-YOU 11y ago
> I'd much rather have security for the EHR managed within the EHR system itself I would trust Google's security team over most EHRs. I base this on finding a few sql injection flaws and single DES usage in one I worked on but I don't have broad experience in many EHRs.
- jrapdx3 11y ago
  Yeah, I know some EHRs have been attacked re: inadequate security, though AFAIK major vendors in my local area seem to have been doing OK recently. However, it only takes small errors here or there to open up significant holes, a fact I've brought up many times when discussing "interoperability" among EHRs, a favorite subject of governmental planners. I think the problem trusting Google might not lie with their "security team" (they probably have a number of such teams), but rather with privacy policies and guarantees. IOW Google is no doubt capable of providing security, questions arise about enforcing constraints necessary to assure the high level of privacy required by EHR systems.

by jrapdx3 11y ago

eternalban 11y ago

> ... not everyone owns a smartphone Relax. We'll chip anyone without a smart device companion.

FLUX-YOU 11y ago

> I'd much rather have security for the EHR managed within the EHR system itself I would trust Google's security team over most EHRs. I base this on finding a few sql injection flaws and single DES usage in one I worked on but I don't have broad experience in many EHRs.

jrapdx3 11y ago
Yeah, I know some EHRs have been attacked re: inadequate security, though AFAIK major vendors in my local area seem to have been doing OK recently. However, it only takes small errors here or there to open up significant holes, a fact I've brought up many times when discussing "interoperability" among EHRs, a favorite subject of governmental planners. I think the problem trusting Google might not lie with their "security team" (they probably have a number of such teams), but rather with privacy policies and guarantees. IOW Google is no doubt capable of providing security, questions arise about enforcing constraints necessary to assure the high level of privacy required by EHR systems.