7 ms·

Why does American medicine still run on fax machines?

46 points by oftenwrong 9y ago

ahuxley2013 9y ago
Faxes are considered the only secure communication channel by medical companies. Email is not secure. The Vatican has the same stance. They pope communicates via fax the majority of the time, per 60 minutes.
- t0mbstone 9y ago
  Which is utterly insane, because faxes aren't encrypted. All anyone would have to do is tap into the phone line and copy the signals and they could print out any fax that was sent over the wire.
  - Terribledactyl 9y ago
    I mean they have a few niceties like having to physically be in the same spot to interact with it and lacking any sort of central discoverability. There’s not really an equivalent to email:francis@aol.com password:p0p3 and having anybody with a computer getting a copy.
junkscience2017 9y ago
old tech like fax will die when the independent Doctor's practice as a viable business model dies...within fifteen years. Most of us already see physicians through network orgs like PAMF in the Bay Area, who migrated to digital tech internally long ago and are slowly replacing independent practices. I have never seen a physician use paper for any reason in PAMF
- vacri 9y ago
  My city has a large, world-class Children's Hospital, but the administration there is ridiculously political, and the doctors will change nothing to make things more efficient. A colleague of mine had a son who needed to get seen there. They asked him to fax in the admissions forms. Who has a fax machine? He found somewhere and faxed them in, in a couple of jobs. Nope, can he fax them so they all come through in one continuous job. So he goes back and faxes them again. Nope, can he fax them so that the documents arrive in the right order? So he decides to go to a different children's hospital in the city. I had a friend who worked in the QA dept of that hospital and tried to get processes improved. He said that any time you tried anything, the relevant head of department would say "If we make this change, children will die". Everyone around the table would know the lie for what it was, but the head of dept had the final say if it involved child health. In short, faxes will still be going strong there for a while yet, and they're a big hospital. :)
mmerlin 9y ago
same in Australia too
pmiller2 9y ago
I'd like to see a similar piece about the law and banking industries.
- enraged_camel 9y ago
  Insurance as well.
- stmw 9y ago
  Well, that's increasingly solved by companies like Stripe & Gusto.
forapurpose 9y ago
How else would they be transferred? E-mail isn't secure enough. Perhaps a partial answer to the question is, 'because the IT industry hasn't provided the world with a secure, widespread, public communication medium" (by public, I mean one not controlled by a private company). The IT industry gets a lot of praise, but there are a lot of gaps in performance that we have become accustomed to overlooking.
- maxxxxx 9y ago
  I am not sure if fax is more secure than E-mail. When I still had my machine I usually received several faxes per year with confidential information. It was always lawyers who had mistyped the fax number. And most of them used redial so they kept sending stuff until I told them they had the wrong number.
  - forapurpose 9y ago
    There's much more to security than misaddressed messages. Email is sent over the Internet, often in the clear, exposing it to many intermediaries, including to both business and government which use mass surveillance of email to collect data on users. Email ends up on many devices, from multiple servers to multiple endpoints (sender's and recipients laptops, phones, etc.) to backups. Email security is so hard to achieve that many security professionals have given up, and design new messaging systems such as Signal. > I am not sure if fax is more secure than E-mail However, I do agree that the difference isn't great because many fax systems, sending and receiving, utilize email anyway.
- chaz6 9y ago
  A common method used in the UK is EDI (electronic data interchange).
frik 9y ago
What should they use instead? Email isn't secure enough. Email got not forced TLS/GPG upgrade (compared to the web's HTTPS)
- interfixus 9y ago
  Email is roughly as secure as you care to make it. Better than stupid phone lines at least.
  - lostboys67 9y ago
    Much easier to hack say the DCI's mail account than say tap his phone line eh :-)
- wutwutwutwut 9y ago
  Create a protocol or API spec on top of HTTPS or something else and use it. I don't know where you ar at but surely the government can just say "hey guys support this secure protocol before 2022 or you're out". I can log on and read any of my medical records at any time and the information is aggregated from multiple sources. What's the issue? If you use fax you won't even be able to see some kind of central audit log for your data. That's pretty crazy.
  - _callcc 9y ago
    > Create a protocol or API spec on top of HTTPS or something else and use it. This is basically what they've done with EDI/X12 over AS2, which was also mandated by HIPAA. The problem is that EDI is a pain to work with as a data format and hooking up to other trading partners can take weeks of coordination between IT teams (sending "implementation guidelines" back and forth). When EDI is the alternative it's not hard to see how the fax machine survives.
- stmw 9y ago
  It's a big and still-unsolved problem, but it's more than just TLS - need a proper set of APIs and platforms. We happen to be working on this, but it's not done yet... :-)
adventured 9y ago
Half of Japan still runs on fax machines. They can still be a useful technology. http://www.nytimes.com/2013/02/14/world/asia/in-japan-the-fax-machine-is-anything-but-a-relic.html http://www.nytimes.com/2013/02/14/world/asia/in-japan-the-fa...
- hkmurakami 9y ago
  And hence the ubiquitous fax copy scan multifunction machine in every convenience store.
Taniwha 9y ago
And so insecure too, my fax machine's number used to be 1 digit off from a pharmacy's .... I used to get more faxes of other people's private prescriptions than genuine faxes intended for me
- tryingagainbro 9y ago
  Point taken, but given the hacks I'm almost certain that while fax machines are insecure, at least the damage is very limited /targeted. Now just imagine an EquiHealth hack...AIDs diagnoses, other STD, infertility, etc etc records out there--forever.
  - dx034 9y ago
    You're being downvoted but I think you have a point. A lot of the old tech is not secure per-se but doesn't concentrate data in one system. Most newer systems have a single point from where you can access all data. If Equifax had been based on paper and Fax, no one would've been able to steal 150mn records.
    - tryingagainbro 9y ago
      I don't care about downvotes. Most of the time I don't write a lot so most is left to be processed. So, many times, even if I'm right, I could downvotes for that ;). But yeah, since we can't secure anything connected to the internet (a lot of big boys got hacked) or to a central db, we have to go to plan B.
interfixus 9y ago
>The clinic has digitized its own patient data. But its electronic system can’t connect with other clinics’ records. So when doctors want to retrieve records from another office — an ultrasound for a pregnant patient, for example — they have to turn to the fax Haven't these people at least heard of email?
- mcpherrinm 9y ago
  They've heard of it, but aren't going to use it. Email is generally not encrypted when stored at rest in many hops along the way, which should be considered insecure. While fax is unencrypted, it's generally not stored in any intermediate systems and has established history of being considered HIPAA compliant.
  - acchow 9y ago
    If email is encrypted, why does it matter that it is stored in any intermediary place along the way?
    - mcpherrinm 9y ago
      I missed a negative. I've updated my comment.
    - rjbwork 9y ago
      Email actually generally isn't encrypted. Sure, you can do things like PGP encryption, but not even some of it's formerly strongest advocates bother anymore. Consider email open to anyone between you and the recipient.
  - interfixus 9y ago
    Security by presumed obscurity. We have a winner.
    - taneq 9y ago
      Security by obscurity isn't military grade security but it's a lot better than insecurity by non-obscurity if those are your only two options.
flukus 9y ago
At least part of it is that no one has come up with a document format that suits everyone. Doctors want to scribble notes with a stylus but when you digitize that you don't really gain anything, other systems don't know how to interpret those scribbles. Suggesting doctors enter fields into a form instead of scribbling notes will get you no where, doctors are the stupidest and most stubborn smart people you will come across. Not that this is perfect anyway, sometimes you really do just need those random notes that don't really fit anywhere else. Some of the younger ones will type instead of scribble, but it's still mostly free form text and not data. The industry is still stuck on the idea that one doctor visit == one patient record as well, the thought that doctors could input blood pressure readings in their own section and have it display the history as a spreadsheet (or even a graph) has not gained any acceptance. So it's not just about how we transfer information but how it's created as well, we haven't invented the right set of primitives to store it in the first place. I've spent a bit of time thinking about how I'd improve things and think things need to be more like emacs org mode or a jupyter notebook than any current EMRS, but even that might have to wait for a generation of scribblers to die.
- vacri 9y ago
  From working with a variety of ticketing systems, any veteran dev will be able to tell you just how painful it is to work with multiple fields. Entry is never zippy. The more fields you have, the more painful it is. Most devs, given the choice, will use a ticketing system that is basically free text + a ticket title. If devs, who live and breathe tech, can't comfortably handle the idea of splitting information over various fields (for superior tracking and analysis), why should doctors be any different?
- maccard 9y ago
  > Suggesting doctors enter fields into a form instead of scribbling notes will get you no where, Maybe in the US, but in the UK and Ireland, all my doctors notes have been typed into a system that is shared among all the doctors in the practice. Last time I went for for an MRI i was given a CD with the mri on it, and I brought it with me to my next appointments. > doctors are the stupidest and most stubborn people you will come across That’s not fair. When I was in university most of the old professors still used overhead projectors and taught the same course from 20 years ago. When I bought my house my solicitor faxed everything, and posted me out the originals of the documents I needed, which took up an entire a4 binder. Developers seem almost bipolar; on one hand you have the “must use shiny new tech” and on the other hand, you have people who won’t update third party libraries ever. We’re still stuck with the same representations of data that we had 40 years ago, and broadly the same basic tools. C and C++ still literally copy and paste header files when including them, all in the name of backwards compatibility. My (long winded) point being, all professions have their own stubborn qualities, and pinning it on old people or a specific profession is wrong
chaitanyana 9y ago
American health care system needs Changes in many ways
dbcooper 9y ago
Paging Pokitdok, Hashed Health, Change Healthcare etc.
Ice_cream_suit 9y ago
Two words: "HIPAA compliaance"
grecy 9y ago
America's infrastructure is behind in many ways. Bank transfers are arcane, no chip n pin, fax machines, etc. etc. I'm moving through West Africa, where these problems have been solved 2+ years ago.
- mamon 9y ago
  America's infrastructure is behind other developed countries because once upon a time it was AHEAD of it's time. When you have a legacy infrastructure that is good enough it is harder to justify the cost of replacing it with something else. African countries, or Eastern European ones didn't have this dillema because they didn't have a legacy infrastructure to deal with.
  - deleted 9y ago
    [deleted]
  - alkonaut 9y ago
    All western countries had faxes, magnetic strip cards, paper check payments, etc. And most of them have no traces of that. I think there must be some other element to it as well, and it's probably not only "well US is big". I think one is the diversity of states and companies. Having tons of systems and businesses communicating over several state borders with varying regulations, it's very easy to just settle with the lowest common denominator which might be faxes, cash etc. Second I think it's a big cultural difference. In the EU for example (Which is looked on with at least as much suspicion as "federal government" in the US) we see it as an important job of central government to put agressive timelines for introduction of modern tech. Because things like this (chip + pin) for example is a herd immunity thing where the cost to upgrade is only motivated if customers actually have the cards etc - so we are very happy to see legislation requiring non-chip credit cards to be phased out, for example. Technological advance like this, or environment rules etc., is NOT seen as overreach, where a lot of other laws would be. Third it's the power of corporations in relation to government. If corporate lobbyists see that a regulation will affect their bottom line (such as all of retail having to buy chip+pin equipment within 3 years) they protest. In the EU, there is just no chance that a retail lobby would be able to resist EU legislation that was advertised as good for consumers.
PragmaticPost 9y ago
Most modern copiers have the ability to encrypt PDF files. The password is the problem. There are also some email providers who serve healthcare that offer security that abides by HIPAA rules. The solution is there. It's mandating a standard that facilitates the flow of data that is not.
avryhof 9y ago
On this note, one of the divisions of the company I work for is hiring a Python/Django developer in the Syracuse, NY area - https://www.indeed.com/cmp/Noble-Health-Services/jobs/Application-Analyst-f132d5fe58493d9d?q=Noble https://www.indeed.com/cmp/Noble-Health-Services/jobs/Applic... Change healthcare, develop for a pharmacy!
featherverse 9y ago
The answer is simple. Regarding technology, _most_ people are still in the 1980s. More than anything, this is proof that tech industry salaries are on average _way too low_. Stop working for peanuts. Let them go back to pen and paper. Let their corporations collapse. Demand to be paid what you're all worth.

46 points by oftenwrong 9y ago

ahuxley2013 9y ago

Faxes are considered the only secure communication channel by medical companies. Email is not secure. The Vatican has the same stance. They pope communicates via fax the majority of the time, per 60 minutes.

t0mbstone 9y ago
Which is utterly insane, because faxes aren't encrypted. All anyone would have to do is tap into the phone line and copy the signals and they could print out any fax that was sent over the wire.
- Terribledactyl 9y ago
  I mean they have a few niceties like having to physically be in the same spot to interact with it and lacking any sort of central discoverability. There’s not really an equivalent to email:francis@aol.com password:p0p3 and having anybody with a computer getting a copy.

junkscience2017 9y ago

old tech like fax will die when the independent Doctor's practice as a viable business model dies...within fifteen years. Most of us already see physicians through network orgs like PAMF in the Bay Area, who migrated to digital tech internally long ago and are slowly replacing independent practices. I have never seen a physician use paper for any reason in PAMF

vacri 9y ago
My city has a large, world-class Children's Hospital, but the administration there is ridiculously political, and the doctors will change nothing to make things more efficient. A colleague of mine had a son who needed to get seen there. They asked him to fax in the admissions forms. Who has a fax machine? He found somewhere and faxed them in, in a couple of jobs. Nope, can he fax them so they all come through in one continuous job. So he goes back and faxes them again. Nope, can he fax them so that the documents arrive in the right order? So he decides to go to a different children's hospital in the city. I had a friend who worked in the QA dept of that hospital and tried to get processes improved. He said that any time you tried anything, the relevant head of department would say "If we make this change, children will die". Everyone around the table would know the lie for what it was, but the head of dept had the final say if it involved child health. In short, faxes will still be going strong there for a while yet, and they're a big hospital. :)

mmerlin 9y ago

same in Australia too

pmiller2 9y ago

I'd like to see a similar piece about the law and banking industries.

enraged_camel 9y ago
Insurance as well.
stmw 9y ago
Well, that's increasingly solved by companies like Stripe & Gusto.

forapurpose 9y ago

How else would they be transferred? E-mail isn't secure enough. Perhaps a partial answer to the question is, 'because the IT industry hasn't provided the world with a secure, widespread, public communication medium" (by public, I mean one not controlled by a private company). The IT industry gets a lot of praise, but there are a lot of gaps in performance that we have become accustomed to overlooking.

maxxxxx 9y ago
I am not sure if fax is more secure than E-mail. When I still had my machine I usually received several faxes per year with confidential information. It was always lawyers who had mistyped the fax number. And most of them used redial so they kept sending stuff until I told them they had the wrong number.
- forapurpose 9y ago
  There's much more to security than misaddressed messages. Email is sent over the Internet, often in the clear, exposing it to many intermediaries, including to both business and government which use mass surveillance of email to collect data on users. Email ends up on many devices, from multiple servers to multiple endpoints (sender's and recipients laptops, phones, etc.) to backups. Email security is so hard to achieve that many security professionals have given up, and design new messaging systems such as Signal. > I am not sure if fax is more secure than E-mail However, I do agree that the difference isn't great because many fax systems, sending and receiving, utilize email anyway.
chaz6 9y ago
A common method used in the UK is EDI (electronic data interchange).

frik 9y ago

What should they use instead? Email isn't secure enough. Email got not forced TLS/GPG upgrade (compared to the web's HTTPS)

interfixus 9y ago
Email is roughly as secure as you care to make it. Better than stupid phone lines at least.
- lostboys67 9y ago
  Much easier to hack say the DCI's mail account than say tap his phone line eh :-)
wutwutwutwut 9y ago
Create a protocol or API spec on top of HTTPS or something else and use it. I don't know where you ar at but surely the government can just say "hey guys support this secure protocol before 2022 or you're out". I can log on and read any of my medical records at any time and the information is aggregated from multiple sources. What's the issue? If you use fax you won't even be able to see some kind of central audit log for your data. That's pretty crazy.
- _callcc 9y ago
  > Create a protocol or API spec on top of HTTPS or something else and use it. This is basically what they've done with EDI/X12 over AS2, which was also mandated by HIPAA. The problem is that EDI is a pain to work with as a data format and hooking up to other trading partners can take weeks of coordination between IT teams (sending "implementation guidelines" back and forth). When EDI is the alternative it's not hard to see how the fax machine survives.
stmw 9y ago
It's a big and still-unsolved problem, but it's more than just TLS - need a proper set of APIs and platforms. We happen to be working on this, but it's not done yet... :-)

adventured 9y ago

Half of Japan still runs on fax machines. They can still be a useful technology. http://www.nytimes.com/2013/02/14/world/asia/in-japan-the-fax-machine-is-anything-but-a-relic.html http://www.nytimes.com/2013/02/14/world/asia/in-japan-the-fa...

hkmurakami 9y ago
And hence the ubiquitous fax copy scan multifunction machine in every convenience store.

Taniwha 9y ago

And so insecure too, my fax machine's number used to be 1 digit off from a pharmacy's .... I used to get more faxes of other people's private prescriptions than genuine faxes intended for me

tryingagainbro 9y ago
Point taken, but given the hacks I'm almost certain that while fax machines are insecure, at least the damage is very limited /targeted. Now just imagine an EquiHealth hack...AIDs diagnoses, other STD, infertility, etc etc records out there--forever.
- dx034 9y ago
  You're being downvoted but I think you have a point. A lot of the old tech is not secure per-se but doesn't concentrate data in one system. Most newer systems have a single point from where you can access all data. If Equifax had been based on paper and Fax, no one would've been able to steal 150mn records.
  - tryingagainbro 9y ago
    I don't care about downvotes. Most of the time I don't write a lot so most is left to be processed. So, many times, even if I'm right, I could downvotes for that ;). But yeah, since we can't secure anything connected to the internet (a lot of big boys got hacked) or to a central db, we have to go to plan B.

interfixus 9y ago

>The clinic has digitized its own patient data. But its electronic system can’t connect with other clinics’ records. So when doctors want to retrieve records from another office — an ultrasound for a pregnant patient, for example — they have to turn to the fax Haven't these people at least heard of email?

mcpherrinm 9y ago
They've heard of it, but aren't going to use it. Email is generally not encrypted when stored at rest in many hops along the way, which should be considered insecure. While fax is unencrypted, it's generally not stored in any intermediate systems and has established history of being considered HIPAA compliant.
- acchow 9y ago
  If email is encrypted, why does it matter that it is stored in any intermediary place along the way?
  - mcpherrinm 9y ago
    I missed a negative. I've updated my comment.
  - rjbwork 9y ago
    Email actually generally isn't encrypted. Sure, you can do things like PGP encryption, but not even some of it's formerly strongest advocates bother anymore. Consider email open to anyone between you and the recipient.
- interfixus 9y ago
  Security by presumed obscurity. We have a winner.
  - taneq 9y ago
    Security by obscurity isn't military grade security but it's a lot better than insecurity by non-obscurity if those are your only two options.

flukus 9y ago

At least part of it is that no one has come up with a document format that suits everyone. Doctors want to scribble notes with a stylus but when you digitize that you don't really gain anything, other systems don't know how to interpret those scribbles. Suggesting doctors enter fields into a form instead of scribbling notes will get you no where, doctors are the stupidest and most stubborn smart people you will come across. Not that this is perfect anyway, sometimes you really do just need those random notes that don't really fit anywhere else. Some of the younger ones will type instead of scribble, but it's still mostly free form text and not data. The industry is still stuck on the idea that one doctor visit == one patient record as well, the thought that doctors could input blood pressure readings in their own section and have it display the history as a spreadsheet (or even a graph) has not gained any acceptance. So it's not just about how we transfer information but how it's created as well, we haven't invented the right set of primitives to store it in the first place. I've spent a bit of time thinking about how I'd improve things and think things need to be more like emacs org mode or a jupyter notebook than any current EMRS, but even that might have to wait for a generation of scribblers to die.

vacri 9y ago
From working with a variety of ticketing systems, any veteran dev will be able to tell you just how painful it is to work with multiple fields. Entry is never zippy. The more fields you have, the more painful it is. Most devs, given the choice, will use a ticketing system that is basically free text + a ticket title. If devs, who live and breathe tech, can't comfortably handle the idea of splitting information over various fields (for superior tracking and analysis), why should doctors be any different?
maccard 9y ago
> Suggesting doctors enter fields into a form instead of scribbling notes will get you no where, Maybe in the US, but in the UK and Ireland, all my doctors notes have been typed into a system that is shared among all the doctors in the practice. Last time I went for for an MRI i was given a CD with the mri on it, and I brought it with me to my next appointments. > doctors are the stupidest and most stubborn people you will come across That’s not fair. When I was in university most of the old professors still used overhead projectors and taught the same course from 20 years ago. When I bought my house my solicitor faxed everything, and posted me out the originals of the documents I needed, which took up an entire a4 binder. Developers seem almost bipolar; on one hand you have the “must use shiny new tech” and on the other hand, you have people who won’t update third party libraries ever. We’re still stuck with the same representations of data that we had 40 years ago, and broadly the same basic tools. C and C++ still literally copy and paste header files when including them, all in the name of backwards compatibility. My (long winded) point being, all professions have their own stubborn qualities, and pinning it on old people or a specific profession is wrong

chaitanyana 9y ago

American health care system needs Changes in many ways

dbcooper 9y ago

Paging Pokitdok, Hashed Health, Change Healthcare etc.

Ice_cream_suit 9y ago

Two words: "HIPAA compliaance"

grecy 9y ago

America's infrastructure is behind in many ways. Bank transfers are arcane, no chip n pin, fax machines, etc. etc. I'm moving through West Africa, where these problems have been solved 2+ years ago.

mamon 9y ago
America's infrastructure is behind other developed countries because once upon a time it was AHEAD of it's time. When you have a legacy infrastructure that is good enough it is harder to justify the cost of replacing it with something else. African countries, or Eastern European ones didn't have this dillema because they didn't have a legacy infrastructure to deal with.
- deleted 9y ago
  [deleted]
- alkonaut 9y ago
  All western countries had faxes, magnetic strip cards, paper check payments, etc. And most of them have no traces of that. I think there must be some other element to it as well, and it's probably not only "well US is big". I think one is the diversity of states and companies. Having tons of systems and businesses communicating over several state borders with varying regulations, it's very easy to just settle with the lowest common denominator which might be faxes, cash etc. Second I think it's a big cultural difference. In the EU for example (Which is looked on with at least as much suspicion as "federal government" in the US) we see it as an important job of central government to put agressive timelines for introduction of modern tech. Because things like this (chip + pin) for example is a herd immunity thing where the cost to upgrade is only motivated if customers actually have the cards etc - so we are very happy to see legislation requiring non-chip credit cards to be phased out, for example. Technological advance like this, or environment rules etc., is NOT seen as overreach, where a lot of other laws would be. Third it's the power of corporations in relation to government. If corporate lobbyists see that a regulation will affect their bottom line (such as all of retail having to buy chip+pin equipment within 3 years) they protest. In the EU, there is just no chance that a retail lobby would be able to resist EU legislation that was advertised as good for consumers.

PragmaticPost 9y ago

Most modern copiers have the ability to encrypt PDF files. The password is the problem. There are also some email providers who serve healthcare that offer security that abides by HIPAA rules. The solution is there. It's mandating a standard that facilitates the flow of data that is not.

avryhof 9y ago

On this note, one of the divisions of the company I work for is hiring a Python/Django developer in the Syracuse, NY area - https://www.indeed.com/cmp/Noble-Health-Services/jobs/Application-Analyst-f132d5fe58493d9d?q=Noble https://www.indeed.com/cmp/Noble-Health-Services/jobs/Applic... Change healthcare, develop for a pharmacy!

featherverse 9y ago

The answer is simple. Regarding technology, _most_ people are still in the 1980s. More than anything, this is proof that tech industry salaries are on average _way too low_. Stop working for peanuts. Let them go back to pen and paper. Let their corporations collapse. Demand to be paid what you're all worth.