4 ms·

>The clinic has digitized its own patient data. But its electronic system can’t connect with other clinics’ records. So when doctors want to retrieve records fr

>The clinic has digitized its own patient data. But its electronic system can’t connect with other clinics’ records. So when doctors want to retrieve records from another office — an ultrasound for a pregnant patient, for example — they have to turn to the fax Haven't these people at least heard of email?

mcpherrinm 9y ago
They've heard of it, but aren't going to use it. Email is generally not encrypted when stored at rest in many hops along the way, which should be considered insecure. While fax is unencrypted, it's generally not stored in any intermediate systems and has established history of being considered HIPAA compliant.
- acchow 9y ago
  If email is encrypted, why does it matter that it is stored in any intermediary place along the way?
  - mcpherrinm 9y ago
    I missed a negative. I've updated my comment.
  - rjbwork 9y ago
    Email actually generally isn't encrypted. Sure, you can do things like PGP encryption, but not even some of it's formerly strongest advocates bother anymore. Consider email open to anyone between you and the recipient.
- interfixus 9y ago
  Security by presumed obscurity. We have a winner.
  - taneq 9y ago
    Security by obscurity isn't military grade security but it's a lot better than insecurity by non-obscurity if those are your only two options.
    - danielbarla 9y ago
      Sure, but it's incredibly rare that such a neat dichotomy exists. In reality, there are plenty of alternatives, yet we stick to ones we perceive as more secure. I've heard the argument that fax is preferred over email because "you can just edit an email", and this highlights the issue. The difficulty bar is raised just a tiny bit for fax, yet the scrutiny is dropped right down.
  - ubernostrum 9y ago
    It's a bit more complicated than that. The real story is a combination of: 1. US health care privacy law (primarily HIPAA) has an "analog hole" of sorts. Basically, the security rules around phone/fax communications are far simpler and easier (and thus cheaper!) to comply with than the rules around things like digital networking. So people look at this, see that faxing things and then scanning them (or even paying people to do manual data entry) is cheaper than using more modern techniques and incurring compliance costs for the stricter security rules. 2. Doctors don't upgrade technology unless they have to. New systems cost money, and they don't want to spend money. Fax machines are established, understood, cheap. And they are actually one of the least scary things about the health system -- you don't want to know how many doctors are managing their records and interacting with insurance websites through IE on Windows XP, or even worse setups. 3. For all the crap you might throw at faxing as a way to do things, you have to admit it's easy. Electronic health record systems are a nightmare of badly-specified, horrendously complicated formats that no two vendors ever implement the same way. When consumers of electronic records, like insurers, sign up for clearing-house services a good bit of what they're paying for is getting to make this someone else's problem.
- lostboys67 9y ago
  And set up properly Fax's can provide proof of delivery

mcpherrinm 9y ago

They've heard of it, but aren't going to use it. Email is generally not encrypted when stored at rest in many hops along the way, which should be considered insecure. While fax is unencrypted, it's generally not stored in any intermediate systems and has established history of being considered HIPAA compliant.

acchow 9y ago
If email is encrypted, why does it matter that it is stored in any intermediary place along the way?
- mcpherrinm 9y ago
  I missed a negative. I've updated my comment.
- rjbwork 9y ago
  Email actually generally isn't encrypted. Sure, you can do things like PGP encryption, but not even some of it's formerly strongest advocates bother anymore. Consider email open to anyone between you and the recipient.
interfixus 9y ago
Security by presumed obscurity. We have a winner.
- taneq 9y ago
  Security by obscurity isn't military grade security but it's a lot better than insecurity by non-obscurity if those are your only two options.
  - danielbarla 9y ago
    Sure, but it's incredibly rare that such a neat dichotomy exists. In reality, there are plenty of alternatives, yet we stick to ones we perceive as more secure. I've heard the argument that fax is preferred over email because "you can just edit an email", and this highlights the issue. The difficulty bar is raised just a tiny bit for fax, yet the scrutiny is dropped right down.
- ubernostrum 9y ago
  It's a bit more complicated than that. The real story is a combination of: 1. US health care privacy law (primarily HIPAA) has an "analog hole" of sorts. Basically, the security rules around phone/fax communications are far simpler and easier (and thus cheaper!) to comply with than the rules around things like digital networking. So people look at this, see that faxing things and then scanning them (or even paying people to do manual data entry) is cheaper than using more modern techniques and incurring compliance costs for the stricter security rules. 2. Doctors don't upgrade technology unless they have to. New systems cost money, and they don't want to spend money. Fax machines are established, understood, cheap. And they are actually one of the least scary things about the health system -- you don't want to know how many doctors are managing their records and interacting with insurance websites through IE on Windows XP, or even worse setups. 3. For all the crap you might throw at faxing as a way to do things, you have to admit it's easy. Electronic health record systems are a nightmare of badly-specified, horrendously complicated formats that no two vendors ever implement the same way. When consumers of electronic records, like insurers, sign up for clearing-house services a good bit of what they're paying for is getting to make this someone else's problem.
lostboys67 9y ago
And set up properly Fax's can provide proof of delivery