5 ms·

Stockholms landsting. The landsting are absolutely disgusting when it comes to handing out important tasks to private companys. I have _REALLY_ serious info in

Stockholms landsting. The landsting are absolutely disgusting when it comes to handing out important tasks to private companys. I have _REALLY_ serious info in there, and so do members of my family, that can not get out. But it's effing public, and the CEO of the company responsible is handling it like an asshole and Stockholms Landsting will just add it to the pile of fuckups. It would literally take less than a minute for a red team with IP adresses to find this out, if they ever so much as cared to consider IT-security. Why doesn't the local government force subject the companies they hand contracts to to that?

candiodari 8y ago
This is a far more general problem of states in general. They always see themselves above the rules they apply to others and this is particularly problematic in the medical realm, but also affects criminal justice for example. Governments just don't follow their own rules. This means that medical files just aren't trustworthy anymore, in the sense that the patient has no control over who sees these and how far they are sent. I could say "this is a problem in the Netherlands, Belgium, UK and US" where I know the situation is that essentially any doctor or medical staff anywhere can see everything in your file, related or not (e.g. in Belgium a pharmacist getting a woman's birth control prescription can see if they were ever treated in psychiatric care. Hell, the way the system looks, it'd literally be hard for the pharmacist not to notice). These files can even be used against you in a court of law, for example by child services. Not that all these countries aren't very busy introducing new ways to have the state do whatever they want to do without judicial intervention (Belgium "GAS boetes" and "snelrecht", Netherlands "ZSM"), and just not care how much damage is caused to save a few bucks. So what are you to do as a patient ? You cannot have this file destroyed, because these people have exceptions to every known privacy law. You can usually in theory have it corrected, but the system these governments put in place is fragmented into hundreds of pieces and nobody knows how it works, so good luck. Additionally actually getting them to cooperate even using an order from a judge is near impossible, and the systems may literally not support corrections in some cases. At this point the only advice you can give is to please ask every doctor you ask to not make any notes or files on you at all, and just deal with that. "I travel a lot and this just causes trouble" is a useful phrase in that regard.
- tapland 8y ago
  > At this point the only advice you can give is to please ask every doctor you ask to not make any notes or files on you at all, and just deal with that. Not an option if you have an illness. Also, that excuse wouldn't work in Scandinavia. But journals are kept in-house and I trust that way more than the affected service. If the journaling system breaks so does our banking and national ID-services. Also, this is a phone in service for what you are supposed to do, the step below going to the ER. Not mcuh you can do because you call them because you need their help. It's not an option not to. It unloads some calls and redirects the others to 911/the ER.
- sz4kerto 8y ago
  Plug: this is what we're trying to solve (amongst other things) at Patients Know Best. Giving the control back to the patient (you should always have full access to all data about yourself, and be able to control sharing of these records). We're mostly present in the UK at the moment.
  - tapland 8y ago
    The question is who stores the data. If you manage to let the patients keep it locally or in physical media it's insane. If you are keeping it for them it's the same worries as any other service. This was not journals though, but calls to nurses.
    - sz4kerto 8y ago
      We store data for you in a way that's considerably more secure and paranoid than how other providers work -- quite similarly to CryptDB. We can access your data when serving it to you, but your medical data is never stored on disk with a key that we store (it's derived from your password, and we throw it away after serving you through HTTP).
  - candiodari 8y ago
    More would be solved with simply the ability to, on a simple request and without justification, delete all data associated with yourself. Including all shared copies.
bobl 8y ago
You don't outsource, or 'privatize', because you want responsibility. In the pitch for the company in question they are stating how Stockholm has the lowest cost of all counties for this service [0]. Apparently that means outsourcing to a call center in Thailand [1]. Which in turn use some random provider [2]. It isn't really something hidden. In fact I would say that the whole idea is well supported by a significant part of voters who do not want government to do things, nor have restrictions on companies. If we limit the scope to just politics, Stockholm County had probably the most prominent scandal in the last couple of decades with Nya Karolinska, yet essentially lost no voters in the last election. It is easy to blame politicians, the government or even companies. But at the end of the day there aren't enough people requesting quality or responsibility. [0] https://www.medhelp.se/outsourcad-1177-tjänst-är-effektivast https://www.medhelp.se/outsourcad-1177-tjänst-är-effektivast [1] http://www.medicall.nu/hem-1.aspx http://www.medicall.nu/hem-1.aspx [2] https://www.voiceintegrate.com/se https://www.voiceintegrate.com/se https://www.applion.se/ https://www.applion.se/
- bobl 8y ago
  I just wanted to add, if I came across as criticizing, that I do agree with you. I do think the county is at fault. I do think people should expect more. I am just not seeing people doing that. Sweden was never perfect, but some of its reputation as a functional country is not unfounded. Today we have many systems we know aren't working, yet little is being done. I have even heard Swedish political analysts being dumbfounded that some political issues were there are obvious flaws, and should be something that matters to people, don't show in the polls. I guess it might have to do with the political landscape, were there are a large number of people that very likely are dissatisfied. It just doesn't, because of the polarized situation, result in change. Instead it results in whatever is less objectionable, which is mostly whatever made the situation bad in the first place. Anyway. I hope this incident get some more attention in Swedish media.
- ivanhoe 8y ago
  But blaming politicians, the government and companies is the way to request responsibility, isn't it? Without the political pressure you can request whatever you like, but to a little effect. And as outsourcing work like this is totally illegal under GDPR, it's definitely up to the government to enforce it's laws on it's own contractors, and it's up to companies to suffer the consequences of not treating peoples privacy seriously. The blame here is 100% real.

candiodari 8y ago

This is a far more general problem of states in general. They always see themselves above the rules they apply to others and this is particularly problematic in the medical realm, but also affects criminal justice for example. Governments just don't follow their own rules. This means that medical files just aren't trustworthy anymore, in the sense that the patient has no control over who sees these and how far they are sent. I could say "this is a problem in the Netherlands, Belgium, UK and US" where I know the situation is that essentially any doctor or medical staff anywhere can see everything in your file, related or not (e.g. in Belgium a pharmacist getting a woman's birth control prescription can see if they were ever treated in psychiatric care. Hell, the way the system looks, it'd literally be hard for the pharmacist not to notice). These files can even be used against you in a court of law, for example by child services. Not that all these countries aren't very busy introducing new ways to have the state do whatever they want to do without judicial intervention (Belgium "GAS boetes" and "snelrecht", Netherlands "ZSM"), and just not care how much damage is caused to save a few bucks. So what are you to do as a patient ? You cannot have this file destroyed, because these people have exceptions to every known privacy law. You can usually in theory have it corrected, but the system these governments put in place is fragmented into hundreds of pieces and nobody knows how it works, so good luck. Additionally actually getting them to cooperate even using an order from a judge is near impossible, and the systems may literally not support corrections in some cases. At this point the only advice you can give is to please ask every doctor you ask to not make any notes or files on you at all, and just deal with that. "I travel a lot and this just causes trouble" is a useful phrase in that regard.

tapland 8y ago
> At this point the only advice you can give is to please ask every doctor you ask to not make any notes or files on you at all, and just deal with that. Not an option if you have an illness. Also, that excuse wouldn't work in Scandinavia. But journals are kept in-house and I trust that way more than the affected service. If the journaling system breaks so does our banking and national ID-services. Also, this is a phone in service for what you are supposed to do, the step below going to the ER. Not mcuh you can do because you call them because you need their help. It's not an option not to. It unloads some calls and redirects the others to 911/the ER.
sz4kerto 8y ago
Plug: this is what we're trying to solve (amongst other things) at Patients Know Best. Giving the control back to the patient (you should always have full access to all data about yourself, and be able to control sharing of these records). We're mostly present in the UK at the moment.
- tapland 8y ago
  The question is who stores the data. If you manage to let the patients keep it locally or in physical media it's insane. If you are keeping it for them it's the same worries as any other service. This was not journals though, but calls to nurses.
  - sz4kerto 8y ago
    We store data for you in a way that's considerably more secure and paranoid than how other providers work -- quite similarly to CryptDB. We can access your data when serving it to you, but your medical data is never stored on disk with a key that we store (it's derived from your password, and we throw it away after serving you through HTTP).
- candiodari 8y ago
  More would be solved with simply the ability to, on a simple request and without justification, delete all data associated with yourself. Including all shared copies.

bobl 8y ago

You don't outsource, or 'privatize', because you want responsibility. In the pitch for the company in question they are stating how Stockholm has the lowest cost of all counties for this service [0]. Apparently that means outsourcing to a call center in Thailand [1]. Which in turn use some random provider [2]. It isn't really something hidden. In fact I would say that the whole idea is well supported by a significant part of voters who do not want government to do things, nor have restrictions on companies. If we limit the scope to just politics, Stockholm County had probably the most prominent scandal in the last couple of decades with Nya Karolinska, yet essentially lost no voters in the last election. It is easy to blame politicians, the government or even companies. But at the end of the day there aren't enough people requesting quality or responsibility. [0] https://www.medhelp.se/outsourcad-1177-tjänst-är-effektivast https://www.medhelp.se/outsourcad-1177-tjänst-är-effektivast [1] http://www.medicall.nu/hem-1.aspx http://www.medicall.nu/hem-1.aspx [2] https://www.voiceintegrate.com/se https://www.voiceintegrate.com/se https://www.applion.se/ https://www.applion.se/

bobl 8y ago
I just wanted to add, if I came across as criticizing, that I do agree with you. I do think the county is at fault. I do think people should expect more. I am just not seeing people doing that. Sweden was never perfect, but some of its reputation as a functional country is not unfounded. Today we have many systems we know aren't working, yet little is being done. I have even heard Swedish political analysts being dumbfounded that some political issues were there are obvious flaws, and should be something that matters to people, don't show in the polls. I guess it might have to do with the political landscape, were there are a large number of people that very likely are dissatisfied. It just doesn't, because of the polarized situation, result in change. Instead it results in whatever is less objectionable, which is mostly whatever made the situation bad in the first place. Anyway. I hope this incident get some more attention in Swedish media.
ivanhoe 8y ago
But blaming politicians, the government and companies is the way to request responsibility, isn't it? Without the political pressure you can request whatever you like, but to a little effect. And as outsourcing work like this is totally illegal under GDPR, it's definitely up to the government to enforce it's laws on it's own contractors, and it's up to companies to suffer the consequences of not treating peoples privacy seriously. The blame here is 100% real.