3 ms·

Why are sessions recorded?

g_p 6y ago
This seems to be a pretty big question - how long are they retained for as well? From their own FAQ (on their NHS GP at Home service) at https://support.gpathand.nhs.uk/hc/en-us/articles/115003709229-Who-has-access-to-my-consultation-recordings- https://support.gpathand.nhs.uk/hc/en-us/articles/1150037092... : "All recordings are encrypted and accessible only to you and restricted members of the Babylon GP at hand senior clinical management team managing your care, for the purpose of ensuring exceptional quality of service.ted and accessible only to you and restricted members of the GP at hand senior clinical management team managing your care, for the purpose of ensuring exceptional quality of service." Asides from the fact it's got a copy-paste typo on it (perhaps not an important topic), no real info on how long recordings are retained for. Edit: From https://www.gpathand.nhs.uk/legal/privacy-policy https://www.gpathand.nhs.uk/legal/privacy-policy, it says recordings are retained until 10 years after death (with a few caveats), so "forever"... But only accessible via the app for 14 days, then you would need to ask for access. They also say at https://support.gpathand.nhs.uk/hc/en-us/articles/115003692305-How-safe-is-the-data-that-babylon-holds- https://support.gpathand.nhs.uk/hc/en-us/articles/1150036923... that "All medical records are centrally held and meet or exceed NHS Standards. We work to processes and procedures that meet ISO27001 standards and have been independently audited and confirmed by BSI. The application has also been independently security tested." They could probably argue these recordings aren't "medical records", but a recording of what was discussed is tantamount to a medical record. Just goes to prove to any doubters left that "tickbox" security doesn't work, regardless of ISO standards... And that a pentest is only as good as the pentesters, and the version of the system they tested.
- ekzy 6y ago
  Re-watching a consultation is useful for both the patient and the consultant. As far as I know (I did some consulting work for them), the data is encrypted and not accessed for any other purpose.
  - epanchin 6y ago
    I wouldn’t allow my doctors surgery to record my in person GP sessions, why would I allow an app to do the same?
  - g_p 6y ago
    I can see why there is a benefit to the patient of being able to check back in to listen to something again. It might be encrypted, but it appears that encryption was ineffective (i.e. the API or application has access to the keys), since a user was able to access others' recordings. To me that's the big problem with everyone claiming to be "encrypted" - Dropbox was also encrypted back when they forgot to check user passwords for a few hours and anyone could log in "as you".
  - bigiain 6y ago
    > As far as I know As far as I know (I read the article), the recordings were made available to random users due to a fault in the backend side. Whatever encryption and access control they are using is totally bogus.

g_p 6y ago

This seems to be a pretty big question - how long are they retained for as well? From their own FAQ (on their NHS GP at Home service) at https://support.gpathand.nhs.uk/hc/en-us/articles/115003709229-Who-has-access-to-my-consultation-recordings- https://support.gpathand.nhs.uk/hc/en-us/articles/1150037092... : "All recordings are encrypted and accessible only to you and restricted members of the Babylon GP at hand senior clinical management team managing your care, for the purpose of ensuring exceptional quality of service.ted and accessible only to you and restricted members of the GP at hand senior clinical management team managing your care, for the purpose of ensuring exceptional quality of service." Asides from the fact it's got a copy-paste typo on it (perhaps not an important topic), no real info on how long recordings are retained for. Edit: From https://www.gpathand.nhs.uk/legal/privacy-policy https://www.gpathand.nhs.uk/legal/privacy-policy, it says recordings are retained until 10 years after death (with a few caveats), so "forever"... But only accessible via the app for 14 days, then you would need to ask for access. They also say at https://support.gpathand.nhs.uk/hc/en-us/articles/115003692305-How-safe-is-the-data-that-babylon-holds- https://support.gpathand.nhs.uk/hc/en-us/articles/1150036923... that "All medical records are centrally held and meet or exceed NHS Standards. We work to processes and procedures that meet ISO27001 standards and have been independently audited and confirmed by BSI. The application has also been independently security tested." They could probably argue these recordings aren't "medical records", but a recording of what was discussed is tantamount to a medical record. Just goes to prove to any doubters left that "tickbox" security doesn't work, regardless of ISO standards... And that a pentest is only as good as the pentesters, and the version of the system they tested.

ekzy 6y ago
Re-watching a consultation is useful for both the patient and the consultant. As far as I know (I did some consulting work for them), the data is encrypted and not accessed for any other purpose.
- epanchin 6y ago
  I wouldn’t allow my doctors surgery to record my in person GP sessions, why would I allow an app to do the same?
- g_p 6y ago
  I can see why there is a benefit to the patient of being able to check back in to listen to something again. It might be encrypted, but it appears that encryption was ineffective (i.e. the API or application has access to the keys), since a user was able to access others' recordings. To me that's the big problem with everyone claiming to be "encrypted" - Dropbox was also encrypted back when they forgot to check user passwords for a few hours and anyone could log in "as you".
- bigiain 6y ago
  > As far as I know As far as I know (I read the article), the recordings were made available to random users due to a fault in the backend side. Whatever encryption and access control they are using is totally bogus.