8 ms·
Or you could solve this issue by not having this data in the first place. This data is so private and the violation of trust by the system so complete that the
by candiodari 6y ago
Or you could solve this issue by not having this data in the first place. This data is so private and the violation of trust by the system so complete that the trust of most of these people will never be repaired.
You don't need secure data vaults, you need LESS DATA. And anything you can't deal with seeing published, think VERY long and hard if it is absolutely necessary to have it. Even when it is necessary, is there any reason at all for not having it on a unpowered hard drive in a bank vault that requires approval from at least 2 directors to temporarily connect it to a machine that has never been connected to the internet.
Most security breaches (including ransomware events) are insider attacks. Secure data vaults that only allow "authorized persons" access to patient data are therefore never secure.
Secure data vaults are
- Hamuko 6y agoI don't see how any patient data can exists in this world under these conditions.
- candiodari 6y agoOn a notebook (the paper kind), locked, in a specific doctor's office is not a problem at all.
- Hamuko 6y agoHow do patient referrals work?
- aspenmayer 6y agoSame way they worked before computers? Fax machines still exist.
- Hamuko 6y agoWell now the patient data is not really locked away in a specific office.
- aspenmayer 6y agoHow about physical mailing?
- Sebb767 6y ago> Fax machines still exist Sure, send the patient data over an unencrypted phone line, probably using a never-updated smart scanner to an internet-connected IoT-printer. Sounds like a plan!
- aspenmayer 6y agoYou could make the same argument about the mail system.
- Sebb767 6y agoAnd I would! While mail is not as easy to monitor at scale or distance, the files of single patients are even less protected; catching a letter is rather trivial if one really wants to.
- ent 6y agoIn what part of the world? I haven't seen one in Finland since maybe the early 2000's.
- gruez 6y agoHow did they work a few decades ago?
- RobertDeNiro 6y agoThis shows a very poor understanding of how doctors work. On difficult cases doctors often need to consult with others, sharing information about the case. Furthermore, in pysch. multiple followups are required. If this is all solely done on paper the logistics become more complex and error prone.
- tupputuppu 6y agoPsychologists aren't doctors in Finland where the story is from.
- Aerroon 6y agoThe alternative is that people who have any kind of sensitive issue (which is most mental health issues) won't see a mental health professional at all. There are many people in my social circle that I cannot imagine seeing a mental health professional in general. You add on the risk of the actual discussion leaking and it would be impossible to even convince them to do so. That's the kind of damage leaks like this do.
- fogihujy 6y agoA notebook might be just a little to old-school to work in the modern world, but there's definitely reason to consider having such sensitive data completely separated from the Internet.
- lloda 6y agoThe patient can keep the data and have the doctor sign it.
- Hamuko 6y agoThat's not possible. Medical records have to be kept for 12 years (IIRC).
- candiodari 6y agoWhy is psychological data considered a medical record? Only the medication used, and only as long as it is relevant, should be medical.
- Hamuko 6y agoIs mental healthcare not healthcare?
- astura 6y agoBecause medical coverage/insurance programs pay for it, for one.
- tupputuppu 6y agoIt's not - in Finland where the story is from.
- Hamuko 6y agoI have different info on that. https://www.valvira.fi/terveydenhuolto/hyva-ammatinharjoittaminen/potilasasiakirjat/potilasasiakirjat_psykoterapiassa https://www.valvira.fi/terveydenhuolto/hyva-ammatinharjoitta...
- tupputuppu 6y agoThe story is from Finland. We don't have such requirements, especially relating to psychotherapy session transcripts - these are done by psychologists who aren't even doctors in Finland, all this data is outside of our healthcare data systems.
- jcims 6y agoIt should be an option to ask hospitals to purge your data or have some kind of intentional and deliberate opt in/opt out conversation at some point in care. This is a double-edged sword though. Case history is incredibly valuable for physicians and personally I would likely opt for them to retain it if I'm going through any kind of chronic illness. My wife went through a very severe illness that lasted over two years. We saw numerous hospitals and doctors over that span and the ability to have the hospitals exchange her data completely and accurately was instrumental in ensuring timely and accurate review of her case. Sure I could have done that with some kind of data checkout/checkin mechanism but I wasn't in the best state of mind to be able to implement all of the resiliency mechanisms required to take appropriate care of that information.
- Hamuko 6y ago>It should be an option to ask hospitals to purge your data or have some kind of intentional and deliberate opt in/opt out conversation at some point in care. What if you suspect that there's been medical malpractice done on you and you've purged your data? Or there's some sort of an investigation where the authorities need to get in contact with a certain doctor's patients or something?
- jcims 6y agoPerfectly valid questions that need to be part of the calculation and why I'm interested in this topic. I don't think my wife experienced anything that would reach the bar of malpractice, but mistakes and poor operational practices definitely impacted her care. Because the hospitals retain this data I was collect all of the medical records from her experience and am currently seeking a subject matter expert to review them (very difficult to find it turns out). If I had requested that this data be purged without having a complete copy then obviously the information is not going to contribute to any follow-up investigation. There are very real and concerning issues with ongoing custody of this type of data by any organization, let alone any of the access that is provided to it through relationships that we as consumers are unaware of. But I don't think the answer is wholesale elimination of custody, there's a lot of pros and cons that everyone should be in a position to understand and decide for themselves.
- syshum 6y agoIt seems like with environmental policy where people forgot about Reduce and Reuse/Repair as vital parts of the of environmental protection triangle and instead only focus on Recycle Data Protection has fallen into the same trap, where no one even questions if data should be collected, and then if it is collected for how long it should be retained. It seems the default position is Collect all info, and store it forever, encryption can protect it for all time....
- glaucon 6y ago|Most security breaches (including ransomware events) are insider attacks I'm interested in this suggestion, do you have any data ? The breaches that I recall most vividly (and I appreciate that confirmation bias is at play here) involve outsiders accessing cloud based data stores (almost always S3 because of market dominance) the access rights of which have been inadvertently set up to allow public access. I can recall a case like the above which was then exploited by a disgruntled insider but mostly, it seems to me, it's outsiders. Would be interested to see some numbers although given a lot of ransom events are, I assume, never made public it's probably difficult to get anything definitive ?
- glaucon 6y agoHaving just reviewed the 'Major Incidents' section of https://en.m.wikipedia.org/wiki/Data_breach https://en.m.wikipedia.org/wiki/Data_breach I can see my perception of this stuff is badly skewed, I just happen to be interested in S3 so I pay attention to those.