5 ms·

What’s the dichotomy implied by the hyperbolic title? I couldn’t find any sign of it in the first few pages.

by raldi 4y ago

projektfu 4y ago
The only one I found was that a locked door of emergency supplies had the combination written on the door. Nobody would deny doctors and nurses access to emergency supplies. The article is missing a few things about the environment and its pressures. For example, you have physical access restrictions on many aspects of a hospital. Pharmacy, controlled drug dispensaries, materiel storage, biowaste, nurse's stations, isolation, certain patient rooms, OR, etc. These all have their own rules and many of them have access badges to enter, or combination locks, or software processes to gain access. There is HIPAA (or other patient data control restrictions in other jurisdictions). HIPAA has internal and external controls. Some of it is actually required by law, some by regulation, some as part of accreditation, some is recommended by consultants, and a lot is dreamed up by people apparently out of nowhere. HIPAA internal controls require shielding of patient data from spying eyes. HIPAA external controls require restricting egress of data except as authorized by the patient or permitted by law and regulation. With paper records, you use file folders and clipboards that can cover the data and you try to not leave it unattended. It can be shared internally in the hospital with the people who need it and you can generally trust the providers to do the right thing. With electronic data it can be easier to lock it down but harder to provide access. Hospital IT is incentivized to not have a big data exfiltration embarrassment so they will probably set policy on a strict level and require complaints before they make it easier to access. In most hospitals, the workforce is quite fluid. There are many temporary employees at all levels, and providers join and leave various provider groups that are connect to, but not part of, the hospital. There are many contractors walking around. Some people low on the payscale have access to almost the whole hospital (such as the constantly working painters required by accreditation). Some people high up are not always given access permission to areas they are not typically working but may need to access one day. The same is true electronically, the doctor may not be able to access some information that the IT temp can access. In addition, the integration of systems is a constant headache. Every little system is built with its own patient management system and usually has its own usernames and passwords. Many hospitals are eventually able to harmonize these systems but not all of them can be done cost-effectively. Finally, as the article mentions, there is the fact that a clipboard can be moved with the patient but an EMR may not have a terminal convenient to where data needs to be entered. All of these things (and more, I'm sure) provide a lot of friction to using the standard means of access control, and workarounds abound.
- aftbit 4y ago
  >(such as the constantly working painters required by accreditation) Can you speak more about this or provide some links? I am fascinated by the idea that there is a small army of painters and maintainers moving unnoticed through our planet's hospitals. Sort of a parallel world to the actual care providers.
  - projektfu 4y ago
    Nah, usually just one painter or so per hospital. It could be done by a contractor but because the painting has to be kept up for accreditation, they usually have someone on staff doing a little every day.
nisegami 4y ago
I didn't see anything in the paper that matches the title. Seems to be hyperbole (that doesn't make complete sense either).
- noSyncCloud 4y ago
  It would make more sense if you'd ever spent time in a healthcare setting. As it is, you're unqualified to make a judgment on its sensibility.
xwdv 4y ago
You either accept the password and get immediate access to life saving information, or you drag your feet and go through portals and red tape and by the time you get access after several business days or weeks your patient is dead.
goda90 4y ago
Probably related to password sharing? Sharing your password is considered a bad practice, but if it's essential that someone else gets into a system quickly in order to save a patient, then password sharing doesn't seem so bad in comparison to a dead patient.
mikeyouse 4y ago
It's not clear in the paper, but it's a common issue in healthcare settings. Most meds are dispensed via med cabinets (Pyxis is the primary brand: https://www.bd.com/assets/images/our-products/medication-supply-management/pyxis-medstation-es-system_1R_DI_1011-0003.png https://www.bd.com/assets/images/our-products/medication-sup...) that have a variety of controls in place to prevent diversion and to track medications delivered. It's a hard problem because in the normal flow of the world, the provider will login to the machine, select the correct patient, be given an option for the drugs that are prescribed to that patient, choose the correct one, and then administer the drug when the correct drawer opens up. The software checks for med allergies, appropriate frequency between doses, etc. etc. But what happens when the employee's login doesn't work and they need a drug emergently? What happens when the IT mandate to change passwords shows up during a crash? What happens when the patient is crashing and there are no orders for the correct medication? What happens when the mechanical drawers stick and won't release the drug? It's largely solved with old school "crash carts" that have a standard inventory with all of the emergency drugs that could be required, which are then reconciled to derive what was taken out/used. But then you need to track whether the narcotics that were taken were actually given and not just diverted to someone's pocket.. and not every drug is stable for long periods in these carts... Separately is just the overall shitshow that is medical software -- my spouse worked for a hospital for three months before she was finally granted access to all of the systems she needed to perform her job safely. Basically just borrowed other peoples' access where she could and took extensive handwritten notes that will likely never be entered into the EMR.
- cogman10 4y ago
  All this comes from a common place. The people buying the software and adding the policies are NOT the same people who use the software or enforce the policies. I saw this at HP. As a new hire, I had like 20 different meetings talking about the various policies of the company you had to follow. After I started working, I found my team pretty openly and blatantly violated almost all those policies because they were unworkable and we had a job to do. Things like "shadow it" were openly mocked because hp had an absolute worthless situation (they outsourced their IT management... yeah.. really terrible decision for what you'd call a tech company). The IT requests I did make were basically ignored. Anything short of a password reset request went nowhere.

What’s the dichotomy implied by the hyperbolic title? I couldn’t find any sign of it in the first few pages.

by raldi 4y ago

What’s the dichotomy implied by the hyperbolic title? I couldn’t find any sign of it in the first few pages.

The only one I found was that a locked door of emergency supplies had the combination written on the door. Nobody would deny doctors and nurses access to emergency supplies. The article is missing a few things about the environment and its pressures. For example, you have physical access restrictions on many aspects of a hospital. Pharmacy, controlled drug dispensaries, materiel storage, biowaste, nurse's stations, isolation, certain patient rooms, OR, etc. These all have their own rules and many of them have access badges to enter, or combination locks, or software processes to gain access. There is HIPAA (or other patient data control restrictions in other jurisdictions). HIPAA has internal and external controls. Some of it is actually required by law, some by regulation, some as part of accreditation, some is recommended by consultants, and a lot is dreamed up by people apparently out of nowhere. HIPAA internal controls require shielding of patient data from spying eyes. HIPAA external controls require restricting egress of data except as authorized by the patient or permitted by law and regulation. With paper records, you use file folders and clipboards that can cover the data and you try to not leave it unattended. It can be shared internally in the hospital with the people who need it and you can generally trust the providers to do the right thing. With electronic data it can be easier to lock it down but harder to provide access. Hospital IT is incentivized to not have a big data exfiltration embarrassment so they will probably set policy on a strict level and require complaints before they make it easier to access. In most hospitals, the workforce is quite fluid. There are many temporary employees at all levels, and providers join and leave various provider groups that are connect to, but not part of, the hospital. There are many contractors walking around. Some people low on the payscale have access to almost the whole hospital (such as the constantly working painters required by accreditation). Some people high up are not always given access permission to areas they are not typically working but may need to access one day. The same is true electronically, the doctor may not be able to access some information that the IT temp can access. In addition, the integration of systems is a constant headache. Every little system is built with its own patient management system and usually has its own usernames and passwords. Many hospitals are eventually able to harmonize these systems but not all of them can be done cost-effectively. Finally, as the article mentions, there is the fact that a clipboard can be moved with the patient but an EMR may not have a terminal convenient to where data needs to be entered. All of these things (and more, I'm sure) provide a lot of friction to using the standard means of access control, and workarounds abound.

aftbit 4y ago
>(such as the constantly working painters required by accreditation) Can you speak more about this or provide some links? I am fascinated by the idea that there is a small army of painters and maintainers moving unnoticed through our planet's hospitals. Sort of a parallel world to the actual care providers.
- projektfu 4y ago
  Nah, usually just one painter or so per hospital. It could be done by a contractor but because the painting has to be kept up for accreditation, they usually have someone on staff doing a little every day.

nisegami 4y ago

I didn't see anything in the paper that matches the title. Seems to be hyperbole (that doesn't make complete sense either).

noSyncCloud 4y ago
It would make more sense if you'd ever spent time in a healthcare setting. As it is, you're unqualified to make a judgment on its sensibility.

xwdv 4y ago

You either accept the password and get immediate access to life saving information, or you drag your feet and go through portals and red tape and by the time you get access after several business days or weeks your patient is dead.

goda90 4y ago

Probably related to password sharing? Sharing your password is considered a bad practice, but if it's essential that someone else gets into a system quickly in order to save a patient, then password sharing doesn't seem so bad in comparison to a dead patient.

mikeyouse 4y ago

It's not clear in the paper, but it's a common issue in healthcare settings. Most meds are dispensed via med cabinets (Pyxis is the primary brand: https://www.bd.com/assets/images/our-products/medication-supply-management/pyxis-medstation-es-system_1R_DI_1011-0003.png https://www.bd.com/assets/images/our-products/medication-sup...) that have a variety of controls in place to prevent diversion and to track medications delivered. It's a hard problem because in the normal flow of the world, the provider will login to the machine, select the correct patient, be given an option for the drugs that are prescribed to that patient, choose the correct one, and then administer the drug when the correct drawer opens up. The software checks for med allergies, appropriate frequency between doses, etc. etc. But what happens when the employee's login doesn't work and they need a drug emergently? What happens when the IT mandate to change passwords shows up during a crash? What happens when the patient is crashing and there are no orders for the correct medication? What happens when the mechanical drawers stick and won't release the drug? It's largely solved with old school "crash carts" that have a standard inventory with all of the emergency drugs that could be required, which are then reconciled to derive what was taken out/used. But then you need to track whether the narcotics that were taken were actually given and not just diverted to someone's pocket.. and not every drug is stable for long periods in these carts... Separately is just the overall shitshow that is medical software -- my spouse worked for a hospital for three months before she was finally granted access to all of the systems she needed to perform her job safely. Basically just borrowed other peoples' access where she could and took extensive handwritten notes that will likely never be entered into the EMR.

cogman10 4y ago
All this comes from a common place. The people buying the software and adding the policies are NOT the same people who use the software or enforce the policies. I saw this at HP. As a new hire, I had like 20 different meetings talking about the various policies of the company you had to follow. After I started working, I found my team pretty openly and blatantly violated almost all those policies because they were unworkable and we had a job to do. Things like "shadow it" were openly mocked because hp had an absolute worthless situation (they outsourced their IT management... yeah.. really terrible decision for what you'd call a tech company). The IT requests I did make were basically ignored. Anything short of a password reset request went nowhere.