5 ms·

For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the pr

For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the privacy of their clients. There are a bunch of problems that connection and automation bring with them, the rise of digital monocultures seems to be one of them.

hot_gril 2y ago
I rented from a small landlord office, they were using Windows XP long after dropped support and got infected with ransomware.
momojo 2y ago
Interested in hearing more. I've heard the same sentiment from not just old (~30 yr old) practices but just-starting ones. Like any non-technical market, they just bought what was pitched, and there's often more gripes than complains. One example: When a patient transfers to another dental office, their records need to follow. Before you "had to" fax or snail-mail them. The software/cloud solutions promised streamlined, painless transfers, but those benefits never really materialized due to the amount of HIPA-compliancy issues (the details around this pain point are fuzzy). The office-manager explaining all of this was (half-jokingly) fantasizing about going back to snail mail.
- silverquiet 2y ago
  I work in infrastructure for an EHR provider, so interoperability isn't really my area, but I do work with devs who must do this. I'd say the problem is approximately zero to do with HIPAA; we almost never even talk about it in my experience. It's just a lack of standards, and poor implementations of what standards do exist - every once in awhile something will crash because of a weird escape character or something in an HL7 message (though that could be on us no doubt). I believe last year was the first time that there was a mandated standard to export EHR data and one of the devs was complaining that it didn't even say if units should be imperial or metric. I'm told the labs are a complete mess and have no federally mandated standards; I know they've written code because doctor X wants to use lab Y. Obviously the big national labs win because you only have to write code for them once and all customers can use them. It's just another aspect of a broken American healthcare "system" - there's no incentive for anyone to interoperate in the best case, and in the worst case it allows you to create lock-in for your product.
buildbot 2y ago
This works until it really doesn't - for example, you are visiting your family 3 hours away from home, slip and fall, go the ER, and die because you are allergic to some random drug but that was only noted in your paper documents. This is a contrived example and allergies to medicine are typically checked on the fly - The point is, you will be at a disadvantage any time your records need to be ported somewhere new.
watsocd 2y ago
I don't believe they will go back to paper records. However, I could see certain professions operating with simplified "air gapped" systems. Not connected to the Internet at all. It would take some disciplined processes but it would be possible. Updates could be done by qualified tech's to maintain the air gap when updating with a "sneakernet".
sofixa 2y ago
> For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the privacy of their clients. "Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them. With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. With paper, you're screwed. I still remember a few years ago walking on a street in a city in Easter Europe, behind a bank office for a bank which no longer exists. There were dumpsters nearby that were overflowing with garbage, and the wind was carrying some of it around, like sheets of paper with bank loan applications, ID card scans, etc etc etc. Paper is not easier to secure than digital systems if the people supposed to secure it don't care.
- pjmorris 2y ago
  > With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe. I think you are insightful in identifying care as the key principle. My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.
  - sofixa 2y ago
    > None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe. But it's relatively easy to only have the people that need specific information to have it. Receptionist only has your names and contact information; doctor only has your relevant medical information; etc etc. With paper, either everything will be together in a big file, or it would be very impractical to manage. > My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components. Potentially. Or they'll improvise because they're a small operation and there's trust. Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.

hot_gril 2y ago

I rented from a small landlord office, they were using Windows XP long after dropped support and got infected with ransomware.

momojo 2y ago

Interested in hearing more. I've heard the same sentiment from not just old (~30 yr old) practices but just-starting ones. Like any non-technical market, they just bought what was pitched, and there's often more gripes than complains. One example: When a patient transfers to another dental office, their records need to follow. Before you "had to" fax or snail-mail them. The software/cloud solutions promised streamlined, painless transfers, but those benefits never really materialized due to the amount of HIPA-compliancy issues (the details around this pain point are fuzzy). The office-manager explaining all of this was (half-jokingly) fantasizing about going back to snail mail.

silverquiet 2y ago
I work in infrastructure for an EHR provider, so interoperability isn't really my area, but I do work with devs who must do this. I'd say the problem is approximately zero to do with HIPAA; we almost never even talk about it in my experience. It's just a lack of standards, and poor implementations of what standards do exist - every once in awhile something will crash because of a weird escape character or something in an HL7 message (though that could be on us no doubt). I believe last year was the first time that there was a mandated standard to export EHR data and one of the devs was complaining that it didn't even say if units should be imperial or metric. I'm told the labs are a complete mess and have no federally mandated standards; I know they've written code because doctor X wants to use lab Y. Obviously the big national labs win because you only have to write code for them once and all customers can use them. It's just another aspect of a broken American healthcare "system" - there's no incentive for anyone to interoperate in the best case, and in the worst case it allows you to create lock-in for your product.

buildbot 2y ago

This works until it really doesn't - for example, you are visiting your family 3 hours away from home, slip and fall, go the ER, and die because you are allergic to some random drug but that was only noted in your paper documents. This is a contrived example and allergies to medicine are typically checked on the fly - The point is, you will be at a disadvantage any time your records need to be ported somewhere new.

watsocd 2y ago

I don't believe they will go back to paper records. However, I could see certain professions operating with simplified "air gapped" systems. Not connected to the Internet at all. It would take some disciplined processes but it would be possible. Updates could be done by qualified tech's to maintain the air gap when updating with a "sneakernet".

sofixa 2y ago

> For about ten years, I've theorized that we will see the rise of 'boutique' doctor, dentist, and law offices that keep only paper records for the sake of the privacy of their clients. "Privacy" until a disgruntled staffer copies or takes a picture or just takes the pieces of paper and publishes them. With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. With paper, you're screwed. I still remember a few years ago walking on a street in a city in Easter Europe, behind a bank office for a bank which no longer exists. There were dumpsters nearby that were overflowing with garbage, and the wind was carrying some of it around, like sheets of paper with bank loan applications, ID card scans, etc etc etc. Paper is not easier to secure than digital systems if the people supposed to secure it don't care.

pjmorris 2y ago
> With digital systems, this can be mitigated (rate limiting, encryption and least privilege information sharing, audit logs etc.) to an extent. None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe. I think you are insightful in identifying care as the key principle. My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components.
- sofixa 2y ago
  > None of those measures do anything to prevent someone from taking a picture of the screen, which is the same sinking boat you describe. But it's relatively easy to only have the people that need specific information to have it. Receptionist only has your names and contact information; doctor only has your relevant medical information; etc etc. With paper, either everything will be together in a big file, or it would be very impractical to manage. > My argument would be that care is more easily achieved by smaller groups working on smaller populations using fewer components. Potentially. Or they'll improvise because they're a small operation and there's trust. Many a small company has been caught with terrible physical or digital security, because nobody cares and at their scale dedicated people to care don't make sense.