5 ms·

The part about passwords and password recovery is a bit troublesome in my opinion. If I am unconscious when I am brought to the hospital, the doctor should be

The part about passwords and password recovery is a bit troublesome in my opinion. If I am unconscious when I am brought to the hospital, the doctor should be able to access my records or release them to another doctor. Someone showing early signs of dementia might throw out their token and have no memory of ever having a password -- what do you do then? The threat is that an attacker might dump a database or steal a hard drive, not that a doctor might attack from the inside; doctors need to be able to access patient data under a variety of circumstances, including those where a patient is unable to give their consent or present a special token. I think a better solution would be to give each doctor a smartcard, and to require some sort of threshold signature for certain operations (like sending patient data outside the hospital network) so that no single doctor has all the power. Attribute based encryption comes to mind here, since the ciphertext should only be stored once but should allow any doctor to decrypt; nurses might also need some amount of decryption capability (and would then need a smartcard of their own). Giving patients full control over their records sounds great on paper, but in practice people will forget their passwords and lose their tokens, and will probably not even realize the token is lost until they actually need medical care (and then it is too late).

dawson 13y ago
We're implementing the Summary (Emergency) Care Record http://en.wikipedia.org/wiki/Summary_Care_Record http://en.wikipedia.org/wiki/Summary_Care_Record
Amadou 13y ago
I think key splitting might be a better solution for the corner cases of unconscious or self-destructive patients. For example, split the key among 6 people associated with the patient such that any 4 of them are sufficient to decrypt. That way, even if 1/3 of the key-holders are not available, you can still get the info. This still gives you protection against database dumps and the insider threat, while not completely eliminated, is vastly reduced.
krschultz 13y ago
That is definitely an issue. I wonder if that could be biometric instead. Almost by definition if you are in a serious healthcare situation, biometric is an option. NYU Medical has palm scanners throughout and it is very easy for patients. I was knocked unconscious in a bicycle accident a few years ago. For some reason at the time I was not carrying my wallet and not with anyone else. I ended up in the hospital with no identifying information at all, and actually woke up in the CAT scan machine having no idea what was going on. It was probably 3-4 hours after the accident before I was able to tell them who I was. I imagine in that scenario being able to grab a palm scan and look up my records, call emergency contacts, get my previous medical records, etc would have been very useful and wouldn't have required me to be conscious.
specialist 13y ago
If I am unconscious when I am brought to the hospital... The "break the glass" scenario / use case. It's basically a user facing backdoor. (Normal access goes thru the consent tree.) It's 1 of 2 reasons why patient medical records cannot be encrypted, obfuscated, whatever. At this time. EDIT: The HowAreYou patient/user centric credentials does not permit the sharing (interchange) of medical records. For that, every patient must be uniquely identified and matched across heterogenous systems. This is feasible in a single payer model, where there's a central naming authority issuing unique identifiers. An analogy: A large organization with multiple systems, each with their own credential management. They install a master LDAP or ActiveDirectory, so that identifiers can matched across the organization. In healthcare, that master unique identifier is sometimes called a master record number (MRN), patient identifier (PID), and some other jargon abusing acronyms. EDIT 2: Cambridge. UK NHS. Not the USA. They do have unique identifiers. My bad. My only excuse is I shouldn't comment pre-caffinated.
taway2012 13y ago
I don't think this is a big problem. Just wanted to chime in with the opposing view. We already have legal structures to account for people who are unable to provide informed consent (e.g., unconscious person, dementia sufferer etc): spouse, guardian etc can provide consent. This thing will piggyback on that same legal framework. Simply allow multiple RSA keys to decrypt the encryption key. I think this sort of access control would be BRILLIANT. I am quite concerned about random people accessing my health records. Obamacare's requirement of a standardized data storage format will only increase the temptation to datamine people's health records for fun and profit.

dawson 13y ago

We're implementing the Summary (Emergency) Care Record http://en.wikipedia.org/wiki/Summary_Care_Record http://en.wikipedia.org/wiki/Summary_Care_Record

Amadou 13y ago

I think key splitting might be a better solution for the corner cases of unconscious or self-destructive patients. For example, split the key among 6 people associated with the patient such that any 4 of them are sufficient to decrypt. That way, even if 1/3 of the key-holders are not available, you can still get the info. This still gives you protection against database dumps and the insider threat, while not completely eliminated, is vastly reduced.

krschultz 13y ago

That is definitely an issue. I wonder if that could be biometric instead. Almost by definition if you are in a serious healthcare situation, biometric is an option. NYU Medical has palm scanners throughout and it is very easy for patients. I was knocked unconscious in a bicycle accident a few years ago. For some reason at the time I was not carrying my wallet and not with anyone else. I ended up in the hospital with no identifying information at all, and actually woke up in the CAT scan machine having no idea what was going on. It was probably 3-4 hours after the accident before I was able to tell them who I was. I imagine in that scenario being able to grab a palm scan and look up my records, call emergency contacts, get my previous medical records, etc would have been very useful and wouldn't have required me to be conscious.

specialist 13y ago

If I am unconscious when I am brought to the hospital... The "break the glass" scenario / use case. It's basically a user facing backdoor. (Normal access goes thru the consent tree.) It's 1 of 2 reasons why patient medical records cannot be encrypted, obfuscated, whatever. At this time. EDIT: The HowAreYou patient/user centric credentials does not permit the sharing (interchange) of medical records. For that, every patient must be uniquely identified and matched across heterogenous systems. This is feasible in a single payer model, where there's a central naming authority issuing unique identifiers. An analogy: A large organization with multiple systems, each with their own credential management. They install a master LDAP or ActiveDirectory, so that identifiers can matched across the organization. In healthcare, that master unique identifier is sometimes called a master record number (MRN), patient identifier (PID), and some other jargon abusing acronyms. EDIT 2: Cambridge. UK NHS. Not the USA. They do have unique identifiers. My bad. My only excuse is I shouldn't comment pre-caffinated.

taway2012 13y ago

I don't think this is a big problem. Just wanted to chime in with the opposing view. We already have legal structures to account for people who are unable to provide informed consent (e.g., unconscious person, dementia sufferer etc): spouse, guardian etc can provide consent. This thing will piggyback on that same legal framework. Simply allow multiple RSA keys to decrypt the encryption key. I think this sort of access control would be BRILLIANT. I am quite concerned about random people accessing my health records. Obamacare's requirement of a standardized data storage format will only increase the temptation to datamine people's health records for fun and profit.