Yesterday the Wall Street Journal had an opinion piece "Your Medical Records Aren't Secure" that lamented the current insecure state of medical records. I found the following section particularly disturbing:
[I]n the past five years, according to the nonprofit Privacy Rights Clearinghouse, more than 45 million electronic health records were either lost, stolen by insiders (hospital or government-agency employees, health IT vendors, etc.), or hacked from outside.
Electronic record systems that don't put patients in control of data or have inadequate security create huge opportunities for the theft, misuse and sale of personal health information. The public is aware of these problems. A 2009 poll conducted for National Public Radio, the Kaiser Family Foundation and the Harvard School of Public Health asked if people were confident their medical records would remain confidential if they were stored electronically and could be shared online. Fifty nine percent responded they were not confident.
The privacy of an electronic health record cannot be restored once the contents are sold or otherwise disclosed. Every person and family is only one expensive diagnosis, one prescription, or one lab test away from generations of discrimination.
Privacy threats also come from external sources. A Network World interview with a top FBI official reveals that criminals and nations ". . . have the ability to access virtually any computer system, posing a risk that's so great it could "challenge our country's very existence." See: Cyberattacks are 'existential threat' to U.S., FBI says.
If you doubt the FBI, read iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own:
"Hackers took down Apple 's iPhone and Safari browser, Microsoft 's Internet Explore 8 (IE8) and Mozilla's Firefox within minutes at today's Pwn2Own contest, as expected."
So much for security over online medical records.
Privacy protection continues to erode both from a policy perspective and from a technology perspective. Technology can be used to ensure privacy or it can be used to invade privacy.
There are non-intrusive ways of ensuring privacy. They go beyond policy to simplifying encryption, providing internet-wide authentication (starting with DNSSEC deployment), and improving the security properties of the hardware and software that comprises IT infrastructure. Imagine that your medical records were encrypted such that only your doctor could read them and any transfer to a third party would require a crypto key in the possession of the patient or their guardian?
DNSSEC and more thorough encryption technologies are available today, although they are not widely deployed. Until these technologies are ubiquitous we will not reap the benefits of online medical records.
Comments