Online Security in the World of Health 2.0

It is now the year 2020 and you have control of your complete health record through an online personal health record (PHR) when you receive an email from your local hospital asking you to update the link for their computer system. Before you know it, your medical insurance is exhausted and someone has posted your complete health record on the web for other would be hackers to use and abuse. You've been the victim of a social engineering scam. Sound far fetched?

Take a read of a round table discussion put on by Scientific American. This is a who's-who of industrial internet security;

The Participants
Rahul Abhyankar: Senior director of product management, McAfee Avert Labs,
McAfeeWhitfield Diffie: Vice President and Fellow, chief security officer, Sun Microsystems
Art Gilliland: Vice president of product management, information risk and compliance, Symantec
Patrick Heim: Chief information security officer, Kaiser Permanente
John Landwehr: Director, security solutions and strategy, Adobe Systems
Steven B. Lipner: Senior director of security engineering strategy, Microsoft
Martin Sadler: Director, systems security lab, HP Labs, Hewlett-Packard
Ryan Sherstobitoff: Chief corporate evangelist, Panda Security US, Panda Security

These world experts identify social engineering as one of the major threats to internet security. The reality is that more and more business will be conducted through 3rd party vendors over the internet. That's because other companies will be able to do "it" better, faster and cheaper than any single enterprise. As long as humans are involved, however, security is at risk.

What do the guru's propose? Some of it is extremely high tech stuff. Secured hardware, RF tags and encrypted email. Some of it is ridiculous; an internet driver's license or not opening email from anyone you don't know. But most are pragmatic; encrypting high sensitivity documents, liability for 3rd party vendors, limiting data from public email accounts and USB keys and greater enforcement of internet fraud.

I have good faith that the major players of today will protect my data. I also believe that the 'bad guys' will become more imaginative and progressive with social engineering schemes. The round table was an eye-opener to me. When the head of a one of the biggest anti-virus software companies in the world is advising me not to open any email from people I don't recognize there is a huge problem. More than 90% of our own email is SPAM and we've been brought down more than once by Trojan horses. This problem is not going to go away in the next 10 years so buyer beware before sharing your medical record.

Richness and Reach Redux – Web 2.0 + Medicine

After posting on Richness and Reach I made the mistake of submitting the article to Grand Rounds at the Health Business Blog. I didn’t realize that David was a former Boston Consulting Group member and would run circles around my argument.

In short, people want you to believe that when your doctor (or primary care provider) embraces Web 2.0 (the socialization of the internet) a metamorphosis of medicine will occur. The argument goes that the internet will allow your doctor to reach more people with greater richness then ever before. Don’t believe them – it’s bullshit.

Technology and the internet have done a lot for primary care. I believe it has improved outcomes, standards and the velocity at which primary care is provided. But using the internet allows these improvements in the traditional Web 1.0 way, by increasing the resources at both the provider and patients’ disposal. Going away are the days of photocopied, index articles’ (that any doctor who graduated before 2000 likely has), hunting for x-rays, the latest textbook and lab coats full of plasticized cards and handbooks. They are being slowly replaced by information over the web. Even the much touted on-line personal health record (read more at KevinMD or Health Management Rx) is just another application of the Web 1.0 as a repository for your complete medical history.

The pundits foresee a revolution that will never come. A world where you can input your symptoms in a database, or bounce thoughts off your doctor through a chat room, or go for a virtual CT scan. Check out the science roll for the top ten ways to apply Web 2.0 to your life or learn to do your own cervicofascial advancement flap. The problem is that satisfaction with ones' primary care physician is highly dependant on communication and the perception of respect. The relationship between you and your doctor is independent, fraught with variation from patient to patient and intensely personal. There is fantastic evidence that a good history is not created by just asking the correct questions but by doing so in an appropriate manner. That includes allowing time, overcoming language barriers, laughter, and empathy for the patient as well as structure to the information exchange. The effect of Web 2.0, however, is to broaden and generalize the human experience. Where a good historian creates a quick personal connection with the patient Web 2.0 relies on group think. The two are at odds with one another.

Aside from the philosophical debate, there is the question of finances. When patients arrive they expect answers and are paying dearly to have us find them. Even when histories are directed they can drag on. To exchange information in a haphazard way is not only foolhardy but it takes time. And in a world of skyrocketing costs, litigation conscious patients and physicians who are increasingly bankrupt of time the likelihood of adding a tool that slows and generalizes the process is remote. I’ve said it repeatedly about IT roll-outs in the clinic. A new process should improve quality and velocity. If it only does one or the other it’s an uphill battle. If it does neither, it is doomed.

I have no idea if the blogosphere and the Web 2.0 are just this generation’s versions of public access television but I like to think it improves us by giving a broader perspective. A good doctor will make use of Web 2.0 as a tool for education, a means to bench mark their practices and a way to communicate with groups of patients or other clinicians. They will also make use of the internet to increase the efficiency of their practice. But make no mistake about it, the internet acting as a library of information is very different than it acting as a surrogate for access to your physician. When it is all said and done there are certain fundamental laws to health care the greatest of which is that a good diagnosis is made by a great history and a good examination. And that can’t be done through a web-site.

Over to you David & Jen.

To read Jen's response to this post go to this link at HealthMmgmtRx.