I hear it time and time again in the e-health industry:
“If only we had everyone on an electronic medical record, all of our security and privacy issues would be solved!”
Really?
Perhaps I should introduce you to a little something psychologists like to call “human behavior.” Human behavior will always trump technology when it comes to finding a way to undo everything well-meaning EHRs, EMRs, and PHRs try to implement.
Case in point: Scott Graham. He sent an ex-girlfriend a spyware program he was hoping she’d install on her home computer so he could spy on her. (This is surprisingly more common than you might imagine.) Instead, she opened it on a computer in the hospital’s pediatric cardiac surgery department. The spyware was happy to install itself on that hospital computer and start doing its job — spying on whoever used the computer for whatever purposes they used it. In this case, hospital work.
Guess what Graham discovered?
Between March 19 and March 28 the spyware sent more than 1,000 screen captures to Graham via e-mail.
They included details of medical procedures, diagnostic notes and other confidential information relating to 62 hospital patients.
He was also able to obtain e-mail and financial records of four other hospital employees as well, the plea agreement states.
So implement the most secure, confidential and private medical records you can. But don’t forget to lock down the Internet from any computer that can display such records. Or at least ensure your firewall is set to block everything first, and only allow specifically whitelisted programs through.
Any hospital IT administrator that is not using a whitelist-only procedure (e.g., using blacklists or no list at all) should seriously reconsider that decision, even if it means going toe to toe with the hospital’s CEO or board of directors.
Because while it may be a pain or inconvenience for hospital employees not to be able to run any computer program they wish on the hospital’s computers, this is a prime example of why allowing such access betrays every effort to secure sensitive medical information. An electronic medical record is only as good as the computer and network it’s running on. And if that computer and network aren’t secured from start to finish, it doesn’t matter how “secure” or “standards-compliant” your electronic medical record is — you may just as well post it on a bulletin board at the supermarket.
The only solution to the human behavior problem is to acknowledge you’ll never be able to control it. You can’t expect 100% of your employees to follow 100% of your guidelines and restrictions 100% of the time. Instead, you need to ensure checks are in place to prevent employees — even well-meaning ones — from doing something that could jeopardize not only their computer, but the entire hospital’s network and all of the patient medical records.
Read the full article: Misdirected spyware infects Ohio hospital
John, I’m late getting to this, but what a great post! “A little something psychologists like to call ‘human behavior'” – ha!
Seriously, this is one or two levels beyond what most people seem to be talking about.
Seems like a difficult thing to imagine: it means every computer that can display the EMR has to be locked out of internet access. It essentially means bye-bye to all the talk of social media policies in hospitals, right?
The Dept of Defense is working on the same issues (security, yet openness to innovation) and just held a conference about social network sites – the hashtag is #dodsns on Twitter:
http://twitter.com/#search?q=%23dodsns
Doctors are supposed to be nosy. It’s not just that they examine your naked body inside and out and record all its imperfections. Physicians are trained to peer into your life, past and present, and ask all sorts of sensitive, if not uncomfortable, questions.
Medical records of 15 000 patients at Cabrini Hospital in Malvern, Australia were compromised by the ransomware virus that infiltrated the system at the end of January. The threat actors behind the attack demanded a ransom payment in digital currency to regain access to patients’ data.