N.S.A. Able to Foil Basic Safeguards of Privacy on Web, Including Medical Records - Yet Another Reason To Be Concerned About What You Tell Your Physician

There's already a major issue with privacy and protection of medical records in electronic form.  See the multiple blog posts at this query link:  http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy

Now this from the New York Times:

N.S.A. Able to Foil Basic Safeguards of Privacy on Web
By NICOLE PERLROTH, JEFF LARSON and SCOTT SHANE
September 5, 2013

The National Security Agency is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents.

The agency has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans and others around the world, the documents show.  

But don't worry, your electronic medical records are secure, and will NEVER be used for political purposes by your adversaries...

Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. Having lost a public battle in the 1990s to insert its own “back door” in all encryption, it set out to accomplish the same goal by stealth. 

The agency, according to the documents and interviews with industry officials, deployed custom-built, superfast computers to break codes, and began collaborating with technology companies in the United States and abroad to build entry points into their products. The documents do not identify which companies have participated.

At least we may have gotten faster PC's as a side result of the research that supported these efforts.

... the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.

Some of the agency’s most intensive efforts have focused on the encryption in universal use in the United States, including Secure Sockets Layer, or SSL; virtual private networks, or VPNs; and the protection used on fourth-generation, or 4G, smartphones. Many Americans, often without realizing it, rely on such protection every time they send an e-mail, buy something online, consult with colleagues via their company’s computer network, or use a phone or a tablet on a 4G network. 

Might as well just send them a copy of all your communications to spare them the effort...

... Ladar Levison, the founder of Lavabit, wrote a public letter to his disappointed customers, offering an ominous warning. “Without Congressional action or a strong judicial precedent,” he wrote, “I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.”

Hey, how about let's ALL have our medical records stored by health IT companies providing ASP (Application service provider, http://en.wikipedia.org/wiki/Application_service_provider) offsite EHR hosting services to hospitals and clinics...

From the site "techdirt.com":

Allegedly the NSA and GCHQ (UK Government Communications Headquarters) have basically gotten backdoors into various key security offerings used online, in part by controlling the standards efforts, and in part by sometimes covertly introducing security vulnerabilities into various products. They haven't "cracked" encryption standards, but rather just found a different way in. The full report is worth reading ... (http://www.techdirt.com/articles/20130905/12295324417/nsa-gchq-covertly-took-over-security-standards-recruited-telco-employees-to-insert-backdoors.shtml).

Half facetiously: unless you're a real nobody, if you, say, contracted V.D. from that sexy prostitute at that Vegas Convention, you perhaps better not tell your doctor about it.

Maybe this is what it will take to get the government to start taking electronic medical record privacy, confidentiality and security more seriously.

Our legislators, like everyone else, have a stake in the game.

-- SS

Market Fundamentalism and the Denial of Conflicts of Interest, and of Worse Offenses

While we often point out the pervasiveness of conflicts of interest in medicine and health care, and the likely ill effects of this state of affairs, it seems that the powers that be in health care tend to airily dismiss conflicts of interest as at most a minor problem that needs management (e.g., look here.) 

How Market Fundamentalist Ideology Nullifies the Concept of Conflicts of Interest

On the Hooked: Ethics, Medicine and Pharma blog, Dr Howard Brody discussed how application of the reigning orthodoxy in economics, sometimes called neoliberalism, market fundamentalism, or economism, can be used to dismiss the concept of conflicts of interest.

Basically, supporters of market fundamentalism et al seem to assume that all markets are idealized free markets, and that free markets are like a super computer combining all human thought to provide wisdom in the form of price information.  Furthermore, since the market is based on supposedly rational choices made by free individuals, one cannot go back to question such choices.

 So when, for example, an academic physician makes the "free choice" to accept thousands of dollars from a drug company as a "market consultant," and then also gives talks about clinical topics that happen to favor that drug company's products, such choices cannot be questioned.  Therefore, the notion that these choices constitute a conflict of interest, and that the choice to accept the drug company money in particular might increase the likelihood of abuse of the physician's entrusted responsibility to make the best decisions for individual patients, and to teach other physicians honestly and without bias, essentially makes no sense within this framework.

Dr Brody further enlarged on the internal contradictions within the ideology of neliberalism/ market fundamentalism/ economism, in another post on his Economism Scam blog.

Of course, the ideology seems to ignore the possibilities that 1) people's choice may not be free, may not be rational, and may not be based on coldly rational cognition and the best possible knowledge; and 2) one person's economic choice may limit another person's choices, or directly harm another person.

 By Extension, Fraud and Corruption Denialism

Furthermore, not only does neoliberalism et al seem to deny the existence of meaningful conflicts of interest, it also could be used to deny the meaningful existence of deceptive marketing, of market domination through oligopoly or monopoly, and then of outright fraud, bribery, and extortion. 

See for example how former US Federal Reserve chairman Alan Greenspan seemed to deny the existence of fraud, which he asserted would always be nullified by the ideal market.  As we posted here, according to an article in Stanford Magazine,  Greenspan told Ms Brooksley Born, the federal regulatory agency head who tried to develop some effective regulation of financial derivatives,

'Well, you probably will always believe there should be laws against fraud, and I don’t think there is any need for a law against fraud,' she recalls. Greenspan, Born says, believed the market would take care of itself.

By further extension, market fundamentalism could be used to deny the evils of chattel slavery.

The Conflicted as Defenders of Conflicts of Interest

Finally, notice that neoliberalism/ market fundamentalism/ economism ideology seems to have conveniently been adopted by pundits, both in economics and in medicine and health policy who may be personally profiting from conflicts of interest on one hand, and whose conflicts seem to arise from payments from large corporations whose management seem to be personally profiting even more so. 

For example, we have discussed examples of how defenders of existing financial relationships - which in my humble opinion are actually conflicts of interest - employ logical fallacies to make their points.  Some of these defenders seem to have obvious conflicts of their own (for example, this post included examples of physicians rationalizing their financial ties to drug companies,  and this post included fallacies employed by a current medical school leader, but former extremely well paid biotechnology company executive.).  On the other hand, I have yet to find a logical, reality-based defense of these conflicts of interest made by anyone who demonstrably does not have such conflicts of their own.  

Summary

Human beings have been wrestling with corruption since the dawn of history.  There are ancient arguments against bribery in the Bible  (e.g., in the Old Testament, in Exodus and Deuteronomy), and fraud (e.g., in Leviticus, the Proverbs, and the Gospel of Mark).  One can argue that a fundamental purpose of civilization is to reduce self-serving misbehavior such as bribery, fraud, and extortion, and other varieties of corruption.  The notion that free markets make the concepts of fraud, and of conflicts of interest (that are risk factors for corruption - look here) meaningless is nothing more than school playground sophistry.

To truly reform health care, we need to return it from its current Wild West mentality to a state more resembling civilization.  We need to reject silly notions that free markets erase the concepts of conflict of interest, or of fraud, or of other aspects of corruption.     

Study Explains Errors Caused by EHR Default Values - With Only Four Reports of "Temporary" (By the Grace of God) Patient Harm

From Health Data Management and the Pennsylvania Patient Safety Authority:

Study Explains Errors Caused by EHR Default Value

Joseph Goedert

Sept. 5, 2013

A new study analyzes errors related to “default values” which are standardized medication order sets in electronic health records and computerized physician order entry systems.

The Pennsylvania Patient Safety Authority, an independent state agency, conducted the study. “Default values are often used to add standardization and efficiency to hospital information systems,” says Erin Sparnon, an analyst with the authority and study author. “For example, a healthy patient using a pain medication after surgery would receive a certain medication, dose and delivery of the medication already preset by the health care facility within the EHR system for that type of surgery.”

These presets are the default value, but safety issues can arise if the defaults are not appropriately used. Sparnon studied 324 verified safety reports, noting that 314, or 97 percent, resulted in no harm. Six others were reported as unsafe conditions that caused no harm and four reports caused temporary harm involving some level of intervention.

One might ask:  how many unreported or yet-to-be-reported EHR/CPOE cases involved, or will involve, permanent harm?

Sept. 9, 2012 Addendum:  We learn this from Healthcare IT News (http://www.healthcareitnews.com/news/ehr-adverse-events-data-cause-alarm):  "Sparnon said two of the reports involved temporary harm that required initial or prolonged hospitalization."  I note that hospitalization, especially prolonged hospitalization, exposes the patient to still more risk.

Regarding the "temporary harms", one which includes "default times" as opposed to doses:

The four cases requiring intervention involved accepting a default dose of a muscle relaxant that was higher than the intended dose, giving an extra dose of morphine [keep playing with 'extra doses' of drugs like morphine enough, and you're going to kill someone  - ed.] because of an accepted default administration time that was too soon after the last dose, having a patient’s temperature spike after a default stop time automatically cancelled an antibiotic [do this enough, and you're going to get sepsis and septic shock to deal with - ed.] and rising sodium levels in a patient because confused wording made nurses believe that respiratory therapy was administering an ordered antidiuretic. [Apparently the 'default'- ed.]

More on the errors:

The most common types of errors in the study were wrong time (200), wrong dose (71) and inappropriate use of an automated stopping function (28). 

Any of these, especially the latter two, could have caused harm depending on degree...and to those Risk Management majors out there, eventually will.

 “Many of these reports also showed a source of erroneous data and the three most commonly reported sources were failure to change a default value, user-entered values being overwritten by the system and failure to completely enter information which caused the system to insert information into blank parameters,” Sparnon says. 

Hence my claim that the term "EHR" is anachronistic, and that these systems now are really cybernetic command-and-control mediators and regulators of care (via cybernetic proxy).

“There were also nine reports that showed a default needed to be updated to match current clinical practice.”

The need for a constant, rigorous updating process (which will in the real world likely always be 'behind'), among many others, is a factor that makes the idealistic belief/promise that "health IT will save money and increase safety" (let alone "revolutionize" medicine) unpersuasive.

I note that the "default values" risk is only one of many, many "features" of EHRs and other clinical IT that cause risk and error.  This issue is but one layer of a very, very large and multi-layered onion (cf. AHRQ Health IT Hazards Manager, http://healthit.ahrq.gov/sites/default/files/docs/citation/HealthITHazardManagerFinalReport.pdf, for example).

And this, at the same time that the The HIT Policy Committee, a body of industry stakeholders who advise federal officials, on Sept. 4 adopted final recommendations on health IT risk consistent with an attitude of health IT exceptionalism that included:

"HIT should not be subject to FDA [or any - ed.] premarket requirements" and "Vendors should be required to list products which are considered to represent at least some risk if a non-burdensome approach can be identified."  

If not, no list? ... And what, exactly, is a "non-burdensome" approach, one might ask? 

(See www.healthdatamanagement.com/news/health-information-technology-regulation-fda-onc-fcc-46557-1.html)

 ------------------

Perhaps the penalty for health IT hyperenthusiasts**, short of the Biblical penalty of one of their loved ones suffering the fate of a guinea pig in a medical experiment, should be to be compelled to fly some third rate air carrier with a safety record of "we only had a few near-crashes last month."

-- SS

** [See definition of health IT hyperenthusiast at Doctors and EHRs: Reframing the 'Modernists v. Luddites' Canard to The Accurate 'Ardent Technophiles vs. Pragmatists' Reality' at http://hcrenewal.blogspot.com/2012/03/doctors-and-ehrs-reframing-modernists-v.html]
 

Women's Health Scholars: The Basics

The Women's Health Scholars Program has been getting a lot of attention lately and we are very excited about all of your interest! So for those who do not know and for those who need a refresher, Here is a quick breakdown the Women's Health Scholars Program. You will earn the official title of "Women's Health Scholar" if you complete four requirements during your time a DUCOM:

1. Complete the WH Seminar Series Elective [Available for first and second year students] - You must attend at least 8 seminars in one year and fill out an evaluation form for each seminar attended. Seminars you have gone to in year one cannot roll over to be completed in year two. For more info on seminar series click here 

2. Make a Women's Health Education Resource by creating either a bulletin board, newsletter or brochure. 

3. Community Education / Outreach - You must spend at least 15 hours demonstrating leadership in a community based environment. 

4. Scholarly paper - You will compose a 15-20 page paper on a specific women's health topic. 

For those of you who are interested in learning more, upcoming we will be holding a Women's Health Scholars info session (still TBA). We will be sending an email out with details to all first and second year students. The info session will describe the requirements in greater detail and give a general timeline so you can begin to assess if this is something you would like to do. If so, you will work further with WHEP to craft your own personal plan of action. 

Continue to look for more information here and in your mailbox! 

To read the official WH Scholars document click here

Recap from IFM 1, Reproductive Health

Examining the nuchal translucency of a fetus

For IFM1 folks, hopefully you all enjoyed the interactive component of lecture today. Being able to hear the stories of former patients and their experiences are important as you grow as physicians. 

Today nuchal translucency was discussed in class when we were taking about access fluid being around the neck of a growing fetus. During an ultrasound, the thickness of the nuchal translucency is measured to determine if it is normal. All fetuses have some fluid, but an abnormal amount can indicate a genetic abnormality. Downs Syndrome is one of the most common.

For the visual learners:

The left displays a normal level of thickness. Notice the small arrow
on the right picture indicating the access fluid around a fetus' neck. 

When the mother will be about 35 or older at the time she will give birth, if there is family history of birth defects or if the mother has had previous pregnancies or births with defects, the fetus is at greater risk. Of course along with these, there are other factors that can cause birth defects. Therefore it is important to know the medical and social background of both the mother and the father to help determine which reproductive options work best for them.

 

Cyberbullying: A trend that may be getting worse

Bullying has always been a concern in schools, but the growth of technology allows for a new dimension of bullying called cyberbullying. On top of in person verbal or physical abuse, a child may continue to receive hurtful messages or be slandered online even after the school day ends.  This gives bullies the ability to harm their targets at times that used to be safe, but many states with bullying laws do not include actions performed off campus. 

It is also apparent that this is an issue we are seeing more in young girls.  Girls are more likely to both be cyberbullied and cyberbully someone else. And while many student suicide cases are not based solely on cyber bullying, we have been seeing an increase of (girls especially) suicide in which cyberbullying is involved.  In some of the worst cases, students are sexually assaulted only to have it posted on the internet where they are further humiliated and sometimes blamed for what happened.  Examples like this have come to light recently with cases such as the Stubenville, Ohio rape case.

What could this mean for physicians? In the future young patients may benefit from screening questions that target cyberbullying. In addition to asking if kids feel safe at home or school, perhaps physicians should ask if they feel safe using a phone or the internet (first asking about access), Or ask additionally about technomedia experiences if young patients seem despondent. And while children and teens are effected most frequently, adults can also experience cyberbullying, and it should be considered in patient assessment at every stage of the life cycle.

Want more info on Cyber Bullying? Visit the Cyberbullying research center website  

Cyber-bullying in the news: 

-Audrie Pott, Rehtaeh Parsons suicides show sexual cyber-bulling is "pervasive" and "getting worse," expert says

-Immigrant Teen Taunted by Cyberbullies Hangs Herself

COLOR for a CAUSE

September is Ovarian Cancer Awareness Month!! Youth sports teams around the city can lace up with the Philadelphia Union in supporting the Sandy Rollman Ovarian Cancer Foundation’s annual Get Real with Teal campaign. Laces are provided freeof charge to youth sports teams while supplies last. Please join us in wearing teal shoelaces for games during September to help spread awareness about ovarian cancer!

Know the symptoms of ovarian cancer:

- Bloating

- Pelvic pain or abdominal pain

- Difficulty eating or feeling full quickly

- Urinary symptoms (urgency or frequency)

* These symptoms are persistent and are a change from a woman’s normal body*

For more information on how your sports team can participate:

http://www.sandyovarian.org/get-involved/

Also, mark your calendars! September 15th is the Turn up the Volume Walk on Ovarian Cancer in Harrisburg, PA. Check out this and other great events that are upcoming on the Sandy Rollman events calendar.