Slashdot Log In
Microsoft Working On Health Information 'Vault' System
Journal written by josmar52789 (1152461) and posted by
Zonk
on Thu Oct 04, 2007 01:22 PM
from the vaults-can-be-cracked dept.
from the vaults-can-be-cracked dept.
josmar52789 wrote with an article from the New York Times, discussing Microsoft's new push into the consumer health care market. The plan is to offer personal health care records online via a system called HealthVault. Numerous big names in the medical field have signed up for the service, including the 'American Heart Association, Johnson & Johnson LifeScan, NewYork-Presbyterian Hospital, the Mayo Clinic and MedStar Health'. The ultimate purpose of the service is to provide an online accessible but highly secure service to patients and medical facilities: "The personal information, Microsoft said, will be stored in a secure, encrypted database. Its privacy controls are set entirely by the individual, including what information goes in and who gets to see it. The HealthVault searches are conducted anonymously and will not be linked to any personal information in a HealthVault personal health record. Microsoft does not expect most individuals to type in much of their own health information into the Web-based record. Instead, the company hopes that individuals will give doctors, clinics and hospitals permission to directly send into their HealthVault record information like medicines prescribed or, say, test results showing blood pressure and cholesterol levels. "
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
unsubscribe (Score:4, Funny)
Re:unsubscribe (Score:5, Insightful)
It already is. Look around your doctor's office next time you are there. See the computers? They aren't Macs now, are they?
Parent
Re: (Score:3, Interesting)
This article, at least my understanding of it...isn't just about keeping medical info on a computer running MS Windows....it is more about a centralized medical record datastore that Microsoft is building and its
Microsoft's successful formula (Score:5, Funny)
I'll bet this sentence is not going to go over too well with the slashdot crowd.
Re: (Score:2)
Re: (Score:3, Informative)
I worried that health companies will fall for it (Score:3, Insightful)
Unfortunately, it will sound nice to health care companies. I am involved in the healthcare sector, and I am worried that this will succeed, without the health care companies knowing (or caring) about the issues. Microsoft has the cash, the clout and the reputation for this. (Remember, to non-geeks, Microsoft is the premier co
Re:Monopoly Abuse. Re:Microsoft's successful formu (Score:4, Insightful)
One hell of a pony
Parent
Re:Microsoft's successful formula (Score:4, Funny)
Parent
Oh yeah, triple secure. (Score:3, Insightful)
This sounds like one horribly, terribly bad idea to me from a security standpoint.
Also, I can't help but believe that 'anonymous' information will be handed over to drug companies so they can 'research' their 'market'.
Some things are still best done with paper and pen.
Re:Oh yeah, triple secure. (Score:5, Insightful)
1) Medical professionals never like patients to have full access to their records, as if a patient misunderstands something on their file, their life could be at stake based on the decisions they make.
2) The US has this thing called the PATRIOT act, and MS has agreements with some agencies allowing back-door access to data they host. Let's just say that I highly doubt this information will be protected from people working for US "security" agencies.
3) The system appears to be designed so that MS can sell aggregated data to drug companies and insurance companies. Seems to me though that even with aggregated data, you could reverse-mine it to have a reasonable suspicion regarding individuals (you'd know trends, which would help in searching for more specific details)
Anyway, the whole thing could be really useful if used correctly, but there are so many ways it could be misused even if the system doesn't have a major security breach that I for one would never use it.
Parent
Re: (Score:2)
Proof?
Re:Oh yeah, triple secure. (Score:4, Interesting)
2. HIPPA says no. If a nurse accidentally allows access to your health information, that's a $10,000 fine for her and a $100,000 fine for the hospital.
3. HIPPA says no.
-- http://aspe.hhs.gov/admnsimp/pl104191.htm#1177 [hhs.gov]
Geez, you'd think that people involved in IT would be somewhat aware of the demands of HIPPA PHI.
Parent
Re:Oh yeah, triple secure. (Score:5, Insightful)
Try to fight the Electronic Health Record is like trying to fight the use of computers in any other field -- it's inevitable.
Parent
Uh uh. (Score:3, Insightful)
The last thing I need is an employer or potential employer tracking down my medical records. Or the CIA, NSA, ATF, or cybercriminals or any other organization or individual who wishes to covertly steal my personal data for nefarious purposes.
Do you know what your medical history contains and how it can be used against you? I do.
Re: (Score:2, Funny)
Re:Uh uh. (Score:5, Interesting)
Well, yes, there's a potential problem any time you put enough personal information into one place: sure, it's more convenient for the appropriate people to access, but it's also more convenient for someone to steal.
My bigger concern, however, is that this is Microsoft proposing this. It makes me want to vet the idea for possible abuses. Beyond the obvious privacy concerns, is Microsoft going to make it accessible only to Windows Vista machines, thereby forcing the entire medical system and any potential clients to upgrade, followed by years of lock-in?
Even if such a system is going to be set up, I'd rather someone with a good track record build something that makes use of open formats and protocols. I'd like to know that my family's medical records aren't going to go up in a puff of smoke because Windows Update decided my Office license wasn't "genuine", or something other bizarre thing.
Parent
Re:Uh uh. (Score:5, Funny)
Not at all. It will be web based, and provided you're running Internet Explorer 8 you're fine.
Oh, didn't we mention? IE 8 will be Vista with SP1 only.
Parent
"Blue screen of Death" to have a whole new (Score:5, Funny)
Re:"Blue screen of Death" to have a whole new (Score:5, Funny)
Parent
Standards (Score:2)
Hailstorm (Score:4, Insightful)
Privacy experts freaked out, but Microsoft never cancels anything.
Lock up (Score:2, Funny)
Yeah... (Score:2)
Yeah...That's gonna work out well. After all, whose products are more secure than Microsoft's?
Google Searches too (Score:5, Funny)
Google Search: Itchy crotch
NSA: Hey Fred Smith has crabs again...lol
MS and security? (Score:2)
Say, are the people who are in charge of this living on another planet? I mean, even a non-technical person should have heard by now that "MS" and "security" in the same sentence are usually only used if there is also at least one of the group "flaw", "leak", "compromised" or "nonexistant" in the close vicinity.
In other words: How much was it?
Re:MS and security? (Score:4, Interesting)
As you know, Windows' security issues are ones of legacy. The more they fix it, the more they wreck existing apps.
Apart from this, I have to be honest with you: I'd rather have Microsoft work on this health information system, than some unknown little entity that just is in to grab the money and run.
Microsoft is here to stay, and while they may not end up with the most perfect solution possible, they don't need the money desperately, and can't hide if a major security breach occurs (and it's their fault).
Parent
Re: (Score:2)
No, they can't hide. And won't. And needn't. They'll simply say "gee, we're sorry" and get away with it. As usual.
When was the last time you've seen a large (IT) corporation being forced to take responsibility for the damage they did? Especially if it's "only" privacy leaking.
Re: (Score:2)
Yes, but the other entities getting into this space aren't exactly little and unknown, either. One of those has a name that starts with a "G", and I personally suspect that MS decided to get into this field principally to avoid one of their major competitors pulling one over on them again.
microsoft vs security (Score:2, Insightful)
There are range of tools and cookie cutter stuffs already written for in asp/net allows very powerful function to exist especially inter-operate ability with different MS product like sharing outlook generated schedule via exchange server out to web portal.
However, putting medical records requires requires middleware between ms platform and medical softwares. I see this use of middleware becomes security problem here. Windows
Let's start a lottery on this (Score:2)
I pick 6 months & 7 months, respectively.
I wouldn't trust MS to store my phone number (Score:2)
And sell your health info back to you (Score:4, Insightful)
No thanks.
Just look at what Microsoft is planning to do with Office Live or whatever they are calling it. You need to have Microsoft Office installed locally on your HD. All you are storing is your data. GNU Linux OSes probably won't even be able to run WINE to access those Office Live files. So even if they don't actually charge to access the data, it extends their reach into your life.
Per usual "revise and extend" behavior... (Score:2)
So, great, they got their grubby hands on a copy of the HL7 schema and dropped in into an encrypted database. Whoop-dee-doo.
Sounds Good (Score:3, Informative)
That sounds good. You actually get full say in who is allowed to do what, and "give permission" sounds like the permissions are secure by default.
I have about zero trust that Microsoft will actually implement this correctly and securely (I've seen far too many stupid bugs from them lately), but at least they're saying the right things. Not vague promises that it will be "very secure", but an actual description of the security controls they are planning to provide. Moreover, those security controls seem to actually provide the security one would want in such a system.
Please fill out and sign these forms. (Score:3)
Prepare to see a new waiver in the stack of crap you have to sign when going to a new doctor's office requiring you to give permission for full access to your records for any purpose not prohibited by law.
This will happen because doctors will not want to spend time having you okay access to each locked off section of your records that they might need, and they sur
Except for the tinfoil hat crowd...not a bad idea (Score:4, Insightful)
Anonymous? (Score:2)
What does this mean? I hope it doesn't mean that there's no record of who it was that peaked into your medical records.
Next Doctors visit might go something like... (Score:5, Funny)
Patient: Well, work has been a bit stressful, should I worry?
Doctor: Not at all. It is still good for your age. Have you tried Halo 3?
Patient: huh?
Doctor: Video games are a great stress reliever. If you don't have an Xbox 360 with Halo3, I can put in an order for one for you. Have you had any other problems?
Patient: Sometimes I get a headache from staring at the computer too long.
Doctor: Hold on -- there, I've adjusted your screen resolution and font size on your home and work computers.
Patient: Umm.....
It's about time (Score:2)
Great! A service I can trust! (Score:2)
Microsoft has repeatedly shown that (Score:2)
It understands neither security, nor the enterprise market. The thought that they could be responsible for securing my health history is particularly troubling.
Yes, I understand that a lot of healthcare providers use MS products internally. However, gaining access to that information requires a concerted attack against a particular target, rather than just "listening" on a wire for healthcare info... The difference is that attempting the first is a crime, while even succeeding in the latter is not.
You're easily troubled (Score:3, Insightful)
If that bothers you, how do you feel about the fact that they're right, and you don't get any say in the matter?
MS has the marketing, economic, and political clout to get themselves the contract for keeping the health records for everyone in the USA. Washington is already salivating over the prospect of:
Sued to death (Score:2)
interoperability? (Score:2)
Why do I have a feeling that no one will ever be able to implement a medical records application, which is simultaneously able to interoperate with HealthVault, and also not run on MS Windows?
As a customer, you have to be fucking crazy (and downright hostile to your stockholders), to want more MS lock-in. Auditors, if any of your people don't look terrified by this, start looking for kickbacks. By trying to start a new monopoly, Microsoft is actually doing a wonderful thing: showing you exactly which emp
VA (not MS!) VISTA? (Score:4, Interesting)
http://www1.va.gov/CPRSdemo/ [va.gov]
Sounds exactly like my old Company NDMA (Score:3)
www.ndma.us
(National Digital Medical Archive)
NDMA never did get all the bugs out. It was a little slow and lacked some key xml protocol sharing features. Security and never losing a file are a legitimately difficult task, in itself, and that was addressed. Maybe Microsoft will come up with better ideas than NDMA did. The protocol for the application there was terribly slow, but the website to access the information eventually came through.
Selling anonymous data is, unfortunately, a necessary evil. It's already happening, all Hospitals require you to sign things on joining that will give them rights to sell your data, with your name and ID numbers removed. Doctors do truly need that information, especially for disease outbreaks and drug treatment information. This system by Microsoft just makes it more practical.
With Microsoft entering, it probably means Oracle, IBM, and maybe Sun will as well. There's tens of billions of dollars to be made.
-Ben
Mod parent funny or obvious (Score:2)
Re: (Score:3, Funny)
Actually, I would have said "Let the CHAIR Throwing Begin!"
Re:Free medical records on the web? (Score:4, Interesting)
For example, Use is well-defined in many cases, but actual security mechanisms are not. This kind of programming is right up Microsoft's alley. Not only is the security model pretty weak, there's limited interoperability requirements.
Please, read the standard. It's not fun reading, but the average
http://www.hhs.gov/ocr/hipaa/ [hhs.gov]
Parent