Medical Data Breach of the Month Department: Health Net Once Again a Star in the Healthcare Renewal Theatre

I have written frequently about the breaches of electronic information security, such as at my posts:

"Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?"

"Networked, Interoperable, Secure National Medical Records a Castle in the Sky?"

"Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?"

Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts

and others.

This latest medical information breach only affected a mere 2 million people this time.

Perhaps we should go for 20 million next time?

And then - there were substantial delays in notification (to give identity thieves time to get rich?)

Health Net Delays Notification of Data Breach Involving 2 Million People

By: Brian T. Horowitz
2011-03-16

Insurer Health Net waited until March 14 to disclose a data breach discovered on Jan. 21 involving the loss of nine server drives and the data of 2 million customers, employees and health care providers.

Health Net, a provider of health insurance to about 6 million people across the United States, has come under fire for reporting the loss of nine server drives at its data center in Rancho Cordova, Calif., nearly two months after it occurred.

More than 2 million Health Net members, employees and health care providers may have been affected by the data breach, including about 845,000 California policyholders, according to The San Francisco Chronicle. California regulators are investigating the breach, the newspaper reports.

How did this happen?

The insurer found out about the security lapse on Jan. 21, when IBM, which manages the company's IT infrastructure, informed Health Net that it was unable to locate server drives, according to a recording on Health Net's data breach hotline (855-434-8081).

These drives perhaps are of a new technology, with motorized robotic legs that allow them to walk away.

Or perhaps the drives were like this, where the round drive platter stacks perform double duty as wheels:

A "mobile" hard drive. Click to enlarge.

The drives just rolled away - to the tune of Steppenwolf's "Born to be Wild" ...

These drives were just Born to be Wild! Click to play.

Get your motor runnin' ... head out on the highway ...

The health benefits provider began its investigation at that time and learned that the nine drives included personal information for former and current Health Net members, employees and health care providers. The company didn't report the breach to the public until March 14.

Gee, thanks.

Health Net spokesman Brad Kieffer declined eWEEK's request for additional information on the breach but said, "We continue investigating unaccounted for server drives, and out of an abundance of caution we are notifying our members."

"Abundance of caution" and an almost 2-month delay do not belong in the same news story.

... "Given the size and type of data lost, this is a serious breach, and those affected should have been notified and protected immediately when IBM notified Health Net of the loss," Rob Enderle, principal analyst for the Enderle Group, wrote in an e-mail to eWEEK.

Indeed.

"While the delay was likely due to the belief that these drives were either misplaced or reused and not logged and the hope they would turn up on a maintenance rotation, the exposure to those that may have been compromised is excessive, and for an insurance company not to immediately mitigate this exposure—unforgivable," Enderle said.

"Hope/keeping your fingers crossed" and "due diligence/corporate responsibility" also do not belong in the same paragraph.

Information included names, addresses, health information, Social Security numbers and/or financial information, Health Net reports. .

All the news that's fit to print.

The Health Net breach could be the most serious health care data breach since 2008, when incidents affected 2.2 million people at the University of Utah and 2.1 million people at the University of Miami, according to the San Francisco Chronicle report.

Since 2008, eh, way back when, ancient history, when dinosaurs ruled the earth?

In May 2009, Health Net suffered another security breach in which a portable disk drive holding the medical and financial data on 1.5 million members disappeared from its Connecticut headquarters.

The portable disk drives must have robotic legs, too.

Data breach penalties for Health Net could be severe, according to Enderle.

Perhaps that's why they were crossing their fingers hoping the drives would turn up somehow?

Finally, I note that this company has also been busy in recent years making a name for themselves in the Healthcare Renewal Theatre in other ways. They're stars! See http://hcrenewal.blogspot.com/search/label/Health%20Net

-- SS

Post Title → Medical Data Breach of the Month Department: Health Net Once Again a Star in the Healthcare Renewal Theatre

Windows 7 Service Pack 1 "Glitches": Why Personal Computers are Problematic, and Perhaps Should Not Be Mission Critical Components in Hospitals

A technical note on computer unreliability, and a series of followup critical questions relative to health IT:

I run Windows 7 Professional on one of my computers, a very unspecial 4-5 year old Micro Center machine, the PowerSpec 6001, using conventional components. The machine was upgraded with 2 Gb RAM and an ATI Radeon 9600 series video card, to run the Aero "eye candy."

It has run satisfactorily since I installed Windows 7 Professional (32-bit version) on it last year.

I am not a computer amateur. [I do, however, admit to being a Radio Amateur - Extra class - ed.] Further, I meticulously keep the machine current with Microsoft security patches, use Symantec anti-virus which I also keep updated, check my disk for errors, and only visit major well-known, nationally prominent websites using the machine.

So yesterday, Windows 7 Service Pack 1 appeared in my "Software updates" list from Microsoft, after being released to the general public.

It was explained that this Service Pack improves performance, reliability and security [i.e., it is intended to update all the many, many bugs, unreliabilities and security holes of the operating system since its inception - ed.]

I confirmed my machine met the specs for it, and allowed the computer to download and install Service Pack 1.

That was my mistake.

After installation, the machine could no longer reboot Windows.

The flying color patches of the first screen appeared ... and then the machine suffered a hard reboot (going back to the BIOS-initiated memory checks and screens, etc.), as if I'd pressed the front panel hardware RESET button this machine has.

An automated "wizard" that came up and tried to figure out why the machine would not restart failed to do so.

I asked the machine, therefore, to roll back to the state it was in prior to the Service Pack 1 (SP1) "upgrade" via a "Restore Point", a feature Windows permits using the "system restore" capability. The SP1 installation automatically creates a Restore Point (image of the prior state of the OS) on the machine just before installing itself.

The machine works again, but ... (and that is a big "but"):

• The Service Pack is not installed. Therefore I am not running the latest protections, and do not know what will happen in the future with respect to patches and upgrades. Maybe the Service Pack will get its own Service Pack at some point to fix it, so it can fix my computer;
  

• The Service pack installation, without warning and rather rudely, erased my prior computer Restore Points of the past few weeks, leaving only the Restore Point it created just before inflicting itself on my machine. Just to thumb its nose at me, it also left two Restore Points from back in November, which would require me to then re-install a lot of software and updates at the very least. I cannot even try a Restore Point of, say, last week after other updates;

• I attempted to view the system error logs to determine what caused the failed Service Pack Install. Surprise! The Event Viewer and Task Scheduler management consoles I use to review system operation no longer operated, instead producing this lovely, extremely explanatory message: "MMC cannot initialize the snap-in", followed by hexadecimal gibberish that any doctor or citizen can easily decipher:

Such explanatory error messages! "MMC cannot initialize the snap-in. The snap-in might not have been installed correctly. Name: Event viewer. CLSID: FX: {b05566ad-fe9c-4363-be05-7a4cbb7cb510}." Click to enlarge.

• Attempts to look up the error on the Web produce gobs and gobs of amateurish "legible gibberish", indirection, misdirection, guesswork, and speculation, some of it from Microsoft itself;

• To add insult to injury, typical of poor user interaction design, I could not copy-and-paste the error, but had to type it (partially, fortunately, thanks to Google);
  

• Much of the material was in very broken English (where's those language translators promised to us for some 50 years now by computer scientists?)

• My attempts at repairing the damage by running the command "SFC /scannow" (system file check) to check and repair critical windows files showed that the Service Pack "Upgrade" also corrupted a number of critical Windows system files - despite the "Restore Point" rollback. Great Scott!
  

• SFC repaired the files and produced a log of gibberish that's thousands of pages long for me to ferret out what got damaged (ironically, just like the records from a few weeks of a relative's EMR-error-related hospitalization, at appx. 2,900 pages of legible gibberish);
  

• The repair did not restore the missing functionality;

• Attempts to reinstall supporting packages such as .Net framework also do not restore the functionality;

• Attempts to reinstall the Service Pack produce the same results, a crash on initial restart after the installation and need to roll back, erasure of several Restore Points I manually created, along with re-corruption of the critical system files previously repaired by the SFC /scannow command.
  

• I have no way of knowing what else is broken or may malfunction;
  

• While not rigorous, reports on the web show a significant percentage of others having problems with the "Service Pack" as well. Russian Roulette, anyone?
  

Russian Roulette, anyone?

All this was after many months of Microsoft "Beta testing" the Service Pack. (Perhaps it was really "Alpha testing?")

Similar issues occurred with the former Microsoft OS, Windows XP (now in its third major service pack since its release in 2002, with patches still coming on an almost weekly basis).

Fortunately, I have backup images of my entire disk, but the inconvenience and time wasted is quite irritating - and I will still not have the latest security patches after I roll back my machine to my latest disk image.


One should note that these "glitches" are just in the Operating System (OS) itself. Third-party applications (such as EMR and CPOE sytems, middleware, interfaces, etc.) suffer the same type of problems...for instance, the life-and-limb-threatening "glitches" that occurred at Trinity Healthcare after an EMR "upgrade."

Further, OS "glitches" can cause unexpected application "glitches", and vice versa. Complexity on top of complexity...

Note that machines running similar software are on the "servers" that are the heart of major enterprise systems such as EMR's and CPOE's, that communicate with enduser workstations.

Now, several simple questions:

• Who knows what other "glitches" the Service Pack introduced to my machine, that will "bite me" (or patients) later?

• Are these the machines we want our doctors and nurses to depend upon, since they increasingly regulate every medical transaction that occurs?

• Has the software become too complex to be entirely reliable, maintainable and secure?

• Does the average hospital have the staff to effectively deal with issues such as the above?

• Do these "glitches" raise the risk and the cost - therefore reducing the ROI, already low (see reading list) - of experimental health IT to even more unsatisfactory levels?

Finally:

• Would the average person tolerate such behavior from their car? In their aircraft? (Oops, the brakes don't work properly in 13.5% of cars after the parts upgrade, and that altimeter is simply crazy ...)
  

-- SS

Feb. 24 late night addendum:

Deciding to play with this mayhem, and knowing I was going to be wasting a lot of time, I first backed up my deranged machine to an external disk (~ half an hour) to preserve my files. I then restored my machine from an external disk backup image to its condition in mid-Nov. 2010 [thinking perhaps something more recent caused the SP1 to fail]. That took another half an hour. I then attempted to install the SP1 again. That took another hour or more.

Same results - machine crash after the "circling window panes" display.

I let the "Startup Repair" wizard run. It failed with the following informative messages. In a superb example of poor user design, I had to jot the messages down on paper, as it made no offer to print them, or load them into a thumb drive, etc. - although it did offer to send the error messages to Microsoft, a neat trick as the software components to drive the computer's wireless network adapter were not loaded:

Problem details - System Repair
Problem signature:

1- 6.1.7600.16385
2- 6.1.7600.16385
3 - unknown
4 - 21201077
5- AutoFailure
6 - 3
7 - BadPatch

OS version - 6.1.7600.2.0.0
Local ID - 1033256.1
Root cause - a patch is preventing the system from starting [no fooling - ed.]
Repair Action
System file integrity check and repair
Result = Failed.
Error code = 0xa

Then for added fun, I started the machine up in 'Safe Mode' (using the F8 key at startup). It came up, but told me it was doing a System Restore due to the failure to configure the Service Pack. After about 20 minutes of frantic disk activity, the machine rebooted - and immediately crashed as before.

I am rerunning the Startup Repair wizard again, asking it to restore my system, but I predict it will do so with the original remaining problems of non-functioning components that started this whole mess - if it works at all.

This is all absurd. It is a massive waste of time, a result of poor programming, uninformative, cryptic error messages (what? computers don't have enough storage for useful error messages?), poor (nonexistent) documentation, inadequate attention to the user experience, condescension of the user, inability to report the problems back to HQ automatically due to lack of forethought about a compromised machine's ability to access the network, software unreliability, and probably a host of other issues I haven't thought of yet because I'm tired after all this fritter.

Not to mention, it is potentially destructive of data to those who suffer this problem but did not keep backups. They warn you beforehand - but the installation agreement you "sign" is of the Ross Koppel/David Kreda "hold the vendor harmless" variety.

This experience is a metaphor for the state of health IT (with "glitches", "workarounds", unexplained errors, etc.), and of the dangers of computer worship.

-- SS

Feb 25 addendum - further experimentation based on web comments about SP1, such as running a pre-SP1 readiness checking utility by Microsoft, emptying the /temp folders, renaming the "software distribution" folder, clean booting, etc. all produce the same result: crash of the machine on reboot.

And there's no computer doctor to call for an appointment to fix the problem.

-- SS

Post Title → Windows 7 Service Pack 1 "Glitches": Why Personal Computers are Problematic, and Perhaps Should Not Be Mission Critical Components in Hospitals

Annals of Electronic Information Security

At The Hill, former House Speaker Newt Gingrich raises a good point about the leak of hundreds of thousands of diplomatic cables and other private information:

"You have a private first class who downloads a quarter million documents, and the system doesn't say, 'Oh, you may be over extended?' I mean, this is a system so stupid that it ought to be a scandal of the first order," Gingrich said.

Regardless of which administration(s) are responsible (these systems probably took many years to reach their current form), one wonders if commercial EMR's suffer from the same oversights.

-- SS

Post Title → Annals of Electronic Information Security

Insurers Test Data Profiles to Identify Risky Clients

Stories like this one today at the WSJ disturb me.

“Insurers Test Data Profiles to Identify Risky Clients”
Wall Street Journal
Nov. 19, 2010

From that story:

Life insurers are testing an intensely personal new use for the vast dossiers of data being amassed about Americans: predicting people’s longevity.

Insurers have long used blood and urine tests to assess people’s health—a costly process. Today, however, data-gathering companies have such extensive files on most U.S. consumers—online shopping details, catalog purchases, magazine subscriptions, leisure activities and information from social-networking sites—that some insurers are exploring whether data can reveal nearly as much about a person as a lab analysis of their bodily fluids.

In one of the biggest tests, the U.S. arm of British insurer Aviva PLC looked at 60,000 recent insurance applicants. It found that a new, “predictive modeling” system, based partly on consumer-marketing data, was “persuasive” in its ability to mimic traditional techniques.

The research heralds a remarkable [alarming? -ed.] expansion of the use of consumer-marketing data, which is traditionally used for advertising purposes.

Read the entire article.

The reason I find this article disturbing is that it can and probably should be looked at as another example of technophiles and opportunists with no knowledge of (or lack of caring about) Social Informatics, a decades-old discipline with a focus on studying the unintended consequences of new information and communications technologies (ICT's), enabling our society to move one step closer to centralized control.

Social Informatics (SI) refers to the body of research and study that examines social aspects of computerization, including the roles of information technology in social and organizational change, the uses of information technologies in social contexts, and the ways that the social organization of information technologies is influenced by social forces and social practices.

Stories such as the above WSJ story, and others in their running series on Internet privacy, also dampen my enthusiasm about the possibility that electronic medical information will be kept private, confidential and secure.

-- SS

Post Title → Insurers Test Data Profiles to Identify Risky Clients

Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts

I have written frequently about the pipe dream of secure national electronic medical records, such as in February 2010 at my post "Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?", my post "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?", as well as "Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?" and others.

I was also quoted on July 30, 2010, in a Philadelphia Inquirer story about the theft of a laptop computer with data on 21,000 patients from Thomas Jefferson University Hospital here, and also interviewed August 2 by local NPR station WHYY-91FM, where I stated:

"There is almost no excuse for unencrypted data to be sitting on any computer at a hospital or any organization," said Scot Silverstein, a Drexel University expert on health-information technology.

In the latest health-data-on-computer-theft-of-the-week, the Inquirer ran this story today about a local theft ten times as large as July's:

Medical-data breach said to be major

By Jane M. Von Bergen, Inquirer Staff Writer, Thu, Oct. 21, 2010

A computer flash drive containing the names, addresses, and personal health information of 280,000 people is missing - one of the largest recent security breaches of personal health data in the nation.

"We deeply regret this unfortunate incident," said Jay Feldstein, the president of the two affiliated Philadelphia companies, Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan.

The breach, which involves the records of Medicaid recipients, is the first such Medicaid data breach in Pennsylvania since at least 1997, according to the state's Department of Welfare, which has oversight.

There is little more I can add to my prior postings on this issue except the words of privacy advocate, psychiatrist Dr. Deborah Peel:

The security failure, one of the several largest in nearly two years, involves nearly two-thirds of the insurers' subscribers. It became known only after The Inquirer requested information Tuesday evening. The insurers said the drive was missing from the corporate offices on Stevens Drive in Southwest Philadelphia. It noted that the same flash drive was used at community health fairs.

"That seems grossly irresponsible," said Dr. Deborah Peel, a Texas psychiatrist who heads Patient Privacy Rights, an advocacy group.

"Why would you be hauling around private patient information to a health fair," she said. "I can't imagine what they were thinking, taking this data out of a locked room at company headquarters.

"What's tragic is that this is a particularly vulnerable group of people," Peel said. "They tend to be vulnerable to identity theft, vulnerable to discrimination." Medicaid recipients are low-income people.

As to encryption (a built-in feature of the upper tier versions of Windows and of Mac OS X):

They [the companies] would not comment on the riskiness of taking the drive to health fairs, nor would they say whether the data on the drive was encrypted.

Highly likely translation: no.

The companies issued an apology:

"At Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan, our number one priority is our members. Since reporting this unfortunate incident to the Department of Public Welfare, we have actively and responsibly executed a multifaceted plan to inform those affected, while also evaluating and enhancing our security measures to ensure this does not happen again."

[Did any employee have their "privileges revoked" -- the medical term of art for a physician who is 'fired' -- I wonder? - ed.]

Perhaps the executives in charge of this data, as well as the IT department, should read stories like the aforementioned July 30, 2010 story.

However, I fear there are those who are ineducable or hopelessly irresponsible when it comes to acting cautiously and responsibly regarding computer-based medical information, in the poorly bounded, complex, unpredictable world of healthcare.

That is not to even mention deliberate theft for personal gain.

This is why the dream of secure national electronic medical records seems a pipe dream for the foreseeable future.

-- SS

10/23 Addendum

in an updated story, the Inquirer reports the data was indeed unencrypted, although the companies claimed an encryption project was in progress.

Post Title → Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts

Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?

At "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?" I wrote that the holy grail of electronic medical record efforts - the creation of a networked, interoperable, secure national medical records system - may be far more difficult than anyone expected due to vulnerabilities in current, widespread IT networking and OS platforms.

Now we hear the situation is even worse than in the articles I cited at that post:

Wall Street Journal
Feb. 18, 2010
Broad New Hacking Attack Detected

Global Offensive Snagged Corporate, Personal Data at nearly 2,500 Companies; Operation Is Still Running

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach.

The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

One can only imagine how internet-connected hospitals, generally an IT backwater, might fare under such an onslaught.

... In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier's military email account, NetWitness found. A Pentagon spokesman said the military didn't comment on specific threats or intrusions.

At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee's apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past.

Read the while article. These breaches are an unpleasant reality in 2010, but what's worse is there really are no solid metrics for the true extent of this 'disease.'

Perhaps future Internet technologies will reduce or eliminate the problem, as one reader suggested in a comment to my aforementioned post. I do not believe, however, that patients and their medical records should be used as guinea pigs until those new networking and security technologies are widely deployed and well-proven.

In effect, this is probably not a good time for actual records-level interoperability to be deployed in any manner other than in consideration of a future strategy. Operationalizing that strategy should probably await a time when the "digital ether" in which the data resides and moves is more mature, unless proprietary networks and technology are to be used and without connection to the Internet. Planning data-level compatibility between systems, on the other hand, is work that should continue.

Finally, the layoffs and staffing levels in today's IT departments (at both vendor and user shops), plus the outsourcing of critical IT functions to overseas contractors where workers' loyalty to the primary firm is questionable at best, may be a contributing factor to the nakedness of corporate America's information systems.

-- SS

Post Title → Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?

Networked, Interoperable, Secure National Medical Records a Castle in the Sky?

The holy grail of electronic medical record efforts of late is the creation of networked, interoperable, secure national medical records that would allow a physician in Palo Alto to retrieve the records of a patient from Hoboken if that patient moved or was found (in the hackneyed and somewhat histrionic scenario) unconscious on the streets of San Francisco.

Recent events have made me skeptical we are anywhere near ready for such a technological accomplishment:

McAfee: Big Business Under Constant Cyber Attack
01.29.10

At the World Economic Forum Annual Meeting in Switzerland, McAfee announced the results of a survey of 600 IT security execs in "critical infrastructure enterprises worldwide": that is, in places such as utility companies, banks, and even oil refineries. And apparently, they're constantly under cyber attack and also extortion related to those attacks.

It's a real battlefield out there.

The report, written by the Center for Strategic and International Studies (CSIS), says that 54 percent of those surveyed have already been attacked. The culprits behind the cyber-attacks are listed as "organized crime-gangs, terrorists, or nation-states."

In other words, not simply teenage hackers or cyber-papparazi interested in the medical condition of a movie star.

Only one-fifth of the IT execs surveyed believe their systems are currently secure. One-third say things are worse now, vulnerability-wise, than a year ago, due to budget cuts.

What constitutes a cyber attack? A distributed denial of service (DDoS) is the most typical ... mitigation can be hampered by the local laws, working in multiple countries, or the economics of where they operate. For example, half of those surveyed claim the laws in their countries don't do enough to prevent or deter cyber attacks. That's especially true for Russia, Mexico, and Brazil.

Other attack vectors include DNS poisoning where Web traffic is redirected, SQL injection attacks on back-end data via a public Web site, and plain old theft of services.

If you need a plot for your new thriller novel, keep in mind that 20 percent of these companies are not just cyber-attacked, but have also been threatened with attacks in the last two years in "low-level extortion" attempts.

... Those surveyed said the money loss is the worst part, second is the loss of reputation, and (if you thought you weren't important) loss of customers' personal information is third.

This is a worldwide survey, and almost two-thirds of those surveyed believe foreign governments were responsible in some way for previous attacks. The two countries considering the biggest threats: China (by 33 percent of those surveyed) and the good ol' U.S. of A. (by 36 percent). China believes it's the biggest target.

The full report, called In the Crossfire: Critical Infrastructure in the Age of the Cyber War is free on McAfee's Web site in PDF format.

I note that Google recently called in the National Security Agency to help analyze a major corporate espionage attack:

The attacks targeted Google source code -- the programming language underlying Google applications -- and extended to more than 30 other large tech, defense, energy, financial and media companies. The Gmail accounts of human rights activists in Europe, China and the United States were also compromised.

Then there's this:

Intelligence Chief: U.S. at Risk of Crippling Cyber Attack
Feb. 4, 2010

The United States is at risk of a crippling cyber attack that could "wreak havoc" on the country, Director of National Intelligence Dennis Blair said.

"What we don't quite understand as seriously as we should is the extent of malicious cyberactivity that grows, that is growing now at unprecedented rates, extraordinary sophistication," Blair said.

... He said one critical "factor" is that more and more foreign companies are supplying software and hardware for government and private sector networks. "This increases the potential for subversion of the information in ... those systems," Blair said. [Outsourcing our HIT development overseas sounds like a great idea - ed.]

Read the linked articles in their entirety.

Perhaps we should focus on the local at present. National networked EMR's are a great concept, but there are a few social-technical details that remain to be worked out beforehand.

A Castle in the Sky...

-- SS

Post Title → Networked, Interoperable, Secure National Medical Records a Castle in the Sky?