Health Service laptop goes missing with over eight million patient records
v3.co.uk
v3.co.uk
OK so that isn't a perfect solution (the user could keep their passwords on a bit of paper clearly marked "passwords" in the laptop's bag, if the user loses their passwords the data is lost to them (unless a multi-key system is used and the IT dept keeps their own key so they can reset the user's access, though that probably requires the user sending the laptop into central IT for a time), data could still be emailed out to insecure places by the user, and so on) but it is a far better situation than leaving the data unencrypted on the easily liftable device.
It really does surprise me that after the last five or more years a proper encryption regime isn't mandated on laptops holding such data.
In many ways it's a pain in the ass, because almost exactly none of us will ever use Patient Identifiable Data but we have to put up with machines that run much slower than they should due to the on-the-fly encryption. We're also physically incapable of burning CDs/DVDs or using USB sticks etc.
It's a single person, or small department, using some off-the-shelf tool like Excel or Access to massage data into the format necessary to integrate it with one of the various third parties that must process it in order to get full reimbursement while ensuring compliance with regulations. The problem itself demands that huge amounts of personal data are gathered together, and the way the system works generally forces it to be handled by a regular person, on their workstation.
Obviously this data needs to be shared with the payor (e.g., Medicare). The thing is that the reimbursement regulations change constantly (not just every year or something, but literally weekly in the Federal Register), and changing regulations demand different reporting procedures and formats. The constantly-changing nature means that it's not a very good candidate for automation: every hospital (and every other healthcare provider) would need to have IT staff constantly active addressing changes, or at the very least, providers of hospital ERP/records systems would need to be constantly addressing changes, and hospital IT would need to constantly be integrating software updates.
And it's not just the payor that's a problem. There are countless third parties that communicate this data. Because cases are handled as cases rather than people, when a case is transferred to another hospital, or sent out to a specialist, that must be tracked. But frequently it's not the hospital doing the checking, it's the patient himself that checks himself out and goes to another hospital. That means that hospitals are constantly downloading Medicaid records to cross-check against their own data, and negotiating with other providers to determine who gets "credit" for the cases. Since all of these third parties have their own systems, and the number of combinations of transfers between providers is astronomical, the communication of this data tends to turn into one-off projects, demanding that a human compile the data in a way that both sides agree to.
So it appears that part of the need to keep human hands in heaps of personal data, is driven by the nature of our healthcare regulation.
(I know the article is written about the UK, but I'm assuming that much of what I've said generalizes across the ocean)
The hospital inputs their data into Epic medical software. The home care agency tracks their data in an 80,000-line Excel spreadsheet (less than 8,000,000, which is good, right?). My mother copies down the name and other personal identifiers like insurance numbers from the Excel spreadsheet, counts (with the end of a pen on the screen) the number of billable visits, and enters this by hand onto a printed form which receives minor changes as you noted. She then collates these forms into stacks for various insurance agencies, and faxes the piles to the appropriate numbers. She's an RN, has 20 years of experience, and this is what they pay her to do?
Oh, and her password for remote login to do this from home was (until last week when she told me because I was talking to my sister about password strength) literally abc123. This was the default set by the IT department about 2 years ago.
I will never work in medical IT due to real-life horror stories like this.
I'd wager that there are real-life horror stories like this for just about any industry - they happen whenever non-computer-savvy people meet computers.
[1]http://en.wikipedia.org/wiki/List_of_UK_government_data_loss...
[2]http://www.theregister.co.uk/2007/11/20/hmrc_loses_lots_data...
[3]http://www.itpro.co.uk/625459/mod-laptop-losses-continue
[4]http://www.theregister.co.uk/2008/08/20/uk_gov_lost_records/
[5]http://dioclese.blogspot.com/2011/06/nhs-computer-system.htm...
Even if your process requires someone remote from the office to work with the data in desktop tools like Excel, etc., it seems like it'd be good sense to require them to do it over a Terminal Services or Citrix connection to a secured server.