wbur.org
support wbur today!

John Halamka, the Chief Information Officer at Beth Israel Deaconess Medical Center, says hackers attempt to break into the hospital’s networks every 7 seconds. He has four people working fulltime to fend off attacks, many of which Halamka says are from East Cambridge (MIT) and Eastern Europe. Harvard hospital system =s big trophy. Halamka wrote about this on his blog last October and has a list of 10 recommendations for improved security. I post the link for anyone who didn’t see it, and is thinking about the security of on-line (medical) records.

Share:

This entry is filed under News Stories. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.


Comments
  • reporter posted:
    Comment posted May 12th, 2008 at 10:03 pm

    For all who are concerned about privacy issues and theft of personal and medical info, please avail yourselves of the following which is part of the law but translated here into everyday langauge.

    As of January of 2008, insurance companies will be required to submit monthly reports on the first day of each month of the previous month’s membership, identifying those individuals for whom they provided “creditable coverage.” The Bureau will maintain a database of all health plan membership to confirm who in the Commonwealth has health insurance coverage and during what time frames.

    Medical providers, likewise, must submit monthly reports with similar and other unspecified details or face substantial penalties and possible prosecution.

    There are penalties for nonpayment or late payment by a employer, medical provider or individual who does not provide information within the state’s time frame

    The law stipulates that many state and federal agencies will have access to the personal and financial information of all citizens and be used as needed. The law says that no specific medical data will be included.

    All information and communication is done by an newly developed, internet-based computer system and updated and cross-matched monthly.

    Some of these agencies that will collect and share personal information via the Internet are:

    Commonwealth Health Insurance Connector Authority
    State Division of Unemployment Assistance
    State Division of Health Care Finance and Policy
    State Division of Insurance
    State Department of Revenue
    MassHealth
    State Office of Medicaid
    State Dept. of Public Health
    State Division of Unemployment Assistance
    State Dept. of Health and Human Services
    Department of Public Health’s Bureau of Vital Statistics
    Department of Veteran’s Services
    Department of Industrial Accidents
    Internal Revenue Service
    Social Security Administration
    Bureau of Special Investigations
    Department of Transitional Assistance (welfare)
    Alien Verification Information System
    Health insurance carriers
    Third party (outside hired contractors for any agency-the law explicitly provides for this)
    The Federal Government will also have access to this data

    The State has contracted for all individual information and billing functions to be held and processed in a huge computerized data base that is administered by an international company called Maximus. Another company, Vecna will also be involved. UPDATE: I believe the Connector dumped Maximus and has hired another company but I’m not up to speed on that info yet.

    This massive amount of data sharing opens too many Pandora’s boxes such as, but not limited to:

    Medical cost fraud – more access to info so more opportunity to overlap billing and no one will know the difference

    Political reprisals
    Denial of other types of insurance
    Job security and future employment
    Access to future health care
    Discrimination in personal coverage and cost of future health care
    Medical fraud
    Identity theft
    Residents have not been informed about these databases and exchange of personal and financial information and, thus, have not given their informed consent or any other consent for their information to be passed around

    When will the public be informed about the massive data-collection system in place to manage the mandate and where their personal and financial information is being sent? This information must be disclosed on all eligibility and/or application forms by any and all insurance companies, state and private.

    How can they be sure their confidential medical records are not being shared?

    How many more entities will be added to this list?

    How can we trust the electronic integrity of this system?

    In spring 2007 I asked two Connector CSRs what comes up on their screen if I were to give my social security number. I was informed: name, address, total monthly work income, total monthly interest income and, I believe, profession. I don’t know if this has changed since then but I doubt it. Nonetheless, I did not give my consent, assumed, informed or otherwise, for this information to be made available to such a staff.

  • Leave a comment



Advertisement