Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

cs.dartmouth.edu

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#11

Post by analog31 »

Johnny555 wrote: post #8
gustavus wrote: post #6

It really seems to me that at least for healthcare the solution is just to go back to paper and then just take the paper and do data entry on it after it's out of the workflow on a daily or bidaily basis or something. Honestly I'm also going to go out on a limb and guess that if most of the EHR portals screens were replaced with flat org files things would also work better.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

That may be the medical purpose of electronic records, but there's a business purpose -- billing -- and an administrative purpose that includes security and regulatory compliance. All orchestrated by the same software.

If I were given one guess, it would be that the medical purpose for authentication is to avoid accidentally corrupting the data, e.g., typing Alice's prescription into Bob's screen. But the authentication technology is distorted by a security purpose that may be unnecessary and is being regularly bypassed.

For instance, just having people enter their initials into every entry or screen would go a long way towards eliminating erroneous entry, without being too burdensome.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#12

Post by cfu28 »

Johnny555 wrote: post #8
gustavus wrote: post #6

It really seems to me that at least for healthcare the solution is just to go back to paper and then just take the paper and do data entry on it after it's out of the workflow on a daily or bidaily basis or something. Honestly I'm also going to go out on a limb and guess that if most of the EHR portals screens were replaced with flat org files things would also work better.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

I don’t have the source on hand, but during my clinical informatics rotation it was mentioned that many early EMR implementations actually increased drug errors

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#13

Post by kazinator »

I'm not in healthcare, but I've evaded annoying/inconvenient security crap.

One method I used for evading VPNs and using SSH was to have an script running inside the protected network, making an active connection to a SSH server on my machine at home, and set up a tunnel. Then I could use remote desktop through the tunnel.

I use the following TXR Lisp program to defeat screen timeouts on Windows:

  (typedef UINT uint)
  (typedef LPCWSTR wstr)
  (typedef HWND (cptr HWND))

  (defsymacro NULL cptr-null)
  (defsymacro MB_OK #x00000000)
  (defsymacro MB_ICONWARNING #x00000030)

  (typedef EXECUTION_STATE uint)

  (defsymacro ES_CONTINOUS #x80000000)
  (defsymacro ES_DISPLAY_REQUIRED #x00000002)

  (with-dyn-lib "user32.dll"
    (deffi MessageBox "MessageBoxW"
           int (HWND LPCWSTR LPCWSTR UINT)))

  (with-dyn-lib "kernel32.dll"
    (deffi SetThrExecState "SetThreadExecutionState"
           EXECUTION_STATE (EXECUTION_STATE)))

  (with-resources ((prevstate (SetThrExecState (logior ES_CONTINOUS
                                                       ES_DISPLAY_REQUIRED))
                              (SetThrExecState prevstate)))
    (MessageBox NULL "Screen lock disabled\n\runtil you click OK." "NoLock"
         (logior MB_OK MB_ICONWARNING)))
I wrote a Firefox extension called JP-Hash, which gives you a hotkey that converts text in an input field into hash made up of romanized Japanese syllables (and thus usually easy to type, if you have to, and possibly easy to pronounce and memorize). It includes an upper case letter, a digit and a symbol.

https://addons.mozilla.org/en-US/firefox/addon/jp-hash/

https://www.kylheku.com/cgit/jp-hash/about/

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#14

Post by 11011001 »

toomuchtodo wrote: post #5
Johnny555 wrote: post #4

Earlier quoted context omitted.

Biometrics aren't always reliable, the article mentioned this anecdote: Another example comes from a city hospital where creating a death certificate requires a doctor's digital thumbprint. Unfortunately for that hospital, there is a single doctor that has thumbs that the digital reader manages to scan, so the doctor ends up signing all the death certificates for that hospital regardless of whose patient the deceased…

Smartcard + faceid?

> Smartcard + faceid?

You're missing the point.

The solution is for the tech people to stop thinking they're the center of the universe, and drop requirements that make no sense for their users.

In the case of the death certificate, that means dropping the extra authentication requirements for that computer application*, or just having the doctor print out the certificate and sign it, like it was always done.

* Software engineers suffer from a certain kind of brain rot where they assume the computer system itself is the last and only line of defense (so enforce onerous authentication requirements). In some cases that might be the right call, but in others is makes more sense to loosen the requirements and rely on other systems (e.g. auditing and after-the-fact investigation).

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#15

Post by toomuchtodo »

11011001 wrote: post #14
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Smartcard + faceid?

> Smartcard + faceid? You're missing the point. The solution is for the tech people to stop thinking they're the center of the universe, and drop requirements that make no sense for their users. In the case of the death certificate, that means dropping the extra authentication requirements for that computer application*, or just having the doctor print out the certificate and sign it, like it was always done. * Softw…

Identity and access management is a component of my work at a fintech. The argument isn’t lost on me. A death certificate is a powerful government signal, so while friction should be minimal so as to not be overly burdensome on the practitioner, it is not something you can be careless about from an identity perspective. It calls for strong provenance. If the technology is not transparent, that is a call to improve it to be so, not to ignore the requirements.

Doctors are also known for superiority complexes. Took forever just to get them to wash their hands to prevent contagion spread, historically speaking. They are not special snowflakes nor gods, but yet another stakeholder in a system. Their feedback should be used to improve systems as I mention above, to assist them but not block them. Change is inevitable.

https://www.cmu.edu/dietrich/sds/docs/loewenstein/physicianN...

https://www.nationalgeographic.com/history/article/handwashi...

(not a software engineer, head of security, including anti fraud measures)

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#16

Post by jalapenos »

Have had some level of security farce, like described in this paper, in every org I've ever been in.

The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in.

Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences.

The moment they're under carrot-and-stick for not interfering with productivity, as well as preventing intrusions, you get more acceptable outcomes.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#18

Post by kuchenbecker »

analog31 wrote: post #11
Johnny555 wrote: post #8

Earlier quoted context omitted.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

That may be the medical purpose of electronic records, but there's a business purpose -- billing -- and an administrative purpose that includes security and regulatory compliance. All orchestrated by the same software. If I were given one guess, it would be that the medical purpose for authentication is to avoid accidentally corrupting the data, e.g., typing Alice's prescription into Bob's screen. But the authenticat…

The problem with what you describe is alert fatigue.

This IS the selling point, therefore we can catch all errors!

WARNING: patient medication dose higher than expected (override)

WARNING: patient already received dose within recommendations (override)

WARNING: patient is allergic to medication (override, mistake)

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#19

Post by lamontcg »

toomuchtodo wrote: post #15
11011001 wrote: post #14

Earlier quoted context omitted.

> Smartcard + faceid? You're missing the point. The solution is for the tech people to stop thinking they're the center of the universe, and drop requirements that make no sense for their users. In the case of the death certificate, that means dropping the extra authentication requirements for that computer application*, or just having the doctor print out the certificate and sign it, like it was always done. * Softw…

Identity and access management is a component of my work at a fintech. The argument isn’t lost on me. A death certificate is a powerful government signal, so while friction should be minimal so as to not be overly burdensome on the practitioner, it is not something you can be careless about from an identity perspective. It calls for strong provenance. If the technology is not transparent, that is a call to improve it…

The legal system can generally deal with anything that falls through the cracks.

There's probably not a whole lot of massively society-impacting fraud in the death certificate system if a whole hospital can run off of technically fraudulent records when one guy is signing them all.

You could cut down on that by relaxing the technological attempts to "improve" it all and just let the legal system and humans address any actual abuse.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#20

Post by gustavus »

toomuchtodo wrote: post #5
Johnny555 wrote: post #4

Earlier quoted context omitted.

Biometrics aren't always reliable, the article mentioned this anecdote: Another example comes from a city hospital where creating a death certificate requires a doctor's digital thumbprint. Unfortunately for that hospital, there is a single doctor that has thumbs that the digital reader manages to scan, so the doctor ends up signing all the death certificates for that hospital regardless of whose patient the deceased…

Smartcard + faceid?

What if I misplaced my smart card what if I'm wearing mask or surgical hat.
Post reply on HN