Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hospitals are a weak spot in U.S. cybersecurity

axios.com

Post reply on HN
Print view View original

81–90 of 166 posts

Re: Hospitals are a weak spot in U.S. cybersecurity

#81

Post by snuxoll »

sixothree wrote: post #80
dpflan wrote: post #50

Earlier quoted context omitted.

Regarding legacy EMRs, are specifications/standards like HL7's FHIR actually gaining any traction and making data interoperability more feasible?

In my world they sure are. Want health records on your iPhone? Well that comes via FHIR. You can even see the FHIR resource JSON in the Health app. But there are many systems in a hospital. And as EuphoricEmu pointed out within the hospital, admits, discharges and movements throughout the hospital are still done via HL7v2 (a delimited and structured format). Additionally, I would absolutely NOT build a new system on…

Unfortunately consumer-facing use cases are the ones big EMR vendors like Epic are focusing on with FHIR, push is often neglected or left out meaning we still have to rely on good old HL7v2 to get real time feeds out of the system.

Re: Hospitals are a weak spot in U.S. cybersecurity

#82

Post by analog31 »

keithnz wrote: post #71
rubatuga wrote: post #52

Earlier quoted context omitted.

People need to stop hating on fax. Hospitals still use fax because it is a much more punishable crime to tap phone lines which requires physical access, as opposed to a server that could be infected from a hacker halfway across the world.

Fax is odd, it was a fantastic thing when it first came about, and it has some desirable properties. - It's direct point to point communication (over a network) - The transport network is dedicated and not open to anyone and covered by quite strong laws in many countries - It's easy to see the history of communications - It's easy to see if the other end successfully received something - It's relatively standardized…

- It's easy to see if the other end successfully received something

I think this is a biggie. It means your workflow doesn't need to include going back later and checking to see if your document was received, and then trying to send it some different way. You don't have to guess which way the recipient is capable of receiving a message.

It's the original e-mail. ;-)

Re: Hospitals are a weak spot in U.S. cybersecurity

#83

Post by snuxoll »

VectorLock wrote: post #66
burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

Does Epic use MUMPS? I know a lot of professional nurses and the rancor around Epic is off the charts.

Yes, as does Meditech. Both are horrible products to integrate with and they’re rather common in large hospital systems.

Re: Hospitals are a weak spot in U.S. cybersecurity

#84

Post by roywiggins »

rubatuga wrote: post #52
burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

People need to stop hating on fax. Hospitals still use fax because it is a much more punishable crime to tap phone lines which requires physical access, as opposed to a server that could be infected from a hacker halfway across the world.

And because it's explicitly grandfathered in to HIPAA as a "secure" method of transmitting patient data.

Also, fax machines are very often just as internet connected as anything else. Email to fax, fax to email, fax-over-IP, it's not just modems dialing each other on copper anymore.

Re: Hospitals are a weak spot in U.S. cybersecurity

#85

Post by EuphoricEmu »

dpflan wrote: post #57
EuphoricEmu wrote: post #53

Earlier quoted context omitted.

Not OP but I can tell you that due to the object size limitations of FHIR objects, document exchange is just not feasible. Using FHIR to register a patient is pretty pointless currently as every older and larger hospital sends HL7v2. RHIOs building gateways for 3rd party apps is very much the future of FHIR. But they’ll still be interacting with that crufty legacy system. Just my own two cents.

Thanks! I was not aware of the object size limitations nor of RHIOs Are RHIOs using engineers/consultants to wrapped legacy systems then devise methods to make accessing that data easier -- how are RHIOs using FHIR and legacy system to construct the future of medical data interoperability?

RHIOs exist predominantly to allow the exchange of patient information between participating hospitals or even regions. I personally only have insight into how two RHIOs operate. Both are very interested how they can turn FHIR into another avenue to distribute patient information.

The issue is that most EHR/EMR vendors have very limited limited interoperability with FHIR. As a lot of these vendors are struggling with CCD 2.1 implementations. The exciting space is allowing patients through 3rd party apps to request specific information or even send it to the HIE (RHIO in this case) and let there GPs know of certain events.

Which means a lot of work to bend over backwards to get APIs exposed for these 3rd parties.

Re: Hospitals are a weak spot in U.S. cybersecurity

#86

Post by ethbro »

agumonkey wrote: post #78
ethbro wrote: post #75

Earlier quoted context omitted.

The amount of complexity that it would be necessary to simplify and approximate would make any answer to this question meaningless. And it's not only an IT systems problem. It's a comprehensive systems problem. Which includes training, and counterparty expectations, and manual data entry, etc.

I'd wish hard to have a peek in these projects.

One of the reasons change is so slow in the industry is because there are many must-be-coordinated changes, with various independent parties.

E.g. if I update my system, you need to update your system

From what I saw, one of the biggest motivators would be carving out legal protections for trialing some smaller % of total workflow under new systems.

E.g. If you moved By decreasing that first burden of migration, you might get more traction in aggressive IT updates.

Re: Hospitals are a weak spot in U.S. cybersecurity

#87

Post by EuphoricEmu »

sixothree wrote: post #80
dpflan wrote: post #50

Earlier quoted context omitted.

Regarding legacy EMRs, are specifications/standards like HL7's FHIR actually gaining any traction and making data interoperability more feasible?

In my world they sure are. Want health records on your iPhone? Well that comes via FHIR. You can even see the FHIR resource JSON in the Health app. But there are many systems in a hospital. And as EuphoricEmu pointed out within the hospital, admits, discharges and movements throughout the hospital are still done via HL7v2 (a delimited and structured format). Additionally, I would absolutely NOT build a new system on…

Yup, there are a few EHR vendors that have some limited support. Intersystems’ whole platform is shifting towards have pure native support for FHIR. It’s still very rough and to into the weeds of things you sadly have to delve into that very old language (objectscript = MUMPS). But thankfully there bindings for more modern languages for it.

Re: Hospitals are a weak spot in U.S. cybersecurity

#88

Post by lmiller1990 »

dpflan wrote: post #50
burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

Regarding legacy EMRs, are specifications/standards like HL7's FHIR actually gaining any traction and making data interoperability more feasible?

I work as a company that builds software to optimize dosing, and we have apps in a few of the major EHR vendors app stores. FHIR has been great for getting and presenting data - although I think true interop between EHRs using FHIR would be challenging, due to the large amounts of data and the (relative) complexity of each EHR. Despite everyone using FHIR, it does suffer from the same problem other specs like HTML do, everyone has an ever so slightly different implementation, and once it's been implemented, no interest in changing or improving it.

Re: Hospitals are a weak spot in U.S. cybersecurity

#89

Post by EuphoricEmu »

snuxoll wrote: post #81
sixothree wrote: post #80

Earlier quoted context omitted.

In my world they sure are. Want health records on your iPhone? Well that comes via FHIR. You can even see the FHIR resource JSON in the Health app. But there are many systems in a hospital. And as EuphoricEmu pointed out within the hospital, admits, discharges and movements throughout the hospital are still done via HL7v2 (a delimited and structured format). Additionally, I would absolutely NOT build a new system on…

Unfortunately consumer-facing use cases are the ones big EMR vendors like Epic are focusing on with FHIR, push is often neglected or left out meaning we still have to rely on good old HL7v2 to get real time feeds out of the system.

Yes exactly! Since patient movement within a hospital is done primary with v2 and then hours or even days later a patient summary CCD might get sent across. Unless you’re dealing with encounter based CCDs. But those still aren’t live.

Re: Hospitals are a weak spot in U.S. cybersecurity

#90

Post by roywiggins »

VectorLock wrote: post #66
burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

Does Epic use MUMPS? I know a lot of professional nurses and the rancor around Epic is off the charts.

Backend is all MUMPS. Frontend was for a long time coded in Visual Basic 6.

VB6/MUMPS stack is... not ergonomic to code in.

Epic is easy to hate (it's everywhere), and for good reason. However, the alternatives are not obviously better unless there's been some radical innovation. There are definitely systems designed for a particular piece of a hospital (ex, ER, or labs, etc) that are probably better than Epic is, but when it comes to having one system for the entire hospital, they're all pretty bad.

The main problem is that the customer is not the nurses, it's the legal/financial/administrative side.

Post reply on HN