Patient medical files on Net

WSJ - 2/20/96, page B1 
     
     "Click! Doctor to Post Patient Files on Net" by G. Bruce Knecht
     
     "An audacious experiment ...
     [snip]
     "Deep in the heart of Appalachian coal country, a doctor is about to 
     put his patients' records on the World Wide Web.  The Doctor, Bruce 
     Merkin, works at a community health clinic in Wayne, W. Va."
     [snip]
     "Dr. Merkin and Vasudevan Jagan-nathaniel, a West Virginia University 
     professor who is responsible for developing the software for the 
     system, say they have yet to decide how secure the system should be.  
     At one extreme, they could encrypt the information, offering the 
     highest possible degree of protection.  But encryption is expensive 
     and time consuming and thus could hinder the goals of cutting costs 
     and rapidly transmitting information."
     [snip]
     
     
     Cypherpunks:
     
     The WSJ report seems to indicate that the system is to be deployed 
     without any encryption safeguards.
     
     After talking by phone to Lee Oxley (oxley@vhs.wvu.edu) at Valley 
     Health in Wayne, WV, I got clarifications of what was in the WSJ 
     story.  The present pilot system is an intranet system with dedicated 
     frame relay links and does use encryption.  Eventually they may deploy 
     a system that would be internet based.  They are considering how much 
     protection to put into the system.  The reference in the article about 
     encryption costs was intended to be about CPU cycles not dollars. 
     Vasudevan Jagan-nathaniel's email address is juggy@cerc.wvu.edu
     
     Some obvious proposals would be to use something like SSL to do server 
     to workstation encryption.  I don't know what issues may exist such as 
     the effort to install SSL, key management, and processing delays due 
     to session keys and traffic encryption.  In addition, how could an 
     on-call doctor access patient records through an ISP and maintain 
     patient privacy.  An obvious issue (which I know have been discussed 
     on this list) has to do with the trade-off between key size and 
     privacy.
     
     Any other thoughts?
     
     Martin G. Diehl

When I was working in a reasearch lab at a large hospital, we
considered using SSL for protecting some non-anonymized patient
information.

	We decided against putting those records on the web for a
number of reasons.  First was a general distrust of the SSL protocol.
Versions 1 & 2 were designed by amatuer cryptographers, to protect
credit card numbers.  We considered patient records much more private
than that.  Next was the de facto 40 bit keysize of Netscape.  We
didn't want to try to teach surgeons the difference between the 40 bit
crypto in the free version & the 128 bit in the pay for version.  They
were already convinced that Netscape was unbreakable encryption.
(Fortunately, this was about 2 days before the random numbers got to
the front page of the New York Times, so they believe me now.)  The
last reason was becuase I fully expect web servers to become the
sendmails of the 90s.  Big, badly configured, and used as a means of
breaking into a server.  Once someone breaks into a web server, all
the encryption in the world won't help; those files need to be
decrypted so they can be sent out under SSL's arbitrary keys.

Adam

|      Some obvious proposals would be to use something like SSL to do server 
|      to workstation encryption.  I don't know what issues may exist such as 
|      the effort to install SSL, key management, and processing delays due 
|      to session keys and traffic encryption.  In addition, how could an 
|      on-call doctor access patient records through an ISP and maintain 
|      patient privacy.  An obvious issue (which I know have been discussed 
|      on this list) has to do with the trade-off between key size and 
|      privacy.
|      
|      Any other thoughts?
|      
|      Martin G. Diehl
| 


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Dear all:

We are pleased with the national attention the ARTEMIS project of the
Concurrent Engineering Research Center(CERC) sponsored by NLM has
attracted. On February 20, there was an article in
the Wall Street Journal calling ARTEMIS an "audacious experiment" by a
rural physician in West Virginia, Dr. Bruce Merkin, M.D. This was
followed by an ABC Evening News story with Peter Jennings (Feb 21,
Wednesday) which declared Dr. Merkin is "the future."

While we  are most happy to receive this attention, we are also
concerned that some people may erroneously draw the conclusion that we
are jeopardizing patient confidentiality by "putting their records on
the Web." We are both  extremely security conscious and thouroughly
familiar with all the available security technologies. We have taken a
number of steps to ensure that our experiment will not be compromized:

1. The patient records are on the INTRAnet which is secured with a
firewall and we continously monitor and evaluate the efficacy of this
protection.

2. Standard UNIX network security mechanisms with all the known security
holes addressed and verified with programs such as "Satan"

3. Multiple levels of access controls, role-based access controls,
user-id based access controls - implemented using Oracle DB mechanisms

4. Audit trails as a separate CORBA-service to track all transactions
and accesses to any patient information

We can add additional layers such as classification of sensitivity of
information, stripping patient identifying information etc as our core
infrastructure is based on CORBA.  We have and continue to experiment
with a number of security technologies. We have in our research
testbed prototypes of systems using Kerberos, PGP, MOSS, and RSA-based
public-key server technologies. We are currently investigating
commercial security technologies and technologies that can securely
bridge World Wide Web and distributed object technologies and CORBA
standards promoted by OMG. Until a satisfactory implementation of
security and a market acceptance of the mechanisms using these
emerging and potent technologies are in place, confidential patient
information will NOT be put in the "Internet".


Sincerely

Ramana Reddy, CERC
V. "Juggy" Jannathan, CERC 
Bruce Merkin, Valley Health Systems Inc.

Co-Principal Investigators

------------------------------------------------------------------
            Ramana Reddy (Also known as Y. V. Reddy) 
            Director
            Concurrent Engineering Research Center
            West Virginia University
            Morgantown, WV 26506
       e-mail: rar@cerc.wvu.edu
-------------------------------------------------------------------