Oz e-health privacy: after a breach is too late

Australia's peak privacy body has lambasted the country's Senate for being ignorant about the implications of the country's new e-health records. What was once called the Personally Controlled Electronic Health Record (PCEHR), re-branded My Health Record this year to give it a smiley face, is the government's attempt to …

[dan1980]

"Looking behind the mask, however, the Australian Privacy Foundation reckons the e-health system looks more like it was designed for spooks and revenue-collectors than for doctors or patients."

Say is ain't so . . .

Here is the rub: no system is 100% secure. Maybe it might be possible to build one but there is almost always a play-off between security and convenience/functionality. In any given system, it's necessary to ask whether it's really possible to achieve the goals while ensuring adequate security.'

So we have to ask what the actual point of electronic health records are. The answer is: to compile all the records in one place to create a master copy that is easy and convenient to query and update by numerous people across the public and private sectors working in healthcare, administration, insurance and taxation.

Understood that way, the reality is that the more such a system meets those goals, the less it will be able provide a suitable level of privacy and security for the patients.

Why?

• Collecting all the data in one place provides criminals with a single target they can concentrate on.
• It also means that any breach (whether through criminal activity or negligence) is likely to affect vast numbers of people.
• Providing access to a wide range of people means there is a greater chance of a breach or data loss through poor practices on the part of users.
• Providing access at a wide range of locations means it is next-to impossible to lock down and thus harder to control and restrict unwanted intrusions.

Put simply, the more data you make accessible to clinical and administrative staff and the easier it is for them to access it, the more data you will make available to criminals and the easier it will be for them to access it.

[Winkypop]

"dangerously naïve" - "patently absurd"

That's our current Senate alright.

What a time to be alive!

[dan1980]

Re: "dangerously naïve" - "patently absurd"

Just the senate?

[Tony S]

Re: "dangerously naïve" - "patently absurd"

It does almost seem that those terms could be part of the standard job description for a politician, pretty much anywhere in the world.

[Anonymous Coward]

Re: "dangerously naïve" - "patently absurd"

Perhaps you woul;d have prefereed being alive in WW1 or WW2???

[glen waverley]

"made a hash of avoiding name-collisions in the system"

I saw what you did there!

[Pascal Monett]

"[the system] couldn't handle names with apostrophes"

Did they "forget" to sanitize inputs as well ?

Time will tell.

[g00se]

Re: "[the system] couldn't handle names with apostrophes"

Or maybe they over-sanitized? Perhaps it also disallows the surname Tables? Sorry Bobby, you're out of luck ...

[Cincinnataroo]

I wonder how many think that any information placed with government is safe?

[Anonymous Coward]

And Australia's-peak-privacy-body damning report will be read by?

Absolutely no one in charge! What a world, what a world...............

[Anonymous Coward]

The most sobering bit....

“Relying primarily on penalties overlooks the fact that they are totally ineffective against criminals and cyber-terrorists operating overseas. Once a breach has occurred, the data cannot be put back in the box. Once an identity is used fraudulently, the damage is done.”

.....At a time when the internet has never been more insecure, at a point when the exploitation of data has never held more uncertainty, bureaucrats and politicians go full steam ahead into the unknown.

.....Makes you wonder, what f*cking news they read every day, as every government and corporation gets hacked?

[Jeff Deacon]

care.data on the horizon?

Timothy Kelsey will be riding into town in January, just in time to "monetise" the whole database!

[cantankerous swineherd]

Re: care.data on the horizon?

bwhahaha.

it's taken us *years* to get rid of him.

:-)

[Tashritu]

Same in the UK

Your NHS record at your local surgery is linked to the "Spine". This central registry is checked and updated every time your record is accessed. It contains (amongst other things) your name, address, ethnicity, religion, telephone and contact details. This might be considered to have a use to the State? It can be searched for by almost all parts of the NHS to ensure that the right budget is charged for your treatment. No-one seems to care about this here!

[noj]

"dangerously naïve" - "patently absurd"

I used to think the same thing. But politicians are more intelligent than we give them credit for. Its that their values are different than ours. The people outspoken about privacy are a very small minority and the people who want convenience above all else are the majority. The people outspoken about privacy don't buy the need for blanket surveillance to "fight" terrorism but the majority of does. The people outspoken about privacy are for the most part disorganized and have no lobbying power whereas corporations have an abundance of both. Corporations fund political campaigns and it takes a majority to vote politicians into office. So the politicians are not naive or absurd. They are acting in their own best interests.

[Mark 85]

Re: "dangerously naïve" - "patently absurd"

Have an upvote. That applies to every government in world. Or at least in the so-called "free world". The non-free world types know that there is no privacy.

[sniperpaddy]

couldn't handle names with apostrophes............

"the Accenture-built system couldn't handle names with apostrophes (O'Dwyer for example)."

Not able to handle apostrophes in 2012 ?

What amateur wrote that database?

[Mark 85]

Re: couldn't handle names with apostrophes............

What amateur wrote that database?

You answered your own question in the quote. From what I've seen, Accenture is the biggest group of wankers in the universe. They couldn't program their way out of a wet paper bag. OTOH, they're in India and cheap which explains a lot. No "O'Xxxxx" names there.

[Bernard Robertson-Dunn]

And that's not all.

As primary author of the APF submission, I'd like to point out there was far more to what we said than the issue of Australian laws not stopping overseas criminals and cyber-terrorists.

The main gripe we have with the system is access to the data.

1. It's accessible from the internet. Just stupid.

2. The claim that it's personally controlled and that patients can see who has accessed their data. This is totally and absolutely untrue. As the government's own website says, patients can block certain institutions from accessing their record and can see which institutions have accessed it. That is a long long way from "who". The scenario we used to demonstrate the risk was

"... if a patient goes to see a dentist and there are potential health issues if undergoing dental treatment and the patient grants access, then the dentist, their nurses as well as ancillary and administrative staff all have full access to a patient’s health record. This can include aspects of the patient’s health care that have no relevance to the practice of dentistry, such a mental health issues."

3. That last bit refers to the fact that anyone who can see the record sees all of it.

4. In the enabling legislation is Section 70 which says, in part:

The System Operator is authorised to use or disclose health information included in a consumer’s PCEHR if the System Operator reasonably believes that the use or disclosure is reasonably necessary for one or more of the following things done by, or on behalf of, an enforcement body:

• the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law;

• the enforcement of laws relating to the confiscation of the proceeds of crime;

• the protection of the public revenue;

• the prevention, detection, investigation or remedying of seriously improper conduct or prescribed conduct;

• the preparation for, or conduct of, proceedings before any court or tribunal, or implementation of the orders of a court or tribunal.

These accesses are not logged for the patient to see.

So much for personally controlled.

The whole architecture of the system is a disaster. There are other issues such as data can leak out into other eHealth systems quite legitimately, but then the provisions of the legislation no longer apply. So much for "strong security and privacy controls" as claimed by te government.

I won't bore you with even more, but, IMHO, it's a train-wreck waiting to happen, unless they do something they have never done before - think it through and make changes.

[David Roberts]

Court or tribunal....

This seems unduly generous.

Potentially everything from a rent tribunal to an appeal against a parking fine or an overdue library book?

Do you want your medication for stress 5 years ago produced for the court (or tribunal) to show that you have mental health issues and so all your testimony should be disregarded?

Check out RIPA in the UK.

Pushed through as an essential tool in the fight against terrorists and mainly used to combat bin abuse, dog fouling, and people claiming to be in a better cachment area to get their kids into a better school.

Of course freely available information is of great benefit to corporates large and small, plus government local and national. Not so much benefit to the individual, unfortunately.

[Anonymous Coward]

well I'm not surprised

I've worked on the edges of this, interfacing medical software to the ehealth/nash/pcehr disaster. seeing the request sent to the service over http instead of ssl, even sending the certificate public key via this to validate the requester, worried me no end. it didn't work so I don't know if it failed simply because it was using an unsecure channel, but seeing it do it at all was scary.

just as scary was the responses for support about it. noone knows whats going on or how to fix anything. I can say I don't know if its normally secure as all the support people involved didn't know, couldn't separate the need for a certificate pair with actually using it. oh, but the program needs it, doesn't mean its using it. going any deeper was a nightmare. the only reason practices use it is that they dangle incentives in front of them.

one thing though, I don't see why it being accessible over the internet is in itself a problem. medicare have PKI down reasonably well, its just the team doing pcehr tried to integrate and just failed the basics, now that is a problem.

[scubaal]

yes but.....

Agree with all the concerns above.....but let's be very clear that there are very real tangible benefits to the individual from a properly designed and working system. The frustration of not having all the information in front of the hospital/specialist/GP you are currently taking to because it either on bits of paper or on a different system they cant access I know personally. Even when you think you have given permission - they still don't get access and still don't have the records. Also there are many cases every year where either the wrong/no treatment is given because a key bit of information wasn't known by the medical staff. So yes - this implementation sounds like a disaster - but please let's not throw the baby out with the bath water. The *idea* is not just good - it's essential to save lives and improve healthcare.

Now someone needs to build on that works :)