Learn, hack!

URL

http://dewy.fem.tu-ilmenau.de/CCC/22C3/audio/mp3/22C3-489-en-hacking_health.mp3

File name

22C3-489-en-hacking_health.mp3

File size

21.3 MB

MD5

8e4409b218d1530af107043caf403004

SHA1

4ee2e7a94578ec8d7b91d58fcb57600a72d18c86

I have been researching the implementation of electronic patient records (EPR) in NL. The first part of EPRs - a national database of medication that each patient is described - will become mandatory in early 2006. To 'ease the implementation' of a national EPR database, all Dutch citizens will be given a Civil Service Number which supplants our social security number. This CSN - which is actually the same identifier as your social sucurity number - will be used in health services, school, child care, work and taxes. The Dutch government states that this the use of this CNS will be regulated 'within existing European privacy laws' but also adds that using one identydying number in all social areas, including health care, is 'helpful in matters of law enforcement'. On top of that, national electronic (biometric) identity cards will be issued, allegedly to allow citizend (patients) to log in to heir personal EPRs, notwithstanding the fact that hardly any EPR software exists that allow patients to log in. In other words, EPRs are at least partially used to sell biometric identity cards. EPR implementation is supposed to reduce bureaucracy in health care, and to reduce the amount of medical errors; thus, it supposedly helps to cut down costs. Policy makers do not seem to take into account that automating EPRs creates a new subset of medical errors (input errors now being the 4th most common reason for medical errors). Also, they overvalue using computers, believing them to be 'flawless'. Security around EPRs is bad. One Dutch hospiyal was not able to see policlinic patients for a week, due to a computer virus. More hospitals have ad virus problems but have refrained from stating so. The Dutch Health Inspection issued a warning that a pharmacy software program used to calculate mediaction dosage, iscalculated the amount for 200 medicins, amongst themm cytostatics. To test the safety of hospital computer systems, I organised a penetration test with two random hospitals that used EPRs. We were able to access 1.2 million patient records.