Share it !
This year marks the 31th anniversary of the first mobile phone in Australia. Ten years later, in the Swiss headquarters of CERN, the Computer Scientist Tim Berners Lee created the World Wide Web.
Despite the relative 'youth' of these technologies, it is hard to imagine a world without them. They are fundamental. They have changed the way we interact forever. They have changed the way we communicate, the way we work and the way we relax.
As always, there is a price to pay for such a rapid change and development in technology. As a society, we have left gaping holes in security and privacy as we march on, ever modernising and digitising. These effects are so far reaching that they concern the security of nations, the integrity of corporations and the privacy of individuals. Yet are scientists and engineers to blame? When have we ever stopped and considered the privacy and security implications of the technology we develop?
In 2010 Ali Akbar Salehi, the head of Iran's atomic energy agency, announced that completion of Bushehr (Iran's first Nuclear power plant) would be delayed a further 3 months. They denied any connection to 'stuxnet'.
Stuxnet, a computer worm, has been described by the Internet security firm Semantic as "the most complex threat they have ever analysed". Described as a master of stealth, stuxnet transmitted itself to over 45,000 devices; of which 60% were in Iran. Ordinary computer users would not have noticed a change; for there was nothing to notice. It was designed to install itself on a USB flash drive, and hide. It then waited for the right set of conditions to occur.
Those conditions are unique to specific Siemens machines called SCADA systems. These are high end machines that run and monitor systems such as manufacturing plants, water treatment facilities, civil defence systems and... power plants around the world. Even the smallest security breach to one of these systems could wreck havoc on society - power plants would halt, water treatment systems would stop, traffic control systems would crumble.
The elegance of stuxnet was the target computer didn't need to be connected to the Internet at all - all it needed was an infected USB to be inserted into one of these high-end SCADA systems.
Stuxnet was not looking for just any SCADA system, but rather it had targets. Curiously the only SCADA systems believed to be affected by the worm were those involved in the Iranian nuclear program. It is believed that stuxnet was the product of a state-backed attack to delay Iran's nuclear ambitions. Politically motivated, no doubt; but stuxnet serves to highlight an important point - technology is now a weapon, and security our only defence.
In a world of increasing technology and connectedness, it is near impossible to keep any system isolated. Traffic systems, airports, power plants... all are susceptible to similar attacks. Our society has modernised and interconnected itself so rapidly that scientists and engineers who create the technology have been unable to strike the balance between security and advancement.
Nations are not the only ones affected. In April 2011, the Japanese juggernaut Sony and its PlayStation Network and Qriocity service were crippled by hackers for a cringe-worthy 23 days - an eternity in Internet time. In the process, over 77 million credit cards and other personally identifiable information was stolen.
The examples are plentiful: Britain's National Health Service (hacked), CityGroup network (some 200,000 clients' information stolen), Epsilon database (2500 companies' emailing lists stolen).
Even the Australian government is vulnerable to cyber attack. Despite similar attacks back in 2007, in February of this year the government was stung once again. Up to 10 Federal ministerial computers (including the Prime Minister's) were compromised.
Perhaps the most confronting breaches to our own privacy and security are self-inflicted. The technology that represents the biggest breach of our privacy and security is often the most integral and entrenched... our mobile phones.
Our mobile phones never leave us. They are the last thing we check at night as we go to sleep, and the first when we wake. One smart phone alone has the computing power that was used to send man to the moon. Despite this, society is generally blind to the risks they present; and to the implications this causes.
Ever since GPS chips started appearing in phones there has been a resulting privacy fallout. Apple's latest iPhones come with GPS tracking built-in; should the phone become lost or stolen. However, this service is always on; and because our phones are always with us, it becomes a very simple and covert way to track someone's whereabouts. GPS tracking is a feature, not an oversight. Without much difficulty at all, parents can covertly track their children's whereabouts, wives can check up on their husbands, and bosses can monitor their staff.
Nowadays, when a picture is taken, most GPS-enabled phones will automatically include the location in the photo data. This isn't a problem until the image is widely distributed; and potentially thousands can discover the location it was taken. With services like email, Twitter and Facebook; this is easy. Most will strip out the location data, but many, including email, will not. Technology such as this runs the risk of exposing the locations where photos are taken, with pinpoint accuracy. Often, these are people's homes and workplaces.
Sometimes, the apps are also to blame. Blendr is a mobile dating app with a twist - It shows users how many kilometers they are from each other. Many such users are unaware, but by sampling distances from three different positions and using triangulation, it's possible to compute a person's location, without them explicitly revealing it.
Chinese and US researchers have shown a proof-of-concept Android smart phone application that spies in on users' phone calls, listening for credit card numbers and pins. With the app running in the background, when the user made a call, the app would monitor the microphone for someone speaking or dialing a string of numbers (as in telephone banking) then log the information surreptitiously. It was just an experiment, but startling nonetheless.
The solution is clear... there is no going back. The only solution is to move forward. Society owes a great deal of gratitude to the scientists and engineers who create these immensely powerful technologies, but it does not excuse these professionals from their responsibilities. There is a high risk to our privacy and security today. It is the responsibility of the creators to inform and make society aware of the dangers of these technologies, rather than just providing them.
Whether it's a nation, a corporation or an end user... security is more important than we think. We need to address the issue of privacy and security in the industry, and for scientists and engineers; security and privacy need to be a priority, not an after thought.
Adam Smallhorn is the secretary and a regular contributor for the Young Scientists of Australia, Sydney Chapter. The Young Scientists of Australia (or YSA Sydney) is a volunteer, youth run organisation dedicated to promoting Science to the Youth of Australia. Accepting members from ages 15-25, you can find more information at the website: http://www.ysa.org.au/sydney/
In 1818, British author Mary Shelley's tale of Dr. Frankenstein's infamous creation startled and captivated a receptive audience. Just as the macabre, but resourceful, doctor created life from non-life that terrorized the local countryside, we have created a "cyberspace monster" that "lives" and knows no boundaries. It may not actually terrorize us, but we are likewise captivated by it. It profoundly influences and impacts our everyday activities, but it is also out of control and has spawned many controversial issues involving free speech, censorship, intellectual property, and privacy. The free market and society norm may, in some measure, be capable of regulating these issues and eventually help allay many of our concerns. A major and controversial concern that requires additional discussion is safeguarding the confidentiality of private medical information.
Expectations of Privacy and Private Medical Information
According to attorney and privacy law specialist, Ronald B. Standler, "Privacy is the expectation that confidential personal information disclosed in a private place will not be disclosed to third parties, when that disclosure would cause either embarrassment or emotional distress to a person of reasonable sensitivities" (Standler, 1997). Another theorist, Ruth Gavison, defines privacy as "the limitation of others' access to an individual with three key elements: secrecy, anonymity, and solitude." Secrecy or confidentiality deals with the limits of sharing knowledge of oneself. Anonymity deals with unwanted attention solitude refers to being apart from others (Spinello, 2003). Basically, we want to protect the integrity of who we are, what we do, and where we do it. Regardless of our definition, the right of privacy usually concerns individuals who are in a place reasonably expected to be private. Information that is public record, or voluntarily disclosed in a public place, is not protected.
The open architecture of the modern phenomenon that we call the Internet raises very unique ethical concerns regarding privacy. Information is sent effortlessly over this vast global network without boundaries. Personal information may pass through many different servers on the way to a final destination. There are virtually no online activities or services that guarantee absolute privacy. It is quite easy to be lulled into thinking your activity is private when actually many of these computer systems can capture and store this personal information and actually monitor your online activity (Privacy Rights Clearinghouse, 2006). The Net's underlying architecture is designed to share information and not to conceal or protect it. Even though it is possible to develop an adequate level of security, with an acceptable risk level, it is at enormous cost and considerable time.
Medical records are among the most personal forms of information about an individual and may contain medical history, lifestyle details (such as smoking or participation in high-risk sports), test results, medications, allergies, operations and procedures, genetic testing, and participation in research projects.The protection of this private medical information falls under the area of medical ethics. The realm of medical ethics is to analyze and resolve ethical dilemmas that arise in medical practice and biomedical research. Medical ethics is guided by strict principles or standards that address: Autonomy, Beneficence, Nonmaleficence, Fidelity, and Justice (Spinello, 2003). The principle of Autonomy includes a person's right to be fully informed of all pertinent information related to his/her healthcare. A discussion of medical ethical principles and patient rights leads us to further discuss legislation designed to maintain and protect these cherished rights.
Access to Private Medical Information and the Health Insurance Portability and Accountability Act of 1996
Since 400 B.C. and the creation of the Hippocratic Oath, protecting the privacy of patient medical information has been an important part of the physician' code of conduct. Unfortunately, many organizations and individuals not subject to this strict code of conduct are increasingly requesting this private information.Every time a patient sees a doctor, is admitted to a hospital, goes to a pharmacist, or sends a claim to a healthcare plan, a record is made of their confidential health information. In the past, all healthcare providers protected the confidentiality of medical records by locking them away in file cabinets and refusing to reveal them to anyone else. Today, we rely on "protected" electronic records and a complicated series of laws to maintain our confidential and private medical records.
Congress duly recognized the need for national patient record privacy standards in 1996 when they enacted the Health Insurance Portability and Accountability Act HIPAA). This act was effective April 14, 2003 (small health plans implementation date was April 14, 2004) and was meant to improve the efficiency and effectiveness of the nation's healthcare system. For the first time, federal law established standards for patient medical record access and privacy in all 50 states. The act includes provisions designed to save money for health care businesses by encouraging electronic transactions, but it also required new safeguards to protect the security and confidentiality of that information (Diversified Radiology of Colorado, 2002).
There are three essential parts to HIPAA: Privacy, Code Sets, and Security. The Security section is further subdivided into four parts: Administrative Procedures, Physical Safeguards, Technical Security Services (covering "data at rest"), and Technical Security Mechanisms (covering "data in transmission").
PRIVACY:
The intent of the HIPAA regulations is to protect patients' privacy and allow patients greater access to their medical records. The Act specifically addresses patients' Protected Health Information (PHI) and provides patients with greater access to and modification of their medical records. Prior to providing patient services, the Covered Entity must first receive the patient's consent to share PHI with such organizations as the insurance billing company, the billing office, and physicians to which the patient may be referred. Individuals must be able to access their records, request correction of errors, and they must be informed of how their personal information will be used. Individuals are also entitled to file formal privacy-related complaints to the Department of Health and Human Services (HHS) Office for Civil Rights.
CODE SETS:
Under HIPAA, codes are standardized to improve safety and security of health information. According to these new standards, a code set is any set of codes used for encoding data elements, such as tables of terms, medical diagnosis codes, procedure codes, etc.
SECURITY:
The security section is divided into four major parts:
1. Administrative, which requires documented formal practices, the execution of security measures to protect data, policies and procedures regulating conduct of personnel in protecting data, security training, incident procedures, and termination policies.
2. Physical Safeguards relate to the protection of physical computer systems, network safeguards, environmental hazards, and physical intrusion. One must consider computer screen placement, pass code protection, and computer locks to control access to medical information.
3. Technical Security Services refers to PHI stored on the computer network and how it is securely stored and accessed. Those using the PHI must be logged on and authenticated. An audit trail of authenticated access will be maintained for 6 years.
4. Technical Security Mechanisms refers to PHI transmitted over a communication network such as the Internet, frame relay, VPN, private line, or other network. PHI transmitted over a communication network must be encrypted.
There are also some noticeable shortcomings to HIPAA. The act did little to actually make health insurance more "portable" when an employee changes employers. Also, the Act did not significantly increase the health insurers' accountability for wrongdoing with provisions that are often difficult to monitor and enforce. There is also much confusion for patients, as well as healthcare providers, in regard to the interpretation of the act (Diversified Radiology of Colorado, 2002).
Other Laws, Regulations, and Decisions Regarding Private Medical Information
Besides HIPAA, there are important state regulations and laws, and federal laws and legal decisions, concerning the privacy and confidentiality of medical information (Clifford, 1999):
The Privacy Act of 1974 limits governmental agencies from sharing medical information from one agency to another. Congress declared hat "the privacy of an individual is directly affected by the collection, maintenance, use and dissemination of personal information ...," and that "the right to privacy is a personal and fundamental right protected by the Constitution of the United States ..." (Parmet, 2002).
The Alcohol and Drug Abuse Act, passed in 1988, establishes confidentiality for records of patients treated for alcohol or drug abuse (only if they are treated in institutions that receive federal funding).
The Americans with Disabilities Act, passed in 1990, prohibits employers from making employment-related decisions based on a real or perceived disability, including mental disabilities. Employers may still have access to identifiable health information about employees for reasonable business needs including determining reasonable accommodations for disabled workers and for addressing workers compensation claims.
Supreme Court decision in Jaffee v. Redmond: On June 13, 1996, the Court ruled that there is a broad federal privilege protecting the confidentiality of communication between psychotherapists and their clients. The ruling applies to psychiatrists, psychologists and social workers.
Freedom and Privacy Restoration Act of 1999: Designed to prohibit the creation of government unique medical ID numbers.
Managed Care and Cyber Threats to Private Medical Information
The introduction of the Internet and the advances in telecommunications technology over the last two decades allows us to access vast amounts of medical information, regardless of time, distance, or remoteness, with relative ease. This cyber access to medical information has profoundly changed how healthcare providers treat patients and offer advice. No longer are there barriers to the efficient exchange of health information and critical life-saving medical information. In addition to the many benefits of cyber access to medical information, there are also serious threats to our personal privacy and our medical information.
The intense interest for the protection and privacy of medical information is driven by two major developments. The first is the growth of electronic medical record keeping that has replaced paper records. A report from the National Academy of Sciences states that the healthcare industry spent between $10 and $15 billion on information technology in 1996 (Mehlman, 1999). This was the year that the Health Insurance Portability and Accountability Act was passed with most of the expenditure attributed to converting hard-copy information to electronic formats.Electronic medical records (EMRs) present a significant threat to maintaining the privacy of patient-identifiable medical information. This medical information can be retrieved instantaneously by anyone with access and passwords. Although hard-copy medical information can be easily copied, electronic records are much more easily copied and transmitted without boundaries.
The second major development that concerns the privacy of patient information is the overall growth of managed care organizations. There is a demand for an unprecedented depth and breath of personal medical information by an increasing number of players. In contrast to traditional fee-for-service healthcare, the provider of care and the insurer can be the same entity. In this situation, any medical information in the possession of the provider is also known to the insurer. This is common in all forms of managed care, but most evident in closed-panel HMOs. This sharing of information increases the fear that the insurer may use the data to limit benefits or terminate insurance coverage (Mehlman, 1999).
Some managed care companies are reporting private medical information to an extreme in requiring providers to report to case managers within twenty-four hours any case that is considered a high risk potential for the client, a second party, the employer, or the managed care company. Examples include such things as possible danger to self or others, suspected child abuse, potential threats to national security or the client organization, client's request for records, complaint about Employee Assistance Program services or threat of a lawsuit, and potential involvement in litigation including confession or knowledge of criminal activity. No mention is made concerning client privacy or rights regarding the release of this information. Nothing is also said about what will be done with the information that is shared (Clifford, 1999).
Another issue with managed care companies is the large volume of data processed and the carelessness in handling medical information. A salient example deals with lost records as noted in a 1993 survey sample of San Francisco Bay Area psychologists. In this survey, 59% of reports were mailed or faxed to wrong persons, charts accidentally switched, or proper authorization not obtained (Clifford, 1999).
Maintaining and Protecting Electronic Private Medical Information
In order to maintain and protect valued private medical information, we must always be vigilant and proactive. Basic steps can be taken prior to using electronic information sharing. For example, when signing a "Release of Information" form, read everything carefully. If not clearly understood, ask questions. Also, remember that HIPAA grants you the right to request that your healthcare provider restrict the use or disclosure of your medical information. Make sure those who ask for information are properly identified and authorized to collect this information. Finally, make sure that the person collecting information uses at least two "identifiers" to ensure proper identification of patient (e.g. name, last four of social security number, address, telephone, number, birth date etc.
When dealing with electronic and computerized medical information, the situation gets more tenuous and much more complex. Secure networks and websites, passwords, firewalls, and anti-virus software, are unquestionably the first steps in a plan of protection. Passwords must be complex, using numbers, letters, and cases, yet also easily remembered. To maintain security, experts suggest that passwords be changed every 90 days or if they are believed to be compromised. In addition, any private medical information sent on the NET or non-secure networks should be encrypted. Encryption (64 or 128 bit) is translating information into a secret code where a key or password is required to read the information.
Further security is provided by using privacy enhancing P3P frameworks, filtering software (e.g. MIMESweeper), message authentication codes "(MACs), and "digital signatures." The Platform for Privacy Preferences Project (P3P) is a technological framework that uses a set of user-defined standards to negotiate with websites regarding how that user's information will be used and disseminated to third parties (Spinello, 2003). This P3P architecture helps define and improve cyberethics, improves accessibility, improves consistency, and increases the overall trust in using cyberspace. MACs utilize a common key that generates and verifies a message whereas digital signatures generally use two complementary algorithms - one for signing and the other for verification.
There has also some creative technology proposed for maintaining and protecting private medical information. In October 2004, the "VeriChip" was approved by the FDA for implantation into the triceps of patients. The chip is about the size of a grain of rice and is inserted under the skin during a 20-minute procedure. This invisible chip stores a code that can scanned to further release a patient's private medical information. This code is then used to download encrypted medical information. The procedure cost is about $150-200 (MSNBC, 2004).
Another more commonly used medical information tool is the "smart card," a credit card sized device with a small-embedded computer chip. This "computer in a card" can be programmed to perform tasks and store important information. During an emergency, paramedics and emergency rooms equipped with smart card readers can rapidly access potentially life-saving information about a patient, such as allergies to medication, and chronic medical conditions. There are different types of smart cards: memory cards, processor cards, electronic purse cards, security cards, and JavaCards. These cards are tamper-resistant, can be PIN protected or read-write protected, can be encrypted, and can be easily updated. These unique features make smart cards advantageous for storing personal medical information and are popular throughout the world. In Germany and Austria, 80 million people have the capability of using these smart cards when they visit their doctor (Cagliostro, 1999).
There is also a recent proposed government plan to create a national system of electronic health records (EHRs). Details include the building of a National Health Information Network that will electronically connect all patients' medical records to providers, insures, pharmacies, labs, and claim processors. The sharing of vital information could improve patient care, include more accurate and timely substantiation of claims, and be an asset to public health in emergencies. The goal is to have it operational by 2009. Even with laudatory goals of saving money, making medical care more efficient, and decreasing drug reactions and interactions, there are still inherent dangers to this national plan. There are valid concerns that pharmaceutical companies may attempt to market a new drug or device for your specific medical condition. There are also strong worries of exploitation and abuse of personal data. Who will monitor access to the information? There are also concerns that lenders or employers may rely on private medical information to make business decisions. Then there is always the ever present fear of hackers and pranksters retrieving your personal information. There are still so many questions unanswered (Consumer Reports.org, 2006).
In conclusion, we are now stuck with a "Cyberspace Monster" and all of its advantages and shortcomings. When we use cyberspace, we can have no expectations of privacy and we must accept a level of risk. Therefore, when transmitting and sharing private medical information, we must be always aware to take precautions in safeguarding our privacy as much as possible by using secure networks, P3P architecture, passwords, firewalls, encryption, message codes, digital signatures, and devices like smart cards and "VeriChips." Medical records are among the most personal forms of information about an individual, but we are challenged to find a balance between society's interest in protecting medical confidentiality and the legitimate need for timely access to critical medical information especially with fears of influenza pandemics and bioterrorism. When this information is transferred into electronic format, we have heightened concerns about maintaining and protecting this private data. With managed care, there is a demand for an unprecedented depth and breath of personal medical information by an increasing number of players. While the HIPAA provisions are a welcomed start in protecting our private medical information, we must remain vigilant of the ever increasing need to protect this special information.
References:
Cagliostro, C. (1999) Smart card primer.
Clifford, R. (1999) Confidentiality of records and managed care legal and ethical issues.
Consumer Reports.org (2006). The new threat to your medical privacy.
Diversified Radiology of Colorado (2002) History: HIPAA general information.
Mehlman, M. J. (1999) Emerging issues: the privacy of medical records.
MSNBC (2004) FDA approves computer chip for humans.
Parmet, W. E. (2002) Public health protection and privacy of medical records.
Privacy Rights Clearinghouse (2006) Internet privacy resources.
Spinello, R. A. (2003) CyberEthics: Morality and law in cyberspace. Jones and Bartlett Publishers, Sudbury, MA
Standler, R. B. (1997) Privacy law in the USA.
Mr. Klemens is an accomplished author, writer, and practicing pharmacist. He has authored a book on integrative medicine (Mountains and Rivers: Complementing your Healthcare with Alternative Medicine, ISBN: 1-4033-8672-2) and numerous articles in local, national, and international magazines, and web sites. Topics include integrative medicine, Oriental medicine, herbs and supplements, health and fitness, Scottish culture, and leadership and ethics. He is also listed in the Marquis Who's Who in America, a member of Clan Gregor, and is a Fellow of the Society of Antiquaries of Scotland.
http://www.writers.net/writers/22138
http://jksamurai.googlepages.com/home
Proxy sites allow the users to freely search and surf any location in the web without being tracked the service providers. There is more than one way to surf online with your identities hidden from crackers. The reason for this precautionary method is to ensure that the identity of the user and other vital information such as home address and contact number are not used in spamming activities.
Not only that the insecure networks which you might chance up upon which surfing can be a safety hazard to your personal information. The collection of data in your personal computer can somehow be assessed by the other people in these unauthorized pages.
The worst scenario where invasion of privacy is concerned is cyber theft. The person on the other side of the screen may be able to correctly identify your pass code or Internet security pin number from your banking account facilities. In order to minimize the risk of such unwanted occurrences, be aware of your choice of password. Strictly avoid using your birth date for the pin code or you name for a password option because it is very predictable.
Try to avoid having to write down your password on paper and memorize the password instead. The other approach to keeping cyber theft at bay is by changing your pin number from time to time in order to avoid any attempts of a virtual break-in.
The proxy sites are available for free and it is usually trustworthy, especially when there is an authentic certificate attached together. The users are able to download videos and other files from the Web anonymously. Not only that, you are able to send electronic mail without having to give out your own information. Linking websites anonymously are also available when using a proxy site.
Dennis enjoys writing on wide range of topics such as Proxy. You can visit for more details.
Proxy sites allow the users to freely search and surf any location in the web without being tracked the service providers. There is more than one way to surf online with your identities hidden from crackers. The reason for this precautionary method is to ensure that the identity of the user and other vital information such as home address and contact number are not used in spamming activities.
Not only that the insecure networks which you might chance up upon which surfing can be a safety hazard to your personal information. The collection of data in your personal computer can somehow be assessed by the other people in these unauthorized pages.
The worst scenario where invasion of privacy is concerned is cyber theft. The person on the other side of the screen may be able to correctly identify your pass code or Internet security pin number from your banking account facilities. In order to minimize the risk of such unwanted occurrences, be aware of your choice of password. Strictly avoid using your birth date for the pin code or you name for a password option because it is very predictable.
Try to avoid having to write down your password on paper and memorize the password instead. The other approach to keeping cyber theft at bay is by changing your pin number from time to time in order to avoid any attempts of a virtual break-in.
The proxy sites are available for free and it is usually trustworthy, especially when there is an authentic certificate attached together. The users are able to download videos and other files from the Web anonymously. Not only that, you are able to send electronic mail without having to give out your own information. Linking websites anonymously are also available when using a proxy site.
Dennis enjoys writing on wide range of topics such as Proxy. You can visit for more details.
When it comes to Internet security, privacy is usually what we mean. In fact, it is one of the biggest issues every Internet user will have to deal with. It's no surprise that a lot of people have been underestimating the importantce of online safety, especially in the matter of personal information such as banking account usernames and passwords. Of course, this is but one of the many aspects of privacy that web users just might have to be more on guard against all the time.
In fact, data theft has become a whole trade by itself. Some people actually sell other people's information and other people buy them. This is called data mining and it's unfortunately a very active underground online enterprise these days. After all, we can't escape the necessity of having to visit certain websites for all sorts of purposes from school research to mere recreation. We have to realize that with every website that we visit, there is a chance that somebody out there is going to have an interest in anything we have in our computer.
Even if we sometimes inevitably have to surrender our privacy for a purpose that we believe to be more important, more and more lawmakers have been realizing the need for legislation concerning cyber or computer offenses. For a long time, these online crooks have enjoyed from their nasty tricks without getting caught. And even if they were caught, they would be so confident because they know they'll get nothing more than having to surrender their equipment to confiscating authorities. Or it could well be a ban for the crook so that he can never ever buy any type of computer and accessories in his life.
Sometimes, it's silly to think that's all they get for a crime that could put an innocent victim in financial difficulty for a lifetime. The formula is, indeed, unfair, but it is the formula for now and we need to base our precautionary measures on what is right here right now.
What's even more bothersome is the fact that the way the Internet is structured is the very reason for all these web-related inconveniences. Since we are all identified by our IP addresses, it's also easy for those with impure intentions to fish for our virtual locations so they could target us for phishing or introduction of malware. Of course, we can't just sit down and let things happen on their own.
This issue, after all, is privacy and if we're going to make the Internet work for us, we need to learn to respect each other's need to keep some things confidential. However, as some people can never come around to understanding the value of privacy unless it's their own, it would be best for us to take the responsibility upon our own shoulders in ensuring that we are safe while online .
Definitely, if we're convinced that these threats to our privacy exist, we need to take the extra step in
Because an IP hider lets us surf anonymously, then we can be assured of our privacy as we escape hackers we meet on the web right under their noses. And then we can make the Internet a more secure place for everyone who has no choice but to use this revolutionary technology.
In 1818, British author Mary Shelley's tale of Dr. Frankenstein's infamous creation startled and captivated a receptive audience. Just as the macabre, but resourceful, doctor created life from non-life that terrorized the local countryside, we have created a "cyberspace monster" that "lives" and knows no boundaries. It may not actually terrorize us, but we are likewise captivated by it. It profoundly influences and impacts our everyday activities, but it is also out of control and has spawned many controversial issues involving free speech, censorship, intellectual property, and privacy. The free market and society norm may, in some measure, be capable of regulating these issues and eventually help allay many of our concerns. A major and controversial concern that requires additional discussion is safeguarding the confidentiality of private medical information.
Expectations of Privacy and Private Medical Information
According to attorney and privacy law specialist, Ronald B. Standler, "Privacy is the expectation that confidential personal information disclosed in a private place will not be disclosed to third parties, when that disclosure would cause either embarrassment or emotional distress to a person of reasonable sensitivities" (Standler, 1997). Another theorist, Ruth Gavison, defines privacy as "the limitation of others' access to an individual with three key elements: secrecy, anonymity, and solitude." Secrecy or confidentiality deals with the limits of sharing knowledge of oneself. Anonymity deals with unwanted attention solitude refers to being apart from others (Spinello, 2003). Basically, we want to protect the integrity of who we are, what we do, and where we do it. Regardless of our definition, the right of privacy usually concerns individuals who are in a place reasonably expected to be private. Information that is public record, or voluntarily disclosed in a public place, is not protected.
The open architecture of the modern phenomenon that we call the Internet raises very unique ethical concerns regarding privacy. Information is sent effortlessly over this vast global network without boundaries. Personal information may pass through many different servers on the way to a final destination. There are virtually no online activities or services that guarantee absolute privacy. It is quite easy to be lulled into thinking your activity is private when actually many of these computer systems can capture and store this personal information and actually monitor your online activity (Privacy Rights Clearinghouse, 2006). The Net's underlying architecture is designed to share information and not to conceal or protect it. Even though it is possible to develop an adequate level of security, with an acceptable risk level, it is at enormous cost and considerable time.
Medical records are among the most personal forms of information about an individual and may contain medical history, lifestyle details (such as smoking or participation in high-risk sports), test results, medications, allergies, operations and procedures, genetic testing, and participation in research projects.The protection of this private medical information falls under the area of medical ethics. The realm of medical ethics is to analyze and resolve ethical dilemmas that arise in medical practice and biomedical research. Medical ethics is guided by strict principles or standards that address: Autonomy, Beneficence, Nonmaleficence, Fidelity, and Justice (Spinello, 2003). The principle of Autonomy includes a person's right to be fully informed of all pertinent information related to his/her healthcare. A discussion of medical ethical principles and patient rights leads us to further discuss legislation designed to maintain and protect these cherished rights.
Access to Private Medical Information and the Health Insurance Portability and Accountability Act of 1996
Since 400 B.C. and the creation of the Hippocratic Oath, protecting the privacy of patient medical information has been an important part of the physician' code of conduct. Unfortunately, many organizations and individuals not subject to this strict code of conduct are increasingly requesting this private information.Every time a patient sees a doctor, is admitted to a hospital, goes to a pharmacist, or sends a claim to a healthcare plan, a record is made of their confidential health information. In the past, all healthcare providers protected the confidentiality of medical records by locking them away in file cabinets and refusing to reveal them to anyone else. Today, we rely on "protected" electronic records and a complicated series of laws to maintain our confidential and private medical records.
Congress duly recognized the need for national patient record privacy standards in 1996 when they enacted the Health Insurance Portability and Accountability Act HIPAA). This act was effective April 14, 2003 (small health plans implementation date was April 14, 2004) and was meant to improve the efficiency and effectiveness of the nation's healthcare system. For the first time, federal law established standards for patient medical record access and privacy in all 50 states. The act includes provisions designed to save money for health care businesses by encouraging electronic transactions, but it also required new safeguards to protect the security and confidentiality of that information (Diversified Radiology of Colorado, 2002).
There are three essential parts to HIPAA: Privacy, Code Sets, and Security. The Security section is further subdivided into four parts: Administrative Procedures, Physical Safeguards, Technical Security Services (covering "data at rest"), and Technical Security Mechanisms (covering "data in transmission").
PRIVACY:
The intent of the HIPAA regulations is to protect patients' privacy and allow patients greater access to their medical records. The Act specifically addresses patients' Protected Health Information (PHI) and provides patients with greater access to and modification of their medical records. Prior to providing patient services, the Covered Entity must first receive the patient's consent to share PHI with such organizations as the insurance billing company, the billing office, and physicians to which the patient may be referred. Individuals must be able to access their records, request correction of errors, and they must be informed of how their personal information will be used. Individuals are also entitled to file formal privacy-related complaints to the Department of Health and Human Services (HHS) Office for Civil Rights.
CODE SETS:
Under HIPAA, codes are standardized to improve safety and security of health information. According to these new standards, a code set is any set of codes used for encoding data elements, such as tables of terms, medical diagnosis codes, procedure codes, etc.
SECURITY:
The security section is divided into four major parts:
1. Administrative, which requires documented formal practices, the execution of security measures to protect data, policies and procedures regulating conduct of personnel in protecting data, security training, incident procedures, and termination policies.
2. Physical Safeguards relate to the protection of physical computer systems, network safeguards, environmental hazards, and physical intrusion. One must consider computer screen placement, pass code protection, and computer locks to control access to medical information.
3. Technical Security Services refers to PHI stored on the computer network and how it is securely stored and accessed. Those using the PHI must be logged on and authenticated. An audit trail of authenticated access will be maintained for 6 years.
4. Technical Security Mechanisms refers to PHI transmitted over a communication network such as the Internet, frame relay, VPN, private line, or other network. PHI transmitted over a communication network must be encrypted.
There are also some noticeable shortcomings to HIPAA. The act did little to actually make health insurance more "portable" when an employee changes employers. Also, the Act did not significantly increase the health insurers' accountability for wrongdoing with provisions that are often difficult to monitor and enforce. There is also much confusion for patients, as well as healthcare providers, in regard to the interpretation of the act (Diversified Radiology of Colorado, 2002).
Other Laws, Regulations, and Decisions Regarding Private Medical Information
Besides HIPAA, there are important state regulations and laws, and federal laws and legal decisions, concerning the privacy and confidentiality of medical information (Clifford, 1999):
The Privacy Act of 1974 limits governmental agencies from sharing medical information from one agency to another. Congress declared hat "the privacy of an individual is directly affected by the collection, maintenance, use and dissemination of personal information ...," and that "the right to privacy is a personal and fundamental right protected by the Constitution of the United States ..." (Parmet, 2002).
The Alcohol and Drug Abuse Act, passed in 1988, establishes confidentiality for records of patients treated for alcohol or drug abuse (only if they are treated in institutions that receive federal funding).
The Americans with Disabilities Act, passed in 1990, prohibits employers from making employment-related decisions based on a real or perceived disability, including mental disabilities. Employers may still have access to identifiable health information about employees for reasonable business needs including determining reasonable accommodations for disabled workers and for addressing workers compensation claims.
Supreme Court decision in Jaffee v. Redmond: On June 13, 1996, the Court ruled that there is a broad federal privilege protecting the confidentiality of communication between psychotherapists and their clients. The ruling applies to psychiatrists, psychologists and social workers.
Freedom and Privacy Restoration Act of 1999: Designed to prohibit the creation of government unique medical ID numbers.
Managed Care and Cyber Threats to Private Medical Information
The introduction of the Internet and the advances in telecommunications technology over the last two decades allows us to access vast amounts of medical information, regardless of time, distance, or remoteness, with relative ease. This cyber access to medical information has profoundly changed how healthcare providers treat patients and offer advice. No longer are there barriers to the efficient exchange of health information and critical life-saving medical information. In addition to the many benefits of cyber access to medical information, there are also serious threats to our personal privacy and our medical information.
The intense interest for the protection and privacy of medical information is driven by two major developments. The first is the growth of electronic medical record keeping that has replaced paper records. A report from the National Academy of Sciences states that the healthcare industry spent between $10 and $15 billion on information technology in 1996 (Mehlman, 1999). This was the year that the Health Insurance Portability and Accountability Act was passed with most of the expenditure attributed to converting hard-copy information to electronic formats.Electronic medical records (EMRs) present a significant threat to maintaining the privacy of patient-identifiable medical information. This medical information can be retrieved instantaneously by anyone with access and passwords. Although hard-copy medical information can be easily copied, electronic records are much more easily copied and transmitted without boundaries.
The second major development that concerns the privacy of patient information is the overall growth of managed care organizations. There is a demand for an unprecedented depth and breath of personal medical information by an increasing number of players. In contrast to traditional fee-for-service healthcare, the provider of care and the insurer can be the same entity. In this situation, any medical information in the possession of the provider is also known to the insurer. This is common in all forms of managed care, but most evident in closed-panel HMOs. This sharing of information increases the fear that the insurer may use the data to limit benefits or terminate insurance coverage (Mehlman, 1999).
Some managed care companies are reporting private medical information to an extreme in requiring providers to report to case managers within twenty-four hours any case that is considered a high risk potential for the client, a second party, the employer, or the managed care company. Examples include such things as possible danger to self or others, suspected child abuse, potential threats to national security or the client organization, client's request for records, complaint about Employee Assistance Program services or threat of a lawsuit, and potential involvement in litigation including confession or knowledge of criminal activity. No mention is made concerning client privacy or rights regarding the release of this information. Nothing is also said about what will be done with the information that is shared (Clifford, 1999).
Another issue with managed care companies is the large volume of data processed and the carelessness in handling medical information. A salient example deals with lost records as noted in a 1993 survey sample of San Francisco Bay Area psychologists. In this survey, 59% of reports were mailed or faxed to wrong persons, charts accidentally switched, or proper authorization not obtained (Clifford, 1999).
Maintaining and Protecting Electronic Private Medical Information
In order to maintain and protect valued private medical information, we must always be vigilant and proactive. Basic steps can be taken prior to using electronic information sharing. For example, when signing a "Release of Information" form, read everything carefully. If not clearly understood, ask questions. Also, remember that HIPAA grants you the right to request that your healthcare provider restrict the use or disclosure of your medical information. Make sure those who ask for information are properly identified and authorized to collect this information. Finally, make sure that the person collecting information uses at least two "identifiers" to ensure proper identification of patient (e.g. name, last four of social security number, address, telephone, number, birth date etc.
When dealing with electronic and computerized medical information, the situation gets more tenuous and much more complex. Secure networks and websites, passwords, firewalls, and anti-virus software, are unquestionably the first steps in a plan of protection. Passwords must be complex, using numbers, letters, and cases, yet also easily remembered. To maintain security, experts suggest that passwords be changed every 90 days or if they are believed to be compromised. In addition, any private medical information sent on the NET or non-secure networks should be encrypted. Encryption (64 or 128 bit) is translating information into a secret code where a key or password is required to read the information.
Further security is provided by using privacy enhancing P3P frameworks, filtering software (e.g. MIMESweeper), message authentication codes "(MACs), and "digital signatures." The Platform for Privacy Preferences Project (P3P) is a technological framework that uses a set of user-defined standards to negotiate with websites regarding how that user's information will be used and disseminated to third parties (Spinello, 2003). This P3P architecture helps define and improve cyberethics, improves accessibility, improves consistency, and increases the overall trust in using cyberspace. MACs utilize a common key that generates and verifies a message whereas digital signatures generally use two complementary algorithms - one for signing and the other for verification.
There has also some creative technology proposed for maintaining and protecting private medical information. In October 2004, the "VeriChip" was approved by the FDA for implantation into the triceps of patients. The chip is about the size of a grain of rice and is inserted under the skin during a 20-minute procedure. This invisible chip stores a code that can scanned to further release a patient's private medical information. This code is then used to download encrypted medical information. The procedure cost is about $150-200 (MSNBC, 2004).
Another more commonly used medical information tool is the "smart card," a credit card sized device with a small-embedded computer chip. This "computer in a card" can be programmed to perform tasks and store important information. During an emergency, paramedics and emergency rooms equipped with smart card readers can rapidly access potentially life-saving information about a patient, such as allergies to medication, and chronic medical conditions. There are different types of smart cards: memory cards, processor cards, electronic purse cards, security cards, and JavaCards. These cards are tamper-resistant, can be PIN protected or read-write protected, can be encrypted, and can be easily updated. These unique features make smart cards advantageous for storing personal medical information and are popular throughout the world. In Germany and Austria, 80 million people have the capability of using these smart cards when they visit their doctor (Cagliostro, 1999).
There is also a recent proposed government plan to create a national system of electronic health records (EHRs). Details include the building of a National Health Information Network that will electronically connect all patients' medical records to providers, insures, pharmacies, labs, and claim processors. The sharing of vital information could improve patient care, include more accurate and timely substantiation of claims, and be an asset to public health in emergencies. The goal is to have it operational by 2009. Even with laudatory goals of saving money, making medical care more efficient, and decreasing drug reactions and interactions, there are still inherent dangers to this national plan. There are valid concerns that pharmaceutical companies may attempt to market a new drug or device for your specific medical condition. There are also strong worries of exploitation and abuse of personal data. Who will monitor access to the information? There are also concerns that lenders or employers may rely on private medical information to make business decisions. Then there is always the ever present fear of hackers and pranksters retrieving your personal information. There are still so many questions unanswered (Consumer Reports.org, 2006).
In conclusion, we are now stuck with a "Cyberspace Monster" and all of its advantages and shortcomings. When we use cyberspace, we can have no expectations of privacy and we must accept a level of risk. Therefore, when transmitting and sharing private medical information, we must be always aware to take precautions in safeguarding our privacy as much as possible by using secure networks, P3P architecture, passwords, firewalls, encryption, message codes, digital signatures, and devices like smart cards and "VeriChips." Medical records are among the most personal forms of information about an individual, but we are challenged to find a balance between society's interest in protecting medical confidentiality and the legitimate need for timely access to critical medical information especially with fears of influenza pandemics and bioterrorism. When this information is transferred into electronic format, we have heightened concerns about maintaining and protecting this private data. With managed care, there is a demand for an unprecedented depth and breath of personal medical information by an increasing number of players. While the HIPAA provisions are a welcomed start in protecting our private medical information, we must remain vigilant of the ever increasing need to protect this special information.
References:
Cagliostro, C. (1999) Smart card primer.
Clifford, R. (1999) Confidentiality of records and managed care legal and ethical issues.
Consumer Reports.org (2006). The new threat to your medical privacy.
Diversified Radiology of Colorado (2002) History: HIPAA general information.
Mehlman, M. J. (1999) Emerging issues: the privacy of medical records.
MSNBC (2004) FDA approves computer chip for humans.
Parmet, W. E. (2002) Public health protection and privacy of medical records.
Privacy Rights Clearinghouse (2006) Internet privacy resources.
Spinello, R. A. (2003) CyberEthics: Morality and law in cyberspace. Jones and Bartlett Publishers, Sudbury, MA
Standler, R. B. (1997) Privacy law in the USA.
Mr. Klemens is an accomplished author, writer, and practicing pharmacist. He has authored a book on integrative medicine (Mountains and Rivers: Complementing your Healthcare with Alternative Medicine, ISBN: 1-4033-8672-2) and numerous articles in local, national, and international magazines, and web sites. Topics include integrative medicine, Oriental medicine, herbs and supplements, health and fitness, Scottish culture, and leadership and ethics. He is also listed in the Marquis Who's Who in America, a member of Clan Gregor, and is a Fellow of the Society of Antiquaries of Scotland.
http://www.writers.net/writers/22138
http://jksamurai.googlepages.com/home
Max Secure Software creates innovative privacy, protection , performance products and services for all home and enterprise users around the world. 5-star rated Anti-Spyware and advanced registry cleaner are some of the flagship products of this company.
Check it out!
Visit msnbc.com for breaking news, world news, and news about the economy
Max Secure Software creates innovative privacy, protection , performance products and services for all home and enterprise users around the world. 5-star rated Anti-Spyware and advanced registry cleaner are some of the flagship products of this company.
Check it out!
