[PLUG] Medical records and commercial firewall boxen - was ethernet switches ...

[Keith Lofstrom]

On Mon, Dec 19, 2005 at 04:53:58PM -0800, Keith Lofstrom wrote:
> Actually, this is probably an opportunity to buy a firewall switch, for
> reasons I will outline in another message.

I'm pretty sure the problem I'm having is because the little ethernet
switch I am using is a POFS.  Since the problem space is morphing a little
bit, this may actually be an opportunity to test out more appropriate gear.

New subject:

The situation is this:  my wife is a doctor, uses Linux at home, and works
at a clinic that is still laden with zillions of paper folders containing
paper charts.  One of my missions is to set up an "Electronic Health Record"
replacement for her clinic.  Political and legal and interpersonal issues
aside, there is the thorny issue of data security and patient privacy.  

There is some nifty open source software out there for EHR and practice
management.  I am looking at one package called OSCAR, from McMaster 
University. OSCAR is being used in clinics across Canada, with a concentration
in BC (see the "BC billing" demo at http://www.oscarmcmaster.org/demos ). 
There is also a consultant in Missouri maintaining a US variant.  The
software is web and java based, with a Tomcat/MySQL back end. 

My first thought was that we could run all this on my wife's office PC 
(Linux of course) for her use only, and remove power from the USB hard
drive containing the patient database when the ethernet switch between her
and the internet is powered up.  One or the other, never both at once.

However, since OSCAR is a complete practice management system, with billing
and scheduling and connection to external pharmacy databases and such, 75%
of the usefulness comes from connecting OSCAR to the net and to the database
simultaneously.  So now I am thinking of allowing all the computers in the
office to get HTTPS access to the OSCAR database, and integrating OSCAR into
their practice.  The security job just got harder, and HIPPA is now involved.

The clinic is in one of the Physician Office Buildings managed by Legacy
Good Samaritan Hospital, and LGSH does physical maintenance of the wires and
the network to all the computers in the clinic.  LGSH is NATted and firewalled,
and the clinic lives inside firewall cloud of the whole hospital system.  The
clinic runs a half dozen PCs using windoze XP.  They don't seem to run much
specialized software on these PCs, though, so they are not deeply invested
in M$. The LGSH security is good enough that there have not been any virus
infections for the last few years.  I need to learn more about the details.  

Still with me?  The expansive solution I envision in the short term is her
Linux box acting as an OSCAR server for the office, behind a commercial firewall
appliance that permits inbound HTTPS access from the six clinic computers,
and nothing else inbound.  Outbound, she will have http/https/ping, and I
will be driving an SSH tunnel through my public server to my inside server,
allowing her access from home and connecting her home email account to her
work machine - maybe.  That should be reasonably secure, though someone really
nefarious and persistent could break through the LGSH firewall, zombie one
of the XP computers, then use that to crack OSCAR.  Or break through my three
firewalls.  I suspect it would be easier to subvert one of the staff, though,
and that can happen just as easily with the current paper charts.

During the discussion of Rich's travails using an "all-in-one" firewall switch,
I suggested he use an old laptop as a firewall.  This is a good solution where
there is a Linux guru handy, but it probably is not suitable for a clinic
without a propellerhead in sight.  So, we need an appliance that can do the
firewall, pass ssh packets, and keep an eye on things.  While there isn't a
large pile of money to burn, we probably should buy something better than a
$59 Fry's brand-X special, though not some top-of-the-line $5000 Cisco product.

So a question ---------------------------------------------------------
  Can somebody suggest a reliable, secure, easy-to-use firewall appliance
  that does the simple job above, and they have had good luck with?
And another question --------------------------------------------------
  Are there better alternatives to the security concerns than the vision
  outlined above?
---------------------------------------------------------------------------

There is a lot of risk - EHR permits data mining by litigious attorneys, which
is one reason why this excellent patient-protective technology isn't more
widespread in the US.  On the other hand, if the EHR system is maintained
by a bunch of little Linux consultancies, there are fewer targets worth
being sued by the big law firms.

The upside is pretty good.  The clinic is not completely software ignorant - they
were founded by a doctor who later went on to start a medical informatics company.  
My wife's partner is one of the principle doctors at LGSH, and if the whole clinic
converts over to Linux in the mid term, and if OSCAR looks good, this could spread
like crazy around the Legacy system, and in clinics in the Portland area and
elsewhere.  There are also a number of medical informatics experts in the area,
including Tom Clark of Tualatin, who regularly participates in open source ESR
conferences in Europe.  Perhaps we can even come up with some "will code for cheap
healthcare" system for some of the local open source unemployables, though I
wouldn't bet the farm on that, because of clinic economic and liability issues.

Alas no, there is no big money in it.  Rich doctors are impersonated by rich actors
in rich Hollywood.  In Real Life (tm) most clinic doctors work incredible hours
at high personal risk for meager personal incomes, and do it because they hate
suffering and want to heal your sorry asses.  An EHR system will reduce suffering, 
increase personal risk, involve all sorts of bureaucratic HIPPA compliance
nightmares, and have a small negative economic effect.  Definitely a mixed bag.

Anyone who wants to talk about this stuff, or who has connections with other
clinics and would like to help me evaluate alternatives, let me know.  People with
good diplomatic skills suitable for imperious doctors and cautious hospital
IT departments are welcome to participate. 

Keith

-- 
Keith Lofstrom          keithl at keithl.com         Voice (503)-520-1993
KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon"
Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs