Comment by KennyBlanken | Hacker News Reader

Comment by KennyBlanken | Hacker News Reader

> Patient R was in a hurry. I signed into my computer—or tried to. Recently, IT had us update to a new 14-digit password. Once in, I signed (different password) into the electronic medical record

That's IT infrastructure incompetence, not an EMR issue.

At the two healthcare systems I go to, both utilize RFID badge readers plus PIN. In the ER and urgent care, nurses need only tap their badge and enter a quick pin and they're in. It's taken them seconds to pull up my records and I've never noticed a delay in care.

In the PCP's network, everyone seems to get smooth and quick access often while we're conversing, and I can see all my visits, lab results, and so on. The major annoyance is that I get emails notifying me I have a "message", instead of even offering me the option of receiving an email with the actual message.

I don't think people understand how expensive and time consuming the non-electronic stuff was. I remember my mother spending considerable amounts of time trying to get records from labs and doctors and having to shelp a lot of it by hand.

> That's IT infrastructure incompetence, not an EMR issue.

The two cannot be unlinked so easily when I have never met someone so doesn't have the same story of hospital IT. Even the IT workers hate hospital IT. The deployment of an EMR has to take into account the regulatory and security requirements imposed on all digital systems.

> I get emails notifying me I have a "message", instead of even offering me the option of receiving an email with the actual message.

You need to bash the right heads together and get your email provider and sender in DirectTrust https://directtrust.org/what-we-do/direct-secure-messaging

Not gonna say it's not a bitch and a half to implement but you can send sensitive data directly via email. And if you're the SaaS provider you're part of DT that's a huge value add for your offerings.

The email thing is probably a privacy requirement. Email isn't encrypted meaning your email provider (and the EMR's) can fully read the contents of said email.

I think people want to waive that privacy concern. My email provider has access to tons of my private data including lots of health data. Given the option, I suspect many would prefer to just get an email.

In the US, that's a HIPAA violation, which opens the provider up to massive fines.

It's definitely not. As a patient, I can do whatever I want with my medical records. I can copy them right out of MyChart and put it on my blog if I want to. I feel like I should have the right to sign a form saying they can email me.

This agrees with you:

https://www.hhs.gov/hipaa/for-professionals/faq/570/does-hip...

Agreed, I often email results to my spouse so they can review as well. I don't think many health care systems permit spousal access to results (although I can see my young kids' data).

My comment was implied aspirationally. US legal issues may (or may not, see sibling comments) prevent a provider from sending health info via email. If it was/is allowed, I think many would like to opt in (but never the default).

As I understand HIPAA (I'm not a lawyer), the patient can send info to the provider via email. In fact, since my last comment I emailed a test result of mine to my doctor (in the US).

Outside the US, email is sometimes used. I've had a couple non-US doctors send me my health data via email. I don't know which foreign laws applied, but I assume they were permitted to do so.

No, it's absolutely is not a HIPAA violation if the patient requests email communication. But it's a common myth.

A patient can consent to receive protected health information over email or other unsecured channels as long as they are informed of the risks and consent anyways. Patients are allowed to communicate about their own health to whoever they want to in whatever manner they want.

For example - the American Academy of Family Physicians has the following to say about it - https://www.aafp.org/pubs/fpm/blogs/inpractice/entry/hipaa_m...

Myth 3: HIPAA prohibits email communication with patients about clinical matters.

Fact: You can send protected health information by email, but you must implement safeguards under the security rule to ensure the information is secure, accessed only by authorized individuals, and not altered, edited, or deleted. The best way to do this is to encrypt your emails; however, patients have the right to request access to their own information via unencrypted email. You may send patient information by unencrypted email if you have advised the patient of the risks and the patient still prefers unencrypted email.

Yes but it should be the consumer’s right to simply say they don’t care about the risks, and prefer the convenience.

Yeah, as a patient I don't have any problem with EMRs. When I visit a specialist I can fill out all the forms and pay the copay online. The app notifies the office when you arrive, so you just sit down and get called in. I used to go to NYU Langone but switched to Mt. Sinai and all my records came over fine.

I'm a "visit the doctor once every 0.9 years" kind of a person, so I guess my needs are not incredibly complicated, but I've found the experience to be pretty fine overall. Good, I'd say, honestly.

I could see that badge system easily costing a million+ dollars, fyi. RFID identity management is an entire platform in itself and is extremely expensive.

A lot of hospitals already use it for things like door access. Sometimes parking tagged on too.

Door access and stuff like that is orders of magnitude cheaper. Integrating identity with all the proprietary systems is crazy expensive, I specced it out for about 100 users and it was 10's of thousands of dollars just for the hardware and thousands a month for the software.

Reply on news.ycombinator.com