analogj

I just posted a tongue-in-cheek blog post about HIPAA/Cures Act Information Blocking techniques found in the wild.

These are real barriers faced by patient-access API developers like Fasten Health, effectively blocking patients' access to their own medical records

That's exactly what we're doing with our Fasten Health PHR[0] & with our Fasten Connect[1] product. The biggest issue is that there are 250,000 registered health systems in the US. That's a massive long-tail to support and integrate with (we only support 30,000 at the moment). It requires a ton of time and effort, and at the end the Patient experience is still... mediocre. Patients need to search for each health system, then login to their individual patient portals -- it's pretty high friction. And thats even before you discuss all the barriers that EHRs put up to make it difficult for app developers to register and get production access to EHR systems.

- [0] https://www.fastenhealth.com/ - [1] https://www.fastenhealth.com/connect/

As the Metriport team mentions HIEs/TEFCA don't realistically allow patients to request their own medical records at the moment. But there are definitely examples of PHRs that leverages the Cures Act Final Rule mandates around individual patient access.

Fasten Health's PHR[0] and MereMedical[1] are both great examples of this. The trade off is that patients need to remember & search for each of their health systems & then login to each of their individual patient portals. It can be a pretty high friction experience.

- [0] https://www.fastenhealth.com/ - [1] https://meremedical.co/

As the Metriport team mentions HIEs/TEFCA don't realistically allow patients to request their own medical records at the moment. However it is possible to request your individual medical records using the Cures Act Final Rule mandates -- it's what powers Fasten Health's Open Source PHR[0] and our B2B Fasten Connect service. The trade off is that patients need to remember & search for each of their health systems & then login to each of their individual patient portals. It's a pretty high friction experience.

- [0] https://www.fastenhealth.com/ - [1] https://www.fastenhealth.com/connect/

Hey HN,

I've been thinking alot about the properties of viral open-source licenses and how this could be applied to other legal documents - like privacy policies.

As it becomes possible to share our medical records with caregivers and practitioners using apps, we have to trust that these apps are managing our data and respecting our privacy as we intend. But it's not only the app developers we need to care about, its also the third party services that they use (and share our data with), and the third party services that they then use.. its turtles all the way down.

What if we could create standardized "viral" privacy policy clauses, similar to the viral nature of open-source notice & attribution clauses.. which would "follow" Personally Identifiable Information (PII) and Protected Health Information (PHI).. ensuring it's used as we intend, no matter the degrees of separation?

So this is partially the reason why I built my own open-source Personal Health Record (PHR) Fasten Health [1][2]

In my experience patient portals vary from incredibly functional to almost worthless, which was a huge problem for me given that some of my important specialists were in the latter bucket.

Honestly, everything that I've read comes to the conclusion that EHR's aren't designed for patients, nor practitioners, they're built for the accounting dept. Patient portals have been tacked on-top to comply with govt regulation & certification programs [3], but UX/usability is almost universally lacking.

Thankfully the FHIR API's that Fasten leverages seem to be fairly consistent:

- the interoperability standard (FHIR) ensures that patient medical records are (somewhat) consistent.

- EHRs APIs are tested against an automated test suite before they are "approved" - its not comprehensive, but its better than the subjective UX rules.

[1] - Marketing - https://www.fastenhealth.com/

[2] - Source Code - https://github.com/fastenhealth/fasten-onprem

[3] - https://chpl.healthit.gov/

There's actually a "Patient-contributed data" initiative being run by the standards body (HL7) that's gaining traction. In an ideal world it would allow patients to "push" their electronic records to a new practitioner, meaning that intake forms could be much simpler. In practice I think the implementation is going to start with Observations/Lab Results first though.

I hope to eventually support it with my open source personal health record (PHR) Fasten Health. IMO this would be a "killer app" for PHRs.

Disclaimer: I built an Open-Source PHR

The thing that most people don't realize is that the legally enforced HIPAA protections they take for granted no longer apply when they request their medical data from a healthcare institution and store it in a third party app -- like Apple Health.

The only thing protecting your medical records from being data-mined and monetized is Apple Health's privacy policy and (current) technical architecture. You've seen examples of it in the news with women's period tracking apps, but it'll become even more common as apps start leveraging APIs opened by the 21st Century Cure's Act.

I'm not a tin-foil hat wearing engineer, but I can forsee a day when Apple's reputation of being "Privacy-conscious" might not be worth as much money as the medical data they've collected from their customers.

It's one of the reasons why I decided to build my own open-source PHR, so that the incentives between the software and me as an individual are kept in alignment.

https://github.com/fastenhealth/fasten-onprem

This is not quite the case any longer

The 21st Century Cures Act was signed 8 years ago (but compliance was only required as of 2023). It states that Healthcare Institutions (& EHR developers) must provide a mechanism for patients to access their health records electronically in a standardized format (FHIR).

It's what allowed my open-source startup Fasten Health to even exist. I was diagnosed with a chronic condition, and wanted a way to store my health records privately on my own devices. A bit of luck and a POC later, I was able to confirm that patients can access their own records with little-to-no barriers.

It doesn't matter that I've had 6 different insurance companies over my career, or that I've visited more than 2 dozen different healthcare institutions, as a Patient we have the unique ability to collate and generate our own longitudinal health record.

https://github.com/fastenhealth/fasten-onprem

Interestingly your [1] citation may no longer be the case. The 21st Century Cures Act was signed 8 years ago (but compliance was only required as of 2023). It states that Healthcare Institutions (& EHR developers) must provide a mechanism for patients to access their health records electronically in a standardized format (FHIR).

It's what allowed my open-source startup Fasten Health to even exist. I was diagnosed with a chronic condition, and wanted a way to store my health records privately on my own devices. A bit of luck and a POC later, I was able to confirm that patients can access their own records with little-to-no barriers.

https://github.com/fastenhealth/fasten-onprem

I'm actually working on an open-source Personal Health Record (PHR) app called Fasten Health - https://github.com/fastenhealth/fasten-onprem

It allows patients to pull their complete medical history from their various healthcare institutions, and store it locally without having to worry about some corporation monetizing and data-mining their health record

I've been working on my own Open-Source Personal Health Record (PHR) that leverages FHIR & Smart-on-FHIR https://github.com/fastenhealth/fasten-onprem

Hopefully with the Cures Act Final Rule, interoperability will become the norm

Sorry to hear about your wife's health issues, I hope she's on the mend. I had a similar experience when dealing with my chronic condition. Had to interact with almost a dozen different health portals, a couple of which were ok, the rest were awful.

I'm a software engineer, so I ended up creating my Personal Health Record (PHR) application, which I eventually open-sourced - https://github.com/fastenhealth/fasten-onprem

It's still a work in progress (and definitely not ready to be used as the primary source-of-truth), but I'm always looking for actionable feedback/contributors. I'd love to hear your thoughts

ah, it's not super interesting. Most EMR systems provide an open list of FHIR endpoints for their customers. `fasten-source-gen` is basically an ETL repository which imports the endpoint metadata provided by these EMR systems and enriches it with data from NPPES, Google Maps, user contributed data, Mechanical Turk and elsewhere.

- Epic: https://open.epic.com/MyApps/Endpoints - Cerner: https://github.com/cerner/ignite-endpoints

It will be open sourced (eventually) -- once I've cleaned up some test credentials that were inadvertently committed to the repo.

Hope that answers your question?

Hey! It is definitely US-centric, however FHIR (the protocol that Fasten speaks natively) is an international standard. We're tracking international support in this github issue - https://github.com/fastenhealth/fasten-onprem/issues/42

However, we'll make sure to update the README to make it clearer that international providers are not supported yet.

Fasten Health [1] is an open-source, self-hosted, personal/family electronic medical record aggregator, designed to integrate with 100,000's of insurances/hospitals/clinics.

It's designed to automatically pull your medical records from your EMR -- but users can also enter their conditions, medications and procedures manually. We have plans to allow users to manually enter their lab results [2], however that feature has not been implemented yet.

Fasten is still a work-in-progress, but if you're willing to contribute we have a pretty active discord (linked in the README).

[1]: https://github.com/fastenhealth/fasten-onprem/ [2]: https://github.com/fastenhealth/fasten-onprem/issues/137

Hey! My name is Jason, I'm the developer of Fasten Health - which seems to be a similar open-source project.

https://github.com/fastenhealth/fasten-onprem

If you're interested, I'd love to chat.

Hey, So I recently had a similar problem -- had a semi-serious medical issue, had to go to a number of different medical institutions, all of which asked me for a comprehensive medical history. I was able to give them high-level answers, but some of the details were hard to recall.

I started working on an open-source project to electronically pull my medical information from various healthcare providers, and store it locally (no cloud involvement at all).

https://github.com/fastenhealth/fasten-onprem

It's definitely an early beta, only 1500 healthcare providers are currently supported, but I'm working on a big update to bump that up to ~10k. The UI is also a work in progress. I'd love to hear your thoughts!

Yep, Scrutiny has always been designed for a hub&spoke deployment model:

https://github.com/AnalogJ/scrutiny/blob/master/docker/examp...

Interesting, I don't recall anyone else bringing this up as a potential name collision previously.

Doing a cursory search of Broadcom + scrutiny doesnt yield many results - other than antitrust litigation

https://www.google.com/search?client=firefox-b-1-d&q=Broadco...

Do you have a direct link to the tool bychance?

Thanks!

as LambdaComplex mentioned, yes Scrutiny can differentiate between NVME, ATA and SCSI drives & SMART metadata/attributes

It should You can fun the web & collector in hub & spoke mode, where the webapp runs within a VM/container, and the collector runs on the host.

Someone posted about some issues they're running into wiht ESXI & smartctl recently -- https://github.com/AnalogJ/scrutiny/issues/388

but that wasn't scrutiny related from what I can see.

great to hear! If you run into any issues, or have any feedback, please create a github issue, I'd be happy to help out

Hey everyone, author of Scrutiny here! Thanks @smcleod for posting about it, I was surprised by the spike in traffic and stars this morning :)

Happy to answer any questions about Scrutiny you all may have

I’ve been using Airalo for a couple years now to get cheap data during international travel. I’m sure there are cheaper local/physical store options, but the ease of getting access to local cellular network with a couple of clicks cannot be understated. Airalo supports 190+ countries via esims, it’s amazing

Airalo $3 off referral link for anyone who wants to check it out - https://ref.airalo.com/nLLz

Yeah, data brokers are awful and their business model is an abuse of the ideals of the internet imo.

I’ve been working on a tool to automate GDPR & CCPA deletion requests to data brokers - basically it’s a database of ~650 registered data brokers + email templates written in legalese. After the user provides some basic contact information, it does a simple mail merge.

https://github.com/AnalogJ/justvanish

Still a WIP

Yep, thats one of the public services that I looked at initially, but there was no way I was willing to give an unknown third party access to the complete contents of my inbox.

The promotions tab is just a filtering mechanism, it doesn't mean that you'll get more spammy promotional email?

its currently targeted towards Gmail users because it specifically looks for the "All Mail" inbox which Gmail provides. I'm working on allowing users to configure the inbox name, which means it should work with any email provider.