Nothing much/Re: Data Sharing Review

Peter Fairbrother ukcrypto at chiark.greenend.org.uk
Sat, 19 Jul 2008 00:45:48 +0100


Michael Simpson wrote:
> Asked the junior who the older woman
> lying in the bed in the corner with the lights off was. I had noticed
> that she had a breathing tube in but it wasn't connected to anything
> and wasn't being monitored. I was told that she had had a massive
> stroke and was for TLC only.
> I recognised her as a regular attender of the hospital that i had just
> come from and knew her as a brittle diabetic who tended to overdo her
> medication. Some dextrose later and she was sitting up telling me
> about how she had been visiting her sister for the first time in ages
> and had taken one of her turns.
> nice lady. the fault lay *totally* at the door of the staff who hadn't
> done a blood glucose estimation and we did the critical incident
> analysis but thankfully the patient was ok.

Can you give more details please?

eg, why hadn't they done an analysis? How was it anything to to with her 
medical records?

just asking


> Mistakes happen, and are happening more and more thanks to silly
> regulation/targets. Unfortunately the system is creaking and is
> reduced to providing best effort and relying upon serendipity
> (In stitches by nick edwards is a good book)
> i think this is the standard example given for the sharing of alerts
> 
> 2) 20 yr old daughter gets involved with inappropriate man, becomes
> infected with HIV. Is on treatment, viral load is undetectable. Has a
> nasty accident whilst on holiday far away from her own healthboard and
> ends up in a comatose state. Needs to have her medication with the
> utmost importance but seriously needs to have the confidence that her
> records are held securely.

First, the docs who treat her should know, for their own sakes. Viral 
load notwithstanding.

Next, the docs who treat her should know, for her sake.

So the problem is, confidential communication between her doc at home 
and her docs abroad.  Should be easy enough after she's 
conscious/identified.


In data terms, perhaps it's not so easy, especially the international 
aspects - but if we ignore all the data stuff, maybe the foreign doc 
could just talk to her own doc? That's what usually happened before 
computers but after international telephony, if it seemed necessary.


> 
> 
> You have probably heard these before, but in North Lanarkshire we
> tried issuing smart cards to patients and it didn't work. We tried
> issuing med-alert bracelets and it again didn't work.
> 
> I also have a lot of young professional patients who through one
> reason or another have become drug addicts, have come to me, have been
> stabilised (mainly using buprenorphine rather than methadone as it
> preserves functionality), have detoxed and have remained drug free
> ever since.
> 
> I really *really* don't want that to be following them around for the
> rest of their lives because the negative connotations are huge and the
> potential for ongoing harm (and potential relapse) are enormous.
> 
> why is this so difficult to understand?

So why do you want them to be biometrically-tagged, forever?

> 
>> Perhaps the medical people here could say whether it's right to be concerned
>> that staff may get used to believing whatever's in the centralized record
>> rather than checking for themselves?
> 
> YES. in the same way that i don't blindly trust what is written in the
> notes in front of me. One should always take a history and conduct an
> examination. That is one of the central pillars of good medicine.

Sometimes the patient will lie - and maybe the docs get used to that - 
but normally a lie won't kill the patient.

> 
>> If someone doesn't want to use one of these bracelets that is their
>> perogative. The medical mob shouldn't arrogantly impose things on
>> everyone with the "justification" that they are gpong to patronise
>> those who are "too stupid" to do what is "obvious".
> 
> I agree, the point that i am trying to make is that i would see the
> main point of the epr is to protect the patient from the *medics* and
> to try and reduce the unacceptable volume of medical errors made at
> the same time protecting the patient's right to control what happens
> to their data.
> 
> Mistakes will happen and when there is a vacuum of information the
> potential for mistakes increases markedly.
> 








Apropos nothing much, suppose a patient who has AIDS and a broken arm. 
The hospital receptionist will need to know when the patient's 
appointments for each are, in order not to double-book him.


The broken arm may be embarassing to the patient, and he may want to 
keep it secret - maybe he's a secret drinker and fell down the stairs, 
or got hit by his wife.

Whatever, surely there should be a duty on the receptionist to keep his 
broken-arm status (and his HIV status, if required) secret?




Looking again at the recent request for childhood leukemia data, while 
there may be reasons not to give out the data, there are good reasons to 
give it out as well. The researcher may be (and probably is) a perfectly 
honest chap, and finding clusters might lead to a decrease in childhood 
leukemia.

It might save lives.

So can or should we give him the data? Now he's probably a good man, but 
everybody who asks for that kind of data won't be, especially if it 
leads to their advantage.


What can we do? Suppose a parent who wants the data to prove that the 
local factory has caused several childhood cancers, including their own 
child?


First of all, for doctor-patient trust and confidentiality reasons - and 
these are paramount, without trust the docs won't get any data in the 
first place - we have to do the simple, basic, information-security-100 
stuff.

The docs keep the data, and give it out when they want to.

First-and-a-half, they docs themselves might be cheating or shipmans, so 
under limited, specified circumstances - eg with a Court order - they 
can be required to give out data.

Second, in cases like looking for leukemia clusters, the researcher may 
need to be in a privileged position datawise. He may need the data in 
order to do his useful and lifesaving work.

So let's give him the data, and insist he doesn't tell anyone about it. 
Make it a serious criminal offense to tell anyone, or even to be lax in 
his data security.

And most important, remembering the principles of 
information-security-100, require him to explain why he wants the data 
in the first place, require him to show he's trustworthy, and require 
him to prove he needs it for a good and valid reason, challengeable in 
Court *before* he gets the data.


That's not enough, but maybe it's a starting point.
Nothing much/

-- Peter Fairbrother