Every day we're reading about new viruses, trojans, spyware and other malware on the internet. I was recently asked about the need to reinstall the operating system from scratch on a virus infected machine. Here is the answer from Security Officer at BIDMC:
Is there a valid technical reason for requiring a rebuild? The answer to this is yes. The thing to focus on here is the Anti in the title of Anti-Virus. These applications are intended to stop an infection. Most of them also include a cleaning component and there are many products marketed solely as cleaning products - spybot-SD is a good example. The problem with these products is that malware is constantly morphing. You see this often in the names of the malware , they will contain .a, .b. .c etc. The longer the malware is out the more variants. This means that the cleaning tools need to keep up as well. The fact of the matter is is that they can not. If a system has critical content on it and it appears to be compromised the only way to ensure it is clean is to completely rebuild the system. The more sophisticated viruses will hide in the boot sector of a drive, others will replace O/S files with variants that contain the virus. The former will load on system startup and have not tracks for the AV or file cleaning applications to locate and clean. The later will look like standard files and be skipped over. We also take the precaution of a system rebuild here at BIDMC when we have a system with clinical or privacy content on it that is believed to have been compromised.
On the discovery component - we are also seeing a uptick in Torpig and mebroot. Torpig and mebroot are of the same family - sinowal. These trojans are a high risk trojan as their objective is to steal identity information - and they are good at it. These are of the type that imbed themselves in the boot sector of the system. As I mentioned above it is very difficult to both detect and to clean this type of trojan. I had a family member with this. As an exercise I attempted to clean the boot sector rather then rebuild. I logged over 40 hours of labor on this effort with a wide range of tools - even down to using a disk sector editor to attempt to clean it with no success.
There is no way to determine the original source of the infection without detailed examination of the system. But, this system is used to browse the web, it has Google desktop loaded and it is running MS Office. The infection could be sourced from a web site that is believed to be good. We saw this on Boston.com not to long ago. These pages link to active advertising sites that are not in their control. Those advertising sites can and often do have malware in them. Google desktop in itself is not an issue - but the actions/benefits it provides automatically link the system to sites in a more automated fashion that increases the exposure of a system. Lastly is Windows itself. During the time between the discovery of a vulnerability and the release of a match all systems are vulnerable. In many cases the exposure time is lengthy. Keeping up with patches is critical but in itself does not ensure protection.
There are companies that offer system analysis. In general you can look to pay $350 - $400 per hour from a quality service. For an 80 Gig drive you are looking at about 4 hours of time for a basic pass over the system. A more detailed analysis will take in excess of 10 hours. As an example we are performing an analysis now on a system. The forensic copy of the disk to perform the analysis took 2 hours. The first pass analysis took an additional 6 hours. We are now starting the second pass and that will be 10 to 12 hours. Our times are about 30% more then a commercial provider due to the equipment we use. This is not a cheap process in money or time.
Due to the high risk that the torpig and mebroot trojans present I would highly recommend to completely rebuild the system ensuring that the boot sector is wiped and re-written. I would then ensure before the system goes back into usage that all windows, Internet Explorer, and office patches are applied.
Wednesday, April 15, 2009
Tuesday, April 14, 2009
A Followup on Wal-Mart's EHR effort
I've recently written about Wal-mart's effort to reduce the cost of EHR acquisition. Many folks have asked for more details about how the product will be promoted and sold. Here's the answer based on followup calls with the Wal-mart folks running the project.
Sam's Club currently has "feet on the street" visiting with small business operators. In particular, there are individuals from the Health and Wellness business group that are currently calling on physician members. In the past, they would have spoken to physicians about the $4 Pharmacy program and office supplies. That same group will also be used to promote the EHR Solution. However, that is not enough to spread the word.
In partnering with eClinicalWorks and Dell, Sam's Club will be leveraging their "feet on the street" to get out the message. Sam's will rely on eClinicalWorks to communicate the technical details of how the software product works. ECW will do all the demos. Sam's is working with them to streamline that demo process. A first step is to do a web-demo which is relatively low cost.
Sam's is also beginning the process to partner with state governmental organizations and professional organizations to communicate the value of the program. Those partnerships will also spread the word.
Sam's will eventually create traveling demos so that physicians can be invited to clubs for a more interactive event targeted to their needs.
Per Sam's, all of this may not be enough. Depending on the pace of demand, they may also leverage existing infrastructure from other organizations to get the word out.
So, in summary, you'll not find a doctor at Sam's getting a case of toilet paper and an EHR, you'll find one on one discussion, demonstrations, and the involvement of many professional groups. Just as with the rollout and support, Sam's seems to have really thought this out.
Sam's Club currently has "feet on the street" visiting with small business operators. In particular, there are individuals from the Health and Wellness business group that are currently calling on physician members. In the past, they would have spoken to physicians about the $4 Pharmacy program and office supplies. That same group will also be used to promote the EHR Solution. However, that is not enough to spread the word.
In partnering with eClinicalWorks and Dell, Sam's Club will be leveraging their "feet on the street" to get out the message. Sam's will rely on eClinicalWorks to communicate the technical details of how the software product works. ECW will do all the demos. Sam's is working with them to streamline that demo process. A first step is to do a web-demo which is relatively low cost.
Sam's is also beginning the process to partner with state governmental organizations and professional organizations to communicate the value of the program. Those partnerships will also spread the word.
Sam's will eventually create traveling demos so that physicians can be invited to clubs for a more interactive event targeted to their needs.
Per Sam's, all of this may not be enough. Depending on the pace of demand, they may also leverage existing infrastructure from other organizations to get the word out.
So, in summary, you'll not find a doctor at Sam's getting a case of toilet paper and an EHR, you'll find one on one discussion, demonstrations, and the involvement of many professional groups. Just as with the rollout and support, Sam's seems to have really thought this out.
Monday, April 13, 2009
The Limitations of Administrative Data
The data issue described in the Boston Globe this morning is really unrelated to Google, Microsoft, or any Personal Health Record (PHR) provider. In the US, there are two kinds of healthcare data - clinical data in Electronic Health Records (EHRs) and administrative billing data that is used by payers, researchers, and the government. Billing data is imprecise, but it is a starting point to describe the care given by a doctor or hospital. The only thing that's new in 2009 is that PHRs now enable patients to see the kind of billing data that's been used for 20 years for reimbursement, quality measurement, and population health. Blue Cross of Massachusetts and Medicare (in a few pilot states) share billing data with patients via Google Health, so this is not just a BIDMC implementation.
As a society we're likely to see increased data transparency between patients and providers, which will lead to several improvements:
1. Doctors will likely begin using more structured problem lists based on SNOMED-CT, a standardized clinical vocabulary of symptoms and conditions. This will enable their EHRs to better share data with PHRs as well as to more accurately measure quality. The Healthcare Information Technology Standards Panel (HITSP) has harmonized the national standards needed to reduce the dependency on billing data for PHRs, quality measurement, and population health.
2. Eventually, billing data will become more detailed as ICD-10 replaces ICD-9 billing codes in 2013. It will take several years for ICD-10 to be widely adopted and improve data granularity.
3. In the future, patients and doctors will work together to ensure records are up to date and accurate. It's a shared responsibility. Now that the Stimulus Bill requires doctors to make records available electronically to patients, the limitations of billing data will become more widely understood.
In the meantime, BIDMC will take the following actions to accelerate this work:
1. I'm working with the National Library of Medicine to map the most common Problem List terms used at BIDMC to SNOMED-CT, enabling BIDMC to use a clinical vocabulary and not just a billing vocabulary.
2. I'm working with Google to evaluate the impact of sending our existing free text problem lists instead of billing codes. It will reduce the number of features available to patients, since Google's educational materials are based on billing codes, but it may be more informative to patients to see the text their clinician wrote, not the diagnosis on the bill. Showing problem lists is what we've done in Patientsite for 10 years.
3. We'll hold a conference call with e-Patient Dave, his doctor, Google, and me to review Dave's clinical and administrative data (with his permission), to capture a real world example of the differences between these data sources.
As a society we're likely to see increased data transparency between patients and providers, which will lead to several improvements:
1. Doctors will likely begin using more structured problem lists based on SNOMED-CT, a standardized clinical vocabulary of symptoms and conditions. This will enable their EHRs to better share data with PHRs as well as to more accurately measure quality. The Healthcare Information Technology Standards Panel (HITSP) has harmonized the national standards needed to reduce the dependency on billing data for PHRs, quality measurement, and population health.
2. Eventually, billing data will become more detailed as ICD-10 replaces ICD-9 billing codes in 2013. It will take several years for ICD-10 to be widely adopted and improve data granularity.
3. In the future, patients and doctors will work together to ensure records are up to date and accurate. It's a shared responsibility. Now that the Stimulus Bill requires doctors to make records available electronically to patients, the limitations of billing data will become more widely understood.
In the meantime, BIDMC will take the following actions to accelerate this work:
1. I'm working with the National Library of Medicine to map the most common Problem List terms used at BIDMC to SNOMED-CT, enabling BIDMC to use a clinical vocabulary and not just a billing vocabulary.
2. I'm working with Google to evaluate the impact of sending our existing free text problem lists instead of billing codes. It will reduce the number of features available to patients, since Google's educational materials are based on billing codes, but it may be more informative to patients to see the text their clinician wrote, not the diagnosis on the bill. Showing problem lists is what we've done in Patientsite for 10 years.
3. We'll hold a conference call with e-Patient Dave, his doctor, Google, and me to review Dave's clinical and administrative data (with his permission), to capture a real world example of the differences between these data sources.
What is Meaningful Use?
The definition of "Meaningful Use" in ARRA is one of the most critical decision points of the new administration's healthcare IT efforts. That definition will influence the types of products that will be implemented in clinician offices and the types of standards used for healthcare exchange to qualify for stimulus dollars.
For example, if meaningful use is defined as e-prescribing, then standalone products such as Dr. First's Rcopia could be used as part of a clinician's office compliance in lieu of a complete EHR.
If meaningful use is defined as the basics of ordering/viewing labs, then products like 4medica could constitute meaningful use.
If meaningful use requires sophisticated quality measurement, decision support, and workflow redesign to enhance efficiency, then a CCHIT certified comprehensive EHR may be required.
My prediction of meaningful use is that it will focus on quality and efficiency. It will require electronic exchange of quality measures including process and outcome metrics. It will require coordination of care through the transmission of clinical summaries. It will require decision support driven medication management with comprehensive eRx implementation (eligibility, formulary, history, drug/drug interaction, routing, refills).
Each year, the definition of meaningful use will be expanded, setting the bar higher and requiring more features and more data exchange.
Thus, in the short term, meaningful use may be a combination of products or an EHR lite. However, over the longer term, a comprehensive EHR will be the best foundation for meaningful use.
The definition of "certified" is also important. Today, CCHIT includes those criteria that make an EHR capable of supporting an optimal set of functionality. If certification is redefined as a baseline set of functionality, then more basic EHR lites may meet the definition of "certified". If certification is based on the criteria as written today and the likely evolving criteria for usability and interoperability, then a comprehensive EHR will be the best foundation.
There are many stakeholders on both sides of this discussion. Small clinician offices with few resources want stand alone e-prescribing and lightweight EHRs to get them started on e-health. Hospitals, larger practices, population health experts, and researchers favor a more comprehensive EHR.
As background, here's the HIMSS strawman proposal for meaningful use.
The next few months will settle this question once and for all. If you have an opinion about meaningful use, I expect the first recommendations to come from the new HIT Policy Committee and possibly NCVHS, an existing FACA advising HHS. Participation in any call for public comment will be the best opportunity to contribute your opinion.
For example, if meaningful use is defined as e-prescribing, then standalone products such as Dr. First's Rcopia could be used as part of a clinician's office compliance in lieu of a complete EHR.
If meaningful use is defined as the basics of ordering/viewing labs, then products like 4medica could constitute meaningful use.
If meaningful use requires sophisticated quality measurement, decision support, and workflow redesign to enhance efficiency, then a CCHIT certified comprehensive EHR may be required.
My prediction of meaningful use is that it will focus on quality and efficiency. It will require electronic exchange of quality measures including process and outcome metrics. It will require coordination of care through the transmission of clinical summaries. It will require decision support driven medication management with comprehensive eRx implementation (eligibility, formulary, history, drug/drug interaction, routing, refills).
Each year, the definition of meaningful use will be expanded, setting the bar higher and requiring more features and more data exchange.
Thus, in the short term, meaningful use may be a combination of products or an EHR lite. However, over the longer term, a comprehensive EHR will be the best foundation for meaningful use.
The definition of "certified" is also important. Today, CCHIT includes those criteria that make an EHR capable of supporting an optimal set of functionality. If certification is redefined as a baseline set of functionality, then more basic EHR lites may meet the definition of "certified". If certification is based on the criteria as written today and the likely evolving criteria for usability and interoperability, then a comprehensive EHR will be the best foundation.
There are many stakeholders on both sides of this discussion. Small clinician offices with few resources want stand alone e-prescribing and lightweight EHRs to get them started on e-health. Hospitals, larger practices, population health experts, and researchers favor a more comprehensive EHR.
As background, here's the HIMSS strawman proposal for meaningful use.
The next few months will settle this question once and for all. If you have an opinion about meaningful use, I expect the first recommendations to come from the new HIT Policy Committee and possibly NCVHS, an existing FACA advising HHS. Participation in any call for public comment will be the best opportunity to contribute your opinion.
Friday, April 10, 2009
Spring Break in NYC
There will be a little lull in the posts on EverythingHealth while I take a break with family and visit New York City. In the meantime, please look on the right side under "My Favorite Links" and you'll fine a lot to read on the Medical blogsphere and other fun sites.See you in a week! Come back and be a "follower" of EverythingHealth.
Cool Technology of the Week
Although Google does not generally share the details of its infrastructure, Google's hardware architect recently shared the secrets of its servers, data centers and power management.Having been involved on the advisory council for Google Health, I know that Google runs hundreds of thousands of servers. What I did not know is that it designs and builds its own. The real innovation - each server has a 12 volt battery attached the motherboard to keep the CPU running in case of power failure. Google does not use centralized uninterruptible power supplies. Building the power supply into the server means costs are matched directly to the number of servers. Google also uses the battery design on its network equipment.
Also interesting is that its data centers are standard metal shipping containers, each containing 1,160 servers and drawing 250 kilowatts of power. These shipping containers optimize power distribution, cooling and efficiency to reduced waste heat. For example, Google uses ultra-efficient power supplies that convert AC current to 12 volts DC. It's more efficient to transmit 12 volts over copper wires than 5 volts. All other power conversions take place on the motherboard.
Google servers, pictured above are 3.5 inches thick and contain two processors, two hard drives and 8 memory slots.
Incredible attention to detail to create highly scalable, very reliable, and maximally "green" server farms. That's cool!
Thursday, April 9, 2009
Goodbye Pap Test
The pap smear may become a relic of the past. File it away with blood letting and arsenic when a new DNA test is brought to market that will enable women to be tested once every 5 to 10 years to detect cervical cancer.The annual Pap Smear has been around since the 1940s and requires a scraping of the cervix with a pathologist reading the smear and looking for abnormal cells. The new DNA test,
Subscribe to:
Posts (Atom)