After discussion with Dr Dipak Kalra, we felt that the following would
be of interest:
As part of the EHR developments at UCL we have been looking at
appropriate ways of auditing user interactions with individual EHRs, as
part of an overall security approach. For over a year our record server
On Wed, 2004-03-10 at 23:26, Thomas Beale wrote:
Gavin Brelstaff wrote:
Thomas Beale wrote:
A well known study in Harvard medical school (I think) showed that
putting the message Do not inappropriately access patient data - all
your accesses are being logged on clinician screens a
On Thu, 2004-03-11 at 04:52, lakewood at copper.net wrote:
Hi Tim,
One I failed to include is:
RFC 3586 - IP Security Policy (IPSP) Requirements
http://www.faqs.org/rfcs/rfc3586.html
Some of the included links support searches, e.g., The CMU link returned
over 2200
hits on a search
Security was: Basic EHR functionality
Gavin Brelstaff wrote:
Thomas Beale wrote:
A well known study in Harvard medical school (I think) showed that
putting the message Do not inappropriately access patient data - all
your accesses are being logged on clinician screens a few times
Hi Tim,
Might want to add:
Computer Security Basics
http://www.oreilly.de/catalog/csb/toc.html
IEEE; Compartmented Mode Workstation: Prototype Highlights
http://csdl.computer.org/comp/trans/ts/1990/06/e0608abs.htm
CMU; Trusted Operating Systems
On Wed, 2004-03-10 at 21:31, b.cohen wrote:
I produced a formal definition of most of Anderson's Security 'Principles' in
1996 (see http://www.soi.city.ac.uk/~bernie/hsp.pdf)
Nice paper! Haven't read it in detail but on a quick scan I see the
value in the formalisation.
and circulated it
Gavin Brelstaff wrote:
Thomas Beale wrote:
A well known study in Harvard medical school (I think) showed that
putting the message Do not inappropriately access patient data - all
your accesses are being logged on clinician screens a few times a
day resulted in a drop to near 0 of
Ignacio Valdes wrote:
At the VA, a note is still deletable until it is electronically
signed. You can save it and not sign it and still be able to delete
it. I do not know the algorithm of signature but it involves a
pin-like password that is different from your login. I bet the VistA
Hi Tim,
Security policies are included as are implementation approaches.
Regards!
-Thomas Clark
Tim Churches wrote:
On Wed, 2004-03-10 at 19:10, Thomas Clark wrote:
Hi Tim,
Might want to add:
Computer Security Basics
http://www.oreilly.de/catalog/csb/toc.html
IEEE; Compartmented Mode
Hi Tim,
One I failed to include is:
RFC 3586 - IP Security Policy (IPSP) Requirements
http://www.faqs.org/rfcs/rfc3586.html
Some of the included links support searches, e.g., The CMU link returned
over 2200
hits on a search for 'security policy'. Lots of policy-related
information that is
Tim Churches wrote:
On Sun, 2004-03-07 at 08:42, Thomas Beale wrote:
Client-side file caching is probably a security hole, but
memory caching is safe enough.
You are assuming that computers are turned off when they are not
attended or in use. Increasingly that is not the case, with
Tim Cook wrote:
On Sat, 2004-03-06 at 14:17, Tim Churches wrote:
In general, caches should be
held on encrypted filesystems, either on-disc or in-memory, with the
keys (or a key to the keys) to the encryption/decryption managed by a
daemon which purges the keys from memory when asked (eg
Sent: 08 March 2004 10:18
To: Sam Heard
Cc: Tim Cook; Thompson, Ken; 'openehr-technical at openehr.org '
Subject: Re: Basic EHR functionality
Hi,
I agree.
One can only be responsable for facts if this is shown by a conscious act
like signing.
TNO-PG has developed a set of Essential Requirements
Thomas Beale wrote:
Tim Cook wrote:
On Sat, 2004-03-06 at 14:17, Tim Churches wrote:
In general, caches should be
held on encrypted filesystems, either on-disc or in-memory, with the
keys (or a key to the keys) to the encryption/decryption managed by a
daemon which purges the keys
Hi Nathan,
The real estate codes in most jurisdictions require landowners to post
notices
warning of everything from dangerous conditions to prohibitions.
Interpretations
extend well beyond this to impose duties upon the landowners to take active
measures to persons that may be classified as
and balances in the system.
Any other thoughts on this?
Best Regards,
Ken Thompson
-Original Message-
From: Nathan Lea
To: Thomas Beale
Cc: Openehr-Technical
Sent: 3/9/2004 4:46 AM
Subject: Re: Data Security was: Basic EHR functionality
On 9 Mar 2004, at 06:51, Thomas Beale wrote
Tim
The openEHR and before it GEHR work on legality made it clear to me that a
document has no legal status until it is saved in some voluntary manner - just
as a correction in a written document has no status as fact (if you
contemporaneously correct the document).
Sam
On Sat, 2004-03-06
Hi,
I agree.
One can only be responsable for facts if this is shown by a conscious
act like signing.
TNO-PG has developed a set of Essential Requirements for the
application of IT in Healthcare systems.
This is based on European Directives and other relevant texts.
One of the basic items deal
Message -
From: Sam Heard sam.he...@bigpond.com
To: Tim Cook tim at openparadigms.com
Cc: Thompson, Ken GThompso at unch.unc.edu; openehr-technical at
openehr.org
Sent: Sunday, March 07, 2004 11:03 PM
Subject: Re: Basic EHR functionality
Tim
The openEHR and before it GEHR work on legality made
-techni...@openehr.org
[mailto:owner-openehr-technical at openehr.org] On Behalf Of Sam Heard
Sent: 08 March 2004 07:03
To: Tim Cook
Cc: Thompson, Ken; 'openehr-technical at openehr.org '
Subject: Re: Basic EHR functionality
Tim
The openEHR and before it GEHR work on legality made it clear to me
, Ken; 'openehr-technical at openehr.org '
Subject: Re: Basic EHR functionality
Hi,
I agree.
One can only be responsable for facts if this is shown by a conscious act
like signing.
TNO-PG has developed a set of Essential Requirements for the application of
IT in Healthcare systems.
This is based
At the VA, a note is still deletable until it is electronically
signed. You can save it and not sign it and still be able to delete
it. I do not know the algorithm of signature but it involves a
pin-like password that is different from your login. I bet the VistA
crowd would know.
-- IV
On
...@blueyonder.co.uk
To: openehr-technical at openehr.org
Sent: Saturday, March 06, 2004 5:55 AM
Subject: Basic EHR functionality
Dear all,
I would be grateful for some advice on an issue that has been troubling me
for some time. I am a clinician currently on secondment full time to an EHR
project. I do not wish
On Sun, 2004-03-07 at 01:25, Matt Evans wrote:
Thank you to all for your helpful suggestions. I shall start to go through
them all and see what we can do. No doubt I'll be seeking further advice in
due course.
The basic problem for us is that changes to code are controlled by the
software
Tim Cook wrote:
On Sat, 2004-03-06 at 10:08, Thompson, Ken wrote:
Do you thing that a document being informally saved by an automated process
designed to support recovery of the document should be subject to the same
modification constraints as a formally saved document?
I would say
On Sun, 2004-03-07 at 08:42, Thomas Beale wrote:
Client-side file caching is probably a security hole, but
memory caching is safe enough.
You are assuming that computers are turned off when they are not
attended or in use. Increasingly that is not the case, with low-power
workstations, laptops
On Sun, 2004-03-07 at 10:18, Tim Cook wrote:
On Sat, 2004-03-06 at 14:17, Tim Churches wrote:
In general, caches should be
held on encrypted filesystems, either on-disc or in-memory, with the
keys (or a key to the keys) to the encryption/decryption managed by a
daemon which purges the
that were made in all of these
matters...;-)
Yes, maintenance of I told you so.. files is vital.
Tim C
Best Regards,
Ken
-Original Message-
From: Tim Churches
To: Tim Cook
Cc: OpenEHR Technical
Sent: 3/6/2004 7:14 PM
Subject: Re: Data Security was: Basic EHR
This thread takes me back (30 years) to a Cobol-based NHS payroll system
which in one glorious month paid every single NHS employee in the region
a safety boot allowance, because the first person on the payroll was an
ambulance man who at that time got it and the record was not cleared
down
Thank you to all for your helpful suggestions. I shall start to go through
them all and see what we can do. No doubt I'll be seeking further advice in
due course.
The basic problem for us is that changes to code are controlled by the
software house HQ. Sometimes changes take months (on one
Regards,
Ken Thompson
UNC Healthcare
-Original Message-
From: Thomas Beale
To: Matt Evans
Cc: openehr-technical at openehr.org
Sent: 3/6/2004 8:03 AM
Subject: Re: Basic EHR functionality
Matt Evans wrote:
A month later I review the patient and they no longer have pneumonia. I
open
the pre
On Sat, 2004-03-06 at 10:08, Thompson, Ken wrote:
Do you thing that a document being informally saved by an automated process
designed to support recovery of the document should be subject to the same
modification constraints as a formally saved document?
I would say that the data is not a
On Sat, 2004-03-06 at 14:17, Tim Churches wrote:
In general, caches should be
held on encrypted filesystems, either on-disc or in-memory, with the
keys (or a key to the keys) to the encryption/decryption managed by a
daemon which purges the keys from memory when asked (eg locking the
device)
To: Tim Cook
Cc: OpenEHR Technical
Sent: 3/6/2004 7:14 PM
Subject: Re: Data Security was: Basic EHR functionality
On Sun, 2004-03-07 at 10:18, Tim Cook wrote:
On Sat, 2004-03-06 at 14:17, Tim Churches wrote:
In general, caches should be
held on encrypted filesystems, either on-disc or in-memory
Hi All,
If one resorts to hardware to support security be sure to post guards.
WWII proved than
reliance upon hardware devices to provide adequate security is misplaced.
Hardware components in a security system are acceptable if the software
can re-configure
them and alter even their basic
Dear all,
I would be grateful for some advice on an issue that has been troubling me
for some time. I am a clinician currently on secondment full time to an EHR
project. I do not wish to name the software house we are using but they are
a major EHR developer with an interest in the UK.
The
36 matches
Mail list logo
