by Ken Tubman on March 17, 2011
The process of Threat Modeling when developing Medical Software begins with identification of possible and common threats. Claricode has adopted industry techniques and uses the STRIDE check list to aid in our threat modeling process. The STRIDE checklist stands for: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. The elements of this checklist are further defined below.
Spoofing
Security Property: Authentication
A spoofing attack is when a person or application successfully masquerades as another by falsifying data and thereby gaining illegitimate access.
Spoofing Types
- Man-in-the-middle attack and internet protocol spoofing
- URL Spoofing
- Phishing
- Referrer Spoofing
- Email Address Spoofing
Examples:
Basic HTTP authentication sends credentials in the clear
Credentials or tokens stored in HTTP cookies
Authentication tokens in the clear on the wire
Intercepting DNS requests – DNS Spoofing
Tampering
Security Property: Integrity
A tampering attack is when an unauthorized person or program modifies data or code.
Examples:
SQL injection to modify database data
Modifying data on the wire, in transit
Unsecured access to pages and components
HTTP cookies
Repudiation
Security Property: Non-repudiation
A repudiation attack is when a person or program denies performing an action and there is no evidence or log to prove that person or program did in fact breach security.
Examples:
User performs an illegal operation and there is no trace of what happened
Attacker gets a prescription drug ordered without an audit trail
Information Disclosure
Security Property: Confidentiality
An Information Disclosure attack is when a person or program gained exposure of information and was not authorized to see it.
Examples:
Reading on the wire
Unsecured pages and components
Error messages that reveal implementation details
Denial of Service
Security Property: Availability
A Denial of Service attack is when a program degrades service to users.
Examples:
DDoS attacks
Poorly behaved components that can be exploited
Disabling a credential store
Elevation of Privilege
Security Property: Authorization
An Elevation of Privilege attack is when a person or program gains privileged access without authorization.
Examples:
Install an .exe and wait for an admin logon
Unsecured components that communicate to other services with admin rights
Impersonation
Threat Matrix
These application threats are documented into a Threat Matrix and ranked. This document is a living document and should never be frozen in time. The risks are rated and evaluated for risk exposure by calculating probability multiplied by impact (P * I = RE). The results can be sorted by risk exposure to determine priority.
Another useful acronym for documenting threats is DREAD, which is Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability.
by Ken Tubman on February 19, 2011
In January, Claricode made several bold moves. We invested heavily into Claricode by way of people, knowledge and leadership. We decided in order to continue our growth as leaders in Healthcare Software Development we should proactively grow our people more than ever. Claricode has already demonstrated its ability to find and retain talented healthcare professionals. We now need to demonstrate our leadership by teaching others.
To promote leadership you need leadership.
My first mission was to establish a strong internal management team. The team was put in place before the 1st of the year. As a team we developed a plethora of ideas and immediately put them in motion.
Health and Technology (HAT) Talk
HAT Talks have become a monthly staple for the company. HAT Talks are similar to TED talks except our themes are targeted to Health and Technology. Our first HAT Talk was presented by George Robinson, Clinical Director for Medi-Span. We all assembled in our training room at Claricode to learn more about RxNorm. It was an impressive display of people. Especially, when even your office manager now understands the basics of RxNorm…
It’s our plan to continue HAT Talks and grow these into a public forum. Stay tuned…
Health Experience Design – April 11, 2011
Let’s take the show on the road. Claricode partnered up with a Mad*Pow to host a first-of-its-kind healthcare experience design conference. The conference will be held at The Fairmont Copley Plaza Hotel in Boston.
We have an incredible lineup of speakers and an action packed agenda.
The Healthcare Experience Design Conference blends the powerhouse perspectives of healthcare thought leaders, product developers, and design implementers across a broad spectrum of healthcare technologies and delivery channels. Informative, inspiring and above all practical, this conference will empower technologists, usability practitioners, design practitioners and thought leaders to improve healthcare technologies from electronic health records to web-based applications, medical devices, and human services. For more information visit http://www.healthcareexperiencedesign.com/.
The best you can do for your organization is stimulate leadership. It has proven to move a company with energy, drive and self-promotion.
by Ken Tubman on July 30, 2010
The final rule for Meaningful Use has several categories regarding medications:
- ePrescribing
- Active Medication List
- Active Medication Allergy List
- Electronic Copy of Health Information
- Exchange Key Clinical Information
- Implement Drug-formulary checks
- Medication Reconciliation
To accomplish these features in a meaningful way you will need a comprehensive medication terminology provider. There are many providers to choose from.
How to choose the right provider?
We had a project recently where we needed to help our customer choose which provider was best. Our priorities were as follows:
Trial period
- Does the company offer up the data for us try before we buy?
API (.NET / Java)
- Drug Databases are generally extremely normalized and complicated to navigate. It would save us time if the company offered an API.
Cost
- What does the product cost per user? Is there an upfront licensing fee? Does the API cost extra?
Reliability
- How often do we receive updates?
- What happens when drugs are discontinued?
- How is the database distributed?
Customer Service
- How smart are the sales people?
- Do they understand my needs?
- What is their response time for getting back to me?
Flexibility
- What will they do for me?
- How do I request features?
- Can I talk directly with the experts?
I spoke with several vendors and was quite annoyed by their secrecy. I felt like a competitor rather a potential customer. One vendor told me they would call me back and never did. Another vendor wouldn’t let me review the entire product.
After working through my “needs checklist” I found a company called Lexi-Comp. They had smart people that answered my call on the first attempt. The API is simple and fast. The product cost was reasonable and tailored to my customers’ business model. I walked away with an API w/sample code and data. The product is distributed via FTP and updated often. If you’re looking for an experienced medication terminology provider for your application then I highly recommend Lexi-Comp.
by Andrew Needleman on May 8, 2009
Innovation seems like it is something complicated that really has to be created from hard work.
However, one of the most amazing inventions for healthcare that I’ve seen was taking an existing technology and just changing it slightly to meet a need. I learned about it five years ago and it was a huge improvement for the nurses. They were raving about how much easier it made their lives. Once they explained it, it immediately became clear that it was a huge time saver for them.
Let’s look at the process that the invention changed first and then we’ll talk about the invention. Once we get to the invention, you may think that it is barely an invention at all, but an obvious idea. However, the technology was around for many years before it was created, so it clearly wasn’t an obvious idea. This invention was a huge step forward for home wound care.
One of the major pieces of doing home wound care is documenting the wounds for treatment and reimbursement purposes by taking a picture. For these pictures, you needed to be able to see the relative size of the wound – which was done with a measuring ruler.
Before this invention, for each wound, the nurse would have to:
- Balance a ruler on the part of the body near the wound
- Ask the patient to stay still
- Take a picture with a camera quickly to document the wound (before the ruler fell off).
Inevitably, if you have a wound, it is likely to be even harder to remain still than the average person, and the ruler would fall off. Then the process would start over again with balancing the ruler. Many patient would have multiple wounds, so it really increased the time the patient had to try to remain still, which could be painful. Also it would increase the time of the visits, as well as the difficulty the visit caused the patient. So, the nurses dreaded the whole “taking the pictures” part of the visit
So, what was this amazing invention?
- A pad of post-it notes with rulers printed on each one.
What did it do for the nurses?
- It stayed in place
- It was disposable – you didn’t use the same one near multiple wounds – so that made it easier to avoid transmitting any infections (although that was unlikely as the rulers are not placed on the wound, but nearby).
- The patient did not feel guilty about the ruler falling off (which is almost impossible to control, anyway)
- It saved a lot of time for both the patients and nurses.
- It made the patients and nurses more comfortable by shortening the time the patient had to be uncomfortably still.
- It reduced the awkwardness of the visit by making the time the pictures would take more predictable
All these benefits for a post-it note with a ruler printed on it…
So, what concepts can you combine to invent something that revolutionary?
by Andrew Needleman on April 14, 2009
The vast majority of the time, I believe that EMRs and medical software can help streamline processes if they are designed well.
However, the following is one of the few cases in which it seems to hurt rather than help.
Shooting a mosquito with a rocket launcher: An example from a neonatal intensive care unit (NICU).
I often go to medical IT conferences and hear people speak about their projects. One memorable talk was about a Neonatal Intensive Care Unit of 2 beds that decided to automate their patient charts. Now, neonatal ICUs have a ratio of anywhere from 1 RN per bed up to 3 RNs per bed.
Their original workflow involved putting up a (covered for patient privacy) chart on the wall (large poster size) with all of the relevant info about each baby. They could see all of the information at a glance. So, this would involve 2 charts for 3-6 nurses. These nurses work exclusively with babies in those 2 beds.
How can a computer system help them with their workflow to get it off of paper?
Answer: “it can’t”. After the baby has made it out of the unit, they should enter the relevant records into their Electronic Medical Record to record their information for future visits. However, at the point of care, they spent months designing multiple computer based flow sheets (chart pages) to “help” the nurses view the data.
During the presentation, they announced proudly that after all of their work, the electronic version was almost as good as the paper version.
Hmm… Not what I’d like to hear if my child was in the NICU…
by Andrew Needleman on February 28, 2009
How specific is the HITECH Act?
I keep on hearing about how the HITECH act within the ARRA (full text here) is not specific enough. A lot of the definitions and formulas are in the bill. Most are extremely hard to read & understand, but they are there nonetheless.
Of course, there is intentional wiggle room in there to make sure that we don’t cripple the people who are going to administer the programs or make a regrettable decision.
In fact, where the money goes for Healthcare IT is too specific in my opinion.
I’d like to see it go to the most effective medical software and technologies rather than mainly EMRs through incentive payments.
As an investor, you typically try to spread your bets around, so that you have a better chance at getting a return for your investment. The government should be doing the same thing with Healthcare IT. However, we are throwing down the majority of our money on EMRs which is just one segment of Healthcare IT.
The part where the bill shines is requiring that the funded EMRs have e-prescribing, comply with CCHIT standards, and integrate with other systems.
There are rumors that there will be another set of funds allocated at a later date for additional healthcare projects. So, then the government will be diversifying our bets.
I’m optimistic that future Healthcare IT allocations will have more direct impact on increasing the quality of care & lowering the cost of healthcare.
by Andrew Needleman on January 31, 2009
Do patients care about their raw data? The question is how much detail do patients want to see….
My opinion is that patients care about what the data tells them to do or what it teaches them, rather than the detailed readings.
Unfortunately, we’re all patients with medical conditions sometime during our lives. The key is to remember that people who use home medical devices themselves are not full-time patients. They have family, work, hobbies, and other interests to spend time on.
Would you rather play a board game with your daughter or spend time analyzing a graph about your blood sugar? Most people would skip the graph.
For someone in the medical field, this example is hard to understand. However, look at it from a financial point of view. Pretend that your financial advisor was giving you an hourly cell phone update on your portfolio. Would you ask them to lose your cell phone number?
Given a choice, what would you rather have as a patient?
- A system that shows you each natural fluctuation in your readings. This means that if you are weighing yourself 3 times a day, you’ll see the pound or two that you change due to the position of the moon and how hydrated you are.
- Advantages
- I can see all of my data, so if I want to learn everything about myself on a minute by minute basis, it is available.
- Disadvantages
- I’ll be scared during normal fluctuations that are due to the margin of error.
- I’ll be spending a lot of time doing analysis of data points that I’m not really qualified to do.
- I’ll be calling my doctor more often about false positives.
- I’ll lose track of the big picture when looking at minute by minute readings.
- A system that tells gives you one of the following descriptions and provides an explanation as to why it recommends that action:
- Go to the hospital, because…
- Get a doctor’s appointment soon, because…
- You may be getting worse, because…
- You may be getting better, because…
- etc…
Hopefully, we can work to simplify patients’ lives to get them the information that they want to know – no more, no less.
