The assault on neurosurgeons’ privileges by software and bureaucrats

http://blogs.law.harvard.edu/philg/2015/12/07/brain-surgeon-tortured-by-software-developers-and-hospital-bureaucrats/

by soundsop • 11 years ago

98 150 11 years ago

blogs.law.harvard.edu

nickysielicki2• 11 years ago

I live in Madison, where Epic is stationed. I run into a lot of people that work there.

They hold the records of over 50% of the US. It's pretty scary when you think about it.

officialchicken2• 11 years ago

I just don't think that's true, but I'd love to be wrong.

Any given time 1/3rd of the user-base is dead... and it's growing because the data has to remain in the system for 60 months (HIPAA). It's not scary because it's B.S... No single or group of health provider in the world is close to having access to 125 million active patient-users on an annual basis.

Until Epic disclose any numbers in their 10Q/10K, realize that they're probably taking about "rows" in a db table or nonesuch, not actual patients or anything that will get them in trouble with the SEC/FDA.

I'd guess the reality is Nike is much closer in having shoes on half of the US pedestrian population than Epic having HL7/PII data.

tgokh• 11 years ago

I have no idea what the actual number is, but I remember reading that Epic is in about 20% of hospitals. and in many/most academic centers. Given the number of people who've been seen in an academic center at least once (whether for their own birth, a consultation at some point in life, ER visit, etc), Epic systems likely have entries on a substantial portion of the population, though the amount of people they have complete medical records for is likely much smaller

nickysielicki2• 11 years ago

Health care groups using Epic electronic health records serve 54 percent of patients in the U.S. and 2.5 percent of patients worldwide, CEO Judy Faulkner said at Epic’s users group meeting in September.

Source: http://host.madison.com/news/local/govt-and-politics/epic-sy...

You're probably right though. It's still scary to think that it's possible for them to be centralized to that degree at all.

drumdance• 11 years ago

A friend of mine used to work there but he left last year. When I asked him why he said "because I want to make software that people actually enjoy using."

vln• 11 years ago

I did some time at a healthcare IT startup and had to suffer through some Epic training. It's terrible. But so is most health software.

kendallpark5• 11 years ago

I have friends that worked there. Note the past tense. Just check out their Glassdoor reviews and you'll see how they treat their devs.

Anecdotally, I find it hard to believe they can build truly cohesive software with an insane amount of developer turnover.

encoderer• 11 years ago

Anybody familiar with Conway's Law can probably identify a solid "revolving door pattern" -- somehow Gang of Four left that one out.

vonklaus• 11 years ago

Fuck Off 45. He hates computers.’
‘Why forty-five?’
‘It’s the forty-fifth month since we signed onto that hospital’s system and one has to change the password every month,’ Caroline replied.

Every month is a little aggressive of a timeline. Also, stop making users do your bizarre regex passwords.

* include caps

* include numbers

* include symbol

* eight charachters

* must be recursive backronym

Also, stop trying to keep password requirements secret. I am sick of this guessing game. I can relate to Mr. Johnson's total indifference to the system.

serge2k• 11 years ago

If you don't you end up with bad passwords.

Maybe we should just get rid of the damn passwords and replace them with a system that makes it easier to remember and use without compromising security. At the very least one password + a smartcard system would be way easier. You enter your password once then you just have to swipe your card when you login to another system.

gozo2• 11 years ago

Not entirely sure why you're being downvoted. Sun terminals have had smartcard access for, what, 15 years? (Yes, for hospitals). It's a good idea. Some sort of complementary directional RFID might be even better.

E.g. https://www.youtube.com/watch?v=R497CzmKyVQ&t=38s

camgunz3• 11 years ago

You end up with bad passwords anyway (like Fuck Off 45). Or you end up with everyone using the same account, or post-it notes with passwords, or notebooks with passwords, or an email draft with passwords.

I've seen smartcards have the best impact. Yeah sure they can be swiped or forged, but compared to the real, effective security of passwords, they're much better. You also can't lock yourself out of a smartcard system. You can forget your card at home, but it's easy to just reissue a new card and invalidate the old one (throw it away when you get home, it's just a hunk of plastic now).

Joof• 11 years ago

I had this thought years ago. A smartcard coupled with a biometric seems easier to use and more secure.

Even just a card. You can only have one per person (as opposed to passwords that can have infinite copies and are likely to be unknowingly compromised) and if a card is lost, it can be expected that it will be replaced shortly so long as the replacement process is painless which seals the leak.

ArcticCelt2• 11 years ago

Having an insanely strict password policy is begging for having 60% of the passwords written on a post it near the keyboard of every user.

bigger_cheese• 11 years ago

Yes that happens at my work - most workers have a post-it notes on the side of their monitors with various passwords written down - real secure.

Anything requiring permissions, passwords, group policy etc is a complete nightmare. I had this gem when I emailed Information Services this morning.

My email: "XXX has left the company and I've taken over their role Can you please remove them as Owner of the following sharepoint site: YYY and make me the Owner instead."

IS's reply: "Please fill out a trouble ticket *"

I proceed to fill in a digital form 2 hours later I get a terse reply.

"Hi ZZZZ please contact the owner of site YYY and get them to adjust your permission. We are now closing your ticket."

unprepare2• 11 years ago

Unfortunately, not having a strict password policy very likely violates HIPAA.

I dont think anyone wants to be the one to reduce the security of the HIPAA requirements.

scrupulusalbion• 11 years ago

Assuming at least some users are going to write down their passwords, I wonder if it would be appropriate to show them more secure ways to do that. Unfortunately, my "better" way is to stuff the sticky note in my wallet.

If I could find a device (w/ touch or keyboard for input) that fit into my pocket and has no wireless capabilities, then I would probably use that as a password manager.

defibrelaxing• 11 years ago

My smartphone has touch ID. would it be feasible to implement "touch ID on phone >> phone connects to computer >> computer automatically logs in"?

throwaway_xgqtr• 11 years ago

These things have been around forever, no need for all that complexity:

http://www.amazon.com/Digital-Persona-U-are-U-4500-Fingerpri...

sp332• 11 years ago

Fingerprints are moderately easy to forge, and you can't issue new ones once they are compromised.

USAnum1• 11 years ago

At Microsoft I can use [Azure Authenticator](https://itunes.apple.com/us/app/azure-authenticator/id983156...) as a second factor to my password for company resources. It's got touch ID support, so frankly I find the added security super pain-free.

Full disclosure: I work at Microsoft, but not on Azure Auth.

ww520• 11 years ago

Not sure why the bad password policies keep creeping up. May be because of regulatory compliance?

mikeash• 11 years ago

Strict password policies are easy to implement and feel secure, even if they don't actually help.

gregmac• 11 years ago

I have seen passwords like "Fall2013!". Bet you can't guess how often they had to change their password.. or what this user's current password is....

But yes, IT admins, go on thinking if you just finely craft and tune your password policy enough you'll make users come up with secure passwords.

numbsafari• 11 years ago

... when the policy is to change your password every quarter, and include a mix of case and punctuation, the policy is to use the season, the year, and an exclamation point.

I worked at a place where you could log in to just about anyone's account because our managers literally told us to take this approach so that we'd be less likely to forget what our password was.

grittathh• 11 years ago

One of the hospitals I rotate in has solved this by having you physically scan your nametag (just like unlocking any of the doors) to log in, log out, and whenever else your credentials are needed. It works pretty well, and no passwords to remember once it's set up.

x1798DE• 11 years ago

So anyone with your badge (or a copy of it) can authenticate as you? Seems a bit dangerous to me. A second factor seems like it would be prudent.

dllthomas• 11 years ago

"must be recursive backronym"

I would be fascinated to know how you determine that with a regex.

Unless it's a manually maintained list of known recursive backronyms...

baldfat2• 11 years ago

" They sent the scan on a CD but because of that crap from the government about confidentiality they sent two taxis."

Not they sent the scan over the internet but they had to copy the scan on a CD and rush it over to the hospital.

SORRY BELLOW is a comment I did this week and it seems just as appropriate.

Here is the discussion on Open Source Software for Developing World Hospitals https://news.ycombinator.com/item?id=10675275

My old comment still reliant. Another story about my journey with my son while he battled cancer. Closed Proprietary image formats and systems HURTS patients. We used the local hospital for Chemo and everything else at the Children's Hospital 1.5 hours away for his legs and lungs. I would always have to wait 20-30 minutes to get a DVD of the studies (PET, CT Scan or MRI even ultrasound, but those are worthless) and then bring them to the doctor. The doctor would be forced to use whatever the portable image viewing program that came on the DVD and then they had to be sent to the IT Department to be imported into their system. We would be there to remove some horrible tumor but before half his surgeries (I can't count how many surgeries he had) we would have to go in the day before (3 hour round trip) to get the expensive scan done again. One time I had a scan at 11 PM - Midnight and then drive home around 2 AM and be back at the hospital at 7 AM check in for a 10 hour surgery. ALL BECAUSE THE FORMATS ARE CLOSED and SYSTEMS could not connect so that my son's records were all the same every where. I carried 20 DVDs with me all the time just in case. In case you are wondering my son unfortunately passed away after almost 5 years of fighting. If you are ever interested in giving to a cancer society please consider stbaldricks.org. Most charities give 0% or 2% to pediatric research and that is why we went over 20 years without a new chemo for children till last year, which St Baldrick's funded the research for this amazing new drug to fight a different type of cancer my son did not have.

officialchicken2• 11 years ago

Nothing surprising here. Far and beyond IT, surgeons posses a rare and special type of ignorance... typical of your average over-powered decision maker with not enough time to understand or other incentives to make good IT decisions. This is really, really common in health IT, and not rare at all, but here's it's presented in the form of an over-entitled surgeon. Some people seem to think that brain surgeon is supposed to add gravitas to any conversation, in terms of understanding or something... but your average QA person is 1000x more likely to make a better decision than a surgeon, when it comes to IT.

And the source of the problems in this article? The legal dept. So please don't blame this one on anyone in IT.

parasubvert3• 11 years ago

My take away is close to the opposite, having worked around healthcare IT for many years. Systems are antiquated, un-integrated, use archaic and proprietary languages and databases, and the lack of cohesive design for usability encourages most clinicians to keep using paper.

IT as currently and usually practised, especially in a healthcare environment, is also mostly a disaster in terms of value for expenditure. $2 billion for an Epic system in a regional hospital system... Which was obsolete before it was installed. Heck, the Deustche Bank SAP core banking replacement only cost $1 billion.

Much of the "oh but it's regulated" excuses are just that, excuses to be ignorant and stay stuck in the 1970s.

It doesn't have to be this way, but it requires a lucky administration to find a way out of the mess given the market for lemons in IT management and systems integrators in healthcare.

Open source and Cloud solutions (from an operating model perspective way more than technology) appear to be the only way out of this mess of "your mess for less" IT because it lifts the veil of sales, consultant-speak, and opaque RFP processes in favor of actually-working-and-reliable software that anyone can see and touch.

AnthonyMouse• 11 years ago

Much of the "oh but it's regulated" excuses are just that, excuses to be ignorant and stay stuck in the 1970s.

It is actually a serious problem.

You have a bunch of apparently sensible rules with apparently reasonable justifications, but without a holistic understanding of what those rules cost in terms of engineering and design trade-offs. Then compliance prohibits the use of commodity components not designed with those specific requirements in mind, which requires everything to be custom for the industry at extreme cost, which in turn impairs competition and allows the vendors who do pay all the compliance lawyers to sell low quality software for big money.

And it's not clear how open source or cloud would solve any of that, other than possibly through some kind of regulatory avoidance shell game, which sounds more like a loophole than a solution.

ef43• 11 years ago

In my experience of trying to sell software to healthcare organizations, they are practically immunized against better software.

They are institutionally allergic to agile, iterative improvement. It sounds too scary. They want big-design-up-front, even though that's guaranteed to deliver unusable software that's far more dangerous to patients than any transient bug.

Some of this is regulatory, but most is cultural.

analog31• 11 years ago

How much of the problem is Epic, and how much is the desire of each client to develop their own unique byzantine workflows, that Epic has to implement? I wonder if this is like blaming C because so many programs written in C are bad.

vacri• 11 years ago

I had a similar reaction to the piece, which painted doctors as not being part of the problem - when they have a profound amount of political power.

I had a friend who worked as a QA engineer (hospital processes) for a presitigious children's hospital. The QA department came up with any number of potential, well-conceived plans, but the falling-down point was always the doctors. One of the primary pain points was the lack of interoperability between different departments' record-keeping. Each department head had their favourite vendor, who would give them all sorts of goodies on the side, and as such, none of them wanted to change.

So, you'd have a heads of department meeting where the new QA plan would be discussed, which necessitated regularising the software across departments. The standard refutation was "If I can't use software X, children will die". Everyone knew this was utter bullshit, but there's nothing you can do when the head of department is considered the final domain expert. "Children will die", uttered by doctors and surgeons, killed more efficient processes in that hospital.

Another story of his was at another meeting where one specialist ventured an opinion. It was derided by one of the old-school, a veteran of nearly 30 years: "We don't do things that way; you'd know that if you'd been here any length of time". Said the opinion-venturer: "I've been here 17 years". That is one insular society...

paviva5• 11 years ago

The difference between doctors and engineers is that doctors indeed know which parts of the workflow are critical, and which will indeed cause children to die.

To this date, I'm not aware of any record-keeping software that's at least half as useful and efficient as the old and tried handwritten paper records.

There were only three useful IT innovations in medicine : (a) PACS [1] allows to easily compare and transmit X-rays; (b) lab work records; (c) appointments software.

[1]https://en.wikipedia.org/wiki/Picture_archiving_and_communic...

jakejake2• 11 years ago

I worked on a healthcare IT system at one point as a consultant. I tried to the best of my ability to improve upon the UI or the software, at least for the small tasks commissioned to me. I think that most of the other programmers tried to do the same.

It was extremely difficult because the software was written over a long period of time by multiple generations of programming teams and programming styles. It was hodge-podge to say the least. Take that system and integrate it with another equally hodge-podge system. Then add a couple more hodge-podge systems to that. There were just lots of redundancies and disconnects. I did feel sorry for the people who were going to have to use that system.

I'd say that medical administrative software is ripe for "disruption" just because it sucks so badly. Except for the fact that the systems are a) huge b) require extensive domain knowledge c) are regulated d) sales of such systems are extremely political and e) there's no way to do an end-run around the administrators who are purchasing these systems. It doesn't seem very suited for a "move quickly and break things" scrappy startup.

viraptor5• 11 years ago

‘I’m not starting a big meningioma at 4 p.m.,’ she declared, turning towards me. ‘I’ve got no childcare this evening.’

Without knowing what a "big meningioma" involves, I can only imagine it's something like doing a tricky, manual deployment on Friday afternoon. In that case no, this is a completely reasonable response. People have lives outside of work. Yes, "In the pre-modern NHS consultants never counted their hours – you just went on working until the work was done.", but that doesn't mean it's a good thing. In pre-modern factory days people of any age worked there whole day, 6-7 days a week. It doesn't mean that's a good idea to do it now.

sjg007• 11 years ago

Good hospitals have multiple teams so they can operate 24x7. At any rate scheduling should have figured this out a priori.

cpfohl2• 11 years ago

Many of the hospitals in Boston have surgeons so specialized that they're literally the only surgeon in the US that does their particular type of surgery.

For appendix removal, and trauma surgery, sure, your statement is correct. For brain surgery your statement is a bit ridiculous.

cdcarter2• 11 years ago

Besides, surgeons can no longer get away with such behaviour. I envy the way in which the generation who trained me could relieve the intense stress of their work by losing their temper, at times quite outrageously, without fear of being had up for bullying and harassment.

This is a good thing. Good lord, the ego of some professionals never fails to astound. Treating people like people in the workplace and not harassing them shouldn't be a difficult concept to come to terms with.

OopsCriticality3• 11 years ago

this is a completely reasonable response. People have lives outside of work.

For someone in IT, perhaps, but the professional expectations in medicine are starkly different (although they are admittedly growing more lax, to the chagrin of the old guard). In this particular case, the geriatric meningioma patient had already been cancelled on once, rescheduled with the promise of being the first procedure of the day, and then delayed to the end of the day because she tested positive for MRSA and they needed to do a decon of the OR after her procedure. You would seem to find it reasonable to reschedule her yet again, but neurosurgeons don't have much room in their schedules to play scheduling games with, and in general, patients aren't undergoing elective brain surgery for the fun of it: they need it now.

Perhaps the IT analogy is that neurosurgery is largely a hard real-time system: you must execute within a given time window or you fail.

joshAg2• 11 years ago

Sounds like they need another anesthesiologist or they should have bumped someone else to start the meningioma procedure earlier in the day.

gpvos• 11 years ago

Well, in that case the hospital should pay for extra childcare that evening (including possibly relocating the child to another child care location, which is no fun for the child either), and give them extra time off to have time together with their child at another time. Times have changed, people often live alone with their children (or their partner may be working), and you just don't leave a child alone.

viraptor5• 11 years ago

You would seem to find it reasonable to reschedule her yet again

No, I find it unreasonable that not everyone knew the schedule beforehand, or that someone who knew about it didn't raise it as a problem. This should never happen right before the operation. At that point it's too late and it's on everyone to deal with the situation at hand. What I'm pointing out that if the plan was a surprise then it's completely understandable that someone says no.

As for solutions, it depends on a hospital, location, patient's state, available team, etc. Lots of possibilities. (BTW, anyone shouting at anyone else is not even close to a solution)

cdcarter2• 11 years ago

So, the neurosurgeon should be allowed to throw a fit at an anesthesiologist for the hospital's fuck-up(s)?

There may be a problem with the system here, but the solution isn't forcing people to work past their shift without notice.

paviva5• 11 years ago

When you got the meningioma, you better hope that your surgeon will work until the work is done, instead of delaying it because somebody's unable to find a babysitter.

Medicine was always about putting the patients' needs above your own, and I sure hope it stays that way for the foreseeable future.

viraptor5• 11 years ago

Would you be happy to be handled by an anesthesiologist who's in a hurry to get out as soon as possible, because they don't know what's happening with their children? Yeah, it's a bad choice, or a bad choice.

I'm not sure why you think "Medicine was always about putting the patients' needs above your own". Many hospital employees do. But I've never heard of medicine as a whole having that rule.

If you expect doctors to act like everyone's needs are above theirs, you'll end up with a current situation in the UK. Junior doctors who are overworked, hate the situation, government that wants to pay them even less for more hours (they've got patients to see, right?), and are more and more likely to move abroad - rather than just treat with respect like any other normal employee. And that's not even mentioning the dangerous situations created by tired doctors.

camgunz3• 11 years ago

Well, when you pit "brain surgery" against "babysitter", it seems pretty clear cut. But imagine if you're that anesthesiologist, or one of a half dozen nurses required for the surgery, or whatever, and you've had to ask your parents to pick your kid up from school for the 12th time this semester because you won't be home before bedtime. Kids tend to not understand these kinds of things, parents know that, and they're rightly frustrated when their job unreasonably demands that their kids get short shrift.

That said, this sounds like a hospital procedure/scheduling fuck up. I don't think the anesthesiologist should be blamed at all, she stood up to unreasonable demands just as she should have. The hospital failed the staff and the patient here.

doktrin4• 11 years ago

I agree. It's a little frustrating to see so many argue so fervently of favor of work life balance literally at all costs.

Professionals in western society don't just magically find themselves in the position of regularly making life and death decisions. Those who do are there by choice. At least some tolerance of discomfort is both expected and required.

trhway• 11 years ago

> ‘I’m not starting a big meningioma at 4 p.m.,’ she declared, turning towards me. ‘I’ve got no childcare this evening.’

so with the scale of the money involved, the system can't deal with several hours of unscheduled in advance childcare? No intern around to send take care of it?

camgunz3• 11 years ago

Ehhhhh, I don't really think anyone should be asked to work into the evening unannounced. Sure the stakes at hospitals are high, but that's all the more reason staff shouldn't be stressed, overworked, or distracted. The 40th time you ask your anesthesiologist to work late and put their child in night care from 5-9pm, they're gonna be pretty resentful, and rightly so. Do you want a resentful anesthesiologist? I sure don't.

Retra• 11 years ago

Maybe the hospital should offer free childcare to employees.

Balgair• 11 years ago

http://www.mayoclinic.org/diseases-conditions/meningioma/bas...

They are a large growth in your brain or spinal cord. With this one, think softball sized. Though the link states that they may not be harmful if left to themselves, for a few days, I'd want it out asap. They can cause brain damage or paralysis in the spine. I know this as my PI had one and could only speak Spanish for a few days as his meningoma was pushing hard on his Broca's Area, the part responsible for a lot of speech.

That the lady was complaining of childcare is unacceptable and she should be reprimanded for it. Health care as a profession comes with costs that you know about when you sign up for the job. One of those is irregular hours. I can't imagine how she thought it was ok to put a person and their family through more costly time in a hospital over having her kid stay at daycare a little longer.

SeanDav• 11 years ago

Very frustrating, I agree. I have another medical computer system horror story - Did you know that the UK National Health Service spent 12 Billion pounds (18 Billion USD) on a computer system and ended up with....nothing to show for it!!!

sampo• 11 years ago

The Guardian in 2013: "Abandoned NHS IT system has cost £10bn so far"

http://www.theguardian.com/society/2013/sep/18/nhs-records-s...

taberiand• 11 years ago

On the other hand, sweet consulting gig if you can get it.

grrowl2• 11 years ago

This is the problem. The "if you can get it" translates to "if your company has a huge request-for-tender team dedicated to shmoozing your way into these kinds of contracts".

Add to it the whole tech-health ecosystem is scorched earth after countless clueless contractors have blown their way through it (earning the tens of millions of pounds and so on in the process), it's not a great environment for trust, innovation, or making your way through everything to a real-world-usable result.

engi_nerd7• 11 years ago

Most working professionals who aren't software developers suffer through this in some way or another. I mean, heck, let me count up all the passwords I need to do my job:

* A password for the account request system

* A password for the internal services system

* My email password

* My password for the local network

* My password for the product management system

* Pass for the old product management system that we still use

* Pass to the online drawing and document retrieval system

* Password to control room computer systems

* Various maintenance laptop user names and passwords

* Various passwords to systems I'd rather not mention, call them about 10 in total

That's 25 to 30 passwords, total, that I need to remember and use on a regular basis. I've given up NOT writing them down. And IT won't give me any kind of secure password manager, so I resort to a password protected Excel spreadsheet. And I'm not alone.

daveguy2• 11 years ago

Yikes. Sounds like it's time your company looked into a single sign on solution: https://en.wikipedia.org/wiki/List_of_single_sign-on_impleme...

Or at the very least you should sign up for a password storage system like https://passpack.com

engi_nerd7• 11 years ago

Single sign on solutions don't work when some of the systems you sign on to are air-gapped and will never, ever, EVER be connected to any network. Other networks I access are completely separated from the greater internet. It would be useful, but single sign on would take my 25-30 passwords and shrink it to about 15.

Which would be useful but would still require me to keep track of them manually.

spc476• 11 years ago

I have one password for the Corporation (email, VPN, various online databases, dashboards and wikis). I have another one just for requesting vacation time, because that system is run by the Corporation that owns the Corporation I work for.

Then there's the password for timecards (outsourced to another company), goal setting and training (outsource to another company), 401k, medical insurance and just because, another company (that isn't our medical insurance) for handling prescriptions.

Our Corporation has one password expiration timeframe (90 days but not really because they start nagging two weeks prior and won't shut up until you change the password) and the Corporation that owns The Corporation has another timeframe (60 days, but again, they start bitching about two weeks prior) and of course, all these sites have their own ideas about "secure passwords."

Weren't certificates supposed to deal with all this?

Wait ... don't answer that. I don't think I want to know the answer.

soneil• 11 years ago

You know what's better than single-signon? Two SSO systems! It's fantastic. Not only do you have to remember which backend each system uses, but it actually makes it harder to remember passwords for systems that don't use SSO.

Especially the ones that are used irregularly (annually, quarterly), so SSO isn't a priority.

My passwords are all on a whiteboard by my desk.

javajosh• 11 years ago

Might I at least suggest using an easy-to-execute algorithm that you can apply to your note to turn it into a real password? There are many options, from adding a prefix, a suffix, adding a small integer to every number, or some combination of these. This, I think, is about as secure as you can get since a targeted attack would just install a keylogger and be done.

engi_nerd7• 11 years ago

I have a couple of things I add to each password that I don't write down. I change those things every month. That's about the best I can do.

pdkl954• 11 years ago

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

Even with an algorithm, you're still relying on human memory. As Schneier and other have been recommending for a long time, write down your passwords. People already understand some amount of physical security, which is knowledge that can can utilized for password storage.

As long as human memory is the weakest link, password strength will always be de facto limited to the amount of entropy that a human can reasonably memorize. Unfortunately, brute-force password cracking capabilities flew past that limit a long time ago.

agumonkey• 11 years ago

A friend and I do this, but there's always a few website that will not fit your alphabet.

Ntrails2• 11 years ago

My last work sent around a cardboard triangle "stand" thing which was supposed to remind us all about how much we loved working there and how important such and such policies were. So my password was set as the first 3 letters of the first 3 lines (inc capitalisation) followed by a fairly standard & [incrementing number]. It was written down right next to my computer for the first two weeks whilst I learnt it and then every other password was just a derivation of it.

rabboRubble• 11 years ago

Why get your own password manager and include your work items?

I have 300+ personal passwords. 30 more for work would be a trivial addition.

engi_nerd7• 11 years ago

Then I'm carrying around sensitive work information on a device that I control. Sure, my password protected Excel spreadsheet isn't really protected, either, but if it gets compromised on my work machine, IT at work takes the heat, not me.

such_a_casual• 11 years ago

This is what happens when people create systems they don't have to use (software or otherwise).

baldfat2• 11 years ago

No this what happens when people create systems over things they don't have experience in nor understanding of how things work.

FLUX-YOU• 11 years ago

It's also just a lot of legacy stuff that no one wants to touch because it currently works and brings in money. Good design and practices compared to today just weren't around 10-15-20 years ago. Building a large and robust EHR and/or practice management solution from scratch using good techniques and design (and good security practices like, stupidly enough, parameterized queries instead of string concat) would be great if it wasn't astronomically expensive and risky from a business standpoint. Then by the time you were ready to hit the market you'd be five years behind or something.

Plus everyone will ask "Can you convert some other EHR's notes/data into your system's notes and vice versa?" and now you get to inherit all of that system's bad decisions in that area.

kendallpark5• 11 years ago

As a programmer in my first year of med school, I can only confirm the frustrations with medical software. As someone that gives a damn about usability/UI/UX, most (all?) EHR systems make me want to bang my head against a keyboard.

I honestly don't know how long I will be able to practice medicine before deciding that I can build something better (as foolhardy a notion as that is).

smt882• 11 years ago

before deciding that I can build something better

It's very likely that something better already exists. The reason you use something terrible is because "better" does not result in adoption. Personal relationships, salespeople, and marketers drive adoption, not the quality of the actual product.

kendallpark5• 11 years ago

Right, but if I have control over my practice, I also control what EHR I use. No idea if I'll end up in private practice, but there's always that possibility.

dustingetz• 11 years ago

https://en.wikipedia.org/wiki/Conway%27s_law

(You would end up with the same thing)

naveen99• 11 years ago

It's not that bad. You can get api access to a lot of things and automate your work to a large degree, particularly in radiology. Just not a lot of doctors know what to ask for and what is possible.

jaskerr• 11 years ago

If my doctors are anything to go by, you shouldn't worry too much. You'll be able to make your supporting nurses deal with the computer systems for you ...

Not that I'm advocating this as a good thing. I only report a pattern that I've seen across a number of offices. I can also report that the nurses hate the computer system as much as the doctors, probably more.

yeison• 11 years ago

Everything that Epic touches turns to dust.

bobbles• 11 years ago

I love how "mediocre software developers" are called out in the header, but then it goes on to list about 10 different people in different roles that are causing actual problems, all systematic, where a developer would make no difference whatsoever.

bagacrap• 11 years ago

I find it somewhat distasteful that a doctor would compare an obese patient to a whale while implying it's less worthwhile to treat them than other patients. It's not the job of medical professionals to pass moral judgment.

RightWingRabble• 11 years ago

I find it comforting that a surgeon would consider his field of top importance, especially since it's neurosurgery.

niels_olson2• 11 years ago

I find it distasteful that your tangential comment is upvoted in a presumably Chomsky-esque noone-is-accountable-for-the-consequence summary from which further discussion ensues.

As someone here whose primary job is not programming, the tendency for posts critical of programmers to have a discussion led by minimizers is quite obvious.

You are not the issue. The hordes of upvoters are the issue.

daveguy2• 11 years ago

The whole blog entry read like a tantrum. A comment on the site from "SuperMike" says this:

"Anyone with even a passing familiarity with the world of medicine will be amused by the surgeon being forced by circumstances to treat staff like actual human beings. (And he complains about it!)"

Sounds about right to me. IT issues can definitely be frustrating, but this blog reads like a libertarian rant.

chrismartin• 11 years ago

What if he were complaining about an influx of smokers with emphysema or alcoholics with liver cirrhosis? Doctors are justified in their frustration with the preventable burden that lifestyle diseases impose on their profession.

dbwest• 11 years ago

I see opportunity. Let's make this better.

LoSboccacc• 11 years ago

Hire redundant staff and organize shifts? His frustrated tantrum is wildly misdirected.

Anyway good luck with that. It's a job that comes with massive liabilities, unprecedented complexity and loads of political infighting.

bootload• 11 years ago

"... I envy the way in which the generation who trained me could relieve the intense stress of their work by losing their temper, at times quite outrageously, without fear of being had up for bullying and harassment. ..."

Toxic work environments in surgery are on notice in Australia: "Doctors must stand up to the ‘cowardice’ that is ignoring bullying" Victoria Atkinson, SMH ~ http://www.smh.com.au/comment/doctors-must-stand-up-to-the-c...

marshray3• 11 years ago

When I read the title I was thinking something different.

Torture is a real and a nightmarish thing, and in this ever shrinking world of ours, we (i.e., Westerners) can no longer think of such horrors as existing only for other people in faraway lands.

Am I the only one who's a bit uncomfortable tossing around the term to apply to a well paid professional who's facing bureaucratic inefficiencies at work?

Or am I just being a sensitive ninny-nanny?

JabavuAdams4• 11 years ago

Or am I just being a sensitive ninny-nanny?

Yes. Especially if you have to ask. Either make the case and stand behind it, or don't mention it.

mcphage• 11 years ago

Yes. Introspection and Self-Evaluation are for the weak.

grrowl2• 11 years ago

If someone is literally dying in your duty of care because noone can access any patient records, that sounds tortuous to me. A bit like the Stanford prison experiment, but replace the guards with IT contractors, and the prisoners with surgeons, doctors, and nurses.

marshray3• 11 years ago

Doctors, particularly trauma and tumor surgeons, have dying patients all the time.

Often there are additional treatments available but for resource constraints. Ordinary folk die of heart disease every day, but somehow Dick Cheney lives on with an artificial heart.

I know being a doctor can be quite a stressful job and requires a certain class of personality. But still it has gone with the territory of being a doctor since the beginning of civilization.

AstralStorm• 11 years ago

And the person responsible is not the guy without password, bit a coward who didn't push for 5x 9 SLA. Yes, this includes hard real life access time analysis. If failing to remember a silly password takes longer than k minutes, it should be a breach of contract. Likewise if total disruption due to password changes is too high. It's silly to implement a horde of govt rules while neglecting the basics.

colechristensen• 11 years ago

Hyperbole is a problem.

Or am I just being a sensitive ninny-nanny?

At least a little.

When we describe mundane things as extreme "I'm _starving_ the slow service at this restaurant is torture" or extreme things as mundane "enhanced interrogation techniques" we lose a little bit of our ability to correctly communicate and even experience the world.

Being in awe should be a rare and wonderful state, but instead it's apt to describe a free sandwich as awesome.

The problem: lazy people with poor vocabulary (and education) and bad journalism and editorial work.

downandout• 11 years ago

After reading the title, I too expected to find a peculiar story about a covert team made up of software developers and hospital bureaucrats kidnapping and torturing a brain surgeon (which would have been a fascinating article). Instead the "torture" here appears to be a complaint about password policies and paperwork...the word "torture" does seem to be overkill in this context.

jakejake2• 11 years ago

"I sat through a 3 hour meeting today and it was pure torture."

"I skipped breakfast today. I'm starving."

If you are truly uncomfortable with these sentences then it's possible that you are either a bit overly sensitive, or else you have trouble differentiating between literal statements and common english expressions.

JabavuAdams4• 11 years ago

Was at a party with a group of friends who are physicians, surgeons, and medical researchers. It struck me: we software types are so fucking arrogant. I was definitely not the smartest person in the room, and yet I could see IT and CS types mocking these people for their relative computer illiteracy. You know, the people who are actually saving lives every day instead of figuring out how to distract (er, engage) and bilk (er, monetize) people.

wingerlang• 11 years ago

Well computers are extremely common and used by them all multiple times a day, while no-one else does research or operate.

threatofrain• 11 years ago

There are a lot of people who mock others simply because they don't know a domain of knowledge. You can bet that doctors also mock those who don't successfully take care of their health, especially fat diabetics. Anecdotally, I think fat diabetics are the favorite humiliation punching bag for doctors.

Anyways, the issue that stuck out most saliently to me was the cultural expectation placed upon medical staff to work through any issue regardless of personal life, and what must be a tacit management understanding of the situation. Somebody in management screwed up, and now the doctor is left holding the bag, and this doctor unfortunately feels some responsibility to manage the situation. This doctor is frustrated that the anesthesiologist did not make the same sacrifice, and wanted to tend to family.

I don't blame either of them. Kudos to the doctor for holding the bag that management dropped, and congrats for the anesthesiologist who won't submit to exploitive cultural expectations.

aianus• 11 years ago

Speak for yourself. I don't know anyone in med school who would have cracked the top quartile in my math/CS courses.

Doctors aren't smart, they're just friendly keeners with something to prove to their helicopter parents.

Edit:

You know, the people who are actually saving lives every day instead of figuring out how to distract (er, engage) and bilk (er, monetize) people.

Very few doctors do anything of the sort. Most of them just charge you $100+ to tell you what you already knew and write you a scrip or a referral.

JabavuAdams4• 11 years ago

Doctors aren't smart, they're just friendly keeners with something to prove to their helicopter parents.

See, that's what I mean. I wasn't writing about the general population of doctors, I was writing about the specific doctors who were in the room with me, who you so arrogantly dismiss.

It's really an ugly and limiting mindset.

sopooneo• 11 years ago

All systems within a medical establishment should be forced to work with a single-sign-on system. That might sound like a lot of effort for a small improvement, but I believe it would be the single highest value change that could be made.

The assault on neurosurgeons’ privileges by software and bureaucrats

Related Stories