But the most disturbing part of the interview for me was watching Walter Isaacson, a former editor of TIME Magazine, talk about how Jobs was in complete denial about his cancer.

Rather than seek immediate modern cancer treatment once diagnosed, he turned to a holistic, macrobiotic approach. That approach delayed treatment 9 months.

Whether it may have been “too late” is hard to say after-the-fact. But if you delay any cancer treatment, the results are rarely good. In Steve Jobs’ case, they may have been untimely — and fatal.

The cancer that was to kill him was discovered accidentally when Steve Jobs was being seen for kidney stones back in 2004, according to the CBS News report. Once the doctors found the cancer and do a biopsy, they tell Jobs the good news, “This is good… this is one of those slow-growing, 5% of pancreatic cancers that can actually be cured.”

But Steve Jobs doesn’t get the cancer operated on right away.

“He tries to treat it with diets, he turns to spiritualists, he goes through various ways of doing it macrobiotically,” according to Isaacson. “And he doesn’t get an operation.”

“By the time they operate on him [9 months later], they notice it has spread to tissues around the pancreas.”

Steve Croft: “How could such a smart man do such a stupid thing?”

“You know, I think that he kinda thought that if you ignore something, that if you don’t want something to exist, you could have magical thinking. It had worked for him in the past.”

The worst part, for me, was that even though Steve Jobs continued seeking secret cancer treatments, he was telling everyone he had been cured, according to the CBS News interview. And that’s what people believed — including Apple stockholders — until 2008, when they saw how much weight he had lost at a public Apple event.

Jobs, in his role as a technology superstar, could’ve also taken on the role as a health advocate rockstar. Instead, for 7 years, he sought to constantly hide and downplay his health problems.

So while I admire his marketing and product management savvy (sorry, Jobs was never a technologist), I feel a little disappointed in the way he dealt with his own health concerns. Instead of talking about them openly and publicly — and helping others understand there’s nothing to fear about doing so — he felt like he was so “special” he was going to beat cancer with his magical thinking.

I admit there’s a delicate balance between celebrity and advocacy… But it seems like, if you’re a celebrity, you get to a point in your life where you can use your celebrity and its influence to actually help others in a very humanitarian and altruistic manner by simply acknowledging the plain facts and talking about your battle with cancer publicly. This is something e-Patient Dave does every year. It helps others understand and feel safer to acknowledge their own foibles, and seek out diagnosis, care and treatment.

We all know the sad ending to this story, and I find little joy in writing these words.

But I write them to remind every one of us — myself included — that we need to stop the magical, psychological thinking… That every one of us is somehow “special” and can beat cancer through positive thought alone. Positive thought is very beneficial and helpful in medical treatments. But it cannot — alone — beat cancer. It must be combined with the best medical treatments we have available.

Together — through mind and body — cancer can be beaten. Sadly, Steve Jobs did not understand this until it was too late. Hopefully someone out there reading about his story will be moved to not wait to get treatment.

In the CBS News interview, biographer Isaacson describes what Steve Jobs had as “pancreatic cancer.” MedPage Today contributor Michele Berman, MD begs to differ:

Steve Jobs most likely had an islet cell neuroendocrine tumor, a neoplasm that is considerably more rare than pancreatic adenocarcinoma, is usually detected earlier, and has a better prognosis and different treatment options, including liver transplant. Mr. Jobs’ liver transplant was performed about 17 months ago at Methodist University Hospital in Memphis because he was the sickest patient on the waiting list and had the highest MELD score (Model for End-Stage Liver Disease). Mr. Jobs subsequently urged everyone to become an organ donor.

To me, this is a bit like splitting hairs. I’m not sure what benefit there is diagnosing celebrities from afar when you do not have their medical records or histories in front of you. And yet, audaciously, Dr. Berman’s headline screams, “Steve Jobs Did Not Have ‘Pancreatic Cancer.” Unless Dr. Berman was his physician, she could not make such an outrageous claim.

If you’re attending the Connected Health Symposium in Boston this week, we invite you to share your ideas and enjoy a wine bottle service, hors d’oeuvres and cash bar at one of Boston’s finest luxury hotels. This is an opportunity for people who might be interested in becoming a member of the Society to become better acquainted with the Participatory community. We also encourage you to bring guests that would be interested in learning about the Society by talking with us one-on-one.

You must RSVP if you want to attend this reception to treasurer@participatorymedicine.org. (If you’ve already RSVP’d, no need to do so again.)

But I draw the line with bad reporting and worse, biased representation of the data to prove a point.

Case in point — the blood test for Alzheimer’s disease. The culprit — “Singularity Hub,” a website overseen by apparently a former hardware engineer at Google.

The piece in question is written by Peter Murray, who has a Ph.D. in neuroscience, and is entitled, Scientists Develop Blood Test To Detect Alzheimer’s Disease Before Patients Even Show Symptoms.

Based upon an initial study of just 273 subjects, the claim is that now Alzheimer’s can be diagnosed through a simple blood test. If you actually read the article all the way to the bottom, you’ll see the author finally note the limitations of the current study, “There’s still some ground to cover before the current test can be used in clinics, however. The announcement by Burnham and her colleagues is based on a single study.” Yes, indeed. Science isn’t science until it’s replicated by other, independent researchers with other subjects. That is Science 101.

But like much of the health reporting today, where every finding is labeled as a “breakthrough” or “important milestone,” consumers have no real context of where to put a study like this. Health reporters are supposed to help provide that context.

Beyond the lack of context, and the wide-eyed, unquestioning enthusiasm for the new study’s findings, Murray also suggests that blood tests are the only real way to determine a clinical diagnosis of things like Alzheimer’s disease, which is actually classified as a mental disorder. Notwithstanding the fact that mental disorders have been accurately diagnosed for decades now with objective diagnostic criteria through a simple interview.

The real tragedy of this article is the prominent graph in the middle of the article, “Changes in Selected Causes of Death, 2000-2008.” While technically accurate, it is not really the data you should be interested in:

Who cares about the specific numbers, when over nearly a decade, the population has also grown? People who don’t understand statistics will look at whole numbers of people like this and forget that in 2000, the population was 281 million, while in 2008 it was 305 million — an 8.5 percent increase. (Those 65 and older, however, have basically remained the same at about 13 percent of the population.)

What’s important when looking at population numbers over time is the death rate per 100,000. This will give you a static, comparable rate that you can use to compare population deaths at one point in time with population deaths at another point in time.

Why did the author not provide the proper statistical data in this article? Who knows, but this is what an excerpt of that data graph should look like had it been properly presented (I used 2009 data, since that is the most recent data available from the CDC):

That’s a pretty big difference, cutting the rise of Alzheimer’s disease more than half from the previous graph. Something that misrepresents data by more than half is a pretty serious journalistic gaffe.

You may notice the gains we’ve made against other common causes of death such as stroke and heart disease are significant over the past decade. You rarely hear about this sort of context in health news stories anywhere, but it’s a sign of significant progress.

You’ll also notice that something like HIV, which is not among the top 10 leading causes of death in the U.S., does not appear on the new graph. And there’s no reason to partition off different kinds of cancer into separate categories. Other common health problems we hear a lot about — like diabetes — also enjoyed a decline in the same time period (in diabetes’ case, it’s a 21% decrease).

I think it’s great when neuroscientists report on the latest research findings with a common disease like Alzheimer’s. I just hope they do in a way that represents the data accurately, and in a context that is unbiased and not a part of the disease-mongering that has become commonplace amongst mainstream journalism.

Skin Scan is a new iPhone app that purports to analyze your moles for evidence of malignancy — all in the application itself through its own proprietary algorithms. Just take a few photos over time, and it will analyze their patterns and growth for signs that the mole is or isn’t something to worry about.

With a couple of dermatologists on the company’s board, it seems like it could be an interesting and helpful app for those who want to track their mole growth. But, as the company reminds users, it is for “informational purposes only.”

Would you Take Medical Advice from An iPhone?

So hard, in fact, that it has given up and is shuttering its Google Health service, after just 3 years being open to the public.

Now’s a good time to review Google Health and why it may have never been the roaring success Google had hoped it would be. Perhaps this can act as a warning for future companies who think that (a) there’s a huge, pent-up demand for personal health records and (b) implementing them in a way that is engaging and helpful is easy.

Let’s start with Google’s statement about Google Health’s failure to capture any significant component of the electronic health record space:

In the coming months, we’re going to retire two products that didn’t catch on the way we would have hoped, but did serve as influential models: Google Health (retiring January 1, 2012; data available for download through January 1, 2013) and Google PowerMeter (retiring September 16, 2011). Both were based on the idea that with more and better information, people can make smarter choices, whether in regard to managing personal health and wellness, or saving money and conserving energy at home. While they didn’t scale as we had hoped, we believe they did highlight the importance of access to information in areas where it’s traditionally been difficult.

Of course, when you shut down a product, you have to put as a good a face on it as possible. It’s not a failure — it was a “influential model” for the entire industry! Despite have zero data to demonstrate that Google Health actually helped “people make smarter choices [about their health],” they promote the claim to make it seem like Google Health made a difference.

Objectively, it’s hard to exactly see what kind of difference — for better or worse — Google Health may have made. Since they’ve never publicized numbers of total or active users, it’s hard to gauge whether it had any impact whatsoever. But we know how it helped move the needle in at least better understanding the complexity and difficulties of medical and health data.

That’s because of our own e-Patient Dave, who took Google and his hospital up on the promise of Google Health. As he he detailed a year after Google Health launched, he had a difficult time using it with actual real-world data from his doctor. He had good reason to believe Google Health could help him gain better access to his health records, because that’s what the hype machine suggested:

When Google Health launched last May, my hospital’s CIO blog said “we have enhanced our hospital and ambulatory systems such that a patient, with their consent and control, can upload their BIDMC records to Google Health in a few keystrokes. There is no need to manually enter this health data into Google’s personal health record, unlike earlier PHRs from Dr. Koop, HealthCentral and Revolution Health.”

Sadly, it appears Google’s QA team never actually tried to do what they and their partners said was readily do-able with Google Health — use it to view and interact with their medical and health data.

When it launched to the public in 2008 (after being in development and private testing for two years), Marissa Mayer, who took over the Google Health initiative from Adam Bosworth, was very optimistic about the product’s potential and future:

Google Health, Ms. Mayer said, represents a “large ongoing initiative” by the company, which she said she hoped would eventually include “thousands of partners and millions of users.”

She had good reason to be optimistic. Because, after all, people already use Google to search for health information. Why not help them even more?

“If you look at health care, there’s already a huge user need, people are already using Google more than any other tool on the Web to find health information,” Mayer said. “And the health care industry generates a huge amount of information every year. It’s a natural core competency fo us, to understand how to organize all that data.” [...]

While the focus will be on improving health care and making records more accessible and portable for patients, Google will also improve life for physicians, Mayer noted.

“The goal for a lot of doctors is how many patients can they see in a day,” Mayer said. “That means their minutes per patient has got to go down, and the less time they have to spend finding and going over patient records the better. Ultimately we will design a product that’s useful for users, and also helps doctors do their job more quickly and more efficiently.”

Great ideas. But they never materialized into a product that either doctors or patients (or just ordinary people) could readily or easily use and master.

My own review of the initial release of Google Health demonstrated a product that left more than a little to be desired in lack of bringing anything much new to the table. No cool visualizations. No engaging game component. Nothing other than your manually-entered data (if you didn’t want the nightmare e-Patient Dave experienced) and some boring graphs. Combined with not being a HIPAA-covered entity, it may have been enough to sink expectations as the product’s updates were few and far between.

RIP Google Health; I’m not sure how “influential” you were, other than to act as a role model of how not to role out an online personal health record without significant real-world testing ahead of time. You were not a good idea ahead of its time; you were simply an idea tried many times before and coming up against the exact same problems of prior efforts — nobody is much interested in data for data’s sake.

The most interesting statement I found in this brief news article was, “The e-mail did not indicate why the company decided to terminate its PHR service. The company advised users to download their PHR as a .pdf file and save the document for their records.”

Ah, a PDF. Yes, that’ll make it extremely easy to get that data into some other PHR (sarcasm alert).

And that led me to understand the underlying problem with all PHRs today, and the problem PHRs have always had — nobody trusts the companies who offer them, and few people understand what they are or why they should care.

I kind of chuckle when I hear a company describe that a part of its business strategy is the personal health record. I first heard of a PHR back in 1999, when I worked for drkoop.com, at that time competing for the #1 spot as the leading consumer health website with WebMD (drkoop.com lost). Drkoop.com’s management had this brilliant idea that everybody would want — and pay for — a personal health record online. In fact, this was the founding principle of the company that eventually became drkoop.com (as seen in one of their SEC 10k filings from that time):

Our company was founded in July 1997 as Personal Medical Records, Inc. During 1997 our primary operating activities related to the development of software for Dr. Koop’s Personal Medical Record System.

To say that the idea of a personal health record (or personal medical record, as they called it) has been kicking around the Internet for a long time would be an understatement. (Drkoop.com dropped the idea altogether after a falling out with their PHR development partner, HealthMagic.)

But nobody pays much attention to history on the Internet. One of the most frustrating components of consulting for companies today is their inability and unwillingness to listen and to learn from the companies who’ve come before.

Had the folks who were running Revolution Health at the time really dug into the market for personal health records, they would’ve seen exactly what we’ve seen now for well over a decade — nobody’s clamoring for them. Nobody is going to their doctor and saying,

“Gee doc, if only I had some way where I could manually enter in all of this data and try and keep it updated on a regular basis, and ensure that the company I choose to enter all this data in with is (a) going to be around 5 years from now and (b) is going to allow me to export it in a way that is actually helpful, I would be so much happier and healthier!”

Of course, let’s assume that I’m wrong. Let’s assume the 2011 IDC Health Insights’ survey of 1,200 consumers done earlier this year showing only 7 percent of respondents ever having used a PHR, and less than half still using one — which is virtually unchanged from when they conducted the same survey 5 years ago. Let’s say consumers are chomping at the bit for this kind of personal tracking ability.

What will they find?

Poor quality systems that haven’t undergone real-world testing with real-world data. As we discussed back in April 2009, PHRs simply don’t work as intended with real-world data. If one of the largest companies in the technology world with some of the brightest engineering talent on Earth can’t get this right — Google Health, in this case — what hope do we have?

Well, it seems, not a whole lot.

A March 30 article over at eWeek describes how Google is unlikely to move forward with Google Health. Instead, it’s likely to be relegated to the backburner, along with all of its other failed experiments. Of course, Google won’t comment on this, and they never will. Every company trumpets to every media outlet possible when they release a product, but mum’s the word when it comes time to acknowledge the product was unsuccessful and they’re shutting it down (or worse, putting it into a static state with little future development).

This is exactly the lack of transparency and openness consumers are fed up with, and one of the primary reasons patients are leery of trusting their personal health data with a single company. You don’t know whether it’s going to go under, sell your health data (even in aggregate form), or simply decide to quietly stop supporting its service in any meaningful way (without actually shutting it down). You may get your data out, but it may only be as a PDF. Today, there are still no widely-implemented standards for sharing health data records (although that is changing, slowly).

There are some notable exceptions, which I should call out here so that we can end on a positive note. PatientsLikeMe.com — which just opened up to everyone for any health condition — is quite transparent about what they do with your data. They aggregate it, they sell it, that’s how they make their money. And apparently it’s working, since they’ve been around now for many years.

Electronic medical records, like Microsoft’s HealthVault, are also a different animal, because they have tended to focus on addressing more of the needs of the provider, health care systems and hospitals, rather than just consumers. Paying attention to both sides of the equation — how data enters the system and how data gets out — is so important, yet something a lot of products in this space underestimate or pay nothing but lip service to.

I think it’s time to finally put the idea of a global personal health record to bed, permanently. We already have lots of individual personal health records floating around out there, tied directly to our personal health interests. And while it would be nice and more convenient to have them all somehow communicate with one another, companies who own all these individual records seem reluctant to explore the possibilities of enabling such communication. There are a lot of reasons — some valid, some not — for this reluctance.

Perhaps this will change in a more open and transparent future. But I won’t be holding my breath.

Also check out Denise Amrich RN’s article on the Google Health rumor mill, Have rumors of Google Health’s death been greatly exaggerated?

Except that these drives contained patient data records of nearly 1.9 million people. What good is encrypted online transmission when things like this still happen?

Managed health care provider Health Net said this week that “several” server drives managed by IBM had gone missing, putting possibly 1.9 million records containing the personal information of its customer base at risk.

Health Net did not say how many records may be at risk, although the company says it administers records to 6 million individuals. Data including Social Security numbers, names and addresses, and other personal information are at risk.

On Monday, Health Net said that “several” drives had gone missing from a server or servers operated by IBM, its partner, for a data center in Rancho Cordova, Calif. However, the California Department of Managed Health Care said that nine of Health Net’s server drives containing personal information for 1.9 million current and past enrollees nationwide are missing, including records for more than 622,000 enrollees in Health Net products regulated by the DMHC, more than 223,000 enrolled in California Department of Insurance products, and a number enrolled in Medicare.

The article was moot on perhaps the most important question — was patient data encrypted on these drives? The way they were talking about offering 2 years’ free data monitoring services suggests the worse possible scenario, that all of this patient data was being stored unencrypted on these drives.

Hey, I’m all for electronic records. But let’s get the basics right, too — such as proper, secure handling of all the hardware that actually holds all of our virtual bits. And encrypting the data on these kinds of drives seems like Security 101.

Read the full article: Health Net, IBM Lose Drives with Stored Customer Records

Houston Neal makes the case again over at The Medical Blog, suggesting that because doctors aren’t engaging in social media as much as the ordinary person, they’re actually holding back the improvement of healthcare.

That’s quite a statement (and of course, one not backed up by any data, but it sure sounds good!).

So let’s look at his argument…

“Social media is about more than the relationships between individuals. It’s about the dissemination of information. Information that can improve health care and save lives.”

Yes and no. Social media is primarily about enabling relationships between people to allow for greater sharing of information. However, it is not primarily about the sharing of information itself (which the old web has been doing just fine for the past 16 years).

Sure, it might be nice to “follow” your doctor’s link-sharing on one of these services. But it’s a false dilemma argument to suggest that because your doctor isn’t doing this, it is somehow preventing empowered patients to go online and find the information themselves (which is what most of us do anyways). After all, doctors and psychologists don’t go to medical or graduate school to become glorified link curators, do they?

Neal suggests doctors would be a more reliable source of health information than the web as a whole. They could act as a “quality filter” by sharing more links that they find valuable through social media. But who’s vetting the doctors’ choices? Aren’t they also a part of that group of people — most of us — who don’t verify the reliability of the source of health information online? I couldn’t find a study that has actually looked at this question, so the answer for now is, “We don’t know.”

Neal goes on to make the argument that not only is it potentially beneficial (I use the word “potentially,” because, again, we have no actual data to demonstrate it is or isn’t), but it is an actual obligation of a doctor to do so. Obligation.

“To reduce the amount of flawed information online, doctors need to share reliable resources, address misleading claims, and most of all, help patients understand the issues accurately. Twitter, Tumblr, blogs and the like are perfect channels for this. In the case of the vaccine-autism link, we could mitigate the false information in search results if more doctors used social media to engage with their patients on the issues that concern them.”

I can see it now… “Sorry Ms. Harris, I’m going to have to make you wait in the exam room another 5 minutes while I Tweet about this link.” Because social media isn’t about a one-way information stream — it’s about engaging in an authentic, two-way dialogue with others. If doctors are to start engaging in social media en masse, they must do so in an authentic and very real way. Not just by sharing links, but by engaging in the discussion back and forth with others.

And here’s where the major problems come in. Because social media is so often linked to people’s real-world identity nowadays, it’s virtually impossible to protect a person’s identity if they are going to engage with you. Because patients don’t know what the rules, regulations and laws are about patient safety, confidentiality and privacy, guess who’s ultimately responsible — the doctor.

Neal addresses this primary issue in a paragraph right at the end of the article, suggesting the concerns are “overstated” (again, without evidence) and that they are readily addressed through even more regulations, guidelines and rules by the government or healthcare organizations (like hospitals… but would a hospital defend you in a lawsuit involving something violating patient confidentiality that you tweeted?).

Furthermore, how does that solve the problem of a patient over-sharing with their doctor through social media? Because once a tweet or comment is out there, you can’t really take it back. (Sure, you can delete it, but it’s already been cached and saved in one of the dozens of databases that save every Tweet made, as it’s made.)

So not only would he encourage doctors to engage more in social media, but to do so while trying to follow yet even more rules and guidelines, and be the one responsible even if it’s the patient who breaks confidentiality and privacy rules?

That and the fact that most doctors I know already feel over-worked most days. It’s not so much a payment issue as it is a time issue — doctors just don’t feel like they have a lot of free time. (Neal addresses the payment issue only in regards to individual patient encounters; he doesn’t address the whole “information sharing” aspect Neal was talking about earlier in the article, specifically mentioning the autism-vaccine example.) It’s about finding a balance between a work life, a home life, and a social life. Adding more things into the “work” category can’t be done easily without taking something else out of one of those categories — it’s that simple.

While many people can get away tweeting all day from their workplace, it’s not exactly conducive for a surgeon to do so from the operating room, or for a doctor to do so while working on notes. Social media encourages inattention — something you really don’t want to reinforce or reward a doctor to do. I want my doctor solidly focused on his work, my chart and my data — not my tweets.

Don’t get me wrong – I’m all for doctors tweeting and engaging more in social media. But I think it’s a weak argument to argue it is some sort of “obligation” of doctors to do so, or that it’s going to result in a massive public health difference in America. Social media brings a lot of potential benefits as well as pitfalls to the individual doctor-patient relationship, and these can’t be glossed over with the addition of some more rules or guidelines for doctors to follow.

A doctor’s involvement in social media must be a cautious and considered decision, weighing one’s own personal comfort level with different amounts of risk. Because for doctors and therapists, social media does bring more risk that it does for the average individual.

Read the full blog entry: Social Media Can Improve Healthcare, But Are Doctors Holding Us Back?

Caremark called her this morning. The conversation went something like this…

Caremark: “Hi, this is ****** from Caremark. I’m calling about a recent order. Can I get you to verify your name, date of birth and mailing address?”

Ms. S: “I’m sorry, but how do I know you’re from Caremark? You called me.”

Caremark: “I understand that, but I need to verify this information with you before I can tell you what I’m calling about.”

Ms. S: “You called me. I don’t know if you’re Caremark or someone phishing for account information from me. Why you don’t you tell me the information you have, and I’ll verify it’s correct.”

Caremark: “Sorry, due to HIPAA regulations, I can’t do that in order to protect patient privacy.”

Apparently Caremark is completely unaware that calling someone out of the blue and asking them to “confirm” publicly-accessible personally identifiable information is really not a legitimate way to operate. It violates the common wisdom that any security expert will tell you about identity theft — never give out personally identifiable information on the telephone or in email if you can’t confirm the identity of the person asking for it.

How did this pass Caremark’s best practices group? Is this any way to run a company in the business of dealing with sensitive health data and patient records?? Asking people to violate the cardinal rule of keeping your personal information private.

Nonetheless, apparently needing to meet their hourly customer service quota, the Caremark customer service representative proceeded to tell Ms. S what he was calling about anyway — even though he had no idea who he was actually talking to.

Caremark: “So anyway, the reason I’m calling is that we see you have a refill pending with us, but we need you to pay the balance on this account before we can process your refill.”

Ms. S: “Yes, I tried paying this online, but it wouldn’t let me. It said the order was ‘in process’ or something like that, and I couldn’t pay it online. ”

Caremark: “Well, I’d be happy to accept your credit card information on the phone right now so we can take care of this matter.”

Ms. S: “Again, for the third time, I don’t know who this is. Do you honestly expect me to give out my credit card information just because someone calls me and says they’re with a company I do business with?”

Caremark: “I’m sorry you feel that way. We can’t process your order until we receive payment.”

At this point, from the tone of his voice, the Caremark representative was apparently annoyed Ms. S. told me while relating the story. She saw he didn’t really understand the issue at hand, and probably wouldn’t get any further by trying to point out the problems in asking people for information like this when they initiate the phone call.

Ms. S: “I understand that. Maybe you should upgrade your website to let it accept payments even when an order is ‘in process.’ Anyways, I’ll call the customer service line at my convenience or send you a check.”

Caremark: “Okay. Thank you.”

Ms. S: “Goodbye.”

What an unsettling phone call. They “understand” HIPAA, but apparently don’t understand personal security best practices.

Good Security Practices for Personal Information

Conversations like the above should never occur with a company entrusted with our health data and personal information. It demonstrates a complete lack of understanding of social engineering and the phishing attacks that most people receive every day — because it is a perfect example of a good social engineering attack. If someone wanted to, they could make 100 similar phone calls and I’m certain gain credit card information from at least one or two of those individuals. Without ever having to offer some sort of confirmation that they were indeed Caremark.

Caremark should change these customer service practices immediately. They entice people to provide personally-identifiable information without knowing who they are talking to. Worse, they encourage customers to also provide a stranger with their credit card information over the telephone to someone who called them.

Customers should never reveal any personally identifiable information to anyone who contacts them by telephone or email. Even if that information is correct, all it demonstrates is someone who is (a) either legitimate or (b) has searched public records (e.g., did their homework) in order to perpetuate the scam. And of course, it goes without saying, never give your credit card information to an individual who contacts you via the telephone or email. If you want to take the person up on their offer, call the customer service telephone number listed on a recent bill. That way you can be sure.

That world is here. Well, not right here, but up north in Canada.

Yes, a Canadian insurance company decided to keep tabs on a woman it was paying sick leave benefits to, and lo and behold, that woman was having — wait for it — fun!

Nathalie Blanchard, a 29-year-old IBM employee from Quebec, took a long-term sick leave from her job after being diagnosed with major depression. Her doctor told her to try & have fun, and to take a sunny vacation to get away from her problems. She did just that while she received monthly sick-leave benefits from Manulife.

And she posted her vacation photos on her private Facebook profile. But recently, the monthly payments stopped.

Why? Because Manulife, her insurance company, found the photos and made the medical diagnosis — from a photo, mind you — that she no longer suffered from major depression. From a photo.

After all, if you’re having fun, there’s no way you could still have clinical depression, right? I mean, depressed people aren’t allowed on vacation. They can’t go to parties. And last time I saw one dancing, it must’ve been what, 20 years ago?

The insurance company not only has shot itself in the foot by acknowledging that it spies on its customers through any means possible — including their online social media profiles — but in also the thoughtless, stigmatizing way it treats people with a mental health concern, as second class citizens.

Depressed people can’t have moments of joy? Depressed people can’t have a fun day, but still get home and feel the weight of their major depression weighing down on them? Depressed people can’t dance?

Ignorance + Stigma = Ridiculous.

So while this serves as a warning to anyone who thinks that what they post to Facebook, Myspace, or Twitter is harmless or innocuous — think again. It can and will be used against you to deny you coverage and services. It will be used against you to deny you future employment, or insurance (or insurance will be offered to you at much higher rates). Companies like Manulife will continue to get away with this sort of behavior as long as they have customers.

Read the full story: Woman Loses Sick-Leave Benefits for Depression Thanks to Facebook Pics

“If only we had everyone on an electronic medical record, all of our security and privacy issues would be solved!”

Really?

Perhaps I should introduce you to a little something psychologists like to call “human behavior.” Human behavior will always trump technology when it comes to finding a way to undo everything well-meaning EHRs, EMRs, and PHRs try to implement.

Case in point: Scott Graham. He sent an ex-girlfriend a spyware program he was hoping she’d install on her home computer so he could spy on her. (This is surprisingly more common than you might imagine.) Instead, she opened it on a computer in the hospital’s pediatric cardiac surgery department. The spyware was happy to install itself on that hospital computer and start doing its job — spying on whoever used the computer for whatever purposes they used it. In this case, hospital work.

Guess what Graham discovered?

Between March 19 and March 28 the spyware sent more than 1,000 screen captures to Graham via e-mail.

They included details of medical procedures, diagnostic notes and other confidential information relating to 62 hospital patients.

He was also able to obtain e-mail and financial records of four other hospital employees as well, the plea agreement states.

So implement the most secure, confidential and private medical records you can. But don’t forget to lock down the Internet from any computer that can display such records. Or at least ensure your firewall is set to block everything first, and only allow specifically whitelisted programs through.

Any hospital IT administrator that is not using a whitelist-only procedure (e.g., using blacklists or no list at all) should seriously reconsider that decision, even if it means going toe to toe with the hospital’s CEO or board of directors.

Because while it may be a pain or inconvenience for hospital employees not to be able to run any computer program they wish on the hospital’s computers, this is a prime example of why allowing such access betrays every effort to secure sensitive medical information. An electronic medical record is only as good as the computer and network it’s running on. And if that computer and network aren’t secured from start to finish, it doesn’t matter how “secure” or “standards-compliant” your electronic medical record is — you may just as well post it on a bulletin board at the supermarket.

The only solution to the human behavior problem is to acknowledge you’ll never be able to control it. You can’t expect 100% of your employees to follow 100% of your guidelines and restrictions 100% of the time. Instead, you need to ensure checks are in place to prevent employees — even well-meaning ones — from doing something that could jeopardize not only their computer, but the entire hospital’s network and all of the patient medical records.

Read the full article: Misdirected spyware infects Ohio hospital

If the future of healthcare is electronic, someone in the IT department needs to ensure the computers providing these services are protected from simple things like electric surges. I think it’s called a “surge protector” and Wal-Mart sells them for $10.

Now sure, this was an isolated incident and the hospital was back up and running a few hours later. But still, it makes one wonder… If we can’t get something as simple as this right, how much luck are we going to have with the future of healthcare in the hands of people who can’t see the forest through the trees. Because no matter how unwieldy paper records are, they are there, even in the worst emergencies possible.

The reality, as recounted here first on April 1 by our own e-Patient Dave, shows otherwise. The emperor has no clothes, and it apparently took a single real patient to try it out to show how such a seemingly simple idea — pulling in medical data from your medical records to help you track your health — is really far more complex than even Google realized.

But the fun really started watching the media coverage unfold once The Boston Globe published this article about e-Patient Dave’s experience with Google Health and his attempt to import data from his hospital’s electronic medical record.

The first person to hit the spin cycle was none other than John D. Halamka MD, Chief Information Officer (CIO) of Beth Israel. He’s the guy responsible for helping implement the Google Health PHR connection from the hospital side of things (Dave’s hospital, that held his electronic medical records, the Beth Israel Deaconess Medical Center (BIDMC)). He strangely suggested:

[The problem the article described] is really unrelated to Google, Microsoft, or any Personal Health Record (PHR) provider.

Well, okay, except that it is directly related to those providers and BIDMC insomuch as it affects what the patient sees in Google Health. You really have to ask yourself who did the quality control on this product from either side of the fence — Google Health or the hospital — before saying, “Yup, this baby is good to go!” It’s not like it’s any great secret that insurance billing codes rarely match medical procedures or diagnoses. Anyone who has worked in healthcare for more than a week gets up to speed on that issue very quickly. So why would anyone think sending billing codes as bits of useful and accurate data is a good idea? And how, in any universe other than this one, would the two be “unrelated”?

But it’s okay. Dr. Halamka (who really is more on top of these things than most hospital CIOs) assures us the fix is in. You just might have to wait a decade or more before you see useful results, because all of the procedures and languages hospitals currently use to describe things in electronic medical records aren’t changing any time soon. Meanwhile, his blog entry mentions other ways they’ll try and fix things to make Google Health actually usable from a medical records perspective. To have Halamka respond so quickly and transparently to the problem is nothing short of revolutionary — if healthcare IT is going to change, it may very well be because of people like Dr. Halamka.

Next up, you have good old iHealthBeat, a California Healthcare Foundation electronic publication targeted at those interested in “technology’s impact on health care.” You’d think any mention of The Boston Globe article or this serious issue might at least mention in passing who discovered the flaws in this data exchange system between Google Health and BIDMC. Most of this “article” is simply a quick rewrite of the Globe article, taking entire sentences from the original article and publishing it as though it were original reporting. However, unlike the Globe article, the spin is definitely on the technology and physicians, with no mention of how the flaw was discovered — not by a CIO or Google Health, but by a lowly patient trying to use the tools provided him. You might think that would garner at least one sentence.

At least eWeek is up-front that it’s taking its quotes and article sourcing directly from The Boston Globe, in their article entitled Google Health Accused of Inaccuracy in Electronic Medical Records. I’m not sure the headline is correct or accurate though, as nobody accused anyone of anything. e-Patient Dave simply described the problems he had in importing his hospital data into Google Health. That’s hardly an “accusation.” And at least they credit him with finding the problem in the first place. In the European edition of eWeek, the article morphs into Doctors Criticise Google Health Data. If anyone was criticizing Google Health data, it was the patient who was trying to actually use his PHR as intended.

The Industry Standard also sources The Boston Globe’s article, and credits Dave deBronkart’s experiences up-front. This blog entry focuses on what a patient can do to find and correct such mistakes, quoting Halamka about reviewing your hospital’s medical record on you to ensure it’s accurate. Unfortunately what is not mentioned is that for most patients, such a review would be next to useless (unless you have a degree in medical information science). Medical records weren’t made to be reviewed by patients, and so browsing through it would be as useful to most of us as browsing through a 14th century Latin text.

Dr. Jay Parkinson writes over at The Business Insider, Google Health Will Belly Flop (GOOG). The full entry is well worth a read, but here’s a key quote:

Here’s the problem. Each and every piece of multi, multi-million dollar bloated piece of crap healthcare “electronic medical record” (sounds about as dated as electronic mail, doesn’t it?”), is simply a billing engine to communicate a medical diagnosis to insurance companies with the hopes of maximizing how much doctors are paid. Each diagnosis and procedure has these numerical codes. They are a ridiculously robust antiquated language, like the code written to power the Commodore 64. There are people who speak this language – the 100 or so medical billers who are holed up in the basement of every hospital. They are the people you never see when you visit the hospital, but they’re the ones speaking the language that maximizes how much your hospital gets from your insurance company.

And now Google wants you to have access to this coded language that you, nor your doctors, speak. The assumption is that this will empower consumers and drive advertising revenue to Google based on these medical codes. And then you log in to Google Health and see a language that’s impossible to interpret and, most of the time, simply inaccurate. But these are your medical records found in one of the highest ranking hospitals in America.

He suggests Google should just give up on Google Health while it’s ahead (and maybe Steve Case who tried to foment a revolution in health care with his Revolution Health might agree). I do agree that anyone who tries to whitewash the extent and complexity of the problem or suggests it might be easily solved is living in a dream world. Dr. Parkinson hits it out of the park with his observations on this one.

There are a few other media mentions of the piece, and I’m sure more will be on the way. At the end of the day, I think Dave’s experience demonstrated that this piece of the Google Health really wasn’t ready for primetime, and hospitals shouldn’t have gone along with them and agreed to allow the import of their data into Google Health. As I said earlier, how a hospital electronic medical record works is no mystery to the management who lives and breathes these records every day of the week. How anyone imagined this was going to result in useful, beneficial and most of all, accurate health data for patients to see and use is beyond me.

For instance, I once thought I knew what “information therapy” meant. It meant a doctor or other healthcare professional “prescribed” certain information for you to read, so you could learn about your health or mental health condition. Before the Internet, therapists called this bibliotherapy, as it usually referred to reading a certain book on depression, anxiety or the like. “Information therapy” is a fine term and all (it must be, since there’s an entire nonprofit devoted to it), but a recent blog entry over at The Health Care Blog has made me rethink whether it brings any value to the conversation.

Words must mean something unique, or else they lose all value. Look at the way Facebook and other social networks have co-opted the ordinary-looking word, “friend.” Prior to 2000, a friend was someone you knew and trusted and nearly always someone you actually knew at one time face-to-face. With its co-opted use on social networks, a “friend” now means nothing. It means someone who may have some sort of nebulous connection to you — either an acquaintance, a business associated, or even a complete stranger. It might mean your best friend, or it might mean someone you once talked to at a conference. It might mean you know them presently, or it might mean you haven’t spoken to them (even online) for 10 years. Most social networks today don’t clearly delineate the nature of the relationship and its current status.

So when I read an entry entitled, “The Great Debates,” I suspect there’ll be a lot of intelligent discussion focused around how two different philosophies and approaches might be in conflict (and how to resolve such conflict as it arises).

But when reading the definition of what “information therapy” now is in our ever-connected, 24/7 world, I find myself scratching my head:

However, while both Health 2.0 and Ix are focused on improving patients’ participation in care, they tend to come from different backgrounds. Ix tends to be “prescribed” to the patient, often by a clinician (although system-triggered Ix and consumer-prescribed — either “self-prescribed” or recommended by a peer, caregiver, etc. is also part of the definition).

Once you go down the road of “self-prescribed information therapy,” we already have another word for that — it’s called “learning” and people have been doing it for centuries on their own. Indeed, one could argue that that is one of the core strengths of the Internet (and resources like Wikipedia) — it is the world’s largest learning vehicle. Want to become knowledgeable about fly fishing? Within two hours you can find and learn everything you ever wanted to know about fly fishing.

It gets even worse when we consider the ever-changing definition of “Health 2.0.” At one time, I believed it to mean specifically Web 2.0 tools (like blogging or condition tracking) that empowered patients. PatientsLikeMe.com, for instance, is a perfect example of a “Health 2.0″ site. But apparently it’s larger than that:

Health 2.0 had its start with non-health care organizations delivering content, communities and tools to consumers online—often in the absence of the health care system paying much attention. Thousands of communities about every conceivable health condition exist online, hundreds of sophisticated tools have been developed for consumers and clinicians to use, and now the ability to create and store patient data online is becoming much more prevalent.

Well, gosh, those thousands of communities have been online beginning in the 1980s, pre-Web, and certainly pre-Health 2.0. Does that make every patient community a “Health 2.0″ offering? Good news for ACOR, then, as they can now claim they were at the forefront of the Health 2.0 movement in the 1990s!

And Health 2.0 seems to now be about personal health records, too, something drkoop.com tried doing in 1999. It didn’t work then, and it’s not really showing much signs of life today either. As e-Patient Dave can tell you, the personal health record tools available today — and their connections to the electronic medical record — leave a lot to be desired.

I should know about this stuff, as I created some of the first patient tools on the Internet in the form of depression screening quizzes that allowed you to determine your depressive mood (and track it over time) in 1996. Yes, thirteen years ago we had patient empowerment tools online. We still call them what they actually are — screening tools and trackers.

I have no problem with new terms being invented to co-opt existing behaviors and ways of interacting online. But when “information therapy” morphs into simply learning and “Health 2.0″ describes patient empowered communities that have been around for decades, it does start making me wonder whether these terms actually have much meaning behind them. And whether anything can be characterized as a “great debate” when the distance between the two sides seems almost non-existent (except perhaps on some technical or technicality level).

I think it’s great to encourage physicians and other health care and mental health professionals to “prescribe” information to their patients. Every professional should feel comfortable prescribing information to patients who need it, because as the Pew Internet & American Life Project tells us, patients are often seeking out the professional opinion of those they already trust. (Why turn to WebMD when you already have a doctor you know, respect and trust?) Not every patient will have the resources, skills or ability to become as “empowered” as some of us might like. And even an empowered patient needs a starting point — why not with a doc?

But let’s try and keep our terms and definitions more clear and concise, so everything doesn’t just morph into one big thing, which can mean anything to anyone who happens to be giving a talk on the subject. Words must mean something. Consumers don’t “prescribe” information to one another — they share their stories, recommendations, and experiences. To jam this set of behaviors into the information therapy model and call it “self-prescription” seems to me to be reaching. It confuses the model and the philosophy, and brings muddiness to what used to be a pretty clear concept.

Read the full entry: Health 2.0 Meets Ix–The Great Debates

The most common obstacle to conversion cited by the surveyed hospitals was cost — $20 million for small hospitals to $200 million for large academic centers. About three-quarters of hospitals without a computerized system said lack of capital was a barrier, 44 percent cited maintenance costs and 36 percent cited doctor resistance, according to the survey of 2,952 mostly small and medium U.S. hospitals conducted last year.

For smaller physician offices (like a single physician or small group practice), costs start at $50,000 and can easily balloon to $200,000 without breaking a sweat. This isn’t easy stuff, and unless someone starts writing large checks to these folks, you won’t see any quick adoption of electronic medical records soon. It’s an expensive and time-consuming quagmire, not a cure-all, and “solutions” like Microsoft’s HealthVault are really just a part of a complex equation that virtually everyone under-estimates.

So while some folks continue to extol the virtues of these technologies as though they are inevitable and a cure-all, they remain a tiny, tiny percentage of what most hospitals and providers offer. And for good reason, because as the article notes:

But a third of hospitals surveyed said they were unsure whether they would recoup their investment. And the Congressional Budget Office last year said the adoption of more health technology alone is “generally not sufficient to produce significant cost savings.”

We know such record keeping can help reduce documentation errors (and as a result, medical errors), but as of now, the jury is still very much out as to how quickly such record keeping systems can be implemented to help e-patients.

Read the full article: Study: Few US hospitals use digital records

With the rise of social networking in health, the inevitable questions arise about patient’s data and privacy. But such networks also allow for aggregating data which can help people spot trends and changes in their own health. This discussion panel will discuss the pros and cons of such networking tools.

This conversation couldn’t be more timely, with Google’s recent data leak just the latest in a long history of companies being unable to keep private data they promised they would. Questions to ask yourself — With Twitter and Facebook becoming so prevalent, does privacy even matter anymore? Should I be more or less concerned about the privacy of my health records? What about my mental health records? Should I just trust the big companies and the hospitals and put it all out there? Or is there some better way nobody’s yet thought of?

Room 5B

Sunday, March 15th

11:30 am – 12:30 pm

http://sxsw.com/interactive/talks/core_conversations?action=show&id=IAP0900058

Hope to see you there!