Wednesday, November 12, 2008

Your Data becomes their Data becomes Extortion Attempt

Sat Nov 08 15:47:00 -0800 2008
manage

Another example of databases gone lacking for security. This one involves a prescription writing service that some badguys are trying to extort money from. They threaten to disclose personal customer data unless the company pays up, which they haven't, they have taken it to the feds instead.

St. Louis-based Express Scripts said Thursday that in early October it received a letter that included the names, birth dates, Social Security numbers and, in some cases, prescription data on 75 of its customers. The authors threatened to expose millions of consumer records if the company declined to pay up, Express Scripts said in a statement. ed.z.: Here's a thought..stop giving your social security number out to every dipsquat corporation that asks for it. I say no all the time, just slap refuse. They put up a stink, I say, "give me a written and signed by some officer here indemnification guarantee, that if you lose my data or it is stolen, I am paid x-amount of serious dollars" along those lines. That's *my* data, it ain't *your* data just because you happen to own a hard drive and want something to stick on there because I am hiring you for some service or you are selling me something. Because inevitably the first thing out of their pieholes is how they are "secure" and blah blah and it is their "policy" and nonsense blah blah. Demand they prove that statement with a written indemnification policy, just turn it around on them, talk is cheap, written contracts are what matter.

Every single dad burn company out there claims they are "secure". Uh huh, that's a lot of truthiness..not. Go by a default every single one of them is already compromised, then see how you feel about handing over *your* data that somehow magically becomes *their* data to be lost, stolen, traded, used and abused.

We see these security compromises all the time, and it wouldn't amount to much at all if people stopped handing over everything they are asked for and stuck to their guns past the initial shock period of saying "no" to the clerk/receptionist and they don't know what to do then. Deer in th headlights time when yoiu say no, so you have to nudge them a little, use your best Bene Geserit action. Just be polite, say that "I'm sorry, this isn't necessary, and.." whatever, wing it. (and in a lot of cases it isn't even a legal requirement for the service or product you are trying to get, check with your bartender or barber for more exact legal advice in your jurisdiction..or at least google it) because Social Security is for employment and taxing purposes, and bank account records because they are required by uncah sam, and that's about it. If they squawk, get their manager, or ask to speak to the company lawyer, and demand to see their data security breach indemnification policy. Boy, that gets 'em. Shuts 'em right the heck up, because it don't exist, not as regards YOU anyway, it might exist for some dotgov agency, but that means absolutely nothing to YOU the potential victim. Worked for me any number of times since I started that policy of saying no. I got nailed with ID theft years ago-pre being on the internet at all- and it was a serious PITA getting it cleared up, some of it never was really. Sucks. Since then, I got a new attitude of saying "no" because they will hang you out to dry if they get compromised. And I am unaware of any medical procedure or drug that requires your age down to the exact day for that matter, the nearest year once you are an adult is sufficient.

If you don't care about your data integrity, imagine how much less some other person/corporation cares when you are just some big number in an even larger set of numbers. Oh, they may or may not even inform you if they get pwned, how quaint. Didja catch that little bit in the article about how some "financial services" are paying off the extortionists now? Security is always in layers, and it starts with you.

Tuesday, November 4, 2008

indystar.com

November 2, 2008

Union Yes?

Pharmacists fill prescriptions, educate patients and sometimes carry union cards. How might that play out in Boone County?

By John Russell
john.russell@indystar.com

With their white coats and six-figure salaries, pharmacists might seem like an unlikely group of card-carrying union members.

But around the country, 15,000 pharmacists, or about 6 percent of the U.S. total, belong to the Steelworkers, Teamsters and other unions, joining ranks with blue- collar workers who smelt aluminum, build tires and drive beer trucks.

Most of the unionized pharmacists work in big industrial markets such as Pittsburgh and Chicago, along with smaller cities, such as Tampa, Fla., and Gary, Ind. No union pharmacists work in Central Indiana, according to the Indiana Pharmacists Alliance, a statewide trade group.

But that could change.

The United Steelworkers union is keeping a close eye on a massive mail-order pharmacy springing up in Boone County. The $150 million distribution center, being built by Medco Health Systems, will cover an area the size of six football fields when it opens next year. It eventually will employ 1,300 people, including hundreds of pharmacists and pharmacy technicians who may need help negotiating contracts and addressing grievances.

"We do represent other Medco pharmacies, and we would seek to address representation issues with Medco at that new facility," said Maria Somma, international organizing coordinator with the Steelworkers' Health Care Workers Council in Pittsburgh.

The Steelworkers union represents more than 5,500 Medco workers, including pharmacists in Florida, Texas and Pennsylvania and pharmacy support workers in Nevada, New Jersey and Ohio.

The union, better known for organizing workers at steel mills, said it has represented health-care workers for more than 50 years, including hourly workers in hospitals, pharmacies, mental health centers, drug factories and medical offices.

But following the loss of tens of thousands of steel jobs as one massive mill after another has closed, the union is pushing aggressively to expand its reach in health care.

It's too early to say whether the union will find a receptive ear with pharmacists here, or whether it will face stiff resistance from Medco, the nation's largest mail-order pharmacy. The company said employees are free to join unions if they wish, following the established legal procedure. "Medco values all of its employees, regardless of their union representation status," spokeswoman Ann Smith said.

But the union and company have a rocky past. Two years ago, Medco locked out more than 500 pharmacy tech workers at its Las Vegas mail-order center in a bargaining dispute, replacing them with uncertified temporary workers. During that time, the union called for the Nevada Board of Pharmacy to investigate the company's practices and suspend its license. The two sides settled their differences a few weeks later.

So why would a pharmacist, who typically holds a doctoral degree and makes more than $100,000 a year, want to join a union in the first place?

"When I tell people I'm a pharmacist and I belong to a union, they kind of give me a blank stare, because they cannot put the two together," said Tom Hanson, a staff pharmacist at Walgreens in Chicago.

But unions, he said, have helped pharmacists -- who are on their feet all day and under pressure to fill prescriptions quickly -- win a raft of better working conditions, such as getting every other weekend off, avoiding 14-hour shifts, and the right to bid on store locations and vacation schedules.

"Because we have a contract in place, we're treated fairly," said Hanson, a pharmacist for 32 years and president of Local 1969 of the United Steelworkers/ National Pharmacists Association.

Leo Hans, a pharmacist at a Medco facility in Tampa, Fla., said his union has helped give his colleagues a stronger voice and better hours. Hans, for example, works 6:30 a.m. to 3 p.m., Monday through Friday, hours that are almost unheard of in the industry.

"It's great for me," said Hans, president of Local 991 of the Steelworkers union. "When you work in retail, it's usually crazy hours, working on weekends, overnight, stuff like that."

In some markets, pharmacists are turning to organized labor to help fight back against drug chains, which monitor how quickly pharmacists fill prescriptions.

"If you are filling prescriptions fast enough, a green light appears on the computer screen. If you fall behind, a red light appears," according to a newsletter from Steelworkers Local 1969 in Chicago. "Records are kept and the red-light (pharmacists) are deemed incompetent because they are too slow."

That pressure, some say, cuts back on the amount of time pharmacists can talk to patients about drug interactions, side effects and other important health issues.

"I probably get four or five calls a month from retail pharmacists who say, 'Help me. I can't be the professional I was trained to be,' " said Somma at the Steelworkers union.

Medco, one of the nation's largest pharmacies, dispenses about 550 million prescriptions a year, many of them from a network of highly automated mail-in distribution centers.

The company boasts of its speed, efficiency and technology. Its 2007 annual report says its distribution centers help "maximize the efficiency of the dispensing function."

Medco's newest center, under construction at the AllPoints industrial project at Anson, west of Zionsville, will be its largest, with the capacity to dispense more than 1 million prescriptions a week. Pharmacists will oversee all dispensing, from scanned-in prescriptions from around the country.

The automated centers are springing up, in part, to help alleviate the stress caused by a national shortage of pharmacists, the result of a surge of retirements, a flurry of hospital and drugstore expansions, an aging population and an increased number of prescriptions written.

The Pharmacy Manpower Project predicts a national shortage of 157,000 pharmacists by 2020.

Some experts, however, point out that pharmacists still are expected to fill prescriptions quickly and accurately.

"No question, there's a lot more pressure on pharmacists and their staff to dispense prescriptions quickly," said David Zgarrick, chair of the pharmacy practice department at Drake University in Des Moines, Iowa.

But whether that pressure will prompt pharmacists to join a union remains an open question. Some say they have no desire to do so because that could diminish their professional status.

"I'm not sure what benefit it brings to me as a professional," said Kelley Viola, a staff pharmacist at Meridian North Pharmacy. "If a pharmacist has too much pressure to crank out pills by the hundreds in any given day, they need to stand up and push back. You can't compromise your license and your ability to serve your patients."


Healthy debate on electronic health records

By Steve Johnson

Mercury News
Article Launched: 10/31/2008 07:00:00 PM PDT

Backed by both presidential candidates, Silicon Valley tech giants and
other companies are leading an effort to create electronic health
records containing data about your most intimate health conditions —
from your bunions and bad back to your chronic hemorrhoids and
psychiatric history — so the information can be easily shared with
doctors, insurers and others.

Proponents of electronic health records believe they can dramatically
cut medical costs and lessen the likelihood of patients being
improperly treated. As a result, voluntary programs to test the
concept recently have been launched by major corporations, from
Silicon Valley tech titans Google and Intel to Microsoft.

But despite assurances the records will be kept confidential and
patients will control who sees them, consumer advocates fear the trend
will lead to widespread privacy violations and relentless marketing by
hucksters misusing the data.

"Increasingly, consumers will be receiving an array of pitches and
promotions and product offerings based on very sophisticated
analytical assessments of their health information," said Jeff
Chester, executive director of the Center for Digital Democracy. "This
is an area rife with problems."

Saying the paper records used by most doctors are inefficient, waste
money and make it hard for health professionals to exchange vital
information about patients, President Bush in 2004 ordered the federal
government to begin planning
for the nationwide adoption of electronic health records. And that
goal is being enthusiastically pushed by his would-be successors.

Computerizing such records makes sense "instead of you filling out
forms in triplicate when you go to the hospital, that will reduce
medical errors and reduce costs," said Barack Obama during the
candidate's second debate Oct. 7.

"Let's put health records online," replied John McCain.

Major corporations are promoting the concept, as well.

In May, Google set up an area on its Web site, dubbed Google Health,
where people can place their health records and share the information
with doctors and others. Patients now can exchange health data with
only a few doctors participating with Google Health, but Google plans
to broaden its record-sharing features.

Not to be outdone, Microsoft in June announced a deal to let Kaiser
Permanente's 159,000 employees store their medical data on Microsoft's
HealthVault site. Late last month, Microsoft unveiled a similar
arrangement for patients covered by insurer Aetna.

In addition, Santa Clara computer-chip maker Intel has teamed with
several large companies, including Applied Materials, Wal-Mart and
Pitney Bowes, to create an independent Web-based entity, called
Dossia, where the companies' employees can manage their health data.

The services are free for patients and the companies involved insist
they're not in it for the money.

"None of us are approaching this because we think we can create a new
product line," said Colin Evans, an Intel manager who is Dossia's
chief executive, insisting Intel's interest is to help improve its
workers' health.

"Most doctors keep their data on paper. That's dangerous. If doctors
can't exchange information or have an incomplete view of the patients
because they don't have the records," he said, it can have serious
consequences and has even led to some patients' deaths.

As Microsoft has promised, Google won't pepper patients with unwanted
ads, said Dr. Roni Zeiger, product manager for Google Health. Instead,
he added, the Internet search giant believes it can benefit indirectly
by providing a vital consumer service.

"We think that when people are signed in to applications they trust
and appreciate, they will tend to use other Google products,"
including Google's main search site, which does have ads.

So far, just 13 percent of U.S. doctors use some computerized records
and 4 percent do so extensively, according to a New England Journal of
Medicine national survey of nearly 3,000 physicians in July. But if
the adoption of such records becomes widespread, it could open up a
huge business opportunity. Research firm Kalorama Information
estimates the annual market for products related to such systems could
hit $4 billion by 2015.

Much of the equipment needed to link the network would have to be
powered by computer chips, for example, a potential big plus for
Intel. Google also might be able to charge businesses such as
weight-loss services to put their nutritional or other medical tips on
Google Health, said Andrew Rocklin, a health expert at Diamond
Management & Technology Consultants in Chicago.

But the concept has run into resistance.

Of 1,003 Americans surveyed two years ago by the New York-based Markle
Foundation, which promotes new communication technologies, 77 percent
suspected their information could get into the hands of marketers and
80 percent feared they could be exposed to identify theft and fraud.

Those worries are warranted, consumer advocates say. "One of the
ongoing concerns I think with both Microsoft and Google is these
business models are constantly in flux," said Marc Rotenberg,
executive director of the Electronic Privacy Information Center in
Washington. "They may say today there is no advertising. Once they are
in possession of the medical data, they can change the business
model."

Recent medical-data breaches also have contributed to the misgivings.
In April, federal prosecutors in New York charged a former hospital
employee with improperly accessing nearly 50,000 computerized health
records of patients so he could sell the information to others.

Contact Steve Johnson at sjohnson@mercurynews.com or (408) 920-5043.

Google Health Launches Non-Profit Patient Assistance Web Site

by Becky Jacoby, Reporter
Information on thousands of patient assistance programs can be found online at PatientAssistant.com, Inc. (PatientAssistant), a new nonprofit organization and integrated service launched by Google Health.

A patient assistance program is a service offered by pharmaceutical companies to help low-income, underinsured or uninsured individuals or families procure medications for free or low cost. Based on medications listed in the patient's Google Health profile, the application facilitates a search for eligible patient assistant drug programs. PatientAssistant helps users to identify affordable pricing, thus saving money on the prescription drugs that they need.

"The more medications a patient is required to take, the longer and more difficult it can become for them to find patience assistance programs that meet all of their needs," stated Rex Bowden, President, PatienceAssistance.com, Inc. "Our new integrated service on the Google Health platform is designed to make that process much easier by allowing users to search for programs on multiple medications at once, while using existing information to save time in searching for eligible programs that meet all, or most, of the patient's needs," he said.

How does Google Health work? Users create a Google account, register their medical records and health information then log in to www.google.com/health and "Explore Online Health Services." A walk-through of the program's features is available prior to sign-up.

PatientAssistant also shows users the costs of their prescriptions within their geographic area. It also offers related tools such as the ability to send reminders to patients to submit enrollment forms.