Privacy of Health Forms

[RememberSchiff]

52 minutes ago, willray said:

I dunno - I have a number of modern tools with laser-engraved information that is already completely unreadable due to minor surface wear, and a lot of century-old tools where the stampings can still be read.    There are certainly advantages to laser engraving - like density of the information that could be provided, and the fact that the tags could easily be double-sided if they were laser engraved, but, I'm not sold on its durability.

You get what you pay for. I would avoid jewelry laser etching. Our shop uses engravers who meet MIL-STD 130, MIL-DT1524F, etc. More $$, but durability is not an issue. 

[willray]

1 hour ago, mrkstvns said:

You are very conservative in your estimates.

It is astounding how little the average American knows about information quality or cyber-security.  All of us could benefit from learning a bit more about issues surrounding privacy and cybersecurity. As technologies like AI and data mining become more prevalent, the issues only become more important.

Yeah, I thought about trying to be more precise, but decided it wouldn't actually help.  Anyone who thinks HIPAA, or any other legislation or technological system actually prevents their data from being accessed inappropriately is living in a fantasy world.

The truly silly thing about all of the hullabaloo over data privacy and security (all the way down to website cookies) is that everyone should have learned all that that they need to know about this by the time they were done with Kindergarten:  If you want something to stay secret, don't tell anyone.  If you tell someone something, then everyone is going to know that something, and the best that you can do is go crying to mommy afterwards.  Jimmy dropped a frog in Tina's back pack, you take medication X, or that underwear you bought the missus was less than scout appropriate, if somebody knows (and if you did it online/electronically, at least one other person knows), then you can pretty much bet that everybody knows.

Sure would be nice if that wasn't the case, but getting all bent out of shape because someone else didn't treat your stuff the way you wanted it treated, is pretty silly.  Don't want them to mistreat/lose/sell/give-away your data, don't let them have it.  It's the only actually reliable solution.

Edited April 12, 2019 by willray

[willray]

52 minutes ago, Eagle1993 said:

Also, if you need paper, there should be an option for the leader to print out a report prior to leaving on a trip.

My point was that in the end, this probably generates as much, or more paper use than BSA's paper forms, and done ad-hoc rather than in a principled regular fashion, has all manner of failure modes, from failing to have printed a form for some scout, to greater lossage and leakage of the ad-hoc printed forms.

"Give us your form at the beginning of the year, we store it in a binder that goes on every campout" may be primitive, but it actually provides a simple solution to a lot of problems.

[willray]

1 hour ago, Eagle1993 said:

I work in medical devices, been part of threat models, responded to ICS-CERT advisory’s, worked with white hat hackers and other aspects of cyber security.  I’m not an expert but know enough.  

Most of not all of the info being collected is already in BSA or healthcare providers databases.  BSA already stores much info, including DOB and addresses electronically.  Your medical history is stored in multiple databases already.  Most people really interested in this data will be people who know you... paper will be easier for them to access than a BSA secure database. 

I suppose it comes down to whether you're more concerned about a targeted attack against you as an individual, or general leakage of your data "to the public" in a bulk sense.

I agree completely, if someone close to you wanted the data on your medical form, the social-engineering/physical route would almost certainly be far easier than breaching a "secure" database.

On the other hand, in aggregate, I guarantee that your EMR data is not protected in any meaningful way.  I do computing research in the life sciences.  I do my utmost to insulate my lab from Personal Health Information, and we kick anyone who even looks like they might have PHI back out the door before they even get the chance to introduce themselves.  Even so, I'll probably see anywhere between a half-dozen, and a few hundred records hemorrhaged from protected databases go floating by on any given day, and this is with both all the "protections" built into the system, and us trying desperately not to look.

I'm curious - I've been approaching the discussion from the point of view of general leakage, rather than a targeted attack, so I haven't thought the targeted attack possibility through.  Under what circumstances would you envision someone close to you wanting to specific access to your health data, who didn't already know what they were going to find?   It's a serious question - the only thing that comes immediately to mind for me, is someone who's actually intending to do you harm and wants to know allergy information.  I'm sure there must be other scenarios.

[RichardB]

3 hours ago, willray said:

"Give us your form at the beginning of the year, we store it in a binder that goes on every campout" may be primitive, but it actually provides a simple solution to a lot of problems.

Wait, a simple solution for 3-4 MM folks that works for unit, district, council and national events?   Not sure what those folks at National were thinking.   

 

[Eagle1993]

 

 

1 hour ago, RichardB said:

Wait, a simple solution for 3-4 MM folks that works for unit, district, council and national events?   Not sure what those folks at National were thinking.   

 

I wouldn’t consider it easy given the fact that both my Pack and Troop have to have an adult leader dedicated to chasing down these forms.  This could be a lot easier and GSUSA found a better way (at least in my area).  Parents who have kids in both organizations can quickly see one is superior in terms of renewing membership and collection of health forms. 

I know it’s minor in the grand scheme of things, but would be nice to have our adult leader focused on scheduling another outdoor outing instead of running around collecting paper.  

Again, the big benefit is that once you fill out the GSUSA online tool... you only need to make changes in future years... you don’t need to refill out the entire form.  Easy on the parents and leaders.

 

[willray]

3 minutes ago, Eagle1993 said:

Again, the big benefit is that once you fill out the GSUSA online tool... you only need to make changes in future years... you don’t need to refill out the entire form.  Easy on the parents and leaders.

Which works great, until it's not updated, or not available when it's needed.   Not keeping the data at all, would be even simpler, and also would work great, right up until someone decided to sue the organization because they didn't have it.

I'm not sure where others have difficulty "chasing down" the BSA forms.  We've got an adult leader who's responsible for the forms-binder.  We don't accept permission-slips for campouts/activities unless there's a current medical form in the binder.  End of chase.

[RememberSchiff]

17 hours ago, RichardB said:

Wait, a simple solution for 3-4 MM folks that works for unit, district, council and national events?   Not sure what those folks at National were thinking.   

 

Simple? No, but I agree with your second sentence. 

Summer camp deposits are coming in and the annual  health form, etc. paper chase will begin in a couple days, after April 15 Tax Day. 

[ParkMan]

23 hours ago, willray said:

"Give us your form at the beginning of the year, we store it in a binder that goes on every campout" may be primitive, but it actually provides a simple solution to a lot of problems.

We've been doing this for years to good success.

Every year we ask the scouts to re-up with the troop.  At this time we collect dues and new health forms (parts A&B).  We ask parents to come along at that time and check over paperwork and forms.  Forgot your health form - no problem, here's a blank one.  Not everyone shows, but over the next few weeks things trickle in.  Since we tie all this to continuing as a member in the troop, we'll get to 100%.

Part C health forms are needed mostly for summer camp, so we don't require them at that time and do let them trickle in.  But, since you have to have them to go to summer camp they seem to somehow all arrive by the time the Scouts leave the parking lot for Summer Camp.

This seems to do the trick for us and really isn't too much work.

[Eagle1993]

2 hours ago, RememberSchiff said:

Simple? No, but I agree with your second sentence. 

Summer camp deposits are coming in and the annual  health form, etc. paper chase will begin in a couple days, after April 15 Tax Day. 

I only have x hours of volunteer’s time. Right now, too much of that is chasing paper between health forms, recharter paperwork, BSA annual dues.  We have 150 kids between the pack and troop, at 5 mins a form to review for errors, call for updates, etc. that is 13 hours of volunteer time I could have spent on something more useful.  Other organizations have figured out how to do this more efficiently.

[RichardB]

@Eagle1993 appreciate your concerns.  Scope wise, might consider that your example is estimated at .0000005% of users of an AHMR and may not work for the rest of the population.  But, as you stated in an earlier post about going to "camp",  the "camp" provides the electronic input.   Many of those camps (especially those that that bring the same kids back for multiple years) have gone to one of a couple electronic providers.   Cost $5 or so per camper per year per property (camp).  $750 for your 150 kids or $57 and change per hour for 13 hours of volunteer time if I did the math right.  Would you be willing to absorb that cost or would your unit?   The input so far would indicate this to be a significant cost.    What do you think?  

Also, in your examples what do these camps do for participants in the program the remaining 51 weeks per year (Pack Overnighters, Camporee's, Jamboree's, etc.)?  Who manages that electronic system in your examples of how others do it better.   If you have a specific solution, more than willing to consider it.   Post or PM me the product.     

 

[DuctTape]

On 4/12/2019 at 2:06 PM, RichardB said:

Wait, a simple solution for 3-4 MM folks that works for unit, district, council and national events?   Not sure what those folks at National were thinking.   

 

Kind of like a simple "No one on one contact" rule. 

[Eagle1993]

On 4/13/2019 at 6:07 PM, RichardB said:

@Eagle1993 appreciate your concerns.  Scope wise, might consider that your example is estimated at .0000005% of users of an AHMR and may not work for the rest of the population.  But, as you stated in an earlier post about going to "camp",  the "camp" provides the electronic input.   Many of those camps (especially those that that bring the same kids back for multiple years) have gone to one of a couple electronic providers.   Cost $5 or so per camper per year per property (camp).  $750 for your 150 kids or $57 and change per hour for 13 hours of volunteer time if I did the math right.  Would you be willing to absorb that cost or would your unit?   The input so far would indicate this to be a significant cost.    What do you think?  

Also, in your examples what do these camps do for participants in the program the remaining 51 weeks per year (Pack Overnighters, Camporee's, Jamboree's, etc.)?  Who manages that electronic system in your examples of how others do it better.   If you have a specific solution, more than willing to consider it.   Post or PM me the product.     

 

To be clear, I agree this is not a major issue.  However, IT infrastructure is the 21st century storefront of many businesses and organizations.   I would expect the BSA to create the IT software for councils and units to run efficiently.  If the fee is $5, it must be covered by $25 annual fee we pay GSUSA or the camp charge (which is competitive with BSA).  That said, I understand financial priorities have to me made and agree health forms are not the top priority.

BSA has made some good progress on their IT investments over the last few years.  I never deal with paper youth applications anymore and the process has been great over the last 12 months.  We’ve been using Scoutbook, and while it can improve, the advancement sync is working flawlessly (I was pleasantly surprised the sync with ScoutNet seemed to be almost immediate  and it saved extra paperwork and a drive to the scout center).

I would love to see future improvements in charter renewals, health forms and adult applications.  They should continue to see why Troops or Packs are using other IT packages than Scoutbook and help address the perceived gaps.  All are possible (and again, the BSA is making progress) and it would help improve the storefront while maximizing volunteer hours on activities instead of paper.  

[T2Eagle]

2 hours ago, Eagle1993 said:

 

BSA has made some good progress on their IT investments over the last few years.  I never deal with paper youth applications anymore and the process has been great over the last 12 months.  

Unless things have changed since last year, you can't use electronic enrollment for crossing over Webelos to Scouts, which for our troop is the bulk of our new members.  How are you not using paper applications.

[Eagle1993]

6 hours ago, T2Eagle said:

Unless things have changed since last year, you can't use electronic enrollment for crossing over Webelos to Scouts, which for our troop is the bulk of our new members.  How are you not using paper applications.

Forgot about that one... yep, that would be a nice add as well!