[tor-talk] Could Tor be used for health informatics?

[Paul Templeton <paul@xxxxxxxxxxxx>]

I've been toying with an idea for several years now to facilitate data exchange between health services/providers. Over the last 10 years or so here in Australia the government has funded many projects to allow secure messaging between providers. The majority of projects flopped but one stuck. There are now two players in the market both are now corporate entities (Even though one was a NGO with FOSS application).

One system (HealthLink) is a push pull system that(I believe) stores the data in New Zealand. This is initiated from the poster (ie sending discharge or report).

The second is Argus - it just uses SMTP to send data.

The Government is now in its last bid to force all Australian to have electronic health records(My Health Record). It was an opt in system but the public didn't trust the Government so now its an opt out.

I have been involved from the early days of trying to get some sort of secure data exchange that is controlled by the consumer. I have many a time stated the best approach would be a secure, encrypted peer to peer system to push and pull data at the request of the consumer. Even though many Government Departments involved thought the idea was good they didn't know how to implement plus I think the mandate was more about the Government having access to personal data. 

Where Tor may fit...

The Tor network would provide the secure transport - each site would create an onion address. Central servers would keep tab of address and public keys for each site and practitioner. (down side of the current key infrastructure is the Government creates the key pair and keeps a copy, I would suggest the practitioners create there own keys). The system would use HL7 for data exchange. An app on the practitioners sever would then interpret the requests and talk to the SQL DB. 

The Practitioners DB would have to be modified for permissions to access data based on the customers request. Most DBs all ready have logic fields for consent on many aspects of the clinical data - ie consent for data to be used for chronic disease research, SMS reminders etc.

The only area I fail is the ability for a customer to access there record to set permissions...

Any thoughts out there?

Regards,

Paul Templeton
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk