Basically, I use dokuwiki for the underlying system software. Dokuwiki is free wiki software written in PHP . I have it installed on my own server (not an ISP) which uses dynamic DNS . I’m not comfortable with putting patient records on a web server that I don’t completely control and over which I don’t have physical access. I have the basic dokuwiki system running over https and use strong passwords for security. The only people with  passwords are myself and the physician who covers for me in an emergency. Usually, wikis are used for public collaborative projects, but they also work just fine as a personal wiki, too.

For people who’ve never looked under the hood at Wikipedia or the like, the idea is that you can edit the page you’re seeing on the screen by clicking a button. The page you get to after you click is just plain text, decorated with a few extra symbols that tell the wiki software things like you want something to be a heading or an element of a bullet list. So, for example, in Dokuwiki, if you type:

=====20091212=====
This is some *text*,
and here is a list:
 * one
 * two
 * three

you get something that looks like

20091212

This is some text, and here is a list:

• one
• two
• three

when you finish editing the page.

I have a page for each person’s initial evaluation, and a page for each patient’s history, in reverse chronological order, with each visit under a heading so that I can easily look around from visit to visit. Each time a patient comes in, I put a note at the top of his or her page.

Potentially, every single version of the page of the page is available forever. To keep storage space down, I purge old versions about every 3-4 months, but if I totally mess up someone’s note, I can usually restore to a previous version.

I also have a series of journal pages, one for each day of the month, with everyone whom I see that day listed as a hyperlink so that I can see my patients for the whole day at a glance.

If I have to send records, I use the export_xhtml feature of dokuwiki to get a page suitable for printing, print that page to pdf and mail the pdf to whomever wants it.

For prescriptions, I use NationalErx. The interface is pretty lame and cumbersome (it lacks a lot of things that would make it faster and easier to use), but it’s free, so I can’t complain. At the end of the year I can get a big report of every prescription I’ve written for the year, and I just save an electronic copy of the whole thing for my records. I can also generate reports with individual patient rx histories, or reports by drug.

I have a multifunction fax/printer/copier/scanner and I have it set up to save all faxes to files rather than printing them. When I get a lab or the like by fax, I just copy the file to a directory (one per patient) under dokuwiki so that I know where to find all their paperwork. Occasionally, if I get something like psych testing results by regular mail, I’ll just scan the document in, copy the scanned file to the patient’s directory, and shred the original document.

I have a typed evaluation for everyone, but if my handwriting were better, I could probably get away with just keeping scanning in my evaluation worksheet.

With this very simple system, I basically have medical records for my practice that I can access from anywhere on the Internet, and have almost no paper chart for the patient. The only thing I put in a patient’s paper chart is miscellaneous stuff that’s not worth scanning, like requests for refills. (NationalErx tracks that already.)

Since my whole practice is almost paperless, I have an extensive set of procedures which back up all my key files to truecrypt encrypted volumes stored on and off site.

I use Ubuntu on my practice laptop with full disk encryption, including the root filesystem. The entire disk is encrypted, and even if someone steals the laptop, my understanding is that the encryption on the disk is suitable for data at least up to the level of top secret military information, so I think that’s adequate.

Yes, it helps to be computer literate, but I suspect that a $300 computer for the server and about $300 worth of consulting from someone familiar setting up a web server could probably get anyone a paperless EMR that is suitable for a solo or small group psychiatric practice. For me, the only expense was the price of the server, the time to set it up, and the time to keep it backed up.

For those fortunate individuals who don’t know what HIPAA is,  HIPAA is a law passed in 1996 governing, among several other things, privacy of medical records. This law is responsible for the unintelligible two to three page form that you have to fill out anytime you go to a doctor, dentist or pharmacy these days.

HIPAA says that protected health information (PHI) must be encrypted if it is sent over the Internet. Skype says that they use AES encryption, which is approved by the NSA for encryption of top secret information, so that would seem to be defensible as having encrypted PHI for HIPAA purposes.

Over at Voyager Telepsychiatry, there is a post in which the author describes having sent emails inquiring about whether Skype was HIPAA-compliant to the Office of eHealth Standards and Services at the CMS Headquarters in Baltimore, Maryland and received a reply:

CMS does not advise on technology specific issues, because the HIPAA [Privacy] Rule specifically allows for flexibility in the approach to safeguarding information…

The author of the post then goes on to say:

Who can argue that use of Skype’s 264-bit encryption technique [sic] does not meet HIPAA’s intentionally vague requirement that covered entities safeguard the transmission of private health information?

I looked at the linked document that referred to Skype’s 264-bit encryption technique and I think the post author mistook 256 somewhere for 264 when reading it. Actually, as the article points out, there are really two kinds of encryption going on with Skype. First, Skype uses 1024-bit public-key key exchange protocol to establish keys for a 256-bit AES encrypted channel between the two people using Skype.

Without getting involved in the subtleties of key exchange, whether weak keys exist, and a lot of high level cryptography that I don’t really know anything about, I think that the main issue here is whether AES would meet a  legal challenge. I think it would. My argument would be that Skype is clearly harder to hack into than into my telephone line and that anyone willing to go to that much trouble to get to someone’s PHI would be better served by much cheaper technology like hidden recording devices, electromagnetic emission keystroke loggers or just hiring someone to break into my office when I wasn’t there. I would bet a lot of money that it would be easier for someone to get confidential psychiatric records out of any hospital in Baltimore than it would be to hack my Skype conversation while it was going on as long as my Skype password was secure.

Another post at Telehealth.net brings up just this issue. Nothing on Skype or any other encrypted system I know of is secure if you use crappy passwords that someone can guess like:

• 1234
• your name
• your name plus your birthdate
• dragon
• 696969
• letmein
• qwerty

and the like.  Maybe I’ll write a post in the future on generating passwords for Skype, but I’m happy to tell anyone who wants to know how I generate the passwords I use for anything that’s important to me.  I use Diceware with 20 words. If you’re a hacker, good luck! I hope that you have a fast computer.