I used an analogy in that post that I’m going to continue this week. Basically, I started with talking about how firewalls are like the guard at the desk by the door of a factory. For review, here,

• the factory (and its grounds) are like your home network,
• the goings on at the cafeteria are like the Skype program running on your computer,
• the guard is like your firewall, and
• “Should we tighten up security at the guard’s station?” is like “Can firewalls help make Skype more secure?”

I talked about firewalls last time and how concerns about firewalls are like concerns about the security procedures at the front desk. In general, front desk security is a good thing, but won’t do much to solve a problem in the cafeteria if some rascal there has a valid ID card.

I would like to go with this analogy again. There’s a lot of ways that security could fail in terms of nefarious goings-on at the cafeteria, and those ways are just like the potential security problems of Skype.

• Skype’s program could have a bug in it which someone could exploit. I.e., if someone knows something like putting in a contact with a name that is 50,000 characters long lets that person access some internal aspects of Skype that they aren’t supposed to, then that could be a problem. This is like having someone who works for the factory responsible for the nefarious things in the cafeteria. Here, they are just stealing from the factory.
• More worrisome is something like someone from the outside impersonating someone who has a valid ID. The bad guy gets in by pretending to be someone who works there, and then does his nefarious deeds. The analogous thing for Skype would be for someone to make a specially modified program, convince you to download it, and then have you install the modified program. As far as I know, there are no programs that do something bad while masquerading as Skype, but I have noted the same sort of malware on Skype IM’s that appear regularly in everyone’s email, basically a bogus message saying that you need to go to some URL and install fake antivirus software, or update some kind of program that you already have, such as Adobe Acrobat.

I tend to be very suspicious of these kind of messages anyway so I hope that I, at least, wouldn’t fall for this nonsense, but I can certain see a naive user getting one of these malware spam messages and installing something that would infect their computer with a virus.

A program that works like Skype but does something bad could probably be written, but since this would be a direct shot at Skype, I suspect that Skype would respond quickly and effectively (or else they would be out of business.)

One thing that is possible, but not particularly worrisome to me is that someone could hack my or my patient’s password and pretend to be someone they are not. There is a big reason why I don’t think this would be a problem in my practice. I always see the patient face to face first, before I do Skype sessions with him or her. As long as the impostor is showing me video, then this exploit would be easy to see through.

So far as I know, HIPAA doesn’t certify software as being HIPAA compliant or not. Instead, as best I can understand, various companies claim HIPAA compliance and I guess they could be sued if they were negligent someone.

As far as I know, no one has brought up substantive HIPAA issues regarding cell phones, but every argument I’ve given on this subject would appear to apply to cell phones as well as Skype.

I think the bottom line here is that having some informed consent from the patient is essential, but that some of the discussion regarding HIPAA and Skype may be more based on commercial interests (such as the people who give the seminars on HIPAA compliance) than on believable threats to the security of patient information.

If someone bugs your landline at your office, wouldn’t they be able to gather lots of information? Do you sweep your office for bugs daily? Maybe so, but I suspect that most people would say that trying to absolutely guarantee the privacy of anybody’s practice is impossible. If someone wanted to sue you after a bad guy tapped your phone, do you really think that the government would come after you? What if someone broke into your practice at night, broke open the file cabinets, and looked through someone’s information? (Didn’t this happen during Watergate?) What if the CIA kidnapped you and put a video camera in your nose?

This is beginning to sound a little weird to me…

Lots of things to worry about here for the nervous Nellie’s. The only one I find credible is malware which masquerades as Skype, but then, malware could masquerade as your EHR software, couldn’t it?

I don’t do any group therapy anyway, so the title to this post is only a teaser, but I can really think of some great uses for this technology. I’m pretty open to conference calls with family members while I’m face to face with my patient, so I can see this going better if I can see them as well as talk to them. Also, I’m thinking that video Skype would be a good way to handle some interactions with my professional peers and my patients. For example, sometimes I’m talking with a patient and on the phone to his or her internist at the same time. Wouldn’t a three way video conference be a lot better for everyone?

If I start to do this though, I have to figure out how to manage things with my patient. Right now, the video camera is on my computer facing out at me when I’m behind my desk and (intentionally, right now) doesn’t show anybody or anything in my consulting room, just a wall behind me.

I’ll have to think this out. I’m not crazy about having a camera in the area where I’m seeing patients right now. I’ll have to think about how I need to reconfigure the seating for me and my patient if we want to get on a Skype call together. I’ve tried this once, and it was a little awkward to have the patient standing over my shoulder while we were talking to someone.

Basically, Dr. Maheu points out that there is a lack of potential information about the security and reliability of Skype. Assuming that the security information on the Skype website is correct, then I think I can answer a couple of the good questions that Dr. Maneu asks.

Rather than thinking about things like firewalls (which are pretty nebulous to most people), a better way to understand what the relationship of firewalls to Skype security is to use an analogy. Suppose that you are the director of security for a factory and that you’ve been asked to investigate some nefarious things going on in the cafeteria and to straighten them out. Someone asks you if tightening up security at the guard’s station at the front door to the factory would help.

Here,

• the factory (and its grounds) are like your home network,
• the goings on at the cafeteria are like the Skype program running on your computer,
• the guard is like your firewall, and
• “Should we tighten up security at the guard’s station?” is like “Can firewalls help make Skype more secure?”

If you were the directory of security at the factory, I’m sure that you would answer something like: “It depends on how the nefarious things are happening. If some unauthorized people are getting into the factory, beefing up security at the door will help keep these kinds of people out, but if the person’s got a badge to get in, focusing on the guard at the door isn’t going to make any difference.”

Skype security is pretty similar. Having a good firewall is pretty much a must on any Internet-connected computer these days, but I don’t think changing the firewall is going to make that much difference in Skype security, any more than replacing one competent guard at the factory’s front door with another is necessarily going to solve the problems at the cafeteria. It probably it pays to investigate what’s happening at the cafeteria, rather than at the front desk.

Skype hasn’t made all the details of its security system known, but it does have a lot of information online, and, assuming that they are telling the truth, it sounds like Skype is at least a secure as a cellphone conversation, and, as far as I know, every psychiatrist I know talks to people on cell phones without worrying that much about HIPAA violations.

Skype and modern cellphones use the same basic protocol to communicate (packet switching), but basically what happens is that when you make a call, Skype or your cellphone operator sets up a connection between you and the person you are calling and then steps out of the way, leaving you and that person to talk as if you had your own circuit. Both Skype and cellphones encrypt the data they send. If anything, the AES encryption method used by Skype is probably more secure than the 30-year old A5/1 encryption method used in most cellphones. AES is approved by the government for top secret information while A5/1 has already been partially broken.

I think that the real security issues with Skype (or with cellphones) are probably more with things like whether the government can compel Skype or your cellphone operator to tap into your conversations than with details of encryption or firewalls.

Until then, I think that doctors should give up talking to patients on cellphones before they get worried about whether Skype is secure.

There’s a lot more to think about with Skype security other than whether just this protocol is sufficiently secure. There are other issues which are also important, related (back to the analogy with the guard at the factory with which I started this post) to things like corrupt guards, corrupt employees and the like, which also merit some consideration, and I’ll discuss them in a future post.

The authors bring up a whole group of points that I agree with:

• Email is already verging on obsolescence for people under 30
• The patients under 30 don’t understand why anyone providing a service wouldn’t answer text messages
• Psychiatrists tend to be late-adopters of technology
• Email delivery is sometimes delayed and isn’t suitable for emergency communications in many cases

They also bring up a couple of other issues that make good sense to me. First, email isn’t usually encrypted. I discourage patients from saying anything very personal in emails. I think an email with content like “Your labs looked fine,” isn’t likely to hurt many people, but “I’m having an affair” could be really dangerous.

The obvious solution to this problem is the more widespread use of encryption technologies like PGP . I can use it, but I doubt that most of my patients even know what it is. PGP is a great idea, but as far as I can tell, it never really caught on, primarily because it can involve so many steps to exchange keys, enter passwords, decrypt the text, and so on.

The second issue is that despite mentioning IM, Twitter, social media and the like, they barely mentioned Google Wave and Skype. Google wave (old post here) isn’t really ready for prime time yet but Skype’s been around for a while. Basically, I think Skype could be for real-time (synchronous) communication, while Google Wave would basically do the asynchronous communication that the authors of the article are talking about. All that’s really necessary is for Wave to get some better security features, and for someone to start a “medical Wave” server to make sure the data are secure.

Basically, I think Google Wave and Skype are going to take over a lot of what the under-30 crowd is using.

Let them know how being obsolete feels like for a change.

We’ve had a lot of snow for Maryland this year, and getting around has been a challenge.

Dr Daviss points out that the current regulations would preclude him using telepsychiatry from his home to an inpatient unit and billing Medicaid, primarily because the regulations are totally focused on institution to institution situations where each site is basically a mental health facility or a medical facility, not where either the doctor or the patient is at home.

It’s like Maryland has just caught up to the fact that videoconferencing software exists after it’s been around for decades, but totally ignores the reality that lots of people have access to something like Skype. Hello! It’s the 21st century now. I’m aware that the public mental health system has a lot of economically disadvantaged people in it and that not all of them have Skype at home. However, I’m sure that some do because having a computer is a lot like having a car these days; it’s pretty hard for most people to live without one, even if you’re poor. Yeah, some people in the public mental health system don’t have telephones either, but the majority do.

There is also a “degree of separation” issue going on here. Although I’ve certainly met people who didn’t know exactly what Skype is, I haven’t met very many who don’t know someone in their family who uses it. I suspect that there are plenty of people in the public mental health system who could get some kind of access to Skype if they really wanted to, and if it could save them a long bus trip to a clinic in the inner city, why shouldn’t they be able to do that? If you think about it for a second, giving someone a $30 webcam to use with their computer at home is really nothing. If they get a blood test for screening or a medication level, that costs more than a webcam. Even in the public mental health system I haven’t heard of anyone being begrudged a basic metabolic panel.

I could speculate on whether this would help the no show rate in public mental health clinics (usually astronomically high), but I don’t know if it would really make a difference there.

The situation Dr. Daviss talks about is very striking. Here, he’s got Skype (or something like it, I assume) at home. Why shouldn’t he be able to Skype in to an inpatient unit and do his examinations? I can’t think of any good reason why he shouldn’t.

A few years ago I was one of two attendings on the inpatient service during a blizzard, and ending up being snowed for the weekend at the hospital. I did a little psychiatry, but a lot of paperwork because other doctors couldn’t get in and I was stuck there anyway. The normal contingent of attendings on the weekend was five, so having only two there stretched things pretty thin. The drag wasn’t really being stuck in the hospital or taking care of sick people, it was doing boatloads of routine paperwork so the hospital could get paid from payers like Medicaid.

It was a weekend, so I was covering for other people, and didn’t know any of the patients. It’s hard for me to think that my care of most of the patients in the hospital was better than it would have been if the attending responsible for the ward that month would have been able to Skype in, take care of the routine stuff for the patients he or she already knew, and leave the real emergencies to me.

When I see someone the first time I usually do:

• the Short Portable Mental State Questionaire (SPMSQ),
• the Hamilton depression scale (HAMD), and
• the Brief Psychiatric Rating Scale (BPRS).

Depending on what else is going on, I sometimes do:

• the Mini-Mental State Exam (MMSE),
• the Hamilton Anxiety scale (HAMA),
• the Young Mania Scale (YMRS),
• the Adult ADHD Self-Report scale (ASRS) , or
• the Yale-Brown Obsessive Compulsive Scale (YBOCS).

For follow up visits, I sometimes do:

• the HAMD
• the HAMA, or
• the YMS,

depending on how the patient is doing.

Really, there aren’t that many things that you can’t do by telepsychiatry, but there are some. For example, it’s impossible to do parts of the AIMS without touching the patient, and the HAMD asks me to look for things like fidgetiness, which might be hard to see on a skype call.

I can see a PhD thesis in here somewhere called “Adapting Psychiatric Rating Scales for Telepsychiatry.”

With one exception, all the technical troubles any of my patients have encountered have been the very first time that they’ve set up Skype. Although I tell everyone to test it out before they try it for their first appointment, the problem is that some of the people I see don’t know anyone to Skype with other than me. It’s hard to test the system without someone else to help.

I’ve tried to address the problem by now asking people to make one quick Skype call to me before their first appointment if they can’t test things with someone else. Although this wastes a little of my time occasionally, it really hasn’t been that much of a burden (I’ve done this two or three times,  and it never took more than 10 minutes to get everything working.)

The one exception was a problem that turned out to be really hard to fix. My patient had borrowed one of my loaner webcams, got this webcam to work without a problem, and then decided to buy a new webcam for himself. He installed the software for the new webcam, but it wouldn’t work. He did try to call me, but Skype wasn’t working at all. We did the session by regular phone after it was clear that something was wrong and after we had wasted about 10 minutes trying to fix it.

The problem was that he had not de-installed the software from the loaner webcam before installing the software from the new webcam, and that messed up everything until he uninstalled both sets of software (complete with the usual 10 reboots it tends to take Windows to do these things) and re-installed the software for the new webcam.

I’ve actually only had one video call go south in the middle of the session–the person was in a place with a lot of electronics, and I suspect that the problem was on her end, not on mine, but I guess you never know.

So, the score right now is one failed session and 30 minutes of “technical support” time in what have to be 100+ sessions, at least. Not too bad in my opinion. I probably spend as much time keeping my printer working.

With the right gear, you’ll soon be able to make Skype video calls in 720p HD. The latest beta version of Skype for Windows now supports HD-quality video (1280 x 720 resolution at up to 30 frames per second), giving you an even smoother and richer video calling experience than ever before.

To make an HD video call using Skype, you’ll need to have:

• a high-speed broadband connection (we recommend sustained 1 Mbps symmetrical bandwidth or higher)
• a new HD webcam
• a PC with a 1.8 GHz processor

Skype 4.2 Beta for Windows

For those who aren’t that technical, it means that the quality of video on a Skype video call will soon be just one notch below the best video one can see on a state of the art high-definition TV  (1080p), and on a par with most broadcast HDTV.

Given that you can see the pores on someone’s face on any decent HDTV, it doesn’t seem like there will be much difference between the next generation Skype and face-to-face psychiatry, at least when it comes to video quality.

The blog post also references another post on Skype-enabled TVs–regular TVs with Skype built right in–which will start to be available in this Spring.

Telepsychiatry on a 48 inch screen anyone? Faces will be much bigger than life-size.

I also note that a company called FaceVsion has just announced the first Skype certified HD webcam at a price of $129. I have to get one of these when they come out next month. I wonder what they’ll sell for on Amazon?

I tried to write it in fairly plain English, unlike my HIPAA form , which is so complicated that I don’t really understand half of what it says.

Although I agonized over this informed consent form for a while, I realized that much of it was fairly straightforward. Many of the risks were technical, the benefit was mostly convenience, and the alternative to telepsychiatry was to do what I’ve been doing.

However, I did put in some language covering specific situations, because I’ve thought about certain potential problems:

• I can’t necessarily get the same information that I would get if the patient and I were face-to-face.
• Emergency care might be harder via telepsychiatry.
• Either the patient or I can call it quits if either of us doesn’t think it is working well.
• Neither of us can make recordings of the session.
• Both of us have to know if there is a potential for anyone else to hear our conversation.

I’m sure that I’ll modify this form as time goes on, but at least it’s a start.

At work, I’ve been aware of what’s in the background when I’m talking to patients, and I’m slowly moving things so that there isn’t anything to distract people with whom I speaking on Skype video calls.

Last week, I needed to do a Skype session on short notice, so I decided to do it from my home office. I rushed over to the computer, turned it on, and was making sure that the webcam was working when I noticed how bad the background was. I’ve been getting the place painted, and everything goes from one room to another in piles, following the painter. I noticed that the visual impression I was going to make on my patient was terrible.

Luckily, I had a shoji screen around and just stuck it behind me, so everything worked out fine.

I’m still learning though, I’ve never seen any patients in my home, but I’m beginning to realize that doing telepsychiatry from home requires me to think ahead more than I have been doing.