An article relating data security and internet based health services.
Written by Per Egil Kummervold, social anthropologist at Norwegian Centre for Telemedicine
Theoretically, someone may be bugging all the rooms of your home. That
does not mean that you have to be on your guard whenever you open your mouth.
You can never be 100% certain that nobody is monitoring you when you are
communicating on the net, but that does not mean that you should stop using the
internet.
If you send a letter by registered mail, the chances that an unauthorised
person will read it are smaller than if you send it by ordinary mail. In the
same way we could say that when you use an ordinary phone, there is less
likelihood that unauthorised persons will be tapping your line than if you use
an old-fashioned NMT-phone.
In general, we could say that security on the internet is somewhere between
an ordinary telephone and an old cell phone. Therefore, there is no reason to
become paranoid about security. Having said that, we must also add that security
can be a lot of things. This page will give you a short introduction into what
is meant by security on the internet, and suggest some precautions you may take
to safeguard your own security.
Security has a number of different
aspects:
a) You don't know who you are communicating with
b) You don't
know if anyone is tracking you
c) You don't know how recipient use the
information they get
Though focus is often on point b) when we are talking about the internet, we
think that to you as a private person, points a) and c) are more important. We
shall deal with each point separately:
a) You don't know who you are communicating with
When you communicate with
others through chats, e-mails or discussion fora you will most often have no way
of checking who they are. Many people have discovered that they have been
talking about their personal problems to a person on the internet they never
expected to meet again, only to find out it was someone they actually knew very
well. There is no simple way to prevent this, other than using common sense.
Furthermore, persons or organisations that place health information on the
web might claim to be something they are not. When looking for health
information on the internet, you want to make certain that what you find is of a
high standard. Naturally there is also a lot of good information not written by
professionals, but if the web site tells you that the information is subjected
to quality control, you want to make sure that this is really the case.
Use the following checklist:
Does the site belong to a large organisation which you have confidence
in (for example a public corporation such as a hospital)?
Do they have
a contact address? Ideally, the name and address should be provided on the site,
but a minimum requirement is that they may be contacted by e-mail.
Are they certified?
Several different kinds of certification systems for health information exist on
the internet today and there is no simple standard. One of the most well known
certifications are Health On Net Foundation. This link
will give you an overview of the different rules the sites must observe if
they are to be allowed to use the logo of Health on Net Foundation (HON). At the
bottom of the HON page you may check whether a certain web site has been
approved.
b) You don't know if anyone is tracking you
It is fully possible to
monitor information transmitted between computers, but we don't think there is
any need to be paranoid about it. In practice such monitoring is very difficult.
If somebody should really want to know what health data you are transmitting via
the internet, it would in most cases be far easier to pretend to be someone else
or to get physical access to your PC, rather than monitoring your use of the
web.
What you should consider, on the other hand, is whether someone has access to
your computer. If you are using an operative system without security (such as
Windows 95/98), anyone who may access your computer will be able to see what you
have done on the internet. Your computer stores information about the sites you
have visited, and in most cases a person with access to your computer will also
be able to read all your e-mail messages.
Many services are
protected by passwords, and the computer may offer to save the password for you.
If you don't wish other persons with access to your computer to know which sites
you have visited, it is important that you always answer "no" when the computer
asks whether to save the password.
c) You don't know how the recipients use the information obtained
When
giving information about yourself on the internet (such as name, address, e-mail
and health information, such data may be misused. We all know that mailing lists
are sold, even if the web site expressly states that they only require such
information for internal use.
Here are some tips:
Is the web site asking for more information
than it needs? Are they asking for a postal address, at the same time as they
say they will not send you mail or advertising material? Do they ask for other
personal data such as date of birth, national identity number or health
information without any obvious good reason? This should in itself be enough to
avoid using the site.
When they ask you to state your e-mail address,
you should be aware that it might be sold for advertising purposes. In some
cases you need to give a valid e-mail address to receive a password, for
example. In this case it might be an idea to have two e-mail addresses; one that
you use for serious mail, another that you use for other purposes. Several web
sites allow you to establish such e-mail accounts free of charge.
On
many web sites you need a password. Many are tempted to use the same password
everywhere. Don't do that! If one of these web services is unreliable, the
password may fall into the hands of unauthorised persons. Ideally you should
have different passwords everywhere, but they may be difficult to remember. A
minimum requirement is having two passwords, one that you use for services you
don't want others to access, and one for services where this doesn't matter.
Good luck with your surfing in the future!