When a Palm Reader Knows More Than Your Life Line #biometrics #privacy


By NATASHA SINGER, New York Times
Published: November 10, 2012

“PLEASE put your hand on the scanner,” a receptionist at a doctor’s office at New York University Langone Medical Center said to me recently, pointing to a small plastic device on the counter between us. “I need to take a palm scan for your file.”

I balked.

As a reporter who has been covering the growing business of data collection, I know the potential drawbacks — like customer profiling — of giving out my personal details. But the idea of submitting to an infrared scan at a medical center that would take a copy of the unique vein patterns in my palm seemed fraught.

The receptionist said it was for my own good. The medical center, she said, had recently instituted a biometric patient identification system to protect against identity theft.

I reluctantly stuck my hand on the machine. If I demurred, I thought, perhaps I’d be denied medical care.

Next, the receptionist said she needed to take my photo. After the palm scan, that seemed like data-collection overkill. Then an office manager appeared and explained that the scans and pictures were optional. Alas, my palm was already in the system.

No longer the province of security services and science-fiction films, biometric technology is on the march. Facebook uses facial-recognition software so its members can automatically put name tags on friends when they upload their photos. Apple uses voice recognition to power Siri. Some theme parks take digital fingerprints to help recognize season pass holders. Now some hospitals and school districts are using palm vein pattern recognition to identify and efficiently manage their patients or students — in effect, turning your palm into an E-ZPass.

But consumer advocates say that enterprises are increasingly employing biometric data to improve convenience — and that members of the public are paying for that convenience with their privacy.

Fingerprints, facial dimensions and vein patterns are unique, consumer advocates say, and should be treated as carefully as genetic samples. So collecting such information for expediency, they say, could increase the risks of serious identity theft. Yet companies and institutions that compile such data often fail to adequately explain the risks to consumers, they say.

“Let’s say someone makes a fake ID and goes in and has their photo and their palm print taken as you. What are you going to do when you go in?” said Pam Dixon, the executive director of the World Privacy Forum, an advocacy group in San Diego. “Hospitals that are doing this are leaping over profound security issues that they are actually introducing into their systems.”

THE N.Y.U. medical center started researching biometric systems a few years ago in an effort to address several problems, said Kathryn McClellan, its vice president who is in charge of implementing its new electronic health records system. More than a million people in the New York area have the same or similar names, she said, creating a risk that medical personnel might pull up the wrong health record for a patient. Another issue, she said, was that some patients had multiple records from being treated at different affiliates; N.Y.U. wanted an efficient way to consolidate them.

Last year, the medical center adopted photography and palm-scan technology so that each patient would have two unique identifying features. Now, Ms. McClellan said, each arriving patient has his or her palm scanned, allowing the system to automatically pull up the correct file.

“It’s a patient safety initiative,” Ms. McClellan said. “We felt like the value to the patient was huge.”

N.Y.U.’s system, called PatientSecure and marketed by HT Systems of Tampa, has already scanned more than 250,000 patients. In the United States, over five million patients have had the scans, said Charles Yanak, a spokesman for Fujitsu Frontech North America, a division of Fujitsu, the Japanese company that developed the vein palm identification technology.

Yet, unless patients at N.Y.U. seem uncomfortable with the process, Ms. McClellan said, medical registration staff members don’t inform them that they can opt out of photos and scans.

“We don’t have formal consent,” Ms. McClellan said in a phone interview last Tuesday.

That raises red flags for privacy advocates. “If they are not informing patients it is optional,” said Joel Reidenberg, a professor at Fordham University Law School with an expertise in data privacy, “then effectively it is coerced consent.”

He noted that N.Y.U. medical center has had recent incidents in which computers or USB drives containing unencrypted patient data have been lost or stolen, suggesting that the center’s collection of biometric data might increase patients’ risk of identity theft.

Ms. McClellan responded that there was little chance of identity theft because the palm scan system turned the vein measurements into encrypted strings of binary numbers and stored them on an N.Y.U. server that is separate from the one with patients’ health records. Even if there were a breach, she added, the data would be useless to hackers because a unique key is needed to decode the number strings. As for patients’ photos, she said, they are attached to their medical records.

Still, Arthur Caplan, the director of the division of medical ethics at the N.Y.U. center, recommended that hospitals do a better job of explaining biometric ID systems to patients. He himself recently had an appointment at the N.Y.U. center, he recounted, and didn’t learn that the palm scan was optional until he hesitated and asked questions.

“It gave me pause,” Dr. Caplan said. “It would be useful to put up a sign saying ‘We are going to take biometric information which will help us track you through the system. If you don’t want to do this, please see’ ” an office manager.

Other institutions that use PatientSecure, however, have instituted opt-in programs for patients.

At the Duke University Health System, patients receive brochures explaining their options, said Eliana Owens, the health system’s director of patient revenue. The center also trains staff members at registration desks to read patients a script about the opt-in process for the palm scans, she said. (Duke does not take patients’ photos.)

“They say: ‘The enrollment is optional. If you choose not to participate, we will continue to ask you for your photo ID on subsequent visits,’ ” Ms. Owens said.

Consent or not, some leading identity experts see little value in palm scans for patients right now. If medical centers are going to use patients’ biometric data for their own institutional convenience, they argue, the centers should also enhance patient privacy — by, say, permitting lower-echelon medical personnel to look at a person’s medical record only if that patient is present and approves access by having a palm scanned.

Otherwise, “you are enabling another level of danger,” said Joseph Atick, a pioneer in biometric identity systems who consults for governments, “instead of using the technology to enable another level of privacy.”

At my request, N.Y.U. medical center has deleted my palm print.

E-mail: slipstream@nytimes.com.

 

UK denies right-to-die legal challenge


 

BRITAIN ST.

BRITAIN ST. (Photo credit: marc falardeau)

 

 

MARIA CHENG | August 16, 2012 06:30 PM EST | AP

 


 

LONDON — Britain‘s High Court on Thursday rejected an attempt by a man who has locked-in syndrome to overturn the country’s euthanasia law by refusing to legally allow doctors to end his life.

Tony Nicklinson had a stroke in 2005 that left him unable to speak or move below his neck. He requires constant care and communicates mostly by blinking, although his mind has remained unaffected and his condition is not terminal.

In January, the 58-year-old asked the High Court to declare that any doctor who kills him with his consent will not be charged with murder.

The High Court ruled that challenges from Nicklinson and another man named only as Martin to allow others to help them die without being prosecuted were a matter for Parliament to decide.

Nicklinson said he was “devastated and heartbroken” and planned to appeal the decision.

“I am saddened that the law wants to condemn me to a life of increasing indignity and misery,” he said in a statement.

Martin, 47, also has locked-in syndrome and asked for the court to allow professionals to help him die either by withholding food and water or by helping him go to a clinic in Switzerland to die. His wife said she respects his wishes, but does not want to help kill him.

Locked-in syndrome is a rare neurological disorder where patients are completely paralyzed, and only able to blink. Patients are conscious and don’t have any intellectual problems, but they are unable to speak or move.

The judges wrote that they were both “tragic cases,” but said to allow euthanasia as a possible defense to murder “would usurp the proper role of Parliament.”

Nicklinson had argued that British law violated his right to “private and family life” as guaranteed by the European Convention on Human Rights, on the grounds that being able to choose how to die is a matter of personal autonomy. He has previously described his life as “a living nightmare.”

Legal experts weren’t surprised by the ruling.

“This is a really slippery case,” said Richard Huxtable, deputy director of the Ethics in Medicine department at Bristol University. “Although the courts have been willing to look at guidance around assisted suicide, this is about as far as they have been willing to go.

“The feeling seems to be that only Parliament could give adequate thought to what sort of law should be in place and the safeguards required.”

In Europe, only Belgium, Luxembourg and the Netherlands allow euthanasia. Switzerland allows assisted suicide and is the only country that helps foreigners die at a clinic near Zurich.

“It’s very clear courts are unwilling to make the radical shift in our understanding of murder by allowing euthanasia,” said Arthur Caplan, director of medical ethics at New York University’s Langone Medical Center.

“But they did leave a small door open for prosecutorial discretion,” he said, pointing out the judges acknowledged that the decision to prosecute people who helped others to die were not always straightforward.

Britain’s top prosecutor has previously said that people who help loved ones commit suicide won’t necessarily be charged with murder.

Caplan said the British cases were a major departure from past euthanasia debates because neither man is terminally ill.

“Most of the cases which triggered legislation in the past were about dying people and their quality of life,” he said. “We will see more of these discussions as people live longer and we decide what to do about those who are severely impaired.”

Nicklinson said he hoped the courts would grant him another hearing later this year. Experts said he could take his case to the Supreme Court or to the European Court of Human Rights in Strasbourg.