{'fraction_non_alphanumeric': 0.01722356183258698, 'fraction_numerical': 0.001550120564932828, 'mean_word_length': 4.992260061919505, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Computers Can Be Compatible with Confidentiality

absolute confidentiality is not a requirement. The doctor is expected to use judgement in the assessment of what might, or might not, be information prejudicial to the patient. Thus each new request for a reduction in secrecy must be carefully evaluated by the individual clinician. This vow of silence has, for the most part, remained the cornerstone of western medical practice. It is not universal. In China, for example, physicians have been required to reveal personal medical information to the state for at least an

consultation has been paramount for two and a half thousand years. The Hippocratic Oath required 'whatever I see or hear, professionally or privately, which ought not to be divulged, I will keep secret and tell noone'1. Careful reading of these words shows that absolute confidentiality is not a requirement. The doctor is expected to use judgement in the assessment of what might, or might not, be information prejudicial to the patient. Thus each new request for a reduction in secrecy must be carefully evaluated by the individual clinician. This vow of silence has, for the most part, remained the cornerstone of western medical practice. It is not universal. In China, for example, physicians have been required to reveal personal medical information to the state for at least an equivalent period2.
Nevertheless, confidentiality is now regarded as so much part of the western medical tradition that patients and their doctors alike seem to take it for granted. It was affirmed as one of the profession's 'core values' as recently as two years ago3. The doctor/patient relationship is built on mutual understanding and trust. Information which the patient would not normally reveal, even to close friends, may be crucial in arriving at a correct diagnosis, amid the confusing mixture of signs and symptoms. Particular details of the patient's lifestyle may be crucial to the treatment programme selected and to any reasonable assessment of likely prognosis. If patients ever began to doubt the trust between themselves and the doctor, as some allege is happening in the United States4, the long term consequences for the practice of medicine would be profound.

Changing attitudes to confidentiality
An historical review of confidentiality over the last one hundred and fifty years shows a progressive erosion of an absolutist principle. Whilst these breaches may be unexceptionable in themselves, it becomes progressively more difficult to resist the next request on the basis of what has already been conceded. This is the problem that the profession faces in relation to the NHS network.
The effect of the market The object of the market in health care introduced in 1991 was, in Kenneth Clarke's memorable phrase, 'to allow money to follow the patient'. What was conveniently omitted is that with public money, an auditor will not be far behind! Thus each financial (and therefore patient) transaction needs to be verified. This is done by the dissemination of a common data set which uniquely identifies the patient, the diagnosis and the procedure for which payment is requested. Although the vast majority of patient transactions still take place under block contracts, where individual patient details are less common, the moves to more sophisticated contracts (such as cost and volume contracts based on individual procedures) inevitably require personal information to be transmitted round the health care system. Most clinicians are probably totally unaware that the information which they have supplied is being widely circulated among the largest workforce in Europe, so that the various transactions can be checked and approved for payment. Almost all patients are totally unaware that information, which some of them would regard as confidential, is being used in this way. Patient consent is not sought and although the Secretary of State has insisted that such consent is not a requirement for NHS treatment, the relevant circular6 makes no reference whatever to the problem that would arise if a patient expressed a specific objection to personal medical information being used in this way.

The NHS network
It is self-evident that computers have an enormous contribution to make to the practice of medicine. On J STUART HORNER, md, frcp, Visiting Professor, Centre for Professional Ethics, University of Central Lancashire 1 April 1996 the NHS Executive launched its computerised system, with the potential to link every department, every general practitioner and every administrative unit into a giant inter-communicating family. In time it will be possible for a receptionist in Cornwall to access electronically information retained by a general practice on one of the Scottish islands. The system can communicate with wider computer networks, such as the Internet, but only through a small gate by which transactions can be monitored. Some have seen more sinister motives for this gate. It has been suggested, for example, that access through the gate will be controlled by a monopoly provider. This is likely to increase the cost to the NHS compared with the competition from a more open market. Its existence will threaten current computer links between teaching hospitals and their medical schools. Currently such links operate through a variety of systems including the Internet. In future all such communications should be through the gate controlled by the monopoly provider. At present, the network is being used to process the financial transactions around the NHS market.
Although these already contain some personal medical information, it is not yet possible for the whole records of an individual patient to be computerised and placed on the system. It is, however, only time and resources that prevent such a development and doctors need to think about their attitudes to confidentiality before, rather than after, this process begins to gather pace .

Security
It is often claimed that present medical records are by no means secure8. Paper records are regularly perused by members of the ward team or the general practice team. Last year the Sunday Times demonstrated how easy it was to access sensitive information on paper records by deceiving the staff responsible for data security. Moreover, stories abound of paper records being found in consultants' cars, on rubbish tips, and generally treated in ways which do not inspire confidence in the present systems.
It is however quite wrong to argue that these lax measures are directly analogous to the problems of computer security and they are certainly no justification for laxity in new computerised systems. Paper records are normally kept in one location. In order to secure unauthorised access the individual must run the gauntlet of being spotted by the person currently supervising the records, and give a plausible explanation of why access is required. Electronic records are not, however, limited in time or space. In seconds the record can be copied and moved to an entirely different location, hundreds of miles away. Providing one is authorised to access the system, no-one will even know which individual has seen the record; neither can the unauthorised access be traced.

Security models
It must be stressed that the information management group that is pioneering the NHS network project has always known that confidentiality would be a key issue and has sought to address it. Unfortunately, it seems to have received attention later, rather than earlier in the process. Most attention has been focused on the outside hacker who might wish to gain unauthorised access to the system. The security model is also based on a hierarchical, military structure, which allows those on the 'shop floor' to have only restricted access, whilst those at the top of the organisation may have access to all the information that is available. Two fundamental errors seems to have occurred. First, the situation in the NHS aligns to that in banks and building societies. Here the problem is to ensure that the staff in one branch access only their customers' records and not those of customers in the branch next door.
In other words, the threat of unauthorised access from inside, rather than outside the organisation, is the foremost issue. Second, the NHS is almost unique in that its field level staff are the most able, the most skilled and the ones in whom the customers have confidence.
Whereas the bank teller can refer complex customer queries to more experienced managerial staff further up the line, in the NHS the consultant or the principal in general practice must resolve the issues themselves, perhaps consulting colleagues on an ad hoc basis, without any resort to the management chain whatsoever.
Thus the NHS network is in grave danger of introducing security arrangements that do not deal with the problems the organisation is likely to encounter9. As steadily more personal medical information becomes drawn into the network, it will be seen that the safeguards necessary to protect confidentiality simply do not exist. By then, of course, it will be too late. It is for this reason that the medical profession is being urged to delay using the system until such safeguards can be put in place.
Is there a solution?
One of the more irritating features of the present debate is that it is now known that simple and relatively inexpensive solutions exist. These would include: ? making it a criminal offence for anyone to use medical information for unauthorised purposes ? establishing an 'audit trail', so that any unauthorised access can be logged and traced. Fear of detection is a powerful deterrent ? adopting the security principles that have now been developed by Ross Anderson10 ? pursuing encryption and the use of 'ghost numbers', so that a financial transaction and a patient transaction can be uniquely identified, but not traced from one to the other. At present these security principles are being submitted to trial in a number of locations to confirm their feasibility. They have already been subjected to detailed academic assessment by the scientific community and endorsed as valid. Agreement has been reached with some computer suppliers not to link the full postcode with the date of birth. Not only does this information usually allow unique identification, but paradoxically it creates some risks when large numbers of people live in the same postcode area. Doctors using such information to access the drug regime of a college student, for example, might well find themselves acting on the information available for another student living in the same hall of residence.

Conclusion
The move to electronic data processing creates enormous potential for improvement in patient care. The systems presently being introduced, however, carry major threats for the confidentiality of patient information. As these threats become better known and understood, patients are likely to become increasingly selective about the information that they give to doctors. Such an apparently fanciful scenario is already practical reality in the United States. The technology exists to overcome these problems. It will require the medical profession to review the effectiveness of its present systems used to protect confidentiality. It will require legislative action and relatively minor and inexpensive technical adjustments to the system. Unfortunately, there is no evidence that the political will to pursue these solutions exists among government ministers, and there may be none even among doctors themselves.