Schneier on Security

Sorry if this is a bit off-topic. It is about the databases used for permanent medical records in the US, which seem to be modeled on those used by homeland security.

On my last visit to the clinic, I was told to fill out an extensive history, which was then entered by the physician's assistant before the doctor came in. There were several questions that had no satisfactory answers available on the form. For example, smoking history was defined as the length of time between the age of first cigarette and the last. Like most people who try it, I experimented with smoking in high school; I also had two cigarettes while talking a smoker friend through a divorce several decades later. Between these events I led an athletic life which included cycling an average of sixty miles per week for more than fifteen years. The only way the computer system would register this information was as an uninterrupted thirty-year habit, despite the fact that the total number of cigarettes I have smoked averages to about half a pack per year over that period.

The PA apologized for the system, explaining that he had no way to comment or alter the online form. I called the clinic administration after my appointment and was told that, like no-fly lists and security theater info-dumps, there is no correction mechanism or access to their database (it is administered by a third-party contractor).

This is not only misleading to medical staff who may be evaluating possible treatment options for patients, it provides the data insurers use to determine premium and coverage rates. I fully expect to see my rates balloon next time I must switch insurance.

I thought it was bad enough when I tried to have a mortgage from a state I have never visited removed from my credit report several years ago, but at least those are semi-visible. What is it about information-systems contracting that perverts a reasonable idea (tracking incidents of crime, maintaining medical records) into a dump of inaccuracy and petty vendettas?