EncoreAnywhere how do you feel aboutit?

Mikeb1369 · Post by **Mikeb1369** » Wed Jun 20, 2012 9:53 am

For EncoreAnywhere, does anyone have an idea on what the resolution is of the detailed breath by breath data (5hz, 1hz, 0.01 hz?).
How much data is captured. How often is it captured? One night every 7 days? Is it on the smartCard or is it wireless?
How long is that data stored? Forever? 1 year? 1 month?

Any answers to any one of these questions is most appreciated!!!!

BasementDwellingGeek · Post by **BasementDwellingGeek** » Wed Jun 20, 2012 10:49 am

The Respironics equipment logs breathing samples 5 time per second (5Hz) to the SDCard. It is captured when ever the the machine is on. With every session a new set of files is generated. I have no knowledge on EncoreAnywhere.

I had a modem on my machine during compliance monitoring. I would get a phone call and snail mail once a month stating that was or wasn't compliant and leaks were OK. I seem to recall the woman saying something like "we downloaded the data for the month". I have no clue what they were using at their end.

Unless you have a new Model 60, SleepyHead software will read the SDcard and show you your waveform, leaks and AHI events.
http://sourceforge.net/apps/mediawiki/s ... =Main_Page

greatunclebill · Post by **greatunclebill** » Wed Jun 20, 2012 11:11 am

http://www.healthcare.philips.com/us_en ... nshots.wpd

looks like just summary data to me. the other thing is if everybody concerned can dial up your info at any time, you are on-line at all times. not a good idea.

chunkyfrog · Post by **chunkyfrog** » Wed Jun 20, 2012 11:17 am

Medical privacy; meet 'the cloud'.
This cannot turn out good.

akcpapguy · Post by **akcpapguy** » Wed Jun 20, 2012 12:44 pm

It records ALL that same data that you can get from an SD card.
In the beginning the data is transmitted at 12 p.m. daily, however if you have an altered sleep schedule (ie. night shift worker), the modem is smart enough to adjust for this. I am not sure of the exact specifications, but I know that the modem cannot upload data while the blower is on. So, if it attempts to upload and the blower is on, it will stop the upload attempt and schedule it for a later time. I am unsure what the timeframe is, I believe it will attempt to do this 3 times automatically, after that it will stop attempting until the next day at 12 p.m. Once the modem finds a time for upload that is successful for a couple of days it will alter the initial upload attempt time to this new time, say for example 3 p.m., and this will be the new upload time until the previous situation repeats itself.

Many DME's and Sleep Labs are transitioning to Encore Anywhere, the main reason is that they don't have to deal with updating Encore Pro all the time and the removal of the responsiblity of data security. NO personally identifyable information is transmitted from the modem, the serial number on the modem is linked with your account in Encore Anywhere. When your data is uploaded it gets tagged with the modem serial number and then associated with your record once it is in the database server. The data upload can be initated by either yourself or remotely from Encore Anywhere.

Like it or not this is the way the PAP industry is heading. I would say that Encore Pro will stop being updated within the next 5 years or so and the only way to get data from the new PAP's will be through a cloud based application. I may be wrong, and with the advent of Sleepy Head it may be a moot point.

Our office is currently running a trial of Encore Anywhere and I like it. Our intent is to only monitor patients with the modem long enough to collect enough usage data to satisfy insurance and then remove it. The last thing that I want is people feeling that "Bid Brother" is watching them all the time. For us it is simply going to be another tool collect compliance and efficacy data on patients who we otherwise would have a diffcult time getting data on.

Anyway i'm rambling now, if you have any questions fire away and I will answer them to the best of my ability.

chunkyfrog · Post by **chunkyfrog** » Wed Jun 20, 2012 1:24 pm

This sounds like the machine would need full-time access to the Internet.
Interesting to see how that is done. Blue tooth to my service, or its own dedicated smartphone?
How much would that cost me? and, last but not least: my BIG WORRY:
If DME's have access to efficacy data, can they then lock us out of it?
(just for the heck of it)

akcpapguy · Post by **akcpapguy** » Wed Jun 20, 2012 1:47 pm

The current modems use cellular technology (not your cell account), so as long as you have cellphone service at you home it will be able to upload your data.

WE will not be charging our customers (that’s for you Slinky) for having the modem on their PAP machine. There is a monthly charge to us per modem (and ofcourse the initial cost of the modem), however we crunched the numbers and ignoring the clinical benefit to having access to daily data, we determined that it’s a cost we are willing to financial pay in order to help keep our customers compliant. Slipping into DME money mode for a minute, “A compliant PAP patient equals reoccurring revenue for the DME, it should be in our best interest to keep people compliant on PAP machines”!

The DME company has no more ability to lock you out of data while the modem is on your machine than they do during the initial setup of your machine. Certainly they could go in everyday and reset your data and or pressure and lock the screen displays, but I’m sure you are resourceful enough to find a work around for that problem. Besides I would find those to be very vindictive actions and would run from a DME like that.

pats · Post by **pats** » Wed Jun 20, 2012 2:05 pm

akcpapguy wrote:Many DME's and Sleep Labs are transitioning to Encore Anywhere, the main reason is that they don't have to deal with updating Encore Pro all the time and the removal of the responsiblity of data security. NO personally identifyable information is transmitted from the modem, the serial number on the modem is linked with your account in Encore Anywhere. When your data is uploaded it gets tagged with the modem serial number and then associated with your record once it is in the database server. The data upload can be initated by either yourself or remotely from Encore Anywhere.

I hope there is a lot more to it. That, taken alone, would be extremely weak security.

A few years ago, I did some work with a database of location data. In my research copy of the database we had replaced the user identifiers with numbers, and I made sure did not have access to the key. Nevertheless, without even trying I recognized some individuals. To take a really easy case, I knew my academic adviser's office number. He had to be the user who spent several hours a day, including my research meetings with him, in that office. From that, I could have read the rest of his location data.

In the same way, knowing when someone had started XPAP treatment and a few special events that would be reflected in the record would be sufficient to determine that person's modem number. With the rapid advances in correlating large databases, you can't just look at one set of data, and assume it won't be combined with any other information.

Are there any publicly available papers by experts - preferably peer reviewed - giving a more complete picture of EncoreAnywhere security?

greatunclebill · Post by **greatunclebill** » Wed Jun 20, 2012 2:53 pm

troublemaker hackers don't hack into things or send infections to get personal information. it's a given that when a virus screws up your computer it's not collecting information. they do these things for the pure enjoyment of disrupting and destroying things. i don't care how many fairy tale, happy ending stories i hear or how many papers are published by people in it for profit, my cpap will never be hooked to the internet. someday we'll read about 100,000 cpap's crashing from a script kiddies bug that these self named experts never thought possible and needing to be re-programmed. it won't be mine.

akcpapguy · Post by **akcpapguy** » Wed Jun 20, 2012 3:15 pm

Yes I'm sure there is more to the equation than just the modem serial number. While I also hold a degree in IT, I don't currently work in that industry (however if anyone has a remote work from home position available) , my expertise is not in database or cellular data security. In your example you had access to the data and knew when and how often data was uploaded. I would assume that Respironics database administrators would have access to that information as well, however I am not so sure they would have access to location data. I am guessing one would need access to cell tower location data to determine specific location of the modem.

I am not aware of any papers examining the security of EncoreAnywhere.

pats · Post by **pats** » Wed Jun 20, 2012 3:22 pm

greatunclebill wrote:troublemaker hackers don't hack into things or send infections to get personal information. it's a given that when a virus screws up your computer it's not collecting information. they do these things for the pure enjoyment of disrupting and destroying things. i don't care how many fairy tale, happy ending stories i hear or how many papers are published by people in it for profit, my cpap will never be hooked to the internet. someday we'll read about 100,000 cpap's crashing from a script kiddies bug that these self named experts never thought possible and needing to be re-programmed. it won't be mine.

Far worse than CPAPs crashing would be a Stuxnet-like situation in which they go on appearing to work, and deliver everything-OK reports, but are quietly doing destructive things. Stuxnet was at the limits of the technology, but it does not take long for the most sophisticated exploits to become something every script kiddie can do. The CPAP equivalent of running up the centrifuge speed would be to gradually reduce pressure in the middle of the night. Any relationship between reality and the recorded pressure and event logs is a matter of software on the CPAP. So is any relationship between the pressures shown in the menus and the actual pressures being delivered.

One of the things I would be looking for in any review of the security would be a way to absolutely prevent any remote writes in the hardware. If I could be sure of that, and given reasonable data security, including encryption, proper access monitoring etc., and I might consider allowing remote read-only access.

pats · Post by **pats** » Wed Jun 20, 2012 4:57 pm

akcpapguy wrote:Yes I'm sure there is more to the equation than just the modem serial number. While I also hold a degree in IT, I don't currently work in that industry (however if anyone has a remote work from home position available) , my expertise is not in database or cellular data security. In your example you had access to the data and knew when and how often data was uploaded. I would assume that Respironics database administrators would have access to that information as well, however I am not so sure they would have access to location data. I am guessing one would need access to cell tower location data to determine specific location of the modem.

I am not aware of any papers examining the security of EncoreAnywhere.

I'm also far from an expert, but did go to some seminars on security as a graduate student. The lack of a published paper would definitely be a danger sign to me.

chunkyfrog · Post by **chunkyfrog** » Wed Jun 20, 2012 5:38 pm

I work for county government, and we have heard all kinds of sales talk about 'the cloud'. "Yada, yada, yada"
Regardless, all our software and data resides on secure machines,
instead of out there somewhere we don't even know, much less can control.

EncoreAnywhere how do you feel aboutit?

EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?

Re: EncoreAnywhere how do you feel aboutit?