SleepyHead Qt v0.8 alpha

[TalonNYC]

Heck, I wouldn't be surprised if Philips and ResMed start encrypting their data.

They may have to between now and 2014. HIPAA requirements are very vague, and a lot of medical device manufacturers are encrypting data just to not run afoul of the potential repercussions of the law. I know, it sucks, but I see it a lot in my day job.

[archangle]

Heck, I wouldn't be surprised if Philips and ResMed start encrypting their data.

They may have to between now and 2014. HIPAA requirements are very vague, and a lot of medical device manufacturers are encrypting data just to not run afoul of the potential repercussions of the law. I know, it sucks, but I see it a lot in my day job.

Good point. The real reason would be to keep their evil minions (DMEs and doctors) happy, but they'd claim it was due to HIPAA.

I bet a lot of DMEs and doctors have complained to the manufacturers when they find that users can adjust machines and read their own data. The medical mafia does not like informed and empowered victims.

[Breathe Jimbo]

I wish non-lawyers would stop acting like lawyers. HIPAA generally guarantees a patient's access to his own data. HIPPA cannot be used as an excuse for generally denying a patient's access to his own data. Indeed, any company that encrypted data and did not provide a means for the patient to gain access to the encrypted data would probably be subject to a class action lawsuit in the US.

Please, non-lawyers, stop spreading misinformation about legal issues!

[TalonNYC]

You're right, I'm not a lawyer, I'm a DR specialist. All medical data has to be protected so that it doesn't get seen by anyone except the person in question and medical professionals they have explicitly given permission to view it. If you have unencrypted medical information or personal information, and your laptop gets stolen, after 2013/14, your practice owes tons of cash in fines. You also have to publicly declare the breach, which results in you losing patients who realize their medical histories are floating around.

Same thing goes for data stored on medical equipement that you have any measure of control over. Since you (the DME) placed the device in someone's home, encryption is a simple way to make sure someone else doesn't waltz in and take all the data. Granted, the DME's are not fighting it because it ALSO means that we can't read our own data, but that's an effect, not a cause.

You're right, the law doesn't explicitly say you have to encrypt the data, but encryption is one of the easier ways to make sure you follow what the law DOES say. Just like the FDIC doesn't say that banks need to have backups, but if they can't file their FDIC reporting data on time they can be fined or even shut down, so they have backups to comply with the law.

The reason I know this is that my customers in the medical field are suddenly paranoid about their backup systems keeping the data encrypted so that they don't get nailed with fines.

No, I'm not a lawyer, but I am currently watching corporate and medical practice lawyers change how data is stored, so I get to see the fallout.

[archangle]

I wish non-lawyers would stop acting like lawyers. HIPAA generally guarantees a patient's access to his own data. HIPPA cannot be used as an excuse for generally denying a patient's access to his own data. Indeed, any company that encrypted data and did not provide a means for the patient to gain access to the encrypted data would probably be subject to a class action lawsuit in the US.

Please, non-lawyers, stop spreading misinformation about legal issues!

You would still have the legally required access to your data. All you have to do is talk to several people, get several different stories, file the appropriate paperwork, make an appointment, wait until the appointment to bring it into your equipment manufacturer's approved service center or DME with the appropriate security software, go to the appointment, find out they don't have the right software, reschedule the appointment, repeat the process a few times until you find someone with the right software who's smart enough to actually read it, let them read it, send the information to the doctor, pay for the appointment with the DME, the doctor, and the fee for printing the data out for you. Then go through the entire process again when you find that all you have is a blurry photocopy of a compliance data report. Spend several days with all the parties involved pointing fingers at each other and denying responsibility.

As for HIPAA protecting you, right now, I believe that Philips Respironics doesn't officially sell Encore Pro to patients. There is no approved way for a PRS1 patient to see his own airflow waveform data without having a DME and/or doctor print it out for him. All perfectly legal until someone successfully sues them to make them change the process.

[cflame1]

There is so... that's what Encore Viewer is

[archangle]

There is so... that's what Encore Viewer is

Encore Viewer does NOT allow patients to see airflow waveforms. Only EncorePro does.

Encore Viewer is not supported on 64 bit Windows machines, which is almost any PC you buy these days. Some people have managed to make it work on Win64 with a little hacking. I suspect this is PR's way of withdrawing the product without officially withdrawing it.

[robysue]

As for HIPAA protecting you, right now, I believe that Philips Respironics doesn't officially sell Encore Pro to patients. There is no approved way for a PRS1 patient to see his own airflow waveform data without having a DME and/or doctor print it out for him. All perfectly legal until someone successfully sues them to make them change the process.

And perhaps the relevant question becomes: How does one initiate such a suit? And on what grounds?

I'm not being facetious here.

After all, we are required to purchase these machines (usually with some assistance from our insurance) and then use them in our own homes in the privacy of our own bedrooms. I find it appalling enough that right now we are greeted with patronizing attitudes, if not out and out right scorn and lies, about the fact that we are entitled to see our own data----data that that is recorded by a machine owned by us, not the DME or doctor's office, and data that legally belongs to us. And add to that the industry's presumption is that we are too dumb to be able to make any sense of that data.

The idea that the data residing on a machine in my own bedroom might soon be encrypted in such a way that I would be completely unable to use it without playing significant phone tag with the DME or doc's office is outright appalling. The equivalent would be to sell a diabetic a blood glucose monitor with an encrypted data algorithm that requires the patient to take it back to DME or doctor's office for them to download any data beyond: You did test your blood today and you should presume your glucose level was OK since you feel OK.

There are ways to protect our data once it is downloaded to the DME's or doctor's computer. That can and should be done as part of an overall, larger issue of securing all the data on those machines. After all, the heart and soul of the argument of "What happens if a laptop with your CPAP waveforms, efficacy data, and compliance is stolen?" applies even more so to all the other data that the DME/doc has collected on us: Rather than somebody getting a hold of my efficacy data (and doing what with it?), I'm much more worried that the thief of that laptop is much more likely to be interested in my credit card number, my insurance card number, my phone number, my address, etc., all of which is more valuable (can you say "identity theft"?) that the fact that I've got a near 100% compliance record on my CPAP/BiPAP since Sept. 2010 with AHI's consistently around 1.0 to 2.5.

But, alas, none of this will change as long as the CPAP manufacturers think of the DMEs as their customers instead of us.

And I still think that the CPAP manufacturers could learn a lot from the Scooter-chair makers, the diabetes supplies makers, blood pressure monitor makers, and many drug companies, all of whom market their equipment/drugs directly to the patient. Imagine : If the PAP manufacturers would figure out a way of running a really clever advertising campaign aimed at the large mass of folks walking around with undiagnosed OSA and manage at the same time to reduce the substantial negative stigma that is attached to both OSA and the very idea of sleeping with a PAP machine, the number of folks being willing to get tested would go up, the number of people accepting the challenge of making this therapy work would go up, and ultimately, their profits would go up. And just what would that advertising campaign need to make use of? People in control of their OSA instead of OSA destroying their lives. And that would, naturally, include people knowing and understanding the efficacy data among many other things:

Hi, I'm RobySue and I have OSA. WIthout CPAP my AHI was 23.4 and I woke up tired and in pain and listless most days. But with the help of this marvelous S9*, my AHI stays between 1.0 and 2.0. And I've got so much more energy these days---energy to do the things that I simply wasn't able to do before, like climbing this wonderful mountain here in the background or dancing in the disco with my hubby or enthusiastically playing with my puppies in the park ..... With the voice over then saying something to the effect of, "If you wake up feeling unrefreshed most mornings, have morning headaches, excessive daytime sleepiness and fatigue, or snore, you may have OSA, ask your doctor about OSA. And if you are diagnosed with OSA, be sure to ask for a Resmed S9 machine to treat your OSA. Our machines are quiet and easy to use with features that matter most to OSA sufferers as heated humidification; the ClimateLine hose---a heated hose that provides state of the art protection from condensation; our pattened EPR system to make exhaling easy and breathing with the machine natural; full leak data so you can proactively deal with any leak issues; full efficacy data so you know your OSA is under control night after night; and a user friendly software system for fully monitoring your condition. So you can get on with the business of living your life to the fullest.

* I tried to write this for the PR System One that I now use since I really do find the PR System One BiPAP much more comfortable to sleep with night after night than I did the S9 AutoSet. But "Full leak data" just ain't there, even with Encore Viewer: I've been using the S1 for close to 10 months now. And I still have only the foggiest notion of what actually triggers a "Large Leak" and in my particular situation, "Large Leak" is all but impossible to trigger no matter how badly I'm leaking. When the DME was testing my machine to see if there was something wrong with it, they were able to "duplicate" a Large Leak that topped out at just over 80 L/min.

In actual use? In 10 months of use, I have had one large leak flagged in use: Back in June, I did have a total leak that hit 60 L/min for 2 minutes that got flagged as a Large Leak. At my range of pressure settings, my intentional leak is 20--29 L/min; so that 60 L/min figure represents an unintentional leak of somewhere between 30 and 40 L/min. Moreover, this two minute horrendus leak was in the middle of a very bad 50 minute period where the total leak rate steadily and rapidly increased from about 20 L/min (baseline) to about 50 L/min in a ten minute period, then bounced up to 60 L/min for two minutes, and then settled back in at the very elevated (for me) level of 35-45 L/min for 40 more minutes before I woke up, turned the machine off, fixed the leak and turned the machine back on. During that whole 50 minute period, there's at least 10-15 minutes where the total leak rate is at or above 45 L/min, which is 25 L/min above my normal baseline of about 20 L/min. If a similar leak had happened when I was using the S9, it looks to me like about 20--25 minutes of that nasty leak would have been over the infamous RedLine at 24 L/min for unintentional leaks, with a sizable chunk of the rest of it just below the RedLine. Not enough to trigger a visit from Mr. Red Frowny Face; but evidence in ResScan that the leak was long and significant.

[TalonNYC]

The problem, as I've already complained about in another forum, is that ResMed has already begun shipping units with wireless communication cards on them. That means they can be hacked, which means the data could be accessed. Other vendors will no doubt start enabling their devices with remote connectivity. Then we're off to the races.

Using encryption like this legally protects the vendors, and as long as they can say "the DME and or the doctor can give you the information" - even if we ALL know it's not true - they can encrypt it to cover their own asses.

Glucose meters are non-networked devices, and therefore can't transmit data or be remotely accessed unless you willingly plug (some of the more advanced ones) into your computer. So they don't need to be encrypted because your data can't be accessed by anyone (not even your doctor) unless you willingly give it up. xPAP machines are becoming connected, and therefore pose a security threat.

No, neither the vendors nor the DME give a damn if we can't read our data because "the DME and/or doctor can supply you with your information on request."

The only thing we can do is demand non-networked, non-encrypted brands and devices. If enough people speak with their wallets, the vendors change things.

[ignorant1]

Sorry to be an interloper and interjecting something different here, but at the suggestion of Pugsy I am posting an issue here for JeddiMark to see.

SleepyHead software apparently does not currently support the Resmed S9 VPAP Adapt (an ASV device.) Pugsy suggested that perhaps JeddiMark does not have any data from one of these ASV units to facilitate development of SleepyHead to work with them.

If that is the case, I would gladly send my data to JeddiMark. Pugsy suggested that JeddiMark monitors this thread – so please let me know if I can help!

Here is a link to the thread that I posted regarding the error message that I receive when trying to import data to SleepyHead: viewtopic/t70917/SleepyHead-software--P ... ows-7.html

[Breathe Jimbo]

Pugsy suggested that JeddiMark monitors this thread...[/url]

He does, but it is still best to join either the sleepyhead-devel or the sleepyhead-users mailing list. Go here to do so:

http://sourceforge.net/mail/?group_id=513997

-devel is more for geeks, -users for regular users. You can join both if you so desire. You will probably need to create a sourceforge account if you do not already have one.

[jedimark]

Hi, I am still alive.. and I do monitor this thread.. :}

Apologies If I've missed anyones posts here.. I've been a little out of it this last few weeks.. Had a couple of weeks of mega-fog, then my appendix extracted, plus some minor heart troubles yesterday (nothing another visit to the ER and a little shock couldn't put right.)

@ignorant1: I have tinkered with some S9 VPAP, and it mostly works.. By the crash your getting, it might still need more work - I can't remember if the last VPAP changes I made were before or after the last test binary build.. Anyway, more data is always good.. PM me and I'll give you my email address to send it to.

I'll try to get another build up soon, there's a few new nice features that have been added in source that need a little further testing.

One thing I do need opinions on: The flow waveform now shows the AHI for the selected area. When zooming in on a particularly busy area, with a selected time of less than 1 hour, the AHI calculations goes up, sometimes quite a bit.. Technically this is correct, as AHI calculations is [count of events] divide by [time in hours].

Would anyone find this confusing? or would people be more comfortable with the AHI calculations time divisor to be capped at a 1 hour minimum?
Jimbo suggested calling it Relative AHI.. anyone else have any suggestions?

[archangle]

Glad you're doing better. Take care of number 1 first.

Oooh, the more I think about instantaneous AHI, the uglier it gets. If you sit in one spot and zoom in, the AHI number will go up. which I think will be confusing. Not calling it "AHI" is definitely a good idea. As a silly example, if you look at a 1 minute window, the only possible values would be 0, 60, 120, 180, etc.

I need to do some deep thought about what would be "right" there.

I'm a little concerned about the idea of making up a new measurement term, or "redefining" an existing term.

I wonder what number the manufacturers report if, for instance, you run the machine for 2 minutes and have one apnea? Do they report it as AHI=30, or just don't report?

Think about what it would look like if you graphed this "short term AHI value". Since the AHI index is based on a low number of discrete events spread over a fairly long time period, the idea of short term AHI numbers gets complicated. You almost need something like a shaped time window like an exponential decay function.

If you do just a 1 hour square sliding window, it will jump up by 1 every time there's an event, and even more confusingly, drop 1 unit one hour after every event. If you have a single event or a small cluster of events, it will jump up and stay up for 1 hour after the events have stopped.

I'm not necessarily suggesting implementing a complicated function in SH to calculate that. I'm just thinking that the math and philosophy involved is complicated. I'm not sure there's a good answer.

[jules]

"local AHI" where the whole night would be a "global AHI"

[Breathe Jimbo]

Another idea:

"Daily AHI" - for the entire day, reported in the stats on the left.

"Partial AHI" - for only the selected part of the day, reported atop the flow graph.