ACTION ALERT: Your CPAP data is being held hostage - ACT NOW!

[srlevine1]

I’ll vote with my dollars. if i have to jailbreak my A10 to continue using it, then so be it.

Jailbreak, such an ugly "searchable" word.  I prefer user-enhancement. 

[SuperSleeper]

I just sent out 14 personal letters to various manufacturers via U.S. Postal system (under my own name).  Going to print out a bunch more to send to the various press outlets.  Already sent emails out, but I figure the more response they get from various methods, the better.  I hope to make phone calls to these organizations as time permits later this week.

Those are all under my own name - not Apnea Board.  Later, I hope we can send out official press releases on behalf of Apnea Board itself.  I wanted to wait on that until we build up momentum here in this thread first.

Keep up the pressure, folks!  We will prevail if we don't quit.  

[DaveL]

This is a return to the bad old days. (Prescribed "bricks" so the owner couldn't take control.
Sleep doc had full control, but didn't want to do the work.
So they pushed it down to the DME suppliers.

Now even though I have a ResMed S10 the DME supplier checks my performance.

[Dormeo]

I appreciate having all the contact information and will use it to help get this issue aired out publicly. As others have remarked, we surely should have a right to direct access to our our medical data, generated by our bodies, on machines that in many cases we own.

The restriction of patient access to what have been comfort features is a slightly separate issue, but the two are closely connected because both of them create more need for more patients and insurance companies to pay more to medical providers and DMEs for more services.

I would think that insurance companies would be potential allies in this struggle. Do we know whether that's so?

[Sleeprider]

It's no accident that Philips names their proprietary, professional only subscription software "Care Orchestrator.  It makes Philips the director of all the valuable data to "orchestrate" patient care.   https://www.careorchestrator.com/proxy/c...trator.htm   Granted that Resmed does not make AirView available to patients, but they also don't encrypt their SD cards.

There is a lot of information from Philips here telling us they intended the encryption to be strong: "Care Orchestrator is highly secure to help meet requirements for HIPAA compliance and privacy laws. This includes access security as well as the security and privacy of transmitted data."  HIPAA was never intended to keep a patient's data from the patient, but this scheme channels all information through the professional subscriber.  I wish it didn't need to be said, but "professionals" have been failing patients for a long time.

Above all, changes to patient's machine settings should only be done under the direction of a licensed physician, yet we know that prescription authority for CPAP does not require a physician to prescribe.

Warnings

•     Care Orchestrator should not be used to diagnose the condition of the patient.
  
•    Care Orchestrator is not a substitute for direct patient monitoring.
  
•    The data provided in Care Orchestrator is only one of several elements to consider when evaluating the effectiveness of the therapy.
  
•    Prescription changes should only be made on the order of a licensed physician.
  
•    Creating or changing a prescription should only be completed by a trained medical professional.
  
•    A patient’s prescription should be verified as correct before transferring it to the patient's therapy device.
  
•    Associated therapy device manuals should be read and understood prior to viewing compliance data or changing a patient’s prescription.
  
•    System access features should not be disabled. These features provide a secure work environment to reduce the probability of unwanted access to the system. Users are responsible to follow the policies and procedures that govern their business practices when altering security settings.
  
•    An SD card or USB drive should never be removed from the reader during data transfer to or from the card. Users should wait for the confirmation message to display following the read/write operation.
  
•    Timely assignment (and de-assignment) of a device serial number will reduce the potential for issues when re-using devices between patients.
  
•    Data originating in Care Orchestrator, and transferred to removable media, downloaded and/or printed, contains sensitive personal data, and should be treated in a confidential manner.  It is your responsibility to control the use and distribution of these outputs to only authorized individuals.
  

[mesenteria]

As already suggested, we might need to develop our own in-house 'liberating software'.  These machines use a decoder or something like it to effect the treatment.  There's an eprom or other flash basic firmware, and then it can be updated...except only by the importers/manufacturers, or their designated agents.  If we had our own decoders/arduinos....whatever, and a counterpart to OSCAR.....the rest is just a programmable brick.  This would be for those who can stomach losing their warranty.

[SuperSleeper]

Interesting... I would think it to be possible to extract and save the firmware for one's DreamStation 2 machine (the firmware version that OSCAR developers already know how to decrypt), then if Philips does an over-the-air firmware update that changes the encryption, simply re-flash the firmware to the previous version.  The only thing that would be a pain is if a DS2 owner kept having to do that on a regular basis in order to read data.  Turning off or disabling the cellular modem might become necessary at that point, assuming the patient's compliance data wasn't still being sent out using that method for insurance purposes.

We already have had several people update their DreamStation (original series) firmware using the firmware supplied by Apnea Board (here) [login required].  The process has risks, but it isn't rocket science.

Extracting and saving one's firmware for a potential roll-back (if needed) would certainly be an option, would it not?

[RayBee]

Hmmm...
I wonder if there would be a way to identify code within the firmware that is responsible for allowing remote firmware updates and disable that function during the re-flash???
Gee. A perfect-ish world for DS2 users?

[SuperSleeper]

I would think that insurance companies would be potential allies in this struggle.  Do we know whether that's so?

One would normally think so, but I fear that insurance companies have a vested interest in keeping the status quo, which has been fine-tuned to maximize profits for all their "partners" in health care - the manufacturers, physicians, sleep centers, DMEs, etc. and the insurance companies themselves.

Might be my shortsightedness, but I can't envision any health insurance company advocating for a patient's freedom to self-treat and by-pass health care providers-- at least not the way in which we do it here on Apnea Board.  The shear fear of legal issues would likely keep them awake a night if they were even hint that a patient take control of their own health care independent of pre-approved medical "professionals".

However, perhaps I'm not thinking of something.  I'd sure like to believe that there's some way we could enlist the help of insurance companies.  I just can't think of any workable method right now that would be acceptable to their business model, or their legal departments.

Any ideas?

[SuperSleeper]

Hmmm...
I wonder if there would be a way to identify code within the firmware that is responsible for allowing remote firmware updates and disable that function during the re-flash???

There is undoubtedly a way to do that.  It's code, after all.    The problem is that the OSCAR team has never advocated for using OSCAR to change any CPAP settings, and would likely be very reluctant to tarnish OSCAR's reputation by doing something that is akin to "jail-breaking" one's CPAP machine.  OSCAR is meant to read one's data only.  It has to remain that way in order to retain integrity of reporting.

If any firmware tinkering were to be done to disable any over-the-air updates, it would have to be done by some anonymous group of white-hat hackers.