back to article Programmer's < fumble jeopardizes thousands of medical reports

A bug in code that generates medical reports could force patients in Ireland to repeat their hospital and clinic scans. The Emerald Isle's healthcare bosses have admitted a flaw in the PACS software used to store documents in its National Integrated Medical Imaging System (NIMIS) causes some records to not display a single, …

  1. David 132 Silver badge
    Coat

    Looks like...

    ...the code review was less than diligent.

    I'd make a cheap pun but I'm greater than that.

    1. The Man Who Fell To Earth Silver badge
      Thumb Up

      Re: Looks like...

      i m > u

      1. Arachnoid
        Pint

        Re: Looks like...

        My Dad > Your Dad

        1. Natalie Gritpants

          Re: Looks like...

          Me -> Your sister

    2. Rusty 1
      Coat

      Re: Looks like...

      I'll bet someone's equal to the task, more or less.

  2. Daedalus

    Markup language

    Perhaps the reports are being generated in markup language where "<" has to be escaped. Maybe somebody tried a shortcut trick and it backfired.

    1. Version 1.0 Silver badge

      Re: Markup language

      That sounds likely but you have to wonder about the amount of verification that should have been performed but clearly wasn't.

    2. Doctor Syntax Silver badge

      Re: Markup language

      "Maybe somebody tried a shortcut trick and it backfired."

      Not necessarily tried a short cut. I've seen repeated failures to escape apostrophes (ironically, mostly in Irish names) keep reappearing. I put it down to each fresh batch of programmers on their 6 month visas having to be educated about generating well-formed XML because they thought you could just copy the raw text to the output.

      1. Just Enough

        Re: Markup language

        I've worked with a system recently that completely broke if you typed & into a free text field. It threw away everything entered and gave an error message that explained nothing. And this was a mature system that had been running for years, but obviously testing hadn't noticed and no-one had thought it worth fixing.

        And systems that can't handle Irish O' are so common that it's ridiculous.

        1. LewisRage

          Re: Markup language

          I tried to do name normalisation for a client a while back, I naively set of with a 'Capitalise the first letter of the 2 names' rule, then realised that there were O'Briens (which is capitalised differently to D'eath) and so added an element to catch that, then a MacDonald was noticed so I added something to catch that and McD at the same time, then someone points out that there are people with hyphenated names, and people with 'van' in between names and on researching that I find that some people capitalise the Van and some don't.

          I quit in the end and never finished it all, so if you receive a marketing email from a British car parking company (a National one...) and your unusual name is mangled you can thank me.

          1. Doctor Syntax Silver badge

            Re: Markup language

            " then someone points out that there are people with hyphenated names"

            And multiple word surnames without a hyphen, which are even worse.

            I feel your pain. I had to deal with a situation where a client's client who had stuff properly structured decided they'd send us the names flipped with surname first but expected us to print them correctly. Add in the fact that there might be the occasion title; Prof or Sir etc in there and those names AFAICR hadn't been flipped. They saw nothing wrong until I pointed out a few examples. They then agreed to provide assistance. Instead of just sending the data as they had it the added a field to tell us which of 4 options to apply to reconstruct what they could have sent in the first place.

            1. LewisRage

              Re: Markup language

              @Doctor Syntax

              This stuff amazes me when I bump into it.

          2. Natalie Gritpants

            Re: Markup language

            Why didn't you just give up and use what the form filler typed in? most people know how to format their own name, and people with unusual names are used to telling another human how to. Also, lose the first-name last-name crap, you only have a 50% chance of printing them in the order acceptable to the named person.

            1. LewisRage

              Re: Markup language

              I did just give up; I changed jobs and stopped worrying about it!

              But yeah, thats what I should have done, as it was I was replacing a convoluted set of VB laden Excel docs and one of the functions there 'corrected' the name and I said I'd replicate it without really considering the complexities.

              What was there originally just capitalised the first letter of the two name fields so I got much further than it was originally but I'd have probably just given up and fallen back to the original if I'd stuck around to see it through.

            2. DJV Silver badge
              Facepalm

              @Natalie Gritpants

              "most people know how to format their own name"

              OMG, if only that was really true! I deal with customer entered data for several clients - and I am forced to say nope, nope and more nope!

          3. J.G.Harston Silver badge

            Re: Markup language

            ...and then you find that Mr Mace has been formatted as Mr MacE.

            1. LewisRage

              Re: Markup language

              @J.G.Harston

              Ha. Thankfully I specifically looked for the string 'macd', but like I say I'm sure there was loads of stuff I'd missed.

              1. Shady
                Pint

                Re: Markup language

                So the MacArthur's, MacGregor's and MacLean's were shit outta luck then? As are my ancestors, the MacPollen's.... No hard feelings, you deserve one of these for even attempting that task.

                1. Anonymous Coward
                  Anonymous Coward

                  Re: Markup language

                  And another issue comes when you deal with Koreans, who write the family name first.

                2. LewisRage

                  Re: Markup language

                  @Shady

                  ...shit!

  3. Anonymous Coward
    Anonymous Coward

    AIs first target ....

    spot dodgy code ...

    (It's actually a subset of a Turing test) ...

  4. Kevin McMurtrie Silver badge

    Escape!

    It sounds like bad escaping. Somebody should embed some good cat animations into the reports before it's fixed.

    1. CrazyOldCatMan Silver badge

      Re: Escape!

      good cat animations

      On the bad news front: you have terminal cancer.

      On the good news front: Amusing kitties!

    2. DJV Silver badge

      Re: Escape!

      Well, they should at least do a cat scan, anyway...

  5. Count Ludwig

    MVC Separation of church and state

    ... luckily the data in the reports was held completely separately from the component used to display it, so they only needed to change the displaying component to show ">" properly, and no patients were required to undergo re-testing ...

    Wasn't it?

  6. Simon Harris

    Unnecessary extra scans?

    "The majority of reports are either viewed on paper or electronically within NIMIS RIS, neither of which are affected by the symbol issue," the HSE added.

    So it looks like the notes are stored with the symbol and there are work-arounds for getting the correct description- surely extra scans (and thus extra x-ray exposure) should not therefore be necessary.

    As others said, it sounds like it could be a escaping problem converting the notes perhaps to HTML or XML - I wonder if ampersands also cause problems.

    1. Doctor Syntax Silver badge

      Re: Unnecessary extra scans?

      " I wonder if ampersands also cause problems."

      And names such as O'Malley.

      1. Anonymous C0ward

        Re: Unnecessary extra scans?

        And UTF-8 smart quotes.

  7. Anonymous Coward
    Anonymous Coward

    We had this problem

    We had this problem with our lab system. Medics are in the habit of typing "~" for "approximately" in clinical details when requesting. This broke the transfer of results from the Lab system to the reporting system until the reporting system suppliers fixed it (and charged for it).

    Programmers don't seem to realise that people free-typing stuff will type literally anything that the keyboard will allow (@ is another good example. So is the "any" key...)

    1. a_yank_lurker

      Re: We had this problem

      The way to solve this is by proper entry checking. But, I work a language that functionally has one type - string..

    2. Richard 12 Silver badge

      Re: We had this problem

      People free-typing stuff will eventually use every glyph in the font.

      And will find and complain about missing glyphs fairly quickly. After all, Irish names can contain any characters in Unicode. It's the Law.

      1. John G Imrie

        Re: We had this problem

        Any Unicode character?

        So I can call my self 'v   ᠎ ​ ৮̗̜͓̀̎d͓͚͐'

        1. Anonymous Coward
          Anonymous Coward

          Re: We had this problem

          From the Donegal 'v ᠎ ​ ৮̗̜͓̀̎d͓͚͐'s - yes?

        2. Anonymous Coward
          Anonymous Coward

          Re: We had this problem

          >So I can call my self 'v ᠎ ​ ৮̗̜͓̀̎d͓͚͐'

          How do you pronounce that? In my head it sounds like something that refers to womens genitalia..

        3. gaz.thomas

          Re: We had this problem

          Does that mean "garland of flowers"?

      2. Anonymous Coward
        Anonymous Coward

        Re: We had this problem

        7-bit ASCII or suck it.

    3. Whitter
      Boffin

      Re: We had this problem

      It is fairly standard practise to use tilde as "approximately equal to" as it resembles the standard mathematical sign quite well.

      https://en.wikipedia.org/wiki/Tilde#Approximation

      https://en.wikipedia.org/wiki/Approximation#Unicode

      1. Swarthy
        Headmaster

        Re: We had this problem

        @ Whitter

        So you're saying that '~' ≈ '≈'? Or is it that '~' ~ '≈'? Both?

        1. Whitter
          Thumb Up

          Re: We had this problem

          Well played sir!

    4. CrazyOldCatMan Silver badge

      Re: We had this problem

      Medics are in the habit of typing "~" for "approximately"

      Which is a well-known and completely valid use for a tilde character..

      Programmers don't seem to realise that people free-typing stuff

      In a previous life I worked for a company that did occupational health tracking software. One release, we needed to do a database upgrade and data-matching exercise and tried to automate it.

      Gave up in the end and hired a bunch of temps to re-key stuff because the medics only loosely matched the field name with the content they put in it..

  8. John Smith 19 Gold badge
    Thumb Up

    " and have formed an incident management team to decide the next steps to take."

    Unfortunate result but they seem to be handling it in a more focused way than I suspect would happen in the NHS, although they are considerably smaller. So thumbs up for that.

    So this weeks Top Tip:

    Confirm all characters that can be entered on a data record can both be displayed on screen and on reports, or some sort of commonly understood equivalent is done so instead.

    "<" (and while they're at it perhaps they should check ">" as well) are IIRC standard parts of ASCII, EBCDIC and Unicode. Others have suggested HTML and XML is where it gets tricky. :-(

    1. Fatman
      Joke

      Re: " and have formed an incident management team to decide the next steps to take."

      Which will consist of one director, two vice presidents, a C-suite executive, 15 managers, and one low paid code monkey.

  9. Ralph the Wonder Llama
    Joke

    Erm...

    'it's reported the bug has hit " 25,000" people'

    FTFY

  10. Anonymous Coward
    Anonymous Coward

    Perfect!

    Sorry that should read <Perect!

  11. anonymous boring coward Silver badge

    I'm < impressed.

  12. molletts

    Sadly, nothing new here

    I've encountered similar lack-of-escaping bugs on a pretty regular basis for years, in part because of my persistent habit of working in schools with apostrophes and/or ampersands in their names.

    Some websites totally crap out when you try to submit the name to register a product or download companion software. One even had a hyper-sensitive "hacking detector" that admonished me then locked out the county's outbound IP address for a minute each time I submitted the offending text. (They probably thought they were being really clever by detecting attempts at SQL/script injection or something. Maybe I should have set up a script to submit it automatically every minute to see if they noticed the sudden lack of business coming their way from an entire county.)

    One major technology retailer's site accepted the address but munged it on the shipping label, which isn't disastrous but is rather ugly - "St. Brutus&apos;s School &amp; Deranged Orang-Utan Containment Facility".

    Another completely omitted the address line containing the name of the school which is a little more troublesome - it took several failed (i.e. not attempted) deliveries before someone at the courier's depot thought to phone the contact number on the label (apparently, the drivers aren't allowed to carry phones) to find out exactly where in Snafu Road the parcel should be sent.

    Some would say I should just omit the non-alpha characters as a matter of course but I like to break systems then see how (if) the companies' tech support folks handle the bug report.

    1. CrazyOldCatMan Silver badge

      Re: Sadly, nothing new here

      but I like to break systems then see how (if) the companies' tech support folks handle the bug report.

      Now class, let's see how well your browser and DNS systems handle unicode characters that resemble CP430 characters but give a different value..

  13. Anonymous Coward
    Anonymous Coward

    yeah... < and > in med results can be pretty important.

    Critical difference between your kidneys working and being on the transplant list IIRC too... :oops:

    Did get a lot of help desk calls recorded when a system spat out &gt; rather than > as well.

    1. Anonymous Coward
      Anonymous Coward

      I have been meaning to sort out my own code which display £ and other unicode as something other than it should for a while now. Will probably tackle the &amp;lt; class of bugs as well. Thankfully it's not anything close to a critical system, and why no effort at all was put in to handle such things.

  14. Jason Bloomberg Silver badge

    Retests

    "A bug in code that generates medical reports could force patients in Ireland to repeat their hospital and clinic scans."

    I cannot see why when the data itself is said to be stored correctly and it's only one of the display mechanisms which renders that data wrongly.

    Hyperbole requirement for the week not met? Slow fake news day?

    1. CrazyOldCatMan Silver badge

      Re: Retests

      Hyperbole requirement for the week not met?

      Make hyperbole superlative again!

  15. ibmalone

    I wouldn't necessarily think this is an XML / escaping issue without knowing how their reports are stored. It may be as simple as a bad rule for non-printable characters for display, as DICOM tools can have varying abilities to deal with encodings other than ISO-8859-1. (On a PACS they may well be DICOM structured report rather than XML.)

  16. Anonymous Coward
    Facepalm

    A flaw in the PACS Medical Imaging System (NIMIS)

    What was the name of the operating system this software ran on. What was the name of the company that wrote the software imaging system?

    1. ibmalone

      Re: A flaw in the PACS Medical Imaging System (NIMIS)

      Not that simple http://www.mckessonimaging.ie/projects/nimis

    2. Anonymous Coward
      Anonymous Coward

      Re: A flaw in the PACS Medical Imaging System (NIMIS)

      My bet is on AGFA. They know how to screw up big time.

  17. SonarTaxLaw

    Not an isolated incident

    This looks like poor escaping. There is supposedly a standard for interfacing between medical systems called "HL7". V2 of HL7 is bad enough. V3 is starting to be rolled-out and it is a total cluster****.

    Anyway, as a regular user of these medical systems (not an administrator), I have yet to see one which correctly handles escaping across the various interfaces. Every single system I have used so far, at multiple hospitals and outsourcing firms, screws something up.

    For example, a common issue is incorrect handling of escaping. The character & is a special character in HL7, so needs to be escaped. However, it is rare for the receiving system to de-escape the text. Hence "The patient was advised to attend A&E" becomes "The patient was advised to attend A\T\E".

    Another common issue is incorrect handling of character sets. HL7 is meant to use UTF8. Occasionally, sending systems often screw-up the conversion from Win1252, or fail to do it, or do some sort of other incorrect conversion. More commonly, however, the receiving systems often assume that the incoming data is ASCII or ISO8501 and this buggers up accents (which some voice recognition software includes in phrases such as deja vu, or in the names of eponymous medical conditions). One example of this which has recently come to light is that dictating the word "dash" into dictation software generates an 'n-dash' character, which then gets lost in an incorrect character set conversion and converted to a question mark. This can significantly change the context of a medical opinion, by turning it into a question.

    Having had discussions with a bunch of vendors installing the software I use, most of them aren't interested. I certainly showed the rep from one the chaos coming from loss of accented characters - there was no interest to fix it other than "don't use accented characters in your reports/letters", after their tech support closed the ticket as "won't fix".

    Of course, it often isn't one vendor's fault - and at some sites, there are multiple systems doing incorrect escaping or format conversion - so you get HL7 escape characters interspersed with HTML codes like <BR>, or you get real beauties like A&E becoming A&bsol;&bsol;T&bsol;&bsol;E (at least 3 incorrect escaping there).

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like