Open Letter to Dr. Daniel Palestrant, CEO of Sermo.com

As someone who has an interest in healthcare technology and IT security, I've been paying attention to this. If Sermo's "social engineering exploit" were say, a vulnerability within a Microsoft product, you'd give the vendor a few days to a week plus to respond. If they respond politely and are interested in helping out, then they get disclosed after there's a patch to fix the vulnerability. However, if you as the discoverer of the exploit go unnoticed, then in the interest in security, publicly disclose the vulnerability.

Social networking for physicians sounds like a great idea. It really is. It's a way to keep out neurotic patients like myself and other third parties that would throw such a system into disarray. A lot of good could come from this. However, when you rely on easily accessible information that's in the public domain, it's open for abuse. Yes, it's identity fraud and illegal - I'm not disagreeing with that part and I would fully support the prosecution of someone who claimed to be someone else and besmirching that physician's name and reputation. One could imagine the havoc that masquerading as a high-profile physician and doing stupid things could cause. However, when the authentication mechanism is based on public information, that is a sign that you need to revamp the trust mechanism. That was lost in all of the mud flinging that's been going on between Medgadget, Sermo and the whole blog community.

This issue has ramifications across several areas. For example, I know of hedge fund managers who actually sign up for confidential clinical trials and participate in the trial in order to glean information about the particular drug that is not available to the public. If the trial is going well, then buy the shares, if not, sell sort.

This is just one example of what could happen in Sermo.

Security is critical and medagadget did everyone a service by exposing Sermo's flaws

Nick, I believe that there is a big difference between a vulnerability within a Microsoft product that is usually a minor issue that Microsoft itself is not aware of and a major design flaw that would be a stretch to assume that Microsoft didn't know about. Now imagine that Microsoft is well aware of the major major problem and still mis-advertises the product to consumers. I think that the proper analogy would be the cigarette makers being well aware that cigarette smoking causes increased chances of lung cancer while hiding that very same fact from the comsummers. People who exposed the issue were hailed as good guys and the cigarette makers were sued for not informing the public of the dangers that one faced.

Thanks for helping all narc seekers out there figure out DEA # and other info for calling in their prescriptions, jerks!

Keep up the good fight. I am a computer security professional (I know better than to call myself an "expert" with all the talent out there I used to work with) who is now a medical student. One of the most common mistakes to warn against is "security through obscurity." Transparency in the process (such as with open-source software) always provides the greatest degree of assurance, period. I have so much more to say and actually have recommendations, but I'll write those through the proper channels. Publicly, I just wanted to voice my support and say you are doing the 100% right thing.

The name-calling you experienced tends to occur when there is no accountability because of anonymous posting being permitted and when there is no moderation.

More concerning is the possibility that Dr. Palestrant is perpetrating fraud and deception via his corporation:

http://HeartMDPhD.com/SermoExposed

I'm in the process of creating a website for physicians different from sermo's model. does anyone have any recommendations on how to verify physician status online?