Quote Of The Year

Timeless Quotes - Sadly The Late Paul Shetler - "Its not Your Health Record it's a Government Record Of Your Health Information"

or

H. L. Mencken - "For every complex problem there is an answer that is clear, simple, and wrong."

Saturday, November 12, 2016

Weekly Overseas Health IT Links – 12th November, 2016.

Note: Each link is followed by a title and few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.
-----

Organizations lack trust in insights from data and analytics

Published November 01 2016, 2:20pm EDT
A majority of business leaders believe in the value of using data and analytics to drive decisions in their organization, but say they lack confidence in their ability to measure the effectiveness and impact of data and analytics. Further, they mistrust the analytics used to drive those decisions.
Those are among the findings of a new Forrester Research study commissioned by KPMG, “Building Trust in Analytics.” The study polled 2,165 professionals from 10 countries to identify in which areas businesses are using data and analytics, and to what extent they trust the models and processes they used to drive decision making and desired outcomes.
The survey revealed that a large number of organizations (50 percent) use data and analytics to analyze existing customers; to find new customers (48 percent); and develop new products and services (47 percent). But the same executives say they do not trust that they are managing their data and analytics processes effectively to generate desired outcomes, and they lack the measures necessary to evaluate those models.
-----

E-health Market to Reach $212.76 Billion with 14.56% CAGR Forecast to 2020

The global e-health market is expected to grow at a CAGR of 14.56% to reach $212.76 billion by the end of 2020 from the estimated size of $94.12 billion in 2014
Pune, India - November 4, 2016 /MarketersMedia/ --
The global E-health market is expected to grow at a CAGR of 14.56% to reach $212.76 billion by the end of 2020 from the estimated size of $94.12 billion in 2014. The term e-Health was introduced in the 7th International Congress on Telemedicine and Tele-care in London in November 1999, by John Mitchell. Though the term has had many definitions, however, it can broadly defined as integration of electronic communication and information technology in the health sector in order to make it more convenient and cost effective. It encompasses three main services, they are usage of IT and E-commerce for improved health products and services, management and delivery of health information to patients using internet and telecommunication and usage of E-business and E-commerce for improved management of healthcare systems.
-----

Federal government, healthcare at the same tech crossroads

Published November 04 2016, 7:36am EDT
Whether information technology is increasingly making an impact on both the federal government and healthcare, the result is the same, believes Tony Scott. Given full freedom, IT will “blow up the org chart,” forcing change in the way things have always been done.
Scott, as chief information officer in the U.S. Office of Management and Budget, should know. As the highest ranking CIO within the Obama administration, he’s been leading the charge for increasing the transformative use of technology by the federal government.
From his experiences, Scott can sympathize with healthcare CIOs, he said at the CHIME 16 Fall CIO Forum in Scottsdale, Ariz. “The digitization of the enterprise is a transformation that is taking place in almost every country around the world,” he says. “In the federal government, it is both a great challenge and a phenomenal opportunity.”
-----

AI Takes On Drug Safety

November 1, 2016, 8:00 AM EDT

IBM Watson Health tries to do what no pharma company has done: solve the drug-safety puzzle.

Big Blue has found yet another business application for its precocious cognitive computing system. IBM Watson Health is collaborating with the biopharmaceutical company Celgene to develop a new platform for evaluating the safety of drugs—both before and after they hit the market—the two companies are announcing this morning. The new offering, “Watson for Patient Safety,” will gobble up anonymized medical records, claims data, and millions of electronic submissions to the FDA about potential drug side effects (known as individual case safety reports) to see if it can learn about the hidden dangers of medicines before they become too costly.
The problem is one of the toughest in drug development. Many chemical agents (and maybe even most) interact with more than one “target”—meaning that if a drug has a molecular effect to begin with, it very likely will have one or more side effects. Throw in complication No. 2: We humans, it would appear, are different from one another—meaning that if our eye color and quantity of back hair are dissimilar, we very likely metabolize and react to drugs in different ways, too. There’s more—but suffice it to say this one’s a doozy. (Here’s me going on about it at length.)
-----

Why HIPAA needs an update

by Dan Bowman 
Nov 4, 2016 2:07pm
While technology and innovation in healthcare has undergone a rapid evolution, the Privacy and Security Rules within the Health Insurance Portability and Accountability Act have remained stagnant, say registered nurse Karen Colorafi and attorney Bryan Bailey.
To that end, Colorafi, an assistant professor at the College of Nursing at Washington State University, and Bailey, of Phoenix-based firm Milligan Lawless, believe the rules should be updated to keep up with “unimaginable” advancements over the last 20 years.
“The Security Rule was created with unusual foresight as a set of flexible requirements that could change and adapt with innovation,” the authors say in a viewpoint published in JMIR Medical Informatics. “Yet every week, the headlines online and in the papers discuss significant HIPAA infractions. ... We listen to stories from our friends and patients about the battles they have mounted to gain access to their own healthcare data.”
-----

Natural language processing can capture EHR data more quickly

Nov 2, 2016 10:35am
Natural language processing (NLP) shows “promise” in improving electronic health record documentation, recent research shows.
EHRs need clinical notes and reports to be in both human readable and machine readable formats, which requires more work and new computer skills for physicians. To that end, researchers from Arizona State University and elsewhere wanted to determine if NLP would be a viable solution for clinical data capture by using dictation rather than keyboard and mouse data entry.
In a study published in JMIR Medical Informatics, they evaluated an NLP-enabled solution, focusing on three data capture problem areas: efficiency, effectiveness/documentation quality and physician satisfaction/ease of use. The researchers compared four different protocols: the standard keyboard and mouse method; a fully NLP method; and two hybrids that used both standard and NLP methods.
-----

EHR vendors blocking docs from sharing data with specialty registries

Nov 2, 2016 12:05pm
Electronic health record vendors are interfering with physicians’ ability to share data with registries operated by specialty societies.
Specialty registries, such as tumor registries, are particularly effective at analyzing data regarding that condition. Data exchange between registries and physicians have also shown to improve patient care.
However, according to an article in Politico, many specialties use third-party software over that of their EHR vendors, which view the separate software as competition. The societies have accused the vendors of delaying requests for data exchange, quoting “prohibitive” prices for integration or outright refusing consent to transmit and instead offering to sell physicians their own software to send data to the registries.
-----

Intensive care at home can cut costs, increase patient satisfaction

Nov 3, 2016 11:16am
Intensive home health care, an alternative to hospital admission, offers the potential to ease bed-capacity problems, cut costs and improve patient satisfaction, according to a perspective article published in The New England Journal of Medicine.
It’s an idea being used countries such as United Kingdom, France, New Zealand, and Australia, write authors Luis Ticona, a health policy and management fellow at Massachusetts General Hospital, and Kevin Schulman, a professor of medicine in the Duke University School of Medicine. Multidisciplinary teams provide acute-level care in patients’ homes after they’re evaluated and diagnosed in the emergency department or after a brief hospitalization. With physician oversight, nurses provide customized comprehensive services, such as home infusion, telehealth visits, on-site tests and pharmacy.
-----

It's the doctors being enticed and goaded, not the EHR vendors

Nov 2, 2016 1:58pm
Barely two weeks ago, I pondered whether the government’s ‘entice and goad’ approach in the Medicare Access and CHIP Reauthorization Act (MACRA) would spur electronic health record vendors into being better partners.  While vendors aren’t subject to MACRA, the law encourages vendors to help providers meet their goals by supporting them with better technology and more interoperability support.
It looks like we may already have our answer: no.
Vendors, it seems, are interfering with physicians’ ability to share EHR data with registries operatives by specialty societies, such as the American Academy of Dermatology and the American College of Cardiology, according to Politico. These registries have particular expertise in their respective specialties and collect information for research and clinical purposes. They also help physicians meet their reporting and interoperability requirements under MACRA.
-----

New AMA textbook schools students on EHRs, emerging medical practice

Published November 02 2016, 7:04am EDT
The American Medical Association on Tuesday launched a new “health systems science” textbook designed to provide medical students with a modernized curriculum that properly prepares future physicians for a 21st century healthcare system, including the successful use of electronic health records.
“Emerging technologies are rapidly changing the world and the practice of medicine. And, yet, for all of these advancements, the way we train and educate new doctors actually hasn’t changed that much,” said AMA CEO James Madara, MD.
According to Madara, the “focus and overall structure” of the curriculum currently taught at U.S. medical schools is essentially the same as what it was in the early 20th century. As a result, he contends that there is an “ever-widening gap” between how physicians are educated and trained, and the “practical realities of the modern healthcare environment.”
-----

Best Hospital IT Departments 2016: Leaders reveal what it takes to build a great health IT shop

Our annual reader survey finds the keys to creating an environment where job satisfaction supports the long-term mission.
November 01, 2016 12:39 PM
What makes a hospital IT department a good place to work? Is it good bosses, who value your unique skills and treat you fairly? Good colleagues, willing to work together as a team toward a shared goal? Good pay and benefits? Good coffee in the break room?
For the 6th annual Healthcare IT New Best Hospital IT Departments, we heard from thousands of information technology workers at hospitals and health systems nationwide. The nominated IT teams were large (1100 staffers), small (3 staffers) and everything in between.
The people who took our 87-question survey were senior executives (CIO, CMIOs, etc.), directors of IT, clinical and systems analysts, technicians, help desk staff and others. They spanned ages from just-out-of-college to Medicare-eligible. Their hospitals ranged from Northern Maine to Southern California.
-----

4 ways to improve productivity in healthcare

Nov 2, 2016 11:26am
The industry-wide movement from volume- to value-based care and alternative payment models will require organizations to find new ways to increase productivity.
“Increasing productivity is a survival skill in healthcare today,” writes healthcare futurist Joe Flower in a post for Hospitals & Health Networks. “We will not find the huge increases in productivity that we need by doing what we do now and just doing it incrementally more efficiently. We have to find productivity in a changed payment system that allows us to drop wasteful practices and streamline the workflows that are left.”
-----

AHRQ's new patient safety system could replace the current Medicare Patient Safety Monitoring System

Written by Anuja Vaidya (Twitter | Google+)  | November 01, 2016 
The Agency for Healthcare Research and Quality is developing a new online patient safety tool to track adverse events in hospitals.
The Quality and Safety Review System will track adverse events by capturing data from Medicare patients' EHRs. The system will also offer an expanded array of adverse event measures, including measures related to opioid use/misuse, surgical site infections and obstetric and neonatal adverse events.
-----

Report: Security, Care Team Coordination Tops CIO Priority Lists

Data security and care team coordination are the two top considerations for CIOs in healthcare today, according to a recent Spok survey. The report administered by CHIME surveyed more than 100 CIOs, who responded to questions about their big-picture goals, the use-cases driving their mobile app selections, and which common workflows they are focused on improving.     
When asked which business goals CIOs are focused on for the next 18 months, an overwhelming majority (81 percent) cited strengthening data security. Increasing patient satisfaction (70 percent) and improving physician satisfaction (65 percent) ranked second and third, respectively. When asked which workflows are top of mind to improve with better tools, 67 percent noted “care team coordination for treatment planning
One popular intersection of these two primary goals, data security and care team coordination, is secure mobile communications. The report reveals that sixty eight percent of survey respondents said that implementing secure text messaging is an active project, and 53 percent have an enterprise mobility management, or EMM, solution to further enhance patient data security on mobile devices.
-----

CIOs expect healthcare IT spending to grow in 2017

Published November 01 2016, 6:30am EDT
Healthcare CIOs are more likely to increase IT spending over the next 12 months than top IT executives in other industries, as providers seek to improve efficiency and business processes.
Healthcare IT executives also say they expect to continue to struggle with significant shortages in staff with needed technology skills, according to results of a new survey from Harvey Nash/KPMG CIO Survey.
The survey of 190 healthcare CIOs shows that 52 percent anticipate increases in IT budgets over the next year, while 35 percent predict unchanged budgets. By contrast, 45 percent of CIOs from all industries say they expect budgets to rise, while 33 percent of them expect budgets to remain unchanged.
-----

Healthcare's paltry tech coffers put industry in hacker crosshairs

Aging, outdated systems make techniques such as ransomware common and hard to defend
By John Fontana for Identity Matters | October 31, 2016 -- 14:05 GMT (01:05 AEDT)
It's not a good prognosis for healthcare in terms of cybersecurity.
The industry is getting hit as hard as any other, but what it's lacking is a good defense.
"They have a lot of vulnerabilities going on," says Chris Tarbell, who is part of the cybersecurity and investigations practice at Berkeley Research Group. "They have a lot of old software that was never meant to be part of networks. They have old equipment, end-of-life equipment. They are kind of behind and trying to catch up. But they don't have the money."
-----
October 31, 2016

75% of healthcare industry hit with malware, report

The healthcare vertical is at particular risk from ransomware. This is just one of the findings of the "2016 Healthcare Industry Cybersecurity Report," a just released survey from SecurityScorecard, a security rating and continuous risk monitoring platform.
The analysis reveals that cybersecurity vulnerabilities could be devastating, the study found, as an attack could potentially shut down an entire network. The study examined 700 healthcare organizations including medical treatment facilities, health insurance agencies and healthcare manufacturing companies.
Million of patients could potentially be put at risk, especially as the healthcare vertical ranks 15th out of 18th as a target of social engineering attacks, the survey found.
-----

With no 'silver bullet,' MIFA pushes for a layered approach to medical identity theft

Nov 1, 2016 3:22pm
Both payers and providers are considered a top target for medical identity fraud following the healthcare industry’s shift toward electronic health records (EHRs), but better identity verification and a layered approach to fraud detection can help mitigate a rapidly growing threat.
Acknowledging there is “no silver bullet” to prevent fraud tied to medical identity theft, a new report released by the Medical Identity Fraud Alliance (MIFA) says a layered approach to fraud management that includes identity verification and data breach prevention tools can help healthcare organizations limit the often-devastating consequences associated with medical identity theft. Additionally, providing patients with more tools to take charge of protecting their identity can help health plans quickly identify suspicious activity that leads to fraudulent claims.
The paper urges healthcare organizations to move away from the “pay and chase” mentality of fraud enforcement and take additional steps to verify patient identities through online registration portals and third-party identity authenticators. Although medical loss ratio requirements limit spending on fraud programs, health plans should prioritize identity theft protections as cyber threats continue to evolve.  
-----

Is Home-Based Medical-Data Collection About to Change Healthcare?

Christopher Cheney, October 31, 2016

Patient data informatics can improve clinical outcomes, but stakeholders will have to build a seamless flow of information and win over skeptical patients.

The digital revolution in the healthcare industry is spreading far beyond the boundaries of the hospital walls.
"People are using smart phones and they are using their Fitbits and other wearables such as the Apple Watch. So people are tracking the basics—how many calories they burn in a day and so forth," says Sanket Shah, a University of Illinois at Chicago adjunct professor in the school's Department of Health Informatics and Health Information Management.
-----

Chasing the ROI of Telemedicine

Scott Mace, November 1, 2016

Virtual visit savings are promising but aren't moving the needle yet.

This article first appeared in the November 2016 issue of HealthLeaders magazine.
While some providers are finding a return on investment in telemedicine, measuring such returns involves a multitude of factors.
At the 2016 Healthcare Information and Management Systems Society's annual conference, Kaiser Permanente exhibited its exam room of the future, showing physician-to-physician telemedicine consultations now widely available throughout the Kaiser system.
"It's really personalized, and it builds on our existing relationship with our patients, and it's connected to our electronic medical record," says Angie Stevens, executive director of virtual care IT at the integrated health system and payer, which serves 10.6 million members in eight states and the District of Columbia.
-----

AMA and IHTSDO set collaborative health terminology agreement

Published October 31 2016, 7:27am EDT
The American Medical Association (AMA) and the International Health Terminology Standards Development Organisation (IHTSDO) have entered a new collaborative agreement to coordinate on the design and development of their respective coding and terminology products.
By working together, the organizations seek to address the health system’s emerging need for greater integration between proprietary codes sets in support of interoperability and healthcare data analytics.
AMA’s Current Procedural Terminology is the most widely accepted medical nomenclature used to report medical procedures and services under public and private health insurance programs in the United States. IHTSDO’s SNOMED CT is the global language of healthcare, an international standard that ensures semantically accurate clinical terminology for consistent use across health systems and services.
-----

Tracking technology helps nurses monitor patient conditions

Published October 31 2016, 6:54am EDT
Newton Medical Center in New Jersey went live in early August with an “early warning system” that helps clinicians quickly identify patients who may be in decline, as well as patients getting better.
Early results at 148-bed Newton, which is the pilot site for six-hospital Atlantic Health System, are good, says Laura Reilly, manager of nursing practice at the hospital.
The tool is the Rothman Index from software vendor PeraHealth. Rothman captures 26 different types of patient and measuring data from the electronic health record system, runs it through predictive analytics and displays a 0-to-100 score and graphing trends for each patient indicating whether the patient is getting better or declining.
-----

IoT devices are hackable in under three minutes, researchers warn

ForeScout's IoT Enterprise Risk Report revealed major security flaws in common devices that, once attacked, are difficult to repair.
October 28, 2016 03:39 PM
Internet-of-Things devices lack some of the most basic cybersecurity protocols. As a result, these devices can be weaponized en masse – and in as little as three minutes.
Not only that, ForeScout researchers revealed in the security firm's recent IoT Enterprise Risk Report, but once compromised, these devices are nearly impossible to repair. Many have to return the device to the manufacturer to be reformatted.
The bottom line: These devices are incredibly easy to compromise and hard to make right again after attack, according to ForeScout Chief Strategy Officer Pedro Abreu.
-----

'Cybercrime-as-a-service' in healthcare on the rise

Oct 31, 2016 12:12pm
Stolen medical records may not be worth as much as financial account data or credit card information, but the “cybercrime-as-a-service” market continues to grow when it comes to healthcare, cybersecurity experts say.
Researchers from Intel Security say in a new report that increasingly, cybercriminals are taking advantage of inexpensive hacking tools to capitalize on vulnerability in the industry. While they note that they have yet to identify specific uses for large swaths of medical data, just the fact that the healthcare industry is so far behind the cybersecurity curve makes it an enticing target.
“When a well-developed community of cybercriminals targets a less-prepared industry such as healthcare, organizations within that industry tend to play catch-up to protect against yesterday’s threats, and not those of today or tomorrow,” Raj Samani, Intel Security’s CTO for Europe, the Middle East and Africa, says in a statement. “Where [healthcare organizations] have undervalued cyber defense overall, they must prioritize it.”
-----

Humana harnesses artificial intelligence for competitive edge in customer service

Oct 31, 2016 10:11am
Humana is using artificial intelligence to identify poor member experiences in real-time--a move the company says enhances the ability of call center personnel to empathize with consumers.
As members call in to its customer service centers, Humana’s AI tool listens for signals of consumer frustration, such as a consumer’s elevated tone of voice or instances of the representative and the member talking over one another, according to a Wall Street Journal article. The AI bot, Cogito Dialog, then delivers instant feedback for the customer service agent to alter his or her strategy while on the phone.
That approach, says Humana director of customer experience Geeta Wilson, gives the Louisville, Kentucky-based insurer a cutting-edge competitive advantage, The nature of the calls usually concern a patient’s medical procedures and prescriptions--information demanding sensitivity and empathy that may be missing during interactions between health plans and members.
-----

Smartphone apps could provide effective type 2 diabetes treatment

Fri, 28 Oct 2016
Smartphone apps could provide effective type 2 diabetes treatment
Monitoring blood sugar levels on a smartphone app could help people with type 2 diabetes to better manage their condition, a study has found.
Researchers from Cardiff University found that using specialist diabetes apps, which allow patients to enter data, track medication, set reminders, plan meals, find recipes and plan for doctor's appointments and blood tests, can help to reduce the amount of sugar in your blood.
-----

HIMSS: Health IT Standards Guidance Lacking in Many Areas

By Kyle Murphy, PhD on October 28, 2016

The group with found several faults in ONC's guidance for health IT standards to promote healthcare interoperability.

Leaders of the Healthcare Information and Management Systems Society (HIMSS) recently put pen to paper to recommend a multitude of changes to the Draft 2017 Interoperability Standards Advisory (ISA).
In a letter to the Office of the National Coordinator for Health Information Technology (ONC), HIMSS leadership praises the federal agency’s decision to focus on clinical health data before highlighting a number of areas where the guidance on health IT standards can be improved.
-----

Why artificial intelligence is needed to prevent cyber attacks

Published October 31 2016, 3:54pm EDT
As Halloween approaches, the usual spate of horror movies will intrigue audiences across the US, replete with slashers named Jason or Freddie running amuck in the corridors of all-too-easily accessible hospitals. They grab a hospital gown and the zombies fit right in. While this is just a movie you can turn off, the real horror of patient data theft can follow you.
Unfortunately, this scenario is similar to how data thefts often occur at medical facilities. In 2015, the healthcare industry was one of the top three industries hit with serious data breaches and major attacks, along with government and manufacturers. Healthcare organizations are packed with a wealth of exploitable information, such as credit card data, email addresses, Social Security numbers, employment information and medical history records, much of which will remain valid for years, if not decades and fetch a high price on the black market.
It is commonly believed attacks are from outside intruders looking to steal valuable patient data, and 45 percent of the hacks are external. However, “phantom” hackers are also often your colleagues, employees and business associates who are unwittingly careless in the use of passwords or lured by phishing schemes that open the door for data thieves. Not only is data stolen, but privacy violations are insidious.
-----

Biometric identification improves security, efficiency at Metroplex

Metroplex Adventist and Rollins Brook Community Hospitals use PatientSecure, a device that images veins in the hand, to register and identify patients.
Posted: Saturday, October 29, 2016 7:00 pm
Metroplex Health System has implemented new technology in order to reduce paperwork, improve accuracy, and prevent identity theft.
Metroplex Adventist and Rollins Brook Community Hospitals are now using PatientSecure, a device that images veins in the hand, to register and identify patients.
Infrared light is used to scan the palm, then links the unique biometric trait to each patient’s electronic health record.
-----

NHS trust cancels operations after computer virus hits IT system

North Lincolnshire and Goole trust shuts down most of its network and cancels appointments and routine surgery at three hospitals
All appointments and routine operations have been cancelled at three hospitals after a computer virus attacked critical systems.
Officials said around 1,000 patients would be affected at hospitals run by the North Lincolnshire and Goole trust after a major incident was declared due to the virus, which was identified on Sunday.
A spokesperson said staff had had to power down the majority of the trust’s network on Monday and specialists were now working to fix the problem.
-----

Enjoy!
David.

Friday, November 11, 2016

Is Australia About To Follow Estonia As Far As Digital Identity Management Is Concerned. Australia Card Mark III?

This appeared last week:

National identity card for Australians? Digital government lessons from Estonia

By Marie Sansom on November 1, 2016
As Prime Minister Malcolm Turnbull’s digital transformation agenda gathers pace and renewed urgency in the wake of the botched 2016 Census and the new Digital Transformation Agency gets going, the PM would be wise to seek a meeting with government tech heads in Estonia, where 99 per cent of the country’s services are accessible online.
Anna Piperal is the Managing Director of E-Estonia Showroom, a government-funded investment agency that travels the world showcasing Estonia’s digital prowess and its achievements, marking it out as one the most successful e-societies on Earth.
Ms Piperal was recently a keynote speaker at Civica Expo in Sydney but took time out to speak to Government News about how Australia could learn from how Estonia has transformed itself into an exemplar of digital government.

How it happened
The push towards digitalisation in Estonia began in the early 1990s  after Estonia regained its independence when the Soviet Union fell in 1991. The breakaway from Communism provided the impetus to create a new government architecture from the ground up, with no legacy systems to tangle with, but hampered by having few resources and a small population.
The internet had recently arrived and Estonia’s leaders made a conscious decision to use it to build a more open, e-society and attempt to secure the nation’s future. Project Tiger Leap began in 1996, prioritising computers and the internet in schools and other educational institutions and teaching the population IT skills. Legislation followed to create a national ID card and the X-Road, a system linking databases together.
The country has since gone from strength to strength and has achieved some remarkable things.
For example, a foreigner can get a digital identity and open a bank account in Estonia and then register their own company online in 18 minutes, including all background checks. Health records are all electronic; 96 per cent of the population pay their taxes online in less than three minutes; prescriptions are digital and one-third of voting is done online. In fact, Estonia was the first country to use e-voting for parliamentary elections in 2007.
One of the cornerstones of the system is the compulsory national identity card, which was introduced in 2001 for all Estonians over 15 years old, and serves as the digital access card for all of Estonia’s e-services.
Ms Piperal says the identity card has an encrypted chip and is a non-hackable system that everybody can use.
The ID card has an impressive array of functions, for example it can be used as:
  • A driving licence
  • A virtual ticket on public transport in some parts of Estonia
  • A travel document around the European Union
  • To vote electronically from anywhere in the world
  • A health insurance card
  • For digital signatures
  • To pick up e-prescriptions
  • To access government databases, e.g. health records and taxes
  • To verify your identity when dealing with banks, e.g. when applying for a loan
To head off resistance, banks and the government made the idea of a national identity card more palatable to Estonians by offering incentives.
For example, local government in Tallinn – Estonia’s capital – gave people 30 per cent off public transport fares if they used their ID card as virtual tickets and banks offered attractive rates. This built public confidence in the card.
But it’s a different story in Australia, where the idea of a national identity cards has generated a storm of protest. The Australia Card was abandoned 1987 and the Access Card, ostensibly to be used to access Medicare and welfare payments, was dropped in 2007.
Ms Piperal argues that having a national identity card is no more an invasion of privacy than not having one. “It doesn’t mean they [the government] won’t have data about you,” she says. “It’s just that people don’t know the data they might have.”
Some Estonians are now choosing to have digital ID contained in their smartphone SIM cards so they have mobile ID.
Lots more here:
There are some powerful advantages being extracted by Estonia with their digital enablement, and many have looked on with some envy as to the way it seems to work for the Estonian citizenry. What is often forgotten – as mentioned in the article – is that Estonia is a very small unitary state and we in Australia are 20 times larger by population with all those States and Territories.
It will be interesting to see if the Government is interested.
David.

David Glance Asks Some Really Good Questions Regarding The Red Cross Health Data Breach.

This popped up last week at The Conversation.

Questions still need answering in Australia’s largest health data breach

David Glance
October 31, 2016 1.17am AEDT
In what is Australia’s biggest data breach of medical information, more than 550,000 customers of the Australian Red Cross Blood Service had personal and medical details exposed online and leaked to an anonymous hacker last week.
According to the Blood Service, the data leaked was contained in a backup of a database of its online web site. One part) of the database contained the answers to an online questionnaire which donors complete in order to book an appointment with the service. The questionnaire covers information about the donor’s name, age and address but also medical questions related to the donor’s current health, state of pregnancy and finally about whether the donor has in the last 12 months, engaged in at-risk sexual behaviour.
The backup database had been left, not on the Blood Service website, but on a server managed by the Blood Services’s website developer, Precedent. The database was found there by an anonymous hacker who had been scanning sites for security vulnerabilities and stumbled across the completely unprotected database. On realising what the data was, the hacker contacted a consultant, Troy Hunter, who runs a site called “have i been pwned”. Have i been pwned allows people to see if there email address and other details have been leaked and made publicly available in previous data breaches. Hunter’s and his wife’s details were included in the Blood Service database because they had both donated blood in Australia. Hunter contacted AusCert, a cyber emergency response team located at the University of Queensland and informed them of the breach and the data he had been sent.
AusCert in turn contacted the Blood Service who then notified its donors of the breach. Hunter and the anonymous hacker both deleted their copies of the backup database. Security specialists that the Blood Service had employed to review the breach determined that it was likely that the database had not been discovered by anyone else in the time it was available on the internet.
For the time being, it looks like the Blood Service has managed to dodge what could have been an even more devastating blow to its credibility. Whilst most donors (including Troy Hunter) may not let this incident stop them from donating in future, the incident does bring into question the overall capability of the Blood Service to protect and keep safe extremely sensitive information about its customers. A question it should be addressing is why it was collecting and saving this information through its website in this manner in the first place. An even bigger question is whether it will continue to collect and save this information in the same way.
What the Blood Service should be asking itself is:
[1] Do I really need to collect this information? In the case of the Blood Service the answer is probably no. Whilst it seems like it is being efficient to ask screening questions on the appointment questionnaire, none of the information needs to be saved if the point is simply to give feedback to people that they are unlikely to be eligible to donate blood.
[2] Do you know where all of your data is? In the case of the Blood Service, and indeed its contractor Precedent, the answer was clearly no. A developer had taken a backup of the live system which he or she shouldn’t have needed access to, and put it on an unsecured server that was exposed to the internet. Considering the type of sensitive information the Blood Service dealt with, to entrust that information to a web developer without putting any checks or process in place to prevent access to this information highlights the inexperience of the Blood Service.
[3] Do you know who has access to all of your data? Again, the Blood Service clearly didn’t know that developers at Precedent would have access to its production data. Given that this data was unencrypted, it meant that people outside of the Blood Service would have had the ability to look at the data and potentially leak this information through informal channels. A developer or other staff member at Precedent could have searched the data for a relation, friend, colleague or celebrity to see if they had engaged in risky sex for example. There seemed to be no protections built into the website itself to manage or restrict access. This is possibly because the Blood Service didn’t treat the questionnaire as part of its core systems, erroneously trying to reassure donors that: “The website forms used to collect this information do not connect to our secure internal databases which contain more sensitive donor medical information”. The Blood Service clearly felt, incorrectly, that the personal information collected as part of the questionnaire was not sensitive.
There are of course, more direct cyber security measures that need to be implemented but they are of little use if a company isn’t even aware of the fact that they have data that needs protecting.
By comparison with the US, this data breach is still moderate. A hack earlier this year of 21st Century Oncology affected 2.2 million patients. Another case this year saw details 950,000 of Centene’s patients lost on 6 computer hard drives.
In the US, 21st Century Oncology is facing a US $57 million class action lawsuit over the breach. US federal regulators recently fined Advocate Health Care Network US $5.55 million over three separate breaches that could have affected 4.1 million patients.
The Australian Red Cross Blood Service, and its contractor Precedent, potentially faces fines of up to AU $1.7 million for this breach if it is deemed to have violated the Privacy Act. In the past however, Australian telco Telstra was fined a mere AU $10,000 for exposing the details of 16,000 of its customers online.
If the Blood Service continues with the questionnaire for appointments on its website, it will be clear that it hasn’t learned any lessons from this breach. Precedent in turn, needs to demonstrate to the Blood Service and all of its other clients that it actually can live up to its privacy statement which says: “We store your information securely on our computer system, we restrict access to those who have a need to know, and we train our staff in handling the information securely”.
Here is the link to the original post:
I have to say this looks very much like a very large bullet mostly dodged through good luck rather than good management.
Just as in South Australia it certainly looks like more staff education and training is definitely indicated.
David.