It occurs to me, following a couple of e-mails from some of those interested, it might be worth providing a few pointers to where some useful further information can be found for further research and reading.
The topics and URLs are as follows:
1. Australian Office of the Access Card
http://www.accesscard.gov.au/
This is a new site and has the work of Professor Fels and his taskforce as a sub area at the following URL
http://www.accesscard.gov.au/consumer_privacy_task_force.html
The full press release is worth a careful read as is the Government’s response which is also available at the site.
Media Release
Access Card Consumer and Privacy Taskforce Recommends Safeguards
08 November 2006
Safeguards to protect personal privacy and security and to maximise consumer convenience have been recommended by the Access Card Consumer and Privacy Taskforce.
“Comprehensive legislation to define and regulate the role of the card and associated databases is needed. This will build public trust and confidence, and establish safeguards regarding current and any new future government uses of the card”, Professor Allan Fels AO, Chairman of the Taskforce and Dean of the Australia and New Zealand School of Government said.
“The card is a health and social services access card. It should not be allowed to develop into a national identity card by virtue of “function creep”. Legislation should ensure the card is not a national identity card nor an electronic health record nor have any link with tax records nor be required to be carried by individuals.
The legislation should also prohibit anyone requiring individuals to produce the card (except when they are accessing defined Commonwealth benefits and services).
“The legislation needs to define what the card will and won’t be”, Professor Fels said. More details of the recommended legislation are in the report of the Taskforce.
“Function creep” can be minimised by requiring any new future government uses only being permissible by legislation. Function creep can also be reduced by limiting the ultimate capacity of the card.
Australians should own the card. This will give individuals better control and limit the scope for government and others to determine future uses. There should, however, be some limitations on inappropriate usage of the card e.g. tampering with it, or altering prescribed information on the card.
Card holders should not be required to have their legal name on the face of the card if they have a preferred name they commonly use. There are legitimate reasons why consumers would want to have a name displayed on the card which differs from their legal name such as those who use Australianised names, middle names, changes of name in indigenous communities and maiden names. Their legal name, however, would be stored on the chip and on the register.
The Taskforce accepts that there needs to be a photo on the face of the card (as well as in the chip and stored in the secure customer registration system). This will minimise fraud, increase convenience for card users and government agencies and improve its capability for proof of identity (where consumers choose to use it for that purpose).
“Regarding the storage of the photo on a national photographic database, there is merit in considering the storage in the form of a template rather than in the form of real photos. This would reduce possibilities of fraud and misuse”, he said.
“However, this must be weighed up against cardholder and government convenience. If a card is lost, as frequently happens, the cardholder would have to be rephotographed if the photo was not stored in real form”, he said.
“If there is to be a real photographic database, it is critical that there be maximum security precautions. This should be held separately, within the register, from other cardholder data and there should be stringent special controls to prevent unauthorised access and improper usage”, he said.
The Taskforce is sceptical for the need for a digitised signature to appear on the card. The signature seems to be of limited use and it increases the dangers of identity theft and fraud. Again, whatever the outcome, digitised signatures should be subject to rigorous controls to prevent unauthorised access and improper usage.
The Taskforce accepts that there needs to be a number associated with each card, even though this means that each cardholder then has a unique number assigned to them.
“The taskforce considers that the number should not appear on the reverse of the card”, he said. If the card number is not displayed it reduces the risks of the card slowly developing into a “unique personal identifier” number for the Australian population (that is, each Australian eventually has a unique number assigned to them). Also, if the card number is displayed it increases the risk of fraud. This risk outweighs some advantages for government administration and user convenience. In the alternative the government should give consideration to making the inclusion of a unique number on the reverse of the card a matter of genuine choice for the card holder.
When consumers register for their card they will bring documentation to verify their identity. Should copies be taken of these documents and retained on file in accordance with existing practice?
The argument for the copying and retention of proof of identity (POI) documentation relates to measures taken to detect and control fraud.Such records are accessed by relevant Departments where there is some suspicion of illegal behaviour or identity fraud, or in cases where original documents are subsequently lost or destroyed. Such a procedure may, in some instances, also be required under statute.
The Taskforce supports capturing proof of identity documentation for the purposes of establishing identity and verifying their authenticity but has recommended that they should not be scanned, copied or kept on file after they have been verified.
The Taskforce notes statements by the Government that the card is only to be used for access to health and welfare services. The Taskforce notes that the Government is also in the process of considering the adoption of a National Identity Security Strategy which aims to require a very high (“Gold Standard”) proof of identity.
However, the Taskforce does not believe that the ‘Gold Standard’ being considered for a National Identity Security Strategy is necessarily appropriate for use by to facilitate delivery of health and social services benefits. The most disadvantaged and marginalised members of the community who may be unable to provide sufficient documentation to establish their identity should not be unnecessarily burdened by this process.
The Taskforce has recommended an extensive public information campaign explaining the nature of the card.
The Taskforce makes a number of recommendations to the Government for the ongoing design and implementation of elements of the card. Fundamental to further consideration of these elements by Government is the continued process of consultation that needs to occur between the Taskforce, the Government’s Lead Advisor and Chief Technology Architect.
The Taskforce is committed to ensuring that the views of all Australians feed into the design of the access card system.
The Taskforce is currently working on the second discussion paper, which will consider the Registration process and will seek to ensure that there is continued consultation with consumer and interested groups. This paper is expected to be released for discussion in November 2006.
The Consumer and Privacy Taskforce
The Consumer and Privacy Taskforce, was established in May 2006 to report on consumer and privacy issues arising from the Government’s announced plans to introduce a new health and social services access card.
The Taskforce released an initial discussion paper released on 16 June 2006. The Taskforce has met with 120 representative groups and received over 100 written submissions.
The Taskforce’s believes that all decisions about the design of the card should be made in as transparent a fashion as possible and be informed by public consultation.
The Report makes 26 recommendations.
A copy of the report can be found at www.australia.gov.au/accesscard. The report is titled Issues and Recommendations in Relation to Architecture Questions of the Access Card.
The Government response is found here:
http://www.accesscard.gov.au/publications.html
2. Report from the UK House of Commons: Identity Card Technologies: Scientific Advice, Risk and Evidence
This can be found at the following URL.
www.publications.parliament.uk/pa/cm200506/cmselect/cmsctech/1032/1032.pdf
3. A Blog on Identity by Kim Cameron.
Kim Cameron is Architect of Identity and Access in the Connected Systems Division at Microsoft, where he drives evolution of Active Directory, Federation Services, Identity Integration Services, CardSpace and Microsoft’s other Identity Metasystem products.
See http://www.identityblog.com/
Of particular interest are the Laws of Identity found here.
http://www.identityblog.com/?page_id=354
In very brief high level summary these seven laws are.
1. User Control and Consent:
Digital identity systems must only reveal information identifying a user with the user’s consent.
2. Limited Disclosure for Limited Use
The solution which discloses the least identifying information and best limits its use is the most stable, long-term solution.
3. The Law of Fewest Parties
Digital identity systems must limit disclosure of identifying information to parties having a necessary and justifiable place in a given identity relationship.
4. Directed Identity
A universal identity metasystem must support both “omnidirectional” identifiers for use by public entities and “unidirectional” identifiers for private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.
5. Pluralism of Operators and Technologies:
A universal identity metasystem must channel and enable the interworking of multiple identity technologies run by multiple identity providers.
6. Human Integration:
A unifying identity metasystem must define the human user as a component integrated through protected and unambiguous human-machine communications.
7. Consistent Experience Across Contexts:
A unifying identity metasystem must provide a simple consistent experience while enabling separation of contexts through multiple operators and technologies.
4. The Australian Attorney General’s release on Identity Theft of May 2006 which refers to the still unpublished National Identity Security Strategy (NISS).
http://www.ag.gov.au/agd/WWW/ncphome.nsf/Page/Identity_Theft
5. The Information Commissioner’s Office of the UK Government.
Has a broad range of material on privacy, ID fraud, identity cards and surveillance including the very recent and terrifying report revealing there is now one CCTV camera for every 14 UK citizens.
http://www.ico.gov.uk/
6. The Office of the Australian Privacy Commissioner.
This is a vital site which in the last year or two under Karen Curtis is really producing some excellent work in my view
http://www.privacy.gov.au/
7. The Australian Privacy Foundation.
Putting the case that the Access Card is just a stealth ID card. It is unclear at this point of Minister Hockey or Ms Anna Johnston are winning the debate. Probably the peak Australian privacy lobby group.
http://www.privacy.org.au/
8. Roger Clarke’s Dataveillance and Information Privacy Home-Page.
A well thought out set of Australian resources from an academic who has been thinking about this area for many years.
http://www.anu.edu.au/people/Roger.Clarke/DV/
I hope these are useful.
David.
Monday, November 13, 2006
Sunday, November 12, 2006
The Australian National Identity Security Strategy – Unknown, Critical and Possibly Flawed!
In the November / December issue of the IEEE Internet Computing Journal Daniel J. Weitzner from MIT has written what I see as a very important article entitled “In Search of Manageable Identity Systems”.
The DOI Bookmark is: http://doi.ieeecomputersociety.org/10.1109/MIC.2006.127
The key insights and the reason why I think the article is important is contained in the following two paragraphs from the paper.
“Although no doubt exists about current identity mechanisms’ weaknesses, our efforts to design and successfully deploy network-based identity management systems have been so frustratingly unsuccessful that a new approach seems necessary. Elements of the new approach come into view when we compare Internet identity protocol designs with systems used in financial services.
Traditional computer security systems begin with a nearly metaphysical design goal of associating a single identifier with a single identity (whether a person’s name or pseudonym). Once the system verifies the identifier, all privileges associated with it become available to whoever possesses that identity. Rather than taking this unitary approach, however, credit-card authorization systems take a composite approach, in which the binding between an identifier (a credit-card number) and the associated privileges (access to credit) is established only after the system has completed statistically based antifraud checks. In other words, you aren’t actually recognized as the card holder simply for presenting the card or even after verification that the card token itself is genuine. You’re recognized as an authorized party only on the basis of traditional security checks combined with statistical verification that you’re likely to be who you say you are.”
What is being said here and in the rest of the paper is that the simple concepts of a unique identifier may not be appropriate or workable in the networked world in which we now find ourselves. Indeed the paper suggests we do not yet have “manageable identity systems” as yet.
The paper describes how, in real time we now have credit card providers, having been given an identifier (the card number and expiry date etc), running sophisticated analysis on the card’s transaction history to ensure the purchase looks to fit within the individuals known spending patterns as so on. Unexpected transactions (larger than normal, bigger than normal, from an unexpected location) are either flagged for later review or declined.
It is easy to see how such technology (were it to become widespread) could also be applied to verification of a health or social service identifier, of the sort now being proposed in the Access Card, before a benefit is paid or a clinical record is linked with others.
I wonder are such approaches part of the technology architecture being developed for the various Government identity initiatives?
In late 2005 the following announcement came from the Council of Australian Government.
http://www.coag.gov.au/meetings/270905/
“Identity Security
The preservation and protection of a person's identity is a key concern and right of all Australians. COAG agreed to the development and implementation of a National Identity Security Strategy better to protect the identities of Australians. The strategy will enhance identification and verification processes and develop other measures to combat identity crime. The strategy will be underpinned by an inter-governmental agreement.
COAG also agreed to:
• the development and implementation of a national document verification service to combat the misuse of false and stolen identities; and
• investigate the means by which reliable, consistent and nationally interoperable biometric security measures could be adopted by all jurisdictions.”
Further clarification came in May, 2006 in a press release from the Attorney General.
“The national strategy aims to strengthen identity security through rigorous enrolment and authentication processes while ensuring personal privacy. The national strategy is based on a cross-jurisdictional, whole-of-government approach to maximise its effectiveness and interoperability across all governments.
The key objectives of the strategy include:
• improved standards and procedures for enrolment and registration including identifying key Proof of Identity (POI) documents to be used by all appropriate organisations for the purposes of identifying and registering clients for services;
• enhancing the security features on these documents to reduce the risk of incidence of forgery;
• establishing mechanisms to enable organisations to verify the data on key POI documents provided by clients when registering for services;
• improving the accuracy of personal identity information held on organisations’ databases;
• enabling greater confidence in the authentication of individuals using online services; and
• providing appropriate legislative support.”
It is understood that this strategy relies on the concept of a “gold standard” proof of identity - via the so called Document Verification System – where Proof of Identity (POI) is established by confirmation of the validity (via checks of relevant sources such as Births Deaths and Marriage Registers etc) of the documents presented to confirm the POI.
Were this to be the case one is forced to wonder just how sophisticated the approaches being adopted are and whether there is the risk of the waste of a great deal of money in pursuit of a “gold standard” of identity proof which turns out to be chimera.
A number of things seem clear.
1. Even if an identifier is available and has been obtained with extreme levels of verification that may not be enough to provide certainty as compromise is always possible.
2. The level of certainty required for different transactions is different in different circumstances. (e.g. borrowing a video requires less certainty than linking clinical patient records).
3. Judgements as to the required level of certainty as to identity should be made on a pragmatic and reasonable ‘fit for purpose’ basis.
4. The approaches planned by the Access Card team, the NEHTA Identifier Team and those in the DVS team really need to be aligned, made consistent and fit for purpose and suitable to the application planned. It is hard to see how they are at present.
5. For at least some in the community POI will be very difficult to achieve and any systems implemented need to be sensitive to that fact.
Professor Fels makes relevant points in his November 8, 2006 press release entitled “Access Card Consumer and Privacy Taskforce Recommends Safeguards”
“The Taskforce notes statements by the Government that the card is only to be used for access to health and welfare services. The Taskforce notes that the Government is also in the process of considering the adoption of a National Identity Security Strategy which aims to require a very high (“Gold Standard”) proof of identity. However, the Taskforce does not believe that the ‘Gold Standard’ being considered for a National Identity Security Strategy is necessarily appropriate for use by to facilitate delivery of health and social services benefits. The most disadvantaged and marginalised members of the community who may be unable to provide sufficient documentation to establish their identity should not be unnecessarily burdened by this process.”
It seems to me that while purely identifier based systems seem to have met with some success in places as diverse as Germany, Malaysia and Hong Kong we need to make sure the distinction between enabling access to services and an identity card is not blurred so severely as to become meaningless.
The general unease regarding the melange of identification systems being evolved is only heightened by the recent reports of the extent of individual surveillance happening in the UK and now moving to Australia at an apparently unstoppable speed.
One really begins to wonder whether it may be better overall to tolerate a little CentreLink and Medicare fraud and inefficiency rather than surrender so much control of our individual autonomy and freedom.
Comments, as always, welcome.
David.
The DOI Bookmark is: http://doi.ieeecomputersociety.org/10.1109/MIC.2006.127
The key insights and the reason why I think the article is important is contained in the following two paragraphs from the paper.
“Although no doubt exists about current identity mechanisms’ weaknesses, our efforts to design and successfully deploy network-based identity management systems have been so frustratingly unsuccessful that a new approach seems necessary. Elements of the new approach come into view when we compare Internet identity protocol designs with systems used in financial services.
Traditional computer security systems begin with a nearly metaphysical design goal of associating a single identifier with a single identity (whether a person’s name or pseudonym). Once the system verifies the identifier, all privileges associated with it become available to whoever possesses that identity. Rather than taking this unitary approach, however, credit-card authorization systems take a composite approach, in which the binding between an identifier (a credit-card number) and the associated privileges (access to credit) is established only after the system has completed statistically based antifraud checks. In other words, you aren’t actually recognized as the card holder simply for presenting the card or even after verification that the card token itself is genuine. You’re recognized as an authorized party only on the basis of traditional security checks combined with statistical verification that you’re likely to be who you say you are.”
What is being said here and in the rest of the paper is that the simple concepts of a unique identifier may not be appropriate or workable in the networked world in which we now find ourselves. Indeed the paper suggests we do not yet have “manageable identity systems” as yet.
The paper describes how, in real time we now have credit card providers, having been given an identifier (the card number and expiry date etc), running sophisticated analysis on the card’s transaction history to ensure the purchase looks to fit within the individuals known spending patterns as so on. Unexpected transactions (larger than normal, bigger than normal, from an unexpected location) are either flagged for later review or declined.
It is easy to see how such technology (were it to become widespread) could also be applied to verification of a health or social service identifier, of the sort now being proposed in the Access Card, before a benefit is paid or a clinical record is linked with others.
I wonder are such approaches part of the technology architecture being developed for the various Government identity initiatives?
In late 2005 the following announcement came from the Council of Australian Government.
http://www.coag.gov.au/meetings/270905/
“Identity Security
The preservation and protection of a person's identity is a key concern and right of all Australians. COAG agreed to the development and implementation of a National Identity Security Strategy better to protect the identities of Australians. The strategy will enhance identification and verification processes and develop other measures to combat identity crime. The strategy will be underpinned by an inter-governmental agreement.
COAG also agreed to:
• the development and implementation of a national document verification service to combat the misuse of false and stolen identities; and
• investigate the means by which reliable, consistent and nationally interoperable biometric security measures could be adopted by all jurisdictions.”
Further clarification came in May, 2006 in a press release from the Attorney General.
“The national strategy aims to strengthen identity security through rigorous enrolment and authentication processes while ensuring personal privacy. The national strategy is based on a cross-jurisdictional, whole-of-government approach to maximise its effectiveness and interoperability across all governments.
The key objectives of the strategy include:
• improved standards and procedures for enrolment and registration including identifying key Proof of Identity (POI) documents to be used by all appropriate organisations for the purposes of identifying and registering clients for services;
• enhancing the security features on these documents to reduce the risk of incidence of forgery;
• establishing mechanisms to enable organisations to verify the data on key POI documents provided by clients when registering for services;
• improving the accuracy of personal identity information held on organisations’ databases;
• enabling greater confidence in the authentication of individuals using online services; and
• providing appropriate legislative support.”
It is understood that this strategy relies on the concept of a “gold standard” proof of identity - via the so called Document Verification System – where Proof of Identity (POI) is established by confirmation of the validity (via checks of relevant sources such as Births Deaths and Marriage Registers etc) of the documents presented to confirm the POI.
Were this to be the case one is forced to wonder just how sophisticated the approaches being adopted are and whether there is the risk of the waste of a great deal of money in pursuit of a “gold standard” of identity proof which turns out to be chimera.
A number of things seem clear.
1. Even if an identifier is available and has been obtained with extreme levels of verification that may not be enough to provide certainty as compromise is always possible.
2. The level of certainty required for different transactions is different in different circumstances. (e.g. borrowing a video requires less certainty than linking clinical patient records).
3. Judgements as to the required level of certainty as to identity should be made on a pragmatic and reasonable ‘fit for purpose’ basis.
4. The approaches planned by the Access Card team, the NEHTA Identifier Team and those in the DVS team really need to be aligned, made consistent and fit for purpose and suitable to the application planned. It is hard to see how they are at present.
5. For at least some in the community POI will be very difficult to achieve and any systems implemented need to be sensitive to that fact.
Professor Fels makes relevant points in his November 8, 2006 press release entitled “Access Card Consumer and Privacy Taskforce Recommends Safeguards”
“The Taskforce notes statements by the Government that the card is only to be used for access to health and welfare services. The Taskforce notes that the Government is also in the process of considering the adoption of a National Identity Security Strategy which aims to require a very high (“Gold Standard”) proof of identity. However, the Taskforce does not believe that the ‘Gold Standard’ being considered for a National Identity Security Strategy is necessarily appropriate for use by to facilitate delivery of health and social services benefits. The most disadvantaged and marginalised members of the community who may be unable to provide sufficient documentation to establish their identity should not be unnecessarily burdened by this process.”
It seems to me that while purely identifier based systems seem to have met with some success in places as diverse as Germany, Malaysia and Hong Kong we need to make sure the distinction between enabling access to services and an identity card is not blurred so severely as to become meaningless.
The general unease regarding the melange of identification systems being evolved is only heightened by the recent reports of the extent of individual surveillance happening in the UK and now moving to Australia at an apparently unstoppable speed.
One really begins to wonder whether it may be better overall to tolerate a little CentreLink and Medicare fraud and inefficiency rather than surrender so much control of our individual autonomy and freedom.
Comments, as always, welcome.
David.
Saturday, November 11, 2006
AusHealthIT Blog – Where to From Here?
The blog has now been on-line for a little over eight months and it seems like a good time to take stock of where it has come to and where it should now go.
What I know is that for a topic as absurdly arcane and Health Information Technology in Australia there is more than a little interest. The blog has two counters of activity. One counts the page views and visitor numbers on the main site. The other counts the number of reads and visits generated by e-mail alerts and RSS feeds.
To my amazement – since setting up the feed - there have been 6,413 views of the 62 different items published. This excludes all the direct view from the actual blog site – which is also seeing about 100 page reads per day on average.
In summary it looks like each article is now being read by at least 100 different people with the more “interesting” articles being read over 200 times.
Interestingly the origin of readers is international with a very strong Australian bias. (Australia 70%, US 11%, UK 9% Ireland 2% Rest 8% (India, Macedonia etc!)
On the basis of the feed activity the following ten articles (in order, so far) have been the most popular.
• E-Mail Security and Clinical Practice
• E-Prescribing in Australia – Is there a New Plan
• Oh HealthConnect! – You Have Done it Again
• How to Really Fail at Health IT Strategy
• What is Happening in Electronic Decision Support?
• Just Who Do They Think They are Fooling?
• Electronic Prescribing – What is Needed?
• Clinical Decision Support - A Major Contribution
• An Australian e-Health Strategy - The Outline
• NEHTA's Approach to Privacy V 1.0
This leads me to believe the readers of the blog are most interested in the strategies to be adopted in developing and implementing e-Health and in reviewing possible solutions and approaches. It is also clear many of the readers are interested in what is going on under the NEHTA and HealthConnect banners as well as the progress with the Access Card.
What is now needed are two things.
1. Suggestions as to what other topics should be addressed in the future.
2. Information and feedback on what is going either well or badly in the E-Health space in the “wide brown land”. In this context I am particularly interested in success stories that can be cited or emerging problems that could maybe be rectified.
I already am getting e-mail from places as diverse and Hong Kong and Canberra and the more I receive the better I can tailor the blog to meet people’s interests and needs.
Contact me with tips, news, comments etc (anonymously is fine via a fake Hotmail or Yahoo account if needed) at davidgm – at – optusnet.com.au. (substitute the “– at –“ with “@”). No information on correspondents will be made public without explicit permission!
David.
What I know is that for a topic as absurdly arcane and Health Information Technology in Australia there is more than a little interest. The blog has two counters of activity. One counts the page views and visitor numbers on the main site. The other counts the number of reads and visits generated by e-mail alerts and RSS feeds.
To my amazement – since setting up the feed - there have been 6,413 views of the 62 different items published. This excludes all the direct view from the actual blog site – which is also seeing about 100 page reads per day on average.
In summary it looks like each article is now being read by at least 100 different people with the more “interesting” articles being read over 200 times.
Interestingly the origin of readers is international with a very strong Australian bias. (Australia 70%, US 11%, UK 9% Ireland 2% Rest 8% (India, Macedonia etc!)
On the basis of the feed activity the following ten articles (in order, so far) have been the most popular.
• E-Mail Security and Clinical Practice
• E-Prescribing in Australia – Is there a New Plan
• Oh HealthConnect! – You Have Done it Again
• How to Really Fail at Health IT Strategy
• What is Happening in Electronic Decision Support?
• Just Who Do They Think They are Fooling?
• Electronic Prescribing – What is Needed?
• Clinical Decision Support - A Major Contribution
• An Australian e-Health Strategy - The Outline
• NEHTA's Approach to Privacy V 1.0
This leads me to believe the readers of the blog are most interested in the strategies to be adopted in developing and implementing e-Health and in reviewing possible solutions and approaches. It is also clear many of the readers are interested in what is going on under the NEHTA and HealthConnect banners as well as the progress with the Access Card.
What is now needed are two things.
1. Suggestions as to what other topics should be addressed in the future.
2. Information and feedback on what is going either well or badly in the E-Health space in the “wide brown land”. In this context I am particularly interested in success stories that can be cited or emerging problems that could maybe be rectified.
I already am getting e-mail from places as diverse and Hong Kong and Canberra and the more I receive the better I can tailor the blog to meet people’s interests and needs.
Contact me with tips, news, comments etc (anonymously is fine via a fake Hotmail or Yahoo account if needed) at davidgm – at – optusnet.com.au. (substitute the “– at –“ with “@”). No information on correspondents will be made public without explicit permission!
David.
Sunday, November 05, 2006
HealthConnect Scottish Style – Cheap, Quick and Effective.
I can say I was more that a little pleased to see the following appear this week. It shows the canny Scots have not lost their touch and with decent planning and care good things in e-health can happen really quite quickly.
http://www.ehiprimarycare.com/news/item.cfm?ID=2238
Scottish emergency care records to be electronic by 2007
02 Nov 2006
The Scottish Emergency Care Summary is to become paperless by spring 2007, according to leading members of the Scottish Clinical Information Management in Practice.
Initially launched across Scotland last summer as a hybrid system, including paper and faxes, the Emergency Care Summary has already helped make out-of-hours communications more efficient effective.
Scottish health minister Andy Kerr said of ECS: “This new shared record means that NHS staff who need it to look after you can get important information about your health, even if they can't contact your GP. Health workers will also have a more complete picture of a patient's health and medical background.”
The minister added: "In the future, all health records will be stored and linked electronically and that will bring great benefits over the old paper files kept in different places and electronic records that are not linked up."
Libby Morris, chair of SCIMP told E-Health Insider Primary Care: “Following a public information campaign about the ECS, through leaflets delivered to all 2.5 million households in the country and a further 400,000 copies of the leaflet distributed to GP practices, primary and secondary care services, we were able to successfully go-live across all 14 NHS boards.”
The ECS contains important basic information such as name, date of birth, Community Health Index (patient ID number used in Scotland), medication prescribed by a GP and any adverse reactions to prescribed medicines.
The summary currently covers 2.5m patients, using a password protection system which is protected using the "highest standards of security". NHS staff will have to ask the patient's permission before they can look at the ECS, except in the event the patient is unconscious or unable to give consent.
Morris said of the early experience of the summary record: “ECS has made life so much easier for out of hours and accident and emergency staff. They can now have access to important information on the patients’ clinical history. Doctors, nurses and receptionists in out of hours medical centres; staff at NHS 24 involved in the patients care and staff in accident and emergency departments can all view records quickly and avoid risks to patients.”
NHS Scotland spent half a million pounds on publicising the new system, giving full details of how patients could opt-out of the scheme if necessary. To date, over 5 million records have been uploaded onto the system and only 174 patients in total have opted out of the scheme.
The system makes it possible to check who has looked at the patient's ECS. Patients can ask their GP to show them the information in their own summary.
…….
Plans are now in place to begin the switch over to electronic records and NHS Scotland is aiming to store and link full health records electronically by 2010 – beginning implementation in spring 2007.
A Gold Standards Framework Scotland (GSFS) IT development project has been established which aims to provide electronic patient records in one place helping those with cancer and palliative care needs in particular.
Staff will be able to fill in the patient record forms using the system, which can be saved electronically and then accessed by authorised staff. These will replace current paper-based tools and be integrated into existing practice IT systems.
Ian Kerr added: “GSFS will support clinicians to do the right thing at the right time, making it easy to have the best possible information available for forward planning, team review, consistent communication and sharing critical information.”
He also said that future work on the ECS will help to ensure that there is full integration with the NHS 24 advice centre and ambulance service databases. More data will be put onto the system over time, including lab results and statistics from nurse checks.
Morris told EHI Primary Care: “Patient-clinician interaction is important. Patients should know what is going on and who knows what about them. They must give explicit consent for information to be released, and trust the clinician not to abuse details which can be sensitive.”
The ECS has been piloted by various trusts, accident and emergency units and focus groups since its initial launch in October 2005. Kerr believes that the success of its national launch is thanks to the large amount of feedback received from patients, clinicians and administration staff. “
It would appear that virtually all the key issues that could block a successful implementation including proper public consultation and communication, a sensible approach to consent and privacy, having a clear implementation strategy and system wide technology approach and keeping it simple and quick have all be undertaken. The outcome seems to be great.
Well done to all those involved! Seems to me DoHA and NEHTA could learn a few things from this exercise.
David.
http://www.ehiprimarycare.com/news/item.cfm?ID=2238
Scottish emergency care records to be electronic by 2007
02 Nov 2006
The Scottish Emergency Care Summary is to become paperless by spring 2007, according to leading members of the Scottish Clinical Information Management in Practice.
Initially launched across Scotland last summer as a hybrid system, including paper and faxes, the Emergency Care Summary has already helped make out-of-hours communications more efficient effective.
Scottish health minister Andy Kerr said of ECS: “This new shared record means that NHS staff who need it to look after you can get important information about your health, even if they can't contact your GP. Health workers will also have a more complete picture of a patient's health and medical background.”
The minister added: "In the future, all health records will be stored and linked electronically and that will bring great benefits over the old paper files kept in different places and electronic records that are not linked up."
Libby Morris, chair of SCIMP told E-Health Insider Primary Care: “Following a public information campaign about the ECS, through leaflets delivered to all 2.5 million households in the country and a further 400,000 copies of the leaflet distributed to GP practices, primary and secondary care services, we were able to successfully go-live across all 14 NHS boards.”
The ECS contains important basic information such as name, date of birth, Community Health Index (patient ID number used in Scotland), medication prescribed by a GP and any adverse reactions to prescribed medicines.
The summary currently covers 2.5m patients, using a password protection system which is protected using the "highest standards of security". NHS staff will have to ask the patient's permission before they can look at the ECS, except in the event the patient is unconscious or unable to give consent.
Morris said of the early experience of the summary record: “ECS has made life so much easier for out of hours and accident and emergency staff. They can now have access to important information on the patients’ clinical history. Doctors, nurses and receptionists in out of hours medical centres; staff at NHS 24 involved in the patients care and staff in accident and emergency departments can all view records quickly and avoid risks to patients.”
NHS Scotland spent half a million pounds on publicising the new system, giving full details of how patients could opt-out of the scheme if necessary. To date, over 5 million records have been uploaded onto the system and only 174 patients in total have opted out of the scheme.
The system makes it possible to check who has looked at the patient's ECS. Patients can ask their GP to show them the information in their own summary.
…….
Plans are now in place to begin the switch over to electronic records and NHS Scotland is aiming to store and link full health records electronically by 2010 – beginning implementation in spring 2007.
A Gold Standards Framework Scotland (GSFS) IT development project has been established which aims to provide electronic patient records in one place helping those with cancer and palliative care needs in particular.
Staff will be able to fill in the patient record forms using the system, which can be saved electronically and then accessed by authorised staff. These will replace current paper-based tools and be integrated into existing practice IT systems.
Ian Kerr added: “GSFS will support clinicians to do the right thing at the right time, making it easy to have the best possible information available for forward planning, team review, consistent communication and sharing critical information.”
He also said that future work on the ECS will help to ensure that there is full integration with the NHS 24 advice centre and ambulance service databases. More data will be put onto the system over time, including lab results and statistics from nurse checks.
Morris told EHI Primary Care: “Patient-clinician interaction is important. Patients should know what is going on and who knows what about them. They must give explicit consent for information to be released, and trust the clinician not to abuse details which can be sensitive.”
The ECS has been piloted by various trusts, accident and emergency units and focus groups since its initial launch in October 2005. Kerr believes that the success of its national launch is thanks to the large amount of feedback received from patients, clinicians and administration staff. “
It would appear that virtually all the key issues that could block a successful implementation including proper public consultation and communication, a sensible approach to consent and privacy, having a clear implementation strategy and system wide technology approach and keeping it simple and quick have all be undertaken. The outcome seems to be great.
Well done to all those involved! Seems to me DoHA and NEHTA could learn a few things from this exercise.
David.
Privacy – The Global Perspective and Australia’s Position
The following report on global respect for individual privacy and the levels of surveillance of citizens in most developed countries and some others was released this week.
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-545223
Privacy International and EPIC launch Privacy and Human Rights global study
02/11/2006
Each year since 1997, the Electronic Privacy Information Center and Privacy International have undertaken what has now become the most comprehensive survey of global privacy ever published. The Privacy & Human Rights Report surveys developments in 70 countries, assessing the state of technology, surveillance and privacy protection.
The most recent report published in 2006 is probably the most comprehensive single volume report published in the human rights field. The report runs to almost 1,200 pages and includes about 6,000 footnotes. More than 200 experts from around the world have provided materials and commentary. The participants range from law students studying privacy to high-level officials charged with safeguarding constitutional freedoms in their countries. Academics, human rights advocates, journalists and researchers provided reports, insight, documents and advice.
This year Privacy International took the decision to use the report as the basis for a ranking assessment of the state of privacy in all EU countries together with eleven benchmark countries. This project was first considered in 1998 but was postponed pending availability of adequate data. We now have the full spectrum of information at our disposal and we hope to publish the rankings on an annual basis."
The e-health perspective in this report centres on the impact the findings might have on the possibility of implementation of electronic health information sharing. With our Australian focus the specific notes provided on Australia are of interest. The highlight findings were:
“AUSTRALIA
The Australian Capital Territory became the first jurisdiction to incorporate a bill of rights that includes a right of "privacy and reputation.
New amended legislation has eliminated the warrant requirement for accessing stored communications (email, SMS, and voice mail), allowing non-law enforcement government agencies to access this information without a court order.
The government is considering launching biometric RFID passports at the end of 2005.
A new law allowed the motor vehicle and driver licensing agency to issue photo ID cards to non-drivers and retain personal information about them. A privacy group campaigned against the law, likening it to a State-based universal ID card.
National census administrators proposed to alter the nature of the national census to make it the most extensive data collection tool on any person. An immediate outcry from civil liberties groups caused the proposal to be dropped.”
Also disappointing is the Australia rated only 2.4 out of 5 on its efforts to protect personal privacy and manage unwarranted or intrusive surveillance. This score has us in the category described as having “Systemic failure to uphold safeguards” for privacy.
Areas where Australia was clearly deficient included:
1. Constitutional protection
2. Privacy Enforcement
3. Data-sharing
4. Visual surveillance
5. Communications interception
6. Law enforcement access
7. Travel, finances, Trans-border Data Transmission (especially bad)
8. Leadership
The entire report is worth accessing and a detailed review. In the downloadable .pdf files there is a very full report on all aspects of the Australian situation. The current state of our privacy approaches suggests we will face major barriers in making individuals comfortable with electronic health information management without very major reform.
David.
http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-545223
Privacy International and EPIC launch Privacy and Human Rights global study
02/11/2006
Each year since 1997, the Electronic Privacy Information Center and Privacy International have undertaken what has now become the most comprehensive survey of global privacy ever published. The Privacy & Human Rights Report surveys developments in 70 countries, assessing the state of technology, surveillance and privacy protection.
The most recent report published in 2006 is probably the most comprehensive single volume report published in the human rights field. The report runs to almost 1,200 pages and includes about 6,000 footnotes. More than 200 experts from around the world have provided materials and commentary. The participants range from law students studying privacy to high-level officials charged with safeguarding constitutional freedoms in their countries. Academics, human rights advocates, journalists and researchers provided reports, insight, documents and advice.
This year Privacy International took the decision to use the report as the basis for a ranking assessment of the state of privacy in all EU countries together with eleven benchmark countries. This project was first considered in 1998 but was postponed pending availability of adequate data. We now have the full spectrum of information at our disposal and we hope to publish the rankings on an annual basis."
The e-health perspective in this report centres on the impact the findings might have on the possibility of implementation of electronic health information sharing. With our Australian focus the specific notes provided on Australia are of interest. The highlight findings were:
“AUSTRALIA
The Australian Capital Territory became the first jurisdiction to incorporate a bill of rights that includes a right of "privacy and reputation.
New amended legislation has eliminated the warrant requirement for accessing stored communications (email, SMS, and voice mail), allowing non-law enforcement government agencies to access this information without a court order.
The government is considering launching biometric RFID passports at the end of 2005.
A new law allowed the motor vehicle and driver licensing agency to issue photo ID cards to non-drivers and retain personal information about them. A privacy group campaigned against the law, likening it to a State-based universal ID card.
National census administrators proposed to alter the nature of the national census to make it the most extensive data collection tool on any person. An immediate outcry from civil liberties groups caused the proposal to be dropped.”
Also disappointing is the Australia rated only 2.4 out of 5 on its efforts to protect personal privacy and manage unwarranted or intrusive surveillance. This score has us in the category described as having “Systemic failure to uphold safeguards” for privacy.
Areas where Australia was clearly deficient included:
1. Constitutional protection
2. Privacy Enforcement
3. Data-sharing
4. Visual surveillance
5. Communications interception
6. Law enforcement access
7. Travel, finances, Trans-border Data Transmission (especially bad)
8. Leadership
The entire report is worth accessing and a detailed review. In the downloadable .pdf files there is a very full report on all aspects of the Australian situation. The current state of our privacy approaches suggests we will face major barriers in making individuals comfortable with electronic health information management without very major reform.
David.
Thursday, November 02, 2006
NEHTA’s Annual Report – What We are Not Being Told!
The Australian National E-Health Transition Authority (NEHTA) (The peak government e-health entity) released its 2005-06 Annual Report a couple of days ago. It is an impressive 24 page document that is clearly designed to let us know as little as possible about what is going on. A good two pages are wasted, at least, on the smiling faces of the directors and CEO for example – rather than some useful information (Indeed we get two identical photos of the chairperson – just different sizes!).
The document contains riveting information on the organisational structure of NEHTA, two puff pieces (from the chairperson and CEO) saying what a success it has been so far, two and a half pages outlining all the stakeholders who have been “engaged with”, and a two page 2006 – 6 update of all the projects they are undertaking.
The rest of the document gives is a graph of the exponential recruitment process (to now about sixty people) and two pages of guff on directorial movements and changes.
It then concludes with the usual statements of audit independence and a “concise financial report” – the real report seems to be secret – and an auditors statement that the accounts are unqualified and accurate. (This takes seven pages with only two pages of figures provided).
The 24 page report thus provides a totally inadequate two page report on what NEHTA has achieved with the almost $10 million it has spent this financial year.
Those interested can access the report at the following URL.
http://www.nehta.gov.au/component/option,com_docman/task,cat_view/gid,92/Itemid,139/
As with all such documents it is not what is in the document, but what is left out that really matters.
Left out is enunciation of any real e-Health Vision or Strategy for Australia.
Left out is any indication of how the interoperation between the Private (read the GP, investigative and Specialist sectors), and the Public Health System is going to or could be made to work.
Left out are any performance measures and any statements as to how NEHTA is performing against these benchmarks.
Left out is any analysis of the business risks faced by NEHTA – especially those around not being able to get funding for the Shared Electronic Health Record and what would then be done with all this work.
Left out is any clear forward plan as to just what is to be delivered and when – with a staff of 38 then and 60 now – most having project management skills – one wonders why? (All there are a statements that some things have to be done by mid 2008 and others by mid 2009 – all a long way off compared with the pace we see in the US and the UK right now!)
Left out is any explanation of just what a little over $1.7 million spent on administration has achieved. Given that the total operational expenses were a little over $9 million it would seem a lot was spent administering.
Left out is any listing of, or rationale for the selection of, the clinicians and consumer representatives who have been consulted with a small number of time.
Left out is any evidence of a single improved clinical outcome or improved information flow to result from NEHTA’s two years of work so far.
Left out is why $7 million plus of member contributions were not spent this financial year. Work in this are is urgent and the opportunity cost of inactivity is high. Why so slow to get moving when the funds are available?
Left out is an explanation of the $4.5 million in receivables at the end of the year which is mostly members contributions owing. Seems some States are not paying promptly?
Among the interesting tit-bits to be found in the report are the following quotes:
“The company operates predominantly in one business and geographical segment being the development of methods to electronically collect and securely exchange health information throughout Australia.” (p21). Its nice to know what they are meant to be doing at least!
“The full financial report is available to Members free of charge upon request.” (p20). That means we want to keep the public away I would suggest – the members being the jurisdictional CEOs are to be the only ones who know what is going on!.
“NEHTA believes it is exempt from income tax as a public authority for the purposes of s.50-25 of the Income Tax Assessment Act 1997. This assessment will be confirmed by an application for a private ruling from the Australian Taxation Office during the 2006 - 07 financial year.” (p20). One is amazed this has not been sorted out by this – but delay is consistent with the apparent slowness of the organisation getting ramped up in general.
“The company’s major liability of trade and other payables ($3,086,023) comprises goods and services tax payable on member contributions and general trade payables.” I really wonder why NEHTA would pay GST on its member contributions – they are grants from State to Federal Governments are they not?
I know bureaucrats thrive on letting nothing out that could result and any controversy or criticism – but this so called “Annual Report” has set a new bar for obfuscation and concealment.
NEHTA is a publicly funded entity which has now expended well over $20 million in its initial and now corporate manifestations. The public is entitled to a much clearer statement of just what has been achieved and what is planned in my view.
The total lack of any sense of the need to provide more than the scantiest accountability or openly discuss and consult on future plans and directions is amazingly arrogant and borders on a scandal.
David.
The document contains riveting information on the organisational structure of NEHTA, two puff pieces (from the chairperson and CEO) saying what a success it has been so far, two and a half pages outlining all the stakeholders who have been “engaged with”, and a two page 2006 – 6 update of all the projects they are undertaking.
The rest of the document gives is a graph of the exponential recruitment process (to now about sixty people) and two pages of guff on directorial movements and changes.
It then concludes with the usual statements of audit independence and a “concise financial report” – the real report seems to be secret – and an auditors statement that the accounts are unqualified and accurate. (This takes seven pages with only two pages of figures provided).
The 24 page report thus provides a totally inadequate two page report on what NEHTA has achieved with the almost $10 million it has spent this financial year.
Those interested can access the report at the following URL.
http://www.nehta.gov.au/component/option,com_docman/task,cat_view/gid,92/Itemid,139/
As with all such documents it is not what is in the document, but what is left out that really matters.
Left out is enunciation of any real e-Health Vision or Strategy for Australia.
Left out is any indication of how the interoperation between the Private (read the GP, investigative and Specialist sectors), and the Public Health System is going to or could be made to work.
Left out are any performance measures and any statements as to how NEHTA is performing against these benchmarks.
Left out is any analysis of the business risks faced by NEHTA – especially those around not being able to get funding for the Shared Electronic Health Record and what would then be done with all this work.
Left out is any clear forward plan as to just what is to be delivered and when – with a staff of 38 then and 60 now – most having project management skills – one wonders why? (All there are a statements that some things have to be done by mid 2008 and others by mid 2009 – all a long way off compared with the pace we see in the US and the UK right now!)
Left out is any explanation of just what a little over $1.7 million spent on administration has achieved. Given that the total operational expenses were a little over $9 million it would seem a lot was spent administering.
Left out is any listing of, or rationale for the selection of, the clinicians and consumer representatives who have been consulted with a small number of time.
Left out is any evidence of a single improved clinical outcome or improved information flow to result from NEHTA’s two years of work so far.
Left out is why $7 million plus of member contributions were not spent this financial year. Work in this are is urgent and the opportunity cost of inactivity is high. Why so slow to get moving when the funds are available?
Left out is an explanation of the $4.5 million in receivables at the end of the year which is mostly members contributions owing. Seems some States are not paying promptly?
Among the interesting tit-bits to be found in the report are the following quotes:
“The company operates predominantly in one business and geographical segment being the development of methods to electronically collect and securely exchange health information throughout Australia.” (p21). Its nice to know what they are meant to be doing at least!
“The full financial report is available to Members free of charge upon request.” (p20). That means we want to keep the public away I would suggest – the members being the jurisdictional CEOs are to be the only ones who know what is going on!.
“NEHTA believes it is exempt from income tax as a public authority for the purposes of s.50-25 of the Income Tax Assessment Act 1997. This assessment will be confirmed by an application for a private ruling from the Australian Taxation Office during the 2006 - 07 financial year.” (p20). One is amazed this has not been sorted out by this – but delay is consistent with the apparent slowness of the organisation getting ramped up in general.
“The company’s major liability of trade and other payables ($3,086,023) comprises goods and services tax payable on member contributions and general trade payables.” I really wonder why NEHTA would pay GST on its member contributions – they are grants from State to Federal Governments are they not?
I know bureaucrats thrive on letting nothing out that could result and any controversy or criticism – but this so called “Annual Report” has set a new bar for obfuscation and concealment.
NEHTA is a publicly funded entity which has now expended well over $20 million in its initial and now corporate manifestations. The public is entitled to a much clearer statement of just what has been achieved and what is planned in my view.
The total lack of any sense of the need to provide more than the scantiest accountability or openly discuss and consult on future plans and directions is amazingly arrogant and borders on a scandal.
David.
Sunday, October 29, 2006
Personal Health Information Privacy – The Elephant in the Room.
It seems that on both sides of the Pacific there is increasing interest in, and increasing difficulty with, working out an approach, and the supporting technology infrastructure, to meet public expectations for health information privacy and security while at the same time permitting health care providers the access to information they need, quite legitimately, to provide optimal care. This short article aims to provide some talking points and base assumptions / positions that may be relevant in the very difficult policy area.
The key assumptions I would make are:
1. Technology can provide any level of information security and privacy that can be desired.
In 2006 it is perfectly possible, through techniques such as encryption, to secure electronic health information in such a way as to render unauthorised access virtually impossible. The military of most advanced countries, as an example, achieve this despite quite expert efforts to compromise their message integrity.
So what then is the problem? As I see it there are a few problems. First there are issues of cost. Military grade security comes with a military price tag. Second there is the issue of convenience. If a system is clumsy or difficult to use it will either not be used or the users will work out ways to make things easier for themselves by doing such things as using easily remembered passwords (which are easily compromised) or writing harder ones down in places where they are easy to find.
So while the technology is willing and able it is a truism that the weakest link are the users of system who either for convenience, speed and very rarely for malice will compromise the best designed security system.
The only satisfactory approach to address this risk is a combination of user education around the importance of complying with the rules along with regular audit, both passive via audit file review and active through deliberate attempts to subvert individual user discipline to ensure the educational program is actually working.
That users will take advantage of privileged access to information is well known with many stories of staff in the police, tax departments and hospitals accessing information out of curiosity or occasionally for more nefarious motives.
2. If the issue of privacy of personal identifiable health information is not frankly and honestly addressed it is likely most initiatives involving the sharing of health information will either fail or be severely compromised.
It is an article of faith with me, and I suspect with most readers of this blog, that an appropriate deployment of information technology in the health sector can improve the quality and safety of healthcare services. Central to this improvement being achieved is to put in place individual patient records on which clinical decision making can be based and on which decision support systems can operate.
If the target of our care are not entirely comfortable with the caring professions efforts to keep confidential their most sensitive secrets any electronic record initiative will face major, and probably fatal, implementation hurdles.
At present, as best I read the research, the key concern most citizens have is that, unknown to them, their private information will move out of their control and ability to access and correct as well as a fear of disclosure, profit from or use by unknown third parties.
Most seem quite comfortable with their GP recording information about them in his personal clinical system and most are pleased to be cared for in hospitals where they are not asked for the same details ten times a day.
Concern arises once there is the possibility the information moves out of the direct control of the GP or hospital.
For any such use and sharing of information citizens are very keen to understand just what is being shared, why it is being shared and that they will have an effective right of veto before it is shared.
There is already concern, on the part of some, that GP prescribing sets and the like are being shared, without the patient’s knowledge, with pharmaceutical companies for marketing purposes. One wonders just how the patient’s interests are being served with this sort of disclosure
3. It is important to recognise individuals have differing sensitivities associated with their health information.
Your correspondent is well past his physical prime and in the last few years have had a number of stays in hospital. Each of these stays was for investigations and procedures that are quite commonplace and frankly if anyone where to get hold of my full record the worst that they could conclude is that I should have stopped smoking thirty years ago and not twenty years ago. In a health sense I have nothing to hide and so do no care who has my records.
An individual who is their past has a mental illness, a genetically inherited risk, an abortion, an STD, HIV/AIDS, a cosmetic breast operation or whatever may feel entirely different and wish to either be able to exert very fine grained control on what information can be shared or indeed prevent any sharing at all. This is entirely reasonable and it is up to system designers to ensure such control is available. Again this is not a technical issue but rather a system design issue.
4. While one can design technology neutral Privacy Principles their implementation has to respond to a very different set of risks. In no sense does one size fit all in these circumstances.
There seems to be a view among policy makers that all that is needed are a correct set of Privacy Principles and all will be well for all. I believe this is naïve and wrong.
First there seems to me to be a very good case for ensuring that the level of protection provided for identified health information should be more robust and better enforced than say financial, purchasing or employee records. Not to say these should not be robustly protected but given the potential personal impact of disclosure of health information that even more care is warranted than may be justifiable for other information.
Second, as already discussed on the blog, the risks that are faced by electronic and paper records are different and do require different risk analysis and different responses.
Essentially what we need to recognise it that if private information escapes into hands that the owner of that information is not comfortable with the consequences can be personally and professionally devastating.
What is needed is the sort of education and auditing mentioned above and for breaches there needs to be a carefully designed regime of penalties and enforcement that is swift, has real teeth so it can act as a serious deterrent and which considers the impact on the victim of the breach properly.
Additionally real privacy experts need to be involved in system design and implementation. As well it is important that there be proper piloting and evaluation of privacy controls as they are practically implemented to ensure the outcomes citizens expect are actually being delivered in the real world.
Overall if I had one mantra it would be that “care must to be taken to establish and retain citizen trust”. If this is not achieved we ultimately may not be able to successfully implement and operate the systems the Health Sector so badly needs.
David.
Appendix:
What is discussed above I would see as an ideal situation. What is happening in Australia falls far short of the ideal. The two most egregious examples that comes to mind is the apparent continued use of non-individualised and non role based security provided to protect information contained in the South Australian OACIS system. When I last heard – and I am happy to be corrected on this if things have moved on – a clinical user at one hospital, once logged on, could access any record of essentially any type for any South Australian on the system. When last I spoke with people in SA there was not even the capability for a patient to withhold results from the system. (Note an Updated Comment was posted on November 23, 2006 and should be read with the material provided here - David.)
I understand some similar issues also exist with the Healthelink trial in NSW. Here again there is a single level of access – you can find any patient on the system and see all that is held – or not if the patient has ‘opted out’. Patient have no capacity to segregate sensitive from other information and some will inevitably be disadvantaged by such poor initial system design.
The following two articles in the Australian of the 28th October 2006 make useful supporting reading.
.
http://www.theaustralian.news.com.au/story/0,20867,20655984-23289,00.html
Policing privacy
Plans to put the medical records of all Australians online face strong opposition from doctors and privacy advocates. Leigh Dayton reports
________________________________________
October 28, 2006
HERE'S the dream: your elderly mother suffers breathing difficulties. You take her to a GP who recommends a series of tests. The procedures are scheduled online, much like booking a flight to Bali.
When your mother arrives at the hospital for the tests, all her medical records are available to the specialists, again online. Results are added instantly to her "electronic health record" and a "cyber-script" is sent straight to her local pharmacist. The pharmacist checks the prescription against her other medications and has it filled when you drop by to collect it.
Meanwhile, your mother's doctor has reviewed her test results online and arranged a follow-up visit with a respiratory specialist who immediately has details at the click of a mouse. Online booking, online records, online service. Plus, neither you nor you mother has explained her problem numerous times, or waited for paper records to be sent by mail.
Here's the nightmare: you go to your doctor, seeking help for a drug and alcohol problem. There, you book online for specialist treatment at a discrete facility. The receptionist managing bookings at the facility recognises your name and tells a friend, your former – and very angry – spouse. Word reaches your employer's ear. You're fired.
Continued….
http://www.theaustralian.news.com.au/story/0,20867,20655988-23289,00.html
Patient privacy must be governed by a unified national system
Mukesh Haikerwal
October 28, 2006
THE Australian Medical Association has for a long time been calling for an overhaul of Australia's privacy laws and the establishment of a unified national system governing the privacy of information in the health sector.
Continued …
Dr Mukesh Haikerwal is president of the Australian Medical Association
D.
The key assumptions I would make are:
1. Technology can provide any level of information security and privacy that can be desired.
In 2006 it is perfectly possible, through techniques such as encryption, to secure electronic health information in such a way as to render unauthorised access virtually impossible. The military of most advanced countries, as an example, achieve this despite quite expert efforts to compromise their message integrity.
So what then is the problem? As I see it there are a few problems. First there are issues of cost. Military grade security comes with a military price tag. Second there is the issue of convenience. If a system is clumsy or difficult to use it will either not be used or the users will work out ways to make things easier for themselves by doing such things as using easily remembered passwords (which are easily compromised) or writing harder ones down in places where they are easy to find.
So while the technology is willing and able it is a truism that the weakest link are the users of system who either for convenience, speed and very rarely for malice will compromise the best designed security system.
The only satisfactory approach to address this risk is a combination of user education around the importance of complying with the rules along with regular audit, both passive via audit file review and active through deliberate attempts to subvert individual user discipline to ensure the educational program is actually working.
That users will take advantage of privileged access to information is well known with many stories of staff in the police, tax departments and hospitals accessing information out of curiosity or occasionally for more nefarious motives.
2. If the issue of privacy of personal identifiable health information is not frankly and honestly addressed it is likely most initiatives involving the sharing of health information will either fail or be severely compromised.
It is an article of faith with me, and I suspect with most readers of this blog, that an appropriate deployment of information technology in the health sector can improve the quality and safety of healthcare services. Central to this improvement being achieved is to put in place individual patient records on which clinical decision making can be based and on which decision support systems can operate.
If the target of our care are not entirely comfortable with the caring professions efforts to keep confidential their most sensitive secrets any electronic record initiative will face major, and probably fatal, implementation hurdles.
At present, as best I read the research, the key concern most citizens have is that, unknown to them, their private information will move out of their control and ability to access and correct as well as a fear of disclosure, profit from or use by unknown third parties.
Most seem quite comfortable with their GP recording information about them in his personal clinical system and most are pleased to be cared for in hospitals where they are not asked for the same details ten times a day.
Concern arises once there is the possibility the information moves out of the direct control of the GP or hospital.
For any such use and sharing of information citizens are very keen to understand just what is being shared, why it is being shared and that they will have an effective right of veto before it is shared.
There is already concern, on the part of some, that GP prescribing sets and the like are being shared, without the patient’s knowledge, with pharmaceutical companies for marketing purposes. One wonders just how the patient’s interests are being served with this sort of disclosure
3. It is important to recognise individuals have differing sensitivities associated with their health information.
Your correspondent is well past his physical prime and in the last few years have had a number of stays in hospital. Each of these stays was for investigations and procedures that are quite commonplace and frankly if anyone where to get hold of my full record the worst that they could conclude is that I should have stopped smoking thirty years ago and not twenty years ago. In a health sense I have nothing to hide and so do no care who has my records.
An individual who is their past has a mental illness, a genetically inherited risk, an abortion, an STD, HIV/AIDS, a cosmetic breast operation or whatever may feel entirely different and wish to either be able to exert very fine grained control on what information can be shared or indeed prevent any sharing at all. This is entirely reasonable and it is up to system designers to ensure such control is available. Again this is not a technical issue but rather a system design issue.
4. While one can design technology neutral Privacy Principles their implementation has to respond to a very different set of risks. In no sense does one size fit all in these circumstances.
There seems to be a view among policy makers that all that is needed are a correct set of Privacy Principles and all will be well for all. I believe this is naïve and wrong.
First there seems to me to be a very good case for ensuring that the level of protection provided for identified health information should be more robust and better enforced than say financial, purchasing or employee records. Not to say these should not be robustly protected but given the potential personal impact of disclosure of health information that even more care is warranted than may be justifiable for other information.
Second, as already discussed on the blog, the risks that are faced by electronic and paper records are different and do require different risk analysis and different responses.
Essentially what we need to recognise it that if private information escapes into hands that the owner of that information is not comfortable with the consequences can be personally and professionally devastating.
What is needed is the sort of education and auditing mentioned above and for breaches there needs to be a carefully designed regime of penalties and enforcement that is swift, has real teeth so it can act as a serious deterrent and which considers the impact on the victim of the breach properly.
Additionally real privacy experts need to be involved in system design and implementation. As well it is important that there be proper piloting and evaluation of privacy controls as they are practically implemented to ensure the outcomes citizens expect are actually being delivered in the real world.
Overall if I had one mantra it would be that “care must to be taken to establish and retain citizen trust”. If this is not achieved we ultimately may not be able to successfully implement and operate the systems the Health Sector so badly needs.
David.
Appendix:
What is discussed above I would see as an ideal situation. What is happening in Australia falls far short of the ideal. The two most egregious examples that comes to mind is the apparent continued use of non-individualised and non role based security provided to protect information contained in the South Australian OACIS system. When I last heard – and I am happy to be corrected on this if things have moved on – a clinical user at one hospital, once logged on, could access any record of essentially any type for any South Australian on the system. When last I spoke with people in SA there was not even the capability for a patient to withhold results from the system. (Note an Updated Comment was posted on November 23, 2006 and should be read with the material provided here - David.)
I understand some similar issues also exist with the Healthelink trial in NSW. Here again there is a single level of access – you can find any patient on the system and see all that is held – or not if the patient has ‘opted out’. Patient have no capacity to segregate sensitive from other information and some will inevitably be disadvantaged by such poor initial system design.
The following two articles in the Australian of the 28th October 2006 make useful supporting reading.
.
http://www.theaustralian.news.com.au/story/0,20867,20655984-23289,00.html
Policing privacy
Plans to put the medical records of all Australians online face strong opposition from doctors and privacy advocates. Leigh Dayton reports
________________________________________
October 28, 2006
HERE'S the dream: your elderly mother suffers breathing difficulties. You take her to a GP who recommends a series of tests. The procedures are scheduled online, much like booking a flight to Bali.
When your mother arrives at the hospital for the tests, all her medical records are available to the specialists, again online. Results are added instantly to her "electronic health record" and a "cyber-script" is sent straight to her local pharmacist. The pharmacist checks the prescription against her other medications and has it filled when you drop by to collect it.
Meanwhile, your mother's doctor has reviewed her test results online and arranged a follow-up visit with a respiratory specialist who immediately has details at the click of a mouse. Online booking, online records, online service. Plus, neither you nor you mother has explained her problem numerous times, or waited for paper records to be sent by mail.
Here's the nightmare: you go to your doctor, seeking help for a drug and alcohol problem. There, you book online for specialist treatment at a discrete facility. The receptionist managing bookings at the facility recognises your name and tells a friend, your former – and very angry – spouse. Word reaches your employer's ear. You're fired.
Continued….
http://www.theaustralian.news.com.au/story/0,20867,20655988-23289,00.html
Patient privacy must be governed by a unified national system
Mukesh Haikerwal
October 28, 2006
THE Australian Medical Association has for a long time been calling for an overhaul of Australia's privacy laws and the establishment of a unified national system governing the privacy of information in the health sector.
Continued …
Dr Mukesh Haikerwal is president of the Australian Medical Association
D.
Thursday, October 26, 2006
What is Happening at NSW Health with Healthelink?
In the last couple of days there have been two reports on the ABC related to electronic health records in NSW. To date I am yet to see any other reports covering what was said in a couple of news bulletins.
The two items were, in chronological order, as follows:
http://www.abc.net.au/news/newsitems/200610/s1772953.htm
Privacy group urges patients to opt out of database
The Australian Privacy Foundation (APF) says patients should ask their doctor not to put their records on a new electronic database, because the system is a breach of privacy.
The New South Wales Government says it will roll out the system, which will allow a patient's health records to be accessed from anywhere within the public health system at any time.
The chairwoman of the APF, Anna Johnston, says patients' records will be put on the database unless they opt out.
Ms Johnston says a trial of the system has failed to get the support of doctors.
"There are very real concerns amongst GPs that if they do participate in the system they will be in breach of federal privacy law which says you cannot collect health information about people without their consent," she said.
"The system has been designed in such a way that health service providers could effectively collect health information about every person in the state, not just those who are their patients."
http://www.abc.net.au/news/newsitems/200610/s1773511.htm
Electronic medical record system can save lives: Iemma
New South Wales Premier Morris Iemma says the introduction of a new electronic medical record system will reduce hospital errors and cut costs.
The electronic system places patient details on an internal computer system for quicker access by clinicians.
Private company Cerner Corporation has won a $40 million contract to roll the system out for the state's eight area health services by 2009.
Mr Iemma says it will provide one integrated system.
"This can save lives," he said.
"It frees up the time of the health care professionals to provide health care and not administration."
Currently only 4 per cent of patients are choosing to opt out of the program.
In the future, the system could be centralised and connected to the records of general practitioners.
The Australian Privacy Foundation has raised concerns that expanding the system could breach privacy laws.”
The interesting aspects of all this are as follows.
1. The normally “I’ll announce something good every day” Health Minister in NSW John Hatzistergos was not the announcee of the news.
2. The Premier’s press release refers to Cerner Corporation (a very large US based listed Health IT provider of predominantly hospital systems).
I believe what the Premier’s announcement is about is the final wrapping up of an aborted RFT-IT 190. This tender was released in May 2005 to obtain what used to be referred to as Point of Care Clinical Software (PoCCS) and which has been relabelled as Electronic Medical Record (EMR) software.
As stated in the tender document:
“Potentially four Areas could be seeking EMR implementations through the period contract arrangements resulting from this RFT. These are South Eastern Sydney Illawarra, Hunter New England, Greater Southern and Justice Health”
Some 17 months later we now hear that Cerner is to take up the baton NSW wide as far as clinical systems are concerned for all Area Health Services. This is obviously a good thing as having as much of the current NSW market as Cerner already had – consistency across the whole State system will provide useful efficiencies in staff training and the costs of staff – relocation as well as in the consistency of operational data available.
The delays and costs in getting to this point are, of course, just ridiculous. Six months should have been more than enough time to test the market and confirm (or not) Cerner as the sole EMR provider for NSW Health for the next few years. No wonder the Health Minister left it to his Premier!
This software is specifically for internal Hospital use and has nothing really directly to do with the Healthelink project which I understand is still battling with the issues raised by the Privacy Foundation and which threatens to become a considerable white elephant.
Cerner’s approach to security and privacy, along with its internal hospital operational role, should provide much less in the way of privacy concerns. Systems such as Cerner's provide very considerable operational support for in-hospital care delivery and clearly are something one would not want to take advantage of when in hospital.
I would be curious to hear comments from any readers who have better information – noting the useful confirmation of the iSoft comments made here from a previous insider that has been posted recently.
David.
The two items were, in chronological order, as follows:
http://www.abc.net.au/news/newsitems/200610/s1772953.htm
Privacy group urges patients to opt out of database
The Australian Privacy Foundation (APF) says patients should ask their doctor not to put their records on a new electronic database, because the system is a breach of privacy.
The New South Wales Government says it will roll out the system, which will allow a patient's health records to be accessed from anywhere within the public health system at any time.
The chairwoman of the APF, Anna Johnston, says patients' records will be put on the database unless they opt out.
Ms Johnston says a trial of the system has failed to get the support of doctors.
"There are very real concerns amongst GPs that if they do participate in the system they will be in breach of federal privacy law which says you cannot collect health information about people without their consent," she said.
"The system has been designed in such a way that health service providers could effectively collect health information about every person in the state, not just those who are their patients."
http://www.abc.net.au/news/newsitems/200610/s1773511.htm
Electronic medical record system can save lives: Iemma
New South Wales Premier Morris Iemma says the introduction of a new electronic medical record system will reduce hospital errors and cut costs.
The electronic system places patient details on an internal computer system for quicker access by clinicians.
Private company Cerner Corporation has won a $40 million contract to roll the system out for the state's eight area health services by 2009.
Mr Iemma says it will provide one integrated system.
"This can save lives," he said.
"It frees up the time of the health care professionals to provide health care and not administration."
Currently only 4 per cent of patients are choosing to opt out of the program.
In the future, the system could be centralised and connected to the records of general practitioners.
The Australian Privacy Foundation has raised concerns that expanding the system could breach privacy laws.”
The interesting aspects of all this are as follows.
1. The normally “I’ll announce something good every day” Health Minister in NSW John Hatzistergos was not the announcee of the news.
2. The Premier’s press release refers to Cerner Corporation (a very large US based listed Health IT provider of predominantly hospital systems).
I believe what the Premier’s announcement is about is the final wrapping up of an aborted RFT-IT 190. This tender was released in May 2005 to obtain what used to be referred to as Point of Care Clinical Software (PoCCS) and which has been relabelled as Electronic Medical Record (EMR) software.
As stated in the tender document:
“Potentially four Areas could be seeking EMR implementations through the period contract arrangements resulting from this RFT. These are South Eastern Sydney Illawarra, Hunter New England, Greater Southern and Justice Health”
Some 17 months later we now hear that Cerner is to take up the baton NSW wide as far as clinical systems are concerned for all Area Health Services. This is obviously a good thing as having as much of the current NSW market as Cerner already had – consistency across the whole State system will provide useful efficiencies in staff training and the costs of staff – relocation as well as in the consistency of operational data available.
The delays and costs in getting to this point are, of course, just ridiculous. Six months should have been more than enough time to test the market and confirm (or not) Cerner as the sole EMR provider for NSW Health for the next few years. No wonder the Health Minister left it to his Premier!
This software is specifically for internal Hospital use and has nothing really directly to do with the Healthelink project which I understand is still battling with the issues raised by the Privacy Foundation and which threatens to become a considerable white elephant.
Cerner’s approach to security and privacy, along with its internal hospital operational role, should provide much less in the way of privacy concerns. Systems such as Cerner's provide very considerable operational support for in-hospital care delivery and clearly are something one would not want to take advantage of when in hospital.
I would be curious to hear comments from any readers who have better information – noting the useful confirmation of the iSoft comments made here from a previous insider that has been posted recently.
David.
Subscribe to:
Posts (Atom)