There Are Some Ways That We Can Assist in Reducing Data Breaches In the Health System.

It does seem the US is an endless source of revelations regarding loss of private electronic health information.

A couple of recently reported examples include:

Florida Hospital privacy breach: Workers accessed ER patient information

3 employees terminated; more than 2,000 patients notified by mail of breach

By Kate Santich and David Breen, Orlando Sentinel

7:51 PM EDT, September 30, 2011

Florida Hospital tried to reassure patients Friday that a breach of its electronic medical records spanning 20 months was limited to certain patients and not used for identity theft.

Instead, the intent of the breach — which targeted emergency-room patients who were involved in motor-vehicle accidents — appears to have been to pass the information on to an attorney-referral service. However, neither the hospital nor the Osceola County Sheriff's Office, which continues to investigate the incident, could confirm the motive.

The problem came to the hospital's attention, according to hospital spokeswoman Samantha O'Lenick, when a woman who had been in a car accident complained that she had been contacted by a lawyer referral service — and there apparently was no other way for the service to have obtained her personal information.

The breach occurred between January 2010 and Aug. 15, 2011, O'Lenick said. All 2,252 patients whose records were subject to "inappropriate access" are being contacted by mail.

The hospital has fired the three employees involved, all of whom were nonmedical personnel whose records indicated no previous disciplinary actions. On Sept. 6 the matter was referred to both the Osceola County Sheriff's Office and the FBI. The hospital did not further publicize the situation until Friday, when it took out a public notice to alert patients who might overlook the news in their mailbox.

Lots more here:

http://www.sun-sentinel.com/news/local/florida/os-florida-hospital-privacy-breach-20110930,0,932397.story

and another recent summary comment report here

Stolen patient records call for better communication

October 5, 2011 — 10:08pm ET | By Marla Durben Hirsch - Contributing Editor

It's very disconcerting that TRICARE contractor Science Applications International Corporation (SAIC) lost unencrypted backup tapes from an electronic health care record containing the personally identifiable and protected health information impacting almost 5 million military clinic and hospital patients. The tapes, which included 19 years worth of patient data, were stolen from the car of an SAIC employee.

Even more disconcerting: Not only was this kind of security breach--theft of patient information from a contractor's car--not an isolated incident, but with a little communication, it likely was easily avoidable.

In August, Saint Barnabas Health Care System in New Jersey and Cook County Health and Hospitals System in Chicago both reported that they were affected by a breach involving the theft of an external hard drive from the car of an employee of MedAssets, a business associate of the two hospital systems that provided revenue management and supply chain services. The breach involved the records of 82,000 patients. The hard drive was neither password protected nor encrypted. 

The SAIC employee in the TRICARE breach valued his stolen car stereo system at $300; meanwhile, the stolen Tricare backup tapes were valued only at $100.

According to a recent Ponemon Institute report, however, it now costs the victim of a security breach $214 per compromised record and an average of $7.2 million per data breach event. A large part of the problem is that some business associates, although relatively familiar with HIPAA's privacy rule, still are not as well versed in HIPAA's security rule and the security breach notification requirements.

More here:

http://www.fierceemr.com/story/stolen-patient-records-highlight-need-communication-contractors/2011-10-05

The risk is indeed very real. (see the first paragraph below).

http://govhealthit.com/news/6-tips-avoiding-data-breaches

The 6 tips for avoiding data breaches

September 30, 2011 | Michelle McNickle, Web content producer

According to a Department of Health & Human Services (HHS) tally of data breaches since 2009, about 260 incidents occurred that went on to affect more than 10 million patients. And, it gets worse -- the second largest breach occurred not because of a hacked password but when computer back-up tapes were stolen from the back of a truck.

Security within the industry is changing, and health data breaches are a significant issue. According to Rick Kam, president and co-founder of ID Experts, now is a critical time in determining the future of health security. 

"We're at the convergence of technology becoming more pervasive in healthcare," he said. "Patients want to share information and have multiple providers. This includes more sophisticated criminals as well as healthcare reform. Coming on the horizon in the area of healthcare, you could say we're at the crux of a potential data breach disaster -- if not within the next few months, within the next year you’ll see a data breach oil spill, so to speak."

"We operate with three core values," added Christine Arevalo, director of healthcare identity management at ID Experts. "One is the importance of taking preventative action. The second is doing the right thing for patients and the data you're entrusted with; the system as a whole is based on the trust patients have in physicians and safeguarding their sensitive information. And the third is being compliant -- it's a regulatory matter that can’t be ignored. We’re seeing a lot more of those rules being enforced, specifically data breach notifications. Companies can't hide from those issues anymore."

With that said, Kam and Arevalo shared six ways to plan for, mitigate and protect against health data breaches. 

1. Perform a risk assessment.

2. Inventory your PHI.

3. Develop PHI security strategy.

4. Train employees.

5. Implement processes, technologies and polices.

6. Have an incident response plan ready.

The full article is here - explaining each of the points (note PHI stands for Protected Health Information):

http://govhealthit.com/news/6-tips-avoiding-data-breaches

The reason I raise all this is in the context of the planned legislation for the PCEHR.
(The following is an expansion of my Draft Submission BTW)

On page 29 of the Companion to the Exposure Draft we read:

“Certain participants in the PCEHR system must notify certain matters such as data breaches or risk of being in contravention of the Draft Bill with potential civil penalties to apply to those contraventions.

Entities such as the System Operator, a registered repository or registered portal provider have obligations to report matters to the System Operator, or in certain circumstances both the System Operator and the Information Commissioner.

In addition to the notification, the entity must do the followings things:

• contain the contravention and undertake a preliminary analysis;
• evaluate the associated risks;
• if the entity is the System Operator – consider notifying the affected consumers;
• if the entity is not the System Operator – ask the System Operator to consider notifying the affected consumers.

In addition, the entity must take steps to prevent or mitigate the effects of further contraventions, events or circumstances in relation to the unauthorised collection, use or disclosure of health information included in a person’s PCEHR.

A further civil penalty provision in the Draft Bill provides that a registered repository operator or a registered portal operator must not contravene the PCEHR Rules that apply to that operator or portal.”

Can I suggest this is just not good enough. The legislation should make it clear that the release or breach of any personally identifiable information should be notified to the individual concerned and additionally any breach that involves more than 100 individuals should be notified to the public with an analysis of what caused the breach.

Of course notification is bolting the door after the horse has gone and clearly the legislation should also make it clear, as it does to some extent, that to prevent breaches in the first place is required and to not take reasonable preventative steps is also an offence.

The US compulsion to notify is, of course, the reason we know how it bad it is over there and we need the same here!

Pretty simple really.

David.

Amazing Demonstration of High Definition Dental Education Software. Worth a Look If Dentists Don’t Worry You!

I had an e-mail about this software this morning.

I am no dentist - and I don’t like what they do much with those drills etc. but this educational tool to explain to patients where all the money is going looks amazing.

Go here to watch - if you are not dentist averse! (Only a couple of mins in duration)

http://youtu.be/EbeCUrN09vs

Or if you are up to it try this one:

http://www.youtube.com/watch?v=KKA388h8xbU&feature=related

I am sure they are trying to sell something (i.e. the software!) - but it is interesting to see just what is possible!

I wonder what other clever people are doing for the broader medical arena?

David.

Draft Submission on the Proposed PCEHR Legislation - Due October 28, 2011

Here is what I have in mind - happy to take comments and thanks for all those on yesterday’s post.

-----

Submission to the Commonwealth Department of Health and Ageing.

Topic: Exposure Draft PCEHR Bill

Date October, 2011

Submissions Due: 28 October, 2011

Address for submissions:

E-mail

ehealth.legislation@health.gov.au

Postal Mail

PCEHR Legislation Issues Feedback
Department of Health and Ageing
GPO Box 9848
Canberra, ACT 2606

Submission Author:

Dr David G More BSc, MB, BS, PhD, FANZCA, FCICM, FACHI.

Author’s Background. I am experienced specialist clinician who has been working in the field of e-Health for over 20 years. I have undertaken major consulting and advisory work for many private and public sector organisations including both DoHA and NEHTA.

Previous Submissions

I previously provided a Submission on the PCEHR proposal to NHHRC in May, 2009 and the views expressed in that submission remain my position despite the work undertaken by DoHA and NEHTA since.

This submission is available here:

http://www.health.gov.au/internet/nhhrc/publishing.nsf/Content/309-interim/$FILE/309%20-%20Submission%20-%20Dr%20David%20More.pdf

A later submission on the Draft Concept of Operations for the PCEHR from May2011 is found here:

http://yourhealth.gov.au/internet/yourhealth/blog.nsf/0B1279740F76811CCA2578D9001CB8EC/$FILE/Dr%20David%20More%20submission.pdf

Consent for Publication.

I am more than happy for this submission to be made available for public review on the Department of Health and Ageing website.

Submission

As a non-lawyer I am unable to comment on the drafting of the planned Bills but am basing my comments on the Companion to the Exposure Draft Bill - as I am sure this document accurately reflects both the intention and the drafting of the proposed Bill(s).

It is my view that the intent reflected in the Companion document is deeply flawed and will result in failure of the PCEHR System to deliver the outcomes sought by the Government.

In my view there are two major errors of omission and two major errors of commission contained in the present proposals.

Error of Omission Number 1. - The Lack of an Agreed, Consulted and Legislated Framework for the Governance of the PCEHR.

On Page 13 of the Companion: (as reported by Adobe Reader)

"It is intended that the Secretary will fill the role of System Operator initially. Further discussions will be held with the states and territories around possible future options for the long-term governance of national e-health such as an inter-jurisdictional body."

This is a disastrous flaw and will guarantee there is simply no one will trust the system. Having a system holding your private health information which is not at arm’s length to Government and to political interference is vital.

I believe the best way this can be achieved is via an independent Statutory Authority which is responsible to parliament for its activities, reports regularly, is subject to review by Parliament and Senate Estimates, has a formal recurring budget allocation and a properly constituted and accountable board.

Unless this is planned, discussed, legislated and delivered the Government is simply setting itself up for a lack of public confidence and failure.

Error of Omission Number 2. The Failure to Provide a Legislated and Obligatory Breach Reporting Regime.

On page 29 of the Companion to the Exposure Draft we read:

“Certain participants in the PCEHR system must notify certain matters such as data breaches or risk of being in contravention of the Draft Bill with potential civil penalties to apply to those contraventions.

Entities such as the System Operator, a registered repository or registered portal provider have obligations to report matters to the System Operator, or in certain circumstances both the System Operator and the Information Commissioner.

In addition to the notification, the entity must do the followings things:

• contain the contravention and undertake a preliminary analysis;
• evaluate the associated risks;
• if the entity is the System Operator – consider notifying the affected consumers;
• if the entity is not the System Operator – ask the System Operator to consider notifying the affected consumers.

In addition, the entity must take steps to prevent or mitigate the effects of further contraventions, events or circumstances in relation to the unauthorised collection, use or disclosure of health information included in a person’s PCEHR.

A further civil penalty provision in the Draft Bill provides that a registered repository operator or a registered portal operator must not contravene the PCEHR Rules that apply to that operator or portal.”

Can I suggest this is just not good enough. The legislation should make it clear that the release or breach of any personally identifiable information should be notified to the individual concerned and additionally any breach that involves more than 100 individuals should be notified to the public with an analysis of what caused the breach.

Of course notification is just bolting the door after the horse has gone and clearly the legislation should also make it clear, as it does to some extent, that to prevent breaches in the first place is required and to not take reasonable preventative steps is also an offence.

Proof of the benefit of this approach is that in the US there is compulsion to notify significant breaches and, of course, this is the reason we know how it bad it is over there and why we need the same approach here.

Error of Commission Number 1. A blatant attempt to transfer responsibility for identification of users of the PCEHR from the Government provided security systems to the practitioner or other entity who is accessing the PCEHR.

Page 33 of the Companion: (As reported by Adobe Reader)

“Registered healthcare provider organisations must ensure that individuals accessing PCEHRs on their behalf (i.e. authorised users) provide, at the time of access, sufficient information to identify the individual accessing the PCEHR. This requirement is essential to ensuring a comprehensive audit trail is maintained of access to consumers’ PCEHRs.”

What does this actually mean and how will it work? It seems to it mean the provider organisation needs to retain an audit trail of which user who logged on to what system using the organisational certificate. Note this appears to transfer an obligation to do so from the PCEHR Operator and the PCEHR system back to the healthcare provider organisation.

It is also clear that the approach to providing a user specific audit trail from provider to the PCEHR system is still pretty much a work in progress (in the absence of NASH actually being defined and implemented) - and that the assurances given by NEHTA and the Minister that full audit trails of user access will not be available when the System commences - and for a good while thereafter if special legislative cover is required.

No provided is going to expose themselves to the substantial penalties proposed for no benefit. This approach will ensure just zero practitioner participation once they are advised of the risks by their indemnity insurers.

Error of Commission Number 2. Removal of Both The Commonwealth and All Jurisdiction from Any Accountability and Liability for Harm and Damage Caused by The PCEHR System.

Page 8 of the Companion: (As reported by Adobe Reader)

“Binding of the Crown

The Draft Bill applies to the Commonwealth, states and territories and section 7 of the Draft Bill provides that all jurisdictions will be subject to this law.

While each jurisdiction will be legally bound by the arrangements set out in the Draft Bill, the Crown in right of the Commonwealth, states and territories will not be subject to prosecution and will not be liable for pecuniary penalties.”

So it seems no Government can be sued or prosecuted for any harm or damage resulting from this Legislation and its implementation.

This section clearly does not correctly balance the interests of citizens and government.

There are a number of other minor points where I feel the planned Legislation is in error but correcting the issues cited above would clearly take enormous strides towards some satisfactory and implementable outcomes.

David G More

Date 11.10.2011.

-----

Comments and Suggestions Please!

David.

Draft Article on Australian E-Health in 2012 - For Comment.

I am developing a new article to appear very late in the year. Here is a draft. Comments welcome!

We Are Almost Into A New Year. Time For An E-Health Progress Check.

By the time you are reading this the Festive Season will be well and truly underway and we will be able to consider what we might hope for in the New Year in E-Health.

Unquestionably the major item on the agenda for next year is the commencement of the Personally Controlled Electronic Health Record (PCEHR) which is planned to commence on July 1, 2012.

Before focussing on the PCEHR is it important to point out there is other work going on in the E-Health domain with both WA and Qld moving on finalising procurement of new systems (as of writing in mid-October, 2011) and the other States continuing with implementation of their hospital system infrastructure. The National E-Health Transition Authority (NEHTA) is also pushing on with their agenda and we can only hope in 2012 some value for patients and clinicians finally emerges for all the funds invested.

Additionally it is also worth noting both the new Commonwealth Telehealth Initiative and a range of private sector projects will be making some progress towards their objectives.

Moving to the PCEHR - which is clearly the elephant in room - I thought that there are two questions that are worthwhile considering.

The first is what needs to go right for the PCEHR System to be considered a practical and political success? Here is my list of what is needed.

1. Consumers - especially those with chronic illnesses and other reasons - need to register for and use the system in reasonable numbers. This will require that patients are confident their private health information will be safe from abuse and disclosure. It will be vital that public trust in the system is well managed, especially in the initial start-up phase.

2. Clinicians need to choose to undertake the work of preparing and transmitting the proposed health summaries to the PCEHR System and also decide to refer to the system when wishing to find out more about patients they are seeing.

3. GP and specialist software providers need to undertake the work necessary to integrate access to the PCEHR seamlessly into their practice systems.

4. Hospitals and service providers (pathology and radiology etc.) need to choose to make their information accessible to the PCEHR system or operate their own compliant information repositories.

5. The two key infrastructure programs (the Health Identifier Service and the National Authentication Service for Health (NASH)) need to be available and properly integrated into all the clinical workflows that need them.

6. The enabling legislation for the PCEHR System needs to get through the Commonwealth Parliament in a workable form including a robust governance framework and well considered security.

7. The technical aspects of the PCEHR System need to be properly delivered and the performance and reliability of the system needs to be satisfactory.

8. There needs to be a guarantee of continuing funding and support for the PCEHR System into the future. As of now the funding runs out on the day the system is planned to go live and there needs to be some clear announcement of future funding and support in the reasonably near future.

9. The risk of the entire project being simply scrapped by an incoming Coalition government before the system has had time to prove itself is not realised needs to be considered and planned for. I would be surprised if any serious evaluation of the Program could be done by the time of the next Federal Election so the project is at some risk until the outcome of that is resolved.

10. There need to be no major or publicly damaging breaches of sensitive personal information - especially in the first year or two.

11. It needs to have becomes clear to the public and profession that the PCEHR System is both useful and valuable and is making a positive difference to the care being provided to patients.

12. There need to be working secure and reliable clinical information communications in place between all the relevant parties in the health System.

13. The Standards required for the system to be implemented need to be decided and available for live implementation.

Right now it would be difficult to not form a view that the whole program carries very substantial risk and that it might have been quite sensible to proceed rather more slowly and in an initially geographically confined area until the concept, utility of the approach and rate of user adoption is better understood.

The second is to address is the issue of just what is meant by real success?

This question is pretty easy to answer. Health Minister Roxon has said many times ““Electronic health records have the potential to save lives, time and money and make the health system more efficient.” A recent example of her view on this can be found here:

http://www.health.gov.au/internet/ministers/publishing.nsf/Content/mr-yr11-nr-nr195.htm

Without being too cynical I fear the ‘practical and political’ success and ‘real’ success may not be as closely related as we might like!

It seems to me, therefore, the real criteria are the ones on which we should judge the PCEHR initiative, i.e. making a real and tangible difference. I hope that the consulting evaluation partner hired by DoHA have a plan to get back to us all in year or two after the system is implemented to confirm that indeed this is the case! I won’t hold my breath given the number of times I have seen such evaluations not quite see the light of day. I hope I am wrong in this case.

From an E-Health perspective it is clear that 2012 will be a very interesting year one way or another!

-----

Thanks for any suggestions!

David.

Weekly Australian Health IT Links – 10th October, 2011.

Here are a few I have come across this week.

Note: Each link is followed by a title and a few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.

General Comment

By far the best thing this week was to see the representatives of the medicines shopkeepers union bale out of their absurd plan to sell unproven side-effect modifying medicines to unsuspecting customers based on recommendations provided by their dispensing systems. No matter that most people won’t get the side-effect - let’s just increase our turnover and profit.

Other than this good news we have seen Minister Roxon coming out spruiking the PCEHR with at least some claims that might just be a bit wide of the mark - especially those on just how secure the planned system will be.

Of course I should mark the passing of Steve Jobs. He was clearly an important innovator and a provider of intuitively usable technologies. For this alone e-Health is probably in his debt.

Last I was again reminded that whenever you assign people a number you expose them to some risks. In this case it seems the Tax File Number system has not been as free of abuse as might be wished. The lesson of avoiding letting documents with your Tax File Number - and indeed, if you have one, your CHESS Shareholder Identity Number - go into the bin where they can be retrieved needs to be repeated often! Major risks can be avoided with a little care.

(A good trick is to have a permanent black ink marker and just write over the sensitive numbers before placing in the re-cycling!)

Note: Tomorrow I am going to start work on a submission on the planned PCEHR legislation. Any views via comments or e-mail are welcome.

-----

http://www.theaustralian.com.au/news/health-science/experts-fear-e-health-privacy-breach/story-e6frg8y6-1226157577770

Experts fear e-health privacy breach

• by: Adam Cresswell, Health editor
• From: The Australian
• October 04, 2011 12:00AM

COMPUTER experts have expressed alarm over draft laws on how the federal government's $470 million electronic health records system will work, saying the technology to guarantee security does not exist, yet healthcare organisations will face stiff penalties for privacy breaches.

The draft legislation, released for public comment by federal Health Minister Nicola Roxon on Friday, shows hospitals, GP surgeries and other organisations will be responsible for ensuring the system can identify which individual staff members are accessing records at any given time.

The government has promised this capability, known as an audit trail, will be a key part of the system of personally controlled electronic health records (PCEHR), saying it will help deter unauthorised snooping by ensuring anyone who accesses medical files without a patient's permission can be quickly and easily identified.

-----

http://www.pharmacynews.com.au/news/Patient-safety-boost-with-e-health

Patient safety boost with e-health

• By Chris Brooker on  4 October 2011

Australia’s proposed new e-health system will improve security of medical records, rather than increase privacy concerns, the Federal Government believes.

In an article in today’s Australian Financial Review, Nicola Roxon, the Minister for Health and Ageing, said arguments that electronic records would lead to decreased safety were incorrect. 

“Electronic health records have the potential to save lives, time and money and make the health system much more efficient,” she said. “They can also make medical information much more secure and private.”

-----

http://www.abc.net.au/news/2011-10-04/roxon-defends-draft-electronic-health-records/3209028

Roxon defends electronic health records system

Posted October 04, 2011 23:34:02

Federal Health Minister Nicola Roxon has dismissed criticism from privacy groups about the Government's proposed electronic health records system.

The Australian Privacy Foundation and other computer experts say the Government's draft legislation does not provide sufficient privacy guarantees, will be difficult to implement, and that the system will be unusable.

Ms Roxon says the new system is well developed and will be a great improvement on the current situation.

-----

http://www.theaustralian.com.au/australian-it/opinion/roxon-swipes-at-privacy-advocates/story-e6frgb0o-1226161523157

Roxon swipes at privacy advocates

• by: By Karen Dearne
• From: Australian IT
• October 07, 2011 6:46PM

HEALTH Minister Nicola Roxon has been out spruiking her $500 million national e-health record system this week, along the way taking an unwarranted swipe at volunteer health consumer and privacy advocates who try to consult with her department on such initiatives.

In Hobart, Ms Roxon told ABC Radio that the Australian Privacy Foundation was refusing to get onboard with government plans to create a centralised database containing everyone’s medical information and then offer access to some 800,000 healthcare providers and staff members nationwide.

“We’re actually improving on the current system,” she said. “There are very few protections in place for paper records held in big institutions like hospitals, in general practices, in pathology labs.

-----

http://www.theaustralian.com.au/australian-it/government/govt-agencies-escape-e-health-penalties/story-fn4htb9o-1226159750748

Govt agencies escape e-health penalties

• by: Karen Dearne
• From: Australian IT
• October 06, 2011 6:09AM

LEGAL liability for medical record data breaches will fall on private-sector healthcare providers, while federal and state agencies will escape prosecution and large penalties to be imposed under proposed draft legislation for the personally controlled e-health record system.

General practitioners, private hospitals, medical centres, pathology labs and diagnostic imaging centres will all be expected to access patient files held in the $500 million PCEHR system when it commences next July, but they will bear the full brunt of fines up to $66,000 for each "inappropriate access" by a doctor or other employee.

Meanwhile, public hospitals and state-based facilities will have Crown immunity from prosecution over data breach offences.

-----

http://www.australiandoctor.com.au/articles/e1/0c072fe1.asp

Illegal e-records access to draw fines

4-Oct-2011

Doctors and other health workers risk massive fines if they illegally access soon-to-be created e-health records, under proposed Federal Government legislation.

Federal Health Minister Nicola Roxon outlined the draft laws, which show there would be fines of $13,200 for individuals and $66,000 for companies which unnecessarily accessed the e-health record of any patient.

“Electronic health records have the potential to save lives, time and money and make the health system more efficient,” Ms Roxon said in a statement.

-----

http://www.cio.com.au/article/403395/federal_govt_sheds_light_next_round_e-health_record_funding

Federal Govt sheds light on next round of e-health record funding

The Department of Health and Ageing has revealed what it do with the third tranche of PCEHR funding

• Chloe Herrick (Computerworld)
• 07 October, 2011 15:06

The Federal Department of Health has revealed detailed plans for the third round of funding to be allocated to the National e-Health Transition Authority (NEHTA) next month for the Personally Controlled Electronic Health Record (PCEHR).

A spokesperson for the Department of Health and Ageing (DoHA) told Computerworld Australia that negotiations around the funding were expected to be completed shortly as the scope of NEHTA’s activities for the rest of the initiative were finalised, but could not yet disclose the figure.

According to the spokesperson, the next round of funding will support the management of delivery partners to complete the build of the system, to implement strategies to for change and take-up of the PCEHR, and to support the e-health sites in implementing and testing aspects of e-health record.

-----

http://www.itnews.com.au/News/275647,nehta-proposes-e-health-standards-stopgap.aspx

NEHTA proposes e-health standards stopgap

By James Hutchinson on Oct 5, 2011 6:40 AM

'Tiger teams' look to November deadline

The Federal Government's lead e-health transition body has proposed a new standards strategy that would speed up development of specifications underpinning the personally controlled electronic health record (PCEHR).

It would replace the current, seven-stage standards development process undertaken with Standards Australia, with a view to establishing specifications by the end of November.

In a standards and specifications document released Friday, the National eHealth Transition Authority (NEHTA) said the current development process was comprehensive but slow and resulted in "considerable re-work and re-education being performed during the Working Draft Stage".

http://www.theaustralian.com.au/australian-it/collaboration-leader-visiinc-plans-push-into-e-health/story-e6frgakx-1226157505089

Collaboration leader VisiInc plans push into e-health

• by: Karen Dearne
• From: The Australian
• October 04, 2011 12:00AM

PERTH-BASED collaboration leader VisiInc plans to push into the e-health market with its $US16 million ($16.63m) purchase of US multimedia conferencing platform vendor VIA3.

VisiInc will add VIA3's advanced collaboration software -- featuring secure 3D file-sharing together with secure video and audio services -- to its Vistime communications suite.

Jacques Blandin, founder and chief executive of VisiInc, said the acquisition was timely because the platform addressed key concerns about e-health security.

"We aim to be a major player in the local e-health arena," he said. "We have some of the smartest technology."

-----

http://www.openpr.com/news/194602/VisiInc-PLC-National-Research-reveals-Australians-Embrace-E-health-Personal-Health-Records.html

VisiInc PLC National Research reveals Australians Embrace E-health Personal Health Records

Perth, Western Australia, October 04, 2011 - VisiInc PLC (VZJ) (www.deutsche-boerse.com) have released a National Australian survey showing public confidence in security will boost E-health uptake, just days after VisiInc announced their acquisition of VIA3.

The USD$16 million scrip deal to acquire USA company VIA3 will deliver a powerful combined technology of 3D real time collaboration, voice and video conferencing, an ultra-secure platform and marks a major push into Australian E-health market. The acquisition is timely with a national Australian opinion survey revealing that the uptake of E-health could be considerably higher if security issues are addressed.

-----

http://www.itwire.com/business-it-news/networking/50204-service-streamlines-medical-data-access

Service streamlines medical data access

By Beverley Head

Wednesday, 05 October 2011 09:47

Australian medical software company Zedmed has signed insurance provider MLC as the second customer for its medical record exchange service. The MRE service allows authorised insurance agents to access and search medical information required to process claims or provide health insurance premium quotes.

Zedmed, owned by the Medical One Group which runs 11 doctors’ clinics, developed MRE just over two years ago and has previously signed up MetLife for the service. A further two insurance companies are also running pilots.

Martin Hoel, Zedmed client services manager, acknowledged that when the system was first launched “the market was not quite ready.”

-----

http://www.zdnet.com.au/oracle-fleshes-out-pcehr-software-deal-339323507.htm

Oracle fleshes out PCEHR software deal

By Suzanne Tindal, ZDNet.com.au on October 3rd, 2011

Oracle has today detailed what systems it will use to support Accenture in the development of the backbone for the government's planned personally controlled e-health records (PCEHR) system.

In August, the Federal Government announced that a consortium led by Accenture would be in charge of developing and implementing the physical systems, product and interfaces necessary for the government's personally-controlled electronic health record system, to be completed by mid-2012. Oracle will be paid $11 million for its part in the consortium.

-----

http://www.computerworld.com.au/article/402662/medical_association_concerned_over_pcehr_draft_legislation

Medical association concerned over PCEHR draft legislation

According to the industry body, the proposal fails to address the issue of availability of critical information for practitioners

• Chloe Herrick (Computerworld)
• 30 September, 2011 13:55

The Australian Medical Association (AMA) has raised concerns that the federal government’s released draft of legislation for the Personally Controlled Electronic Health Record (PCEHR) still fails to address the availability of critical information for practitioners.

AMA federal vice president, Steve Hambleton, told Computerworld Australia the government’s nominated healthcare providers, which includes medical practitioners, nurses, aboriginal health practitioners and others, remained a concern for the system’s success.

“We’d prefer to start with medical practitioners to get used to the system and get it up and running and then widen it after that if it seems suitable,” Hambleton said.

-----

http://www.cio.com.au/article/403264/gps_prepared_e-health_records/

GPs get prepared for e-health records

The Royal Australian College of General Practitioners has launched revised information security standards and a workbook to ensure GPs are meeting the minimum requirements

• Chloe Herrick (Computerworld)
• 06 October, 2011 15:54

The Royal Australian College of General Practitioners (RACGP) has launched revised information security standards and a workbook in order to prepare GPs for the Federal Government’s Personally Controlled Electronic Health Record (PCEHR).

RACGP National Standing Committee e-health chair, Dr John Bennett, told Computerworld Australia the revised standards are more comprehensive than the previous Computer Security Guidelines and have been broken into two components, one for information and the other as the workbook.

“The idea with the workbook is to make it easier for a practice to be able to use the information or recommendations contained in the standards and then to make it aligned to their practice,” Bennett said.

-----

http://www.itnews.com.au/News/275911,racgp-launches-e-health-security-guide.aspx

RACGP launches e-health security guide

By Juha Saarinen on Oct 7, 2011 6:31 AM

Issues IT security standards to general practitioners.

The Royal Australian College of General Practitioners (RACGP) has launched a new IT security standards guide to help its members keep practice and patient information secure.

The 43-page self-assessment guide (pdf) is the third edition of a document that was last published in 2005.

It contains a check list covering ten categories of IT security. These include appointing a computer security coordinator, documenting the role and training the person in question.

Security policies and procedures should be documented, the guide advises.

-----

http://www.sciencewa.net.au/3654-harbinger-of-security-warns-national-e-health-system.html

Harbinger of security warns national e-health system

Written by Nic White Thursday, 06 October 2011 09:00

THE vulnerability of Australia’s planned national e-health system to cyber attacks is not being taken seriously enough, according to a WA security academic.

The weakest points of this system are the individual healthcare providers, particularly the small primary care and specialist organisations which make up more than half the connections in the national e-health system.

ECU secau Security Research Centre senior lecturer Trish Williams says the initiative has multiple points of vulnerability that are unlikely to be fully realised until the system goes live.

The $466.7 million plan will digitise and integrate Australia’s patient record databases to allow much greater sharing of patient information, such as allergies, test results and medications, than the current “safe but not particularly useful” paper system.

Dr Williams says the integration of such a big and complex system is far more susceptible to attack than a decentralised paper one because of the communication between diverse healthcare providers, unlike banks where information is securely stored in one domain.

“The integration of individual systems creates greater system susceptibilities,” she says.

-----

http://www.medicalobserver.com.au/news/college-unveils-standards-for-telehealth-and-esecurity

College unveils standards for telehealth and e-security

7th Oct 2011 Mark O’Brien

NEW standards for video consultations and information security have been released by the RACGP, giving GPs a framework to apply to the Medicare telehealth item numbers launched in July.

The college launched its new Standards for Video Consultations and Computer and Information Security Standards yesterday at the GP11 conference in Hobart.

In the absence of standards to abide by since the launch of the MBS items for telehealth, GPs had been advised by Medicare to simply ensure they were confident their method of delivering the service was capable of providing secure, reliable and private consultations.

-----

http://www.electronicsnews.com.au/news/telehealth-software-for-remote-cochlear-implant-ma

Telehealth software for remote cochlear implant maintenance

• By Isaac Leung on  29 September 2011

THE EAR Science Institute of Australia is building software for remote mapping and analysis of cochlear implants.

The software will allow patients to plug their implants into their computer and have them tested by audiologists in real time. This will allow full use of telehealth software, and reduce the need for patients (especially those in remote areas) to visit ear centres for their implant maintenance.

-----

http://www.theaustralian.com.au/australian-it/human-services-taps-new-cio/story-e6frgakx-1226160531000

Human Services taps new CIO

• by: Fran Foo
• From: Australian IT
• October 06, 2011 6:00PM

THE Department of Human Services has tapped the services of former ANZ Bank Australia chief information officer Gary Sterrenberg as its new tech chief.

The department confirmed to The Australian that Mr Sterrenberg will start on October 24.

He will fill the slot left vacant by retired CIO and Infrastructure head John Wadeson.

Mr Wadeson has been a key player in the integration of Centrelink, Medicare and Child Support IT systems under a new look DHS as part of Labor's service delivery reform agenda.

Mr Sterrenberg joined ANZ in 2006 and worked in various roles, including head of IT and business partnerships, Retail.

-----

http://www.computerworld.com.au/article/403378/human_services_appoints_former_anz_cio

Human Services appoints former ANZ CIO

The department appointed Gary Sterrenberg after the retirement of former CIO, John Wadeson

• Chloe Herrick (CIO)
• 07 October, 2011 10:46

The Department of Human Services (DHS) has appointed a former ANZ Australia CIO, Gary Sterrenberg, after a four month search.

Sterrenberg will succeed retiring CIO, John Wadeson, who exited the role in September after five years with the department. Sterrenberg will commence the role on 24 October.

A DHS spokesperson said that Sterrenberg's history in the banking industry would be an asset as it involved significant work with numerous complex systems and was a customer-focused organisation.

-----

http://www.voxy.co.nz/health/gps-and-pharmacists-united-evidence-based-medicines/5/103090

GPs and pharmacists united on evidence-based medicines

Monday, 3 October, 2011 - 14:14

GPs and pharmacists agree that the good of the patient and evidence-based medicine should form the basis of all health care advice provided.

The Royal New Zealand College of GPs, the Pharmacy Guild of New Zealand, Pharmaceutical Society and General Practice New Zealand have agreed that a commercial initiative being employed in Australia to companion sell supplements with prescriptions would not be appropriate in New Zealand.

Blackmores has struck a deal with the Pharmacy Guild of Australia, representing the owners of community pharmacies. Under the agreement, when a prescription is filled, a prompt in the pharmacy's computer will suggest staff discuss with the customer a Blackmores supplement designed to offset possible side effects of the drug being prescribed.

-----

http://www.medicalobserver.com.au/news/pharmacists-call-for-blackmores-deal-scrapping

Pharmacists call for Blackmores deal scrapping

4th Oct 2011 Mark O’Brien

PHARMACISTS have appealed to the Pharmacy Guild of Australia to scrap a deal with Blackmores involving computer prompts to ‘companion sell’ nutritional supplements together with certain prescription medications.

Pharmacist Coalition for Health Reform spokesperson Chris Walton said pharmacists had rejected the deal and it was now time for the Pharmacy Guild to scrap the plan.

“A Pharmacist Coalition poll of over 460 people has shown that 94% of community members, including pharmacists and pharmacists-in-training, disagree with the Blackmores deal and believe it undermines the professionalism of pharmacists,” he said.

-----

http://blogs.crikey.com.au/croakey/2011/10/06/pharmacy-guild-deal-with-blackmores-ends-in-tears/

Pharmacy Guild deal with Blackmores ends in tears

October 6, 2011 – 1:02 pm, by Melissa Sweet

Some extremely interesting conversations must have been occurring behind closed doors in pharmacy-land, in the wake of the disastrous deal between the Pharmacy Guild and Blackmores.

According to a Guild statement reproduced in full below, the deal – for pharmacists’ computer systems to prompt them to discuss Blackmores products with patients picking up a prescription for certain medications – will not go ahead in response “to the strong level of public concern”.

-----

http://www.theaustralian.com.au/news/health-science/brain-implants-tested-in-monkeys-may-help-paralysed-people/story-e6frg8y6-1226159921518

Brain implants tested in monkeys may help paralysed people

• From: AFP
• October 06, 2011 9:37AM

MONKEYS implanted with brain electrodes were able to see and move a virtual object and sense the texture of what they saw, a step forward in the quest to help the severely paralysed touch the outside world once more.

"Someday in the near future, quadriplegic patients will take advantage of this technology," said lead investigator Miguel Nicolelis, a professor of neurobiology at Duke University in North Carolina.

They will seek "not only to move their arms and hands and to walk again, but also to sense the texture of objects placed in their hands, or experience the nuances of the terrain on which they stroll with the help of a wearable robotic exoskeleton."

-----

http://www.zdnet.com.au/vic-healthcare-to-receive-15m-tech-boost-339323597.htm

Vic healthcare to receive $15m tech boost

By Michael Lee, ZDNet.com.au on October 4th, 2011

Victoria's healthcare system is set to benefit from technology with the launch of a $15 million Health Market Validation Program today, which will encourage the growth of small- to medium-sized businesses (SMBs) by providing grants for healthcare-related technology projects.

Victorian Minister for Technology Gordon Rich-Phillips said that the three-stage program would result in better health outcomes, improved healthcare service delivery and economic benefits in Victoria.

The first stage of the program will identify requirements for healthcare, with health-focused public sector agencies specifying their needs, and the expected benefits in a Technology Requirement Specification (TRS).

In the second stage of the program, SMBs will be invited to submit proposals on how they can deliver on a TRS specified in the first stage.

-----

http://www.computerworld.com.au/article/403208/cerebral_palsy_alliance_streamlines_new_cms

Cerebral Palsy Alliance streamlines with new CMS

Weighed down with multiple websites and hundreds of forms and policies, the organisation now has one system to support and maintain

• Chloe Herrick (Computerworld)
• 06 October, 2011 09:51

Juggling numerous websites and 600 different forms and adhering to almost 200 stringent policies was taking a toll on staff at the Cerebral Palsy Alliance (CPA) and their ability to provide services to clients.

The organisation, headquartered in Sydney, provides services to about 4000 people; the majority of these services occur over the internet. CPA also conducts research into cerebral palsy, a condition that affects human movement.

CPA manager of communication design services, Robyn Cummins, said the organisation’s websites were becoming unmanageable for staff with the team working harder to maintain the sites and leaving no time for anything else.

-----

http://www.smh.com.au/money/tax/tax-number-is-a-fraudsters-friend-20111002-1l3z8.html

Tax number is a fraudster's friend

Alexandra Smith

October 3, 2011

STOLEN tax file numbers have been used to lodge as many as 5000 fraudulent tax refunds worth $27 million in just three months, as identity criminals increasingly attempt to defraud government departments.

Since July, the Australian Taxation Office has reviewed about 68,000 claims, with refunds worth more than $285 million.

At least 5000 of those claims are suspected cases of identity crime, including stolen tax file numbers, the Tax Office confirmed.

-----

http://www.smh.com.au/technology/security/dumped-computers-exploited-in-overseas-fraud-20111001-1l2rj.html

Dumped computers exploited in overseas fraud

Natalie O'Brien

October 2, 2011

CRIMINAL networks are feeding off Australians' lust for new technology by skimming data from computers dumped in Africa and Asia - and using it for blackmail, fraud and identity theft.

They will pay as much as $200 on the black market for discarded computer hard drives, which they mine for bank details, credit card numbers and account passwords.

These hard drives are among the mountains of electronic waste earmarked for recycling here. Instead, they are illegally shipped to developing countries by operators seeking bigger profits.

-----

Enjoy!

David.