Quote Of The Year

Timeless Quotes - Sadly The Late Paul Shetler - "Its not Your Health Record it's a Government Record Of Your Health Information"

or

H. L. Mencken - "For every complex problem there is an answer that is clear, simple, and wrong."

Saturday, September 03, 2011

Weekly Overseas Health IT Links - 03 September, 2011.


Note: Each link is followed by a title and few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.
-----

Children's Clinics integrates fingerprint technology with EHR

August 23, 2011 | Molly Merrill, Associate Editor
TUCSON, AZ – Children's Clinics for Rehabilitative Services in Southern Arizona is using fingerprint biometrics to increase access to – and the security of – its new electronic health record system.
Officials said the new technology was the result of Children's Clinics recent transition to a NextGen ambulatory EHR after years of using paper charts.
Officials said they became challenged with managing login credentials, especially given that 40 percent of the clinic's staff are part-time contract providers who only work in the clinic a couple of times a month. In order to improve workflow, officials decided to deploy technology from Redwood City, Calif-based DigitalPersona, Inc.
-----

ONC Wants Comment on Health I.T. Disparities

HDM Breaking News, August 25, 2011
The Office of the National Coordinator for Health Information Technology is seeking public comment on a draft plan to provide equal access for all Americans to the benefits of health I.T.
Worried of a new type of "digital divide," then-national coordinator David Blumenthal, M.D., in October 2010 called on electronic health records vendors to ensure their sales and marketing activities include providers serving minority communities. Under the draft plan now soliciting comment, "the government will endeavor to assure that underserved and at-risk individuals enjoy these benefits to the same extent as all other citizens," according to a new posting on ONC's HealthITBuzz blog.
-----

Study: Primary Care Practices Can Track Preventive Care Delivery Via Electronic Health Records

Written by Sabrina Rodak | August 24, 2011
Small primary care practices can track the delivery of recommended preventive care through electronic health records, which can help providers assess population health, according to a study published in the Journal of the American Medical Informatics Association.
Researchers studied the Primary Care Information Project, a New York City initiative designed to improve population health that helped implement EHRs in more than 300 primary care practices.
-----
Thursday, August 25, 2011

State, Federal Health Data Exchange Efforts Heat Up

The need for robust health information exchange (HIE) continues to grow, and not just because it is a part of the meaningful use incentive program. Having infrastructure to support HIE will be a critical component to enable new payment and care delivery models like accountable care organizations and medical homes.
Background on HIE Efforts
There has been a strong national effort in developing the Nationwide Health Information Network (NwHIN), as well as a dramatic increase in local and regional efforts to create viable health information exchange organizations (HIOs). These efforts include the Direct Project, which created a simple, secure, scalable, standards-based way for participants to send authenticated, encrypted health information directly to known, trusted recipients over the Internet. The Direct Project -- which was sponsored by the Office of the National Coordinator for Health IT -- has become an important on-ramp to the health information superhighway.
-----

EHR adoption costs continue to hold physicians back

August 24, 2011 — 11:11pm ET | By Marla Durben Hirsch - Contributing Editor
Current users and potential purchasers of electronic health record (EHR) software recognize the value of using EHRs, but the high cost is causing nearly one-third of physicians to hesitate from taking the plunge, according to a recently released survey by Sage Healthcare Division.
The survey, published August 10, found that while 77 percent of all respondents saw the ease of use and speediness of an EHR, 32 percent of medical practices who are in the market for the technology remain stymied by the capital investment.  
-----

HHS awards $137M to states for health IT, prevention

August 25, 2011 | Bernie Monegain, Editor
WASHINGTON – The Department of Health and Human Services on Thursday awarded $137 million to nearly every state to strengthen prevention efforts and to improve public health. Many of the awards include a health IT component, such as immunization information technologies and registries.
"More than ever, it is important to help states fight disease and protect public health," said HHS Secretary Kathleen Sebelius. "These awards are an important investment and will enable states and communities to help Americans quit smoking, get immunized and prevent disease and illness before they start."
-----

EHR vendor sues rival and client for stealing proprietary info

August 24, 2011 — 11:08pm ET | By Marla Durben Hirsch - Contributing Editor
As more providers adopt electronic medical record systems, expect to see more disputes between competing vendors protecting their turf, as well as access issues between vendors and their provider clients. In the latest salvo, urology EMR vendor MeridianEMR has sued rival Intuitive Medical Software and one of Meridian's customers, for "malicious interference with and conversion of Meridian's confidential and proprietary information."
According to a lawsuit, filed June 16 in the U.S. District Court for New Jersey, Intuitive, which offers an EMR system called UroChart, sought to unlawfully decipher Meridian's encrypted software to gain an unfair competitive advantage. Meridian claims that Shappley Clinic, a urology practice based in Germantown, Tenn., unlawfully provided Intuitive with access to a computer server that Meridian had installed at Shappley, and that a "clone" server was created containing Meridian's confidential information.
-----

Telemedicine and EHR use for inmates helps save state $1B

August 25, 2011 — 1:04pm ET | By Dan Bowman
While electronic health records generally are touted as being able to save money for the providers implementing such systems, one has been quite successful in saving money for taxpayers in Texas, as well. 
A statewide EMR developed by Atlanta-based Business Computer Applications, Inc. (BCA), combined with a telemedicine system from the University of Texas Medical Branch and Texas Tech University, successfully improved health outcomes for prisoners while reducing overall costs, leading to $1 billion in savings over the last 10 years for the state's taxpayers, according to IT research firm Gartner Group. 
-----

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.
By Mathew J. Schwartz,  InformationWeek
August 23, 2011
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."
The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.
While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.
-----
August 22, 2011

mobileStorm Offers Free Guide to Making Healthcare Mobile

TMCnet Contributor
mobileStorm, a Los Angeles, California-based provider of e-mail and mobile messaging solutions, announced the release of a new guide that presents a detailed guidance for making healthcare mobile.
The new guide titled, "Making Healthcare Mobile" explains how healthcare can be extended into the mobile realm through a detailed, step-by-step lessons.
mobileStorm, according to company officials, is the first technology company to launch a fully HIPAA compliant mobile messaging platform that can be incorporated into any smart phone app.
-----

Patient check-in moves to the iPad

August 18, 2011 | Mike Miliard, Managing Editor
MOUNTAIN VIEW, CA – Just three weeks after its iPad-native EHR made news for gaining ONC-ATCB-certification, drchrono has launched an iOS app to replace paper-based patient check-in.
Company execs say the OnPatient app can be downloaded to the iPad for free and integrated into a medical practice as a standalone application – the patient check-in software also integrates with with the drchrono's iPad EHR.
-----

EHNAC to Accredit HIE Vendors

HDM Breaking News, August 22, 2011
The Electronic Healthcare Network Accreditation Commission has introduced a new program for accrediting vendors of health information exchange services. The initiative complement's industry sponsored EHNAC's launch in 2010 of an accreditation program for health information exchanges.
The new HIE services program will accredit vendors that provide clinical health information exchange technology to HIEs and meet certain performance benchmarks in such areas as privacy and security, technical performance, business practices and organizational resources.
-----

EMIS apologies for data centre failure

22 August 2011   Shanna Crispin
Primary care software provider EMIS has apologised “profusely” and launched a formal investigation after its data centre failed last week.
The initial outage on Thursday morning was caused by hardware problems. From about 8:30am, 333 GP practices across England experienced "performance and stability issues".
The problems then had knock-on effects. As a result, just before midday a further 446 GP practices started experiencing issues with their systems.
-----

Wales pioneers monitor to save diabetes patients

A monitor that will warn doctors and families if a diabetes patient is in danger of an attack is being developed in Wales.
The system will have the capability to be adapted for other chronic conditions, such as coronary heart disease, stroke, cancer and asthma.
Diabetic patients with low blood glucose can become unconscious due to hypoglycaemia and there are many reported incidents where patients, who either live or work alone, fainted without the notice of others and such occurrence can often be fatal.
A multi-functional monitoring system is important to manage the glucose level of diabetic patients and to provide warning when the patient is unconscious.
-----

Electronic ID becoming a reality in the EU

European Commission | Wednesday, August 24, 2011

The BIOP@ASS team says the technologies developed as part of the project will also cut administrative expenses, boost the level of security of future electronic ID cards and passports, speed up data transfer between ID document and reader device, and make it easier for users to use electronic services. The electronic ID cards are based on the European Citizenship Card (ECC) family of standards, and the next generation of electronic passports and residence permits. The ECC, in particular, combines the benefits of standardisation with the added flexibility of being able to adopt national requirements.
The objectives of the BIOP@ASS project were the development of advanced (microelectronics and embedded software) secure and interoperable smart card platforms for required e-administrative applications requested at the European level: e-identity, e-health, and residence permits. The project was grounded on the results of the former MEDEA+ project called ONOM@TOPIC+; it provided a full technical platform and framework enabling European governments to issue interoperable documents or electronic identification or authentication and access to e-services.
-----
Wednesday, August 24, 2011

Reaping the Benefits of Electronic Medical Records

Researchers use natural language processing to flag postsurgical complications in physicians' notes.
Despite billions of dollars in incentives to support the adoption of electronic medical records, evidence that these systems improve the efficiency or quality of care has been scarce. But a new study shows that natural-language processing—a branch of computer science that employs linguistics to analyze regular speech—may greatly increase the utility of these records in improving care.
Researchers used this approach to sift through physicians' notes, the richest and most complicated aspect of electronic medical records, for postsurgical complications such as pneumonia and sepsis. The method proved considerably more accurate than other automated systems. They say similar approaches could be used for a variety of applications, including predicting which patients are at risk, and developing automated tools that help doctors choose treatments.  
"You can finally see how clinical data can be used to measure patient safety more systematically, and that we will really be able to use these things to manage care," says Ashish Jha, a physician at Harvard Medical School who wrote an editorial accompanying the paper. The paper and editorial were published this week in Journal of the American Medical Association.
-----

From Medscape Medical News

Natural Language Processing Improves Complication Tracking

August 23, 2011 — Analysis of electronic medical records (EMRs) with natural language processing shows an improved ability to identify postoperative surgical complications compared with the standard method of relying on administrative data codes, according to a new study published in the August 24/31 issue of JAMA.
In efforts to improve patient safety, hospital administrative data are typically screened for codes that may reflect potential adverse events during hospitalization, and a quality surveillance tool developed by the Agency for Healthcare Research and Quality has refined that process to focus on a set of 20 patient safety indicators used in screening the data.
However, the system has some drawbacks, including some uncertainty about the validity of administrative codes and the inability of discharge codes to distinguish whether a disease existed before a patient's admission or was acquired during hospitalization, according to Harvey J. Murff, MD, MPH, lead author of the study from Tennessee Valley Healthcare System, Veterans Affairs Medical Center, and Vanderbilt University, Nashville, TN, and colleagues.
The emergence of EMRs, combined with the development of automated systems such as natural language processing, however, allows for screening of more extensive medical data and documents and extraction of specific medical concepts, as opposed to simply searching for potentially unreliable discharge codes.
-----

How Radio Waves Remedy Patient Bottlenecks

Gienna Shaw, for HealthLeaders Media , August 23, 2011

RFID tags have for a while been used mainly for things—to keep track of the number of bandages left in the supply closet or to keep an expensive piece of equipment from walking out the door, for example. Increasingly, though, those badges are showing up on the lapels of patients. And hospitals are using the data those RFID badges gather to improve patient flow, shorten length of stay, and more.
Wilmington, DE–based Christiana Care Health System pins patients with RFID tags to track their movements throughout the continuum of care. The collected data is an "extremely powerful" tool for process improvement, says Linda Laskowski-Jones, vice president of emergency and trauma services for the two-hospital system.
The system tracks interval-level data—measuring the time a patient spends in between each activity—from the time they see a doctor to the time the doctor orders labs or an x-ray, for example.
-----
By Joseph Conn

Not yet an Epic monopoly or conflict

Bruce Friedman, in a post on Lab Soft News says, "Epic has achieved a near monopoly of the (electronic health-record systems) installed in the largest U.S. hospitals."
And writing in the Washington Examiner, Lachlan Markay, an investigative writer with the conservative Heritage Foundation's Center for Media and Public Policy, reveals that Epic Systems Corp. CEO Judith Faulkner not only has made campaign contributions to Democrats but also has served as a member of the federal Health Information Technology Policy Committee, which "holds in its hands the future of health information technology policy."
Well, Epic is on a roll. But market share is measurable, so I spoke with Jason Hess, general manager of clinical research with health IT market watcher Klas Enterprises of Orem, Utah. Hess shared with me data from his company's latest survey of 1,467 U.S. hospitals and 151 Canadian hospitals with 200 or more beds.
-----

HealthSpace up for review again

17 August 2011   Shanna Crispin
Yet another review is being carried out into the viability of the HealthSpace organiser, which gives patients access to their Summary Care Record if it exists and they have an ‘advanced’ account.
Figures obtained by eHealth Insider show that the number of people using the NHS service to access their SCR has fallen by more than 50% since the beginning of the year.
In February, 60 patients a month were using an advanced HealthSpace account to see their record, but this has now fallen to just 25 a month.
-----

“The Cities” awards: MIM Software named The Disruptor

Posted By Brandon Glenn On August 19, 2011 @ 12:02 am
What started out as a whim by a couple of software engineers led to a big breakthrough for MIM Software.
In early 2008, MIM’s developers began hammering out the initial lines of code to what three years later became the first-ever medical imaging mobile app [1] to be cleared for sale by the U.S. Food and Drug Administration.
“It wasn’t part of our business plan. It just happened,” said Chief Technology Officer Mark Cain. “Two of our employees began writing the code just to see if they could do”
-----

Facebook App Reminds Transplant Patients To Take Meds

Integration of electronic health record with social network app helps kidney transplant patients stay on their medication schedules.
By Nicole Lewis,  InformationWeek
August 17, 2011
The University of Iowa Children's Hospital is getting ready to launch a Facebook page that will monitor teenage and young adult kidney transplant patients in an effort to get them to take their medications on time. The hospital will use prescription information from its electronic health record (EHR) system to populate the site with the list of medicines each patient is taking, and how many times daily they should be taken.
The initiative, which is been developed by Dr. Patrick Brophy, director of the division of pediatric nephrology, dialysis, and transplantation, along with the hospital's technology department, was borne out of Brophy's frustration that many of his teenage kidney transplant patients were not taking their medications after surgery.
-----
Monday, August 22, 2011

Building Public Trust in Electronic Health Information Exchange

Given the value that individuals place on the privacy of their health information, it is not surprising that there is a federal advisory committee charged with helping the Office of the National Coordinator for Health IT protect the privacy and security of health information exchanged through electronic health records under the Medicare and Medicaid EHR Incentive Programs. This group -- a subcommittee of the Health IT Policy Committee -- is the aptly named privacy and security "Tiger Team."
Background on the Privacy and Security Tiger Team
ONC first assembled the Tiger Team in June 2010. The group includes 15 members from the Health IT Policy Committee, the Health IT Standards Committee and the National Committee on Vital and Health Statistics.
As a matter of scope, the Tiger Team develops privacy and security recommendations for electronic HIE, in which health care providers must engage to demonstrate meaningful use of EHRs under the Medicare and Medicaid EHR Incentive Programs. Generally speaking, this includes electronic exchange for the purposes of treatment, care coordination, and quality and public health reporting.
-----

VA cloud pilot could impact 134K medical workers

August 22, 2011 — 1:43pm ET | By Dan Bowman
Privacy and communications issues surround planned pilot testing of cloud-based tools by the Department of Veterans Affairs that could impact as many as 134,000 VA medical workers. Specifically, the VA wants to move its Microsoft Exchange-based collaboration system to a cloud-based system, according to InformationWeek
The issues date back to last December, FierceGovernmentIT reported last month, when doctors and residents at several VA hospitals used GoogleDocs and Yahoo Calendar to manage their workflow. By storing patient information in each application, however, patient information was put at risk, according to Roger Baker, the VA's chief information officer. 
-----

Social media, HIEs, the recession will impact health IT in 2012

August 22, 2011 — 11:45am ET | By Dan Bowman
While HIMSS12 isn't exactly around the corner, it's not too early to start anticipating some of the key trends that will emerge at the 2012 Vegas-bound conference, which takes place Feb. 20-24.
Social media, and its impact on hospitals and providers, certainly will play a prominent role, given HIMSS' recent announcement that Twitter co-founder Biz Stone will be a keynote speaker. Already, we're seeing that hospital marketing, patient satisfaction and patient engagement are intricately linked to social media. 

-----
Enjoy!
David.

Friday, September 02, 2011

Natural Language Processing - A Method To Better Exploit the Information Content in EHRs?

While there is nothing new under the sun it does seem there have been some progress in utilising Natural Language Processing (NLP) for clinical and research purposes.

Natural language processing better for spotting quality lapses after surgery: study

By Joseph Conn

Posted: August 24, 2011 - 11:45 am ET

Are computer programs that read text-based medical records ready for prime-time use in quality improvement? Maybe so, according to research published in the latest issue of the Journal of the American Medical Association.

Quality-improvement researchers concluded that computerized natural language processing of free-text portions of patient medical records was more effective in identifying quality lapses in post-operative surgical patients than a computerized review of discrete data elements in those records. Natural language processing, or NLP, is the use of computers to read and process information expressed in human language.

The researchers looked at the randomly selected records of 2,974 hospitalized surgical patients at six U.S. Veterans Affairs Department medical centers from 1999 to 2006 that were reviewed through the Veterans Affairs Surgical Quality Improvement Program.

A report on their findings, "Automated Identification of Postoperative Complications Within an Electronic Medical Record Using Natural Language Processing," appears in the Aug. 24/31 issue of JAMA.

In conducting the study, researchers obtained from the VA's VistA electronic health-record system narrative clinical notes, such as discharge summaries, progress notes, operative notes, microbiology reports, imaging reports and outpatient visit notes.

The quality-improvement program records had been assessed for 20 "patient safety indicators" developed by the Agency for Healthcare Research and Quality that rely on structured administrative data, such as ICD-9 codes, from hospital discharge records to identify possible adverse events.

More here:

http://www.modernhealthcare.com/article/20110824/NEWS/308249988

We also have coverage here:

Wednesday, August 24, 2011

Reaping the Benefits of Electronic Medical Records

Researchers use natural language processing to flag postsurgical complications in physicians' notes.

Despite billions of dollars in incentives to support the adoption of electronic medical records, evidence that these systems improve the efficiency or quality of care has been scarce. But a new study shows that natural-language processing—a branch of computer science that employs linguistics to analyze regular speech—may greatly increase the utility of these records in improving care.

Researchers used this approach to sift through physicians' notes, the richest and most complicated aspect of electronic medical records, for postsurgical complications such as pneumonia and sepsis. The method proved considerably more accurate than other automated systems. They say similar approaches could be used for a variety of applications, including predicting which patients are at risk, and developing automated tools that help doctors choose treatments.

"You can finally see how clinical data can be used to measure patient safety more systematically, and that we will really be able to use these things to manage care," says Ashish Jha, a physician at Harvard Medical School who wrote an editorial accompanying the paper. The paper and editorial were published this week in Journal of the American Medical Association.

One of the most anticipated benefits of electronic medical records is computerized tracking of patients and institutions—to detect whether a particular patient is at risk for a specific complication, for example, or a specific department or hospital is performing more poorly than others.

Automated tracking is already in use in prescribing; for example, to detect when two medicines interact. Because prescription information is a highly structured part of the medical record, it has been fairly easy to analyze with software. However, harnessing the vast information available in less structured parts of the medical record, such as clinicians' notes—which contains free-form entries about the patient's history and status, including postsurgical complications—is much harder.

"If we can't access that information, we will have a hard time monitoring records to improve care," says Jha. "This paper is so powerful because it shows you can do this."

.....

Nuance, a leading maker of voice-recognition software, is already developing commercial systems that use natural-language processing to analyze medical information. The company is collaborating with the IBM team that developed Watson, the robot made famous by beating human contestants on the television game show Jeopardy, to apply the robot's natural-language processing tools to medicine.

More here:

http://www.technologyreview.com/biomedicine/38418/?nlid=nldly&nld=2011-08-24

The bottom line here is that we now have essentially proven technology which in the right circumstances can make a real difference to what we know about what is going on in the health system. Another tool seems to be becoming very much more useful.

David.

Thursday, September 01, 2011

Here Is A Key Reason For Privacy in EHRs to Be Taken Very Seriously. The Surrounding Security is Also Important!

This very useful report appeared a few days ago.

Workers staying silent on mental health, with bosses kept in the dark

THE stigma surrounding mental illness remains strong enough for nearly four in 10 sufferers to not disclose the condition to their employers.

And even for those who do, understanding and support from employers and managers is severely lacking, a study by Sane Australia reveals.

The Working Life and Mental Illness study, to be published today, which surveyed 520 people with a mental illness, finds the majority don't believe their manager understands mental illness and its impact in the workplace.

"Fewer than half of managers (43 per cent) were said to understand how it affected people in the workplace," the report says, with only 30 per cent of sufferers offered flexible working arrangements.

"Many people with a mental illness do not disclose their condition to employers, fearful they will lose their jobs, thus making it harder to access support. This also applies to employees who are caring for a family member with a mental illness."

Geelong bookkeeper Nicci Wall, 45, was diagnosed with bipolar disorder and obsessive compulsive tendencies 10 years ago, having suffered depression since her 20s. Ms Wall says her current employer's understanding and acceptance of her illness and preparedness to work around it is a win-win, as the flexible work hours allow them to get the best out of her.

More here:

http://www.theaustralian.com.au/news/health-science/workers-staying-silent-on-mental-health-with-bosses-kept-in-the-dark/story-e6frg8y6-1226121570551

The research bulletin on which the report is found here.

http://www.sane.org/images/stories/information/research/1108_info_rb14work.pdf

What is clear here is that there are a large number of people who suffer, or have suffered, some mental illness (and that is a major segment of the population) who do not have understanding employers and who fear stigmatisation and persecution - like job loss - of the information does not remain confidential.

Add this large group to those that have other illnesses of clinical history that may disadvantage and stigmatise and you are talking a very large number of people.

The ill-informed who label all such patients and more especially those who advocate on their behalf ‘privacy Nazi’s’ really miss the point. Any systems that fail to recognise these issues and make sure there are minimal issues will just fail.

Just how tricky it will be is shown here:

New Data Spill Shows Risk of Online Health Records

By JORDAN ROBERTSON (AP) on August 22, 2011

SAN FRANCISCO (AP) -- Until recently, medical files belonging to nearly 300,000 Californians sat unsecured on the Internet for the entire world to see.

There were insurance forms, Social Security numbers and doctors' notes. Among the files were summaries that spelled out, in painstaking detail, a trucker's crushed fingers, a maintenance worker's broken ribs and one man's bout with sexual dysfunction.

At a time of mounting computer hacking threats, the incident offers an alarming glimpse at privacy risks as the nation moves steadily into an era in which every American's sensitive medical information will be digitized.

Electronic records can lower costs, cut bureaucracy and ultimately save lives. The government is offering bonuses to early adopters and threatening penalties and cuts in payments to medical providers who refuse to change.

But there are not-so-hidden costs with modernization.

"When things go wrong, they can really go wrong," says Beth Givens, director of the nonprofit Privacy Rights Clearinghouse, which tracks data breaches. "Even the most well-designed systems are not safe. ... This case is a good example of how the human element is the weakest link."

Southern California Medical-Legal Consultants, which represents doctors and hospitals seeking payment from patients receiving workers' compensation, put the records on a website that it believed only employees could use, owner Joel Hecht says.

The personal data was discovered by Aaron Titus, a researcher with Identity Finder who then alerted Hecht's firm and The Associated Press. He found it through Internet searches, a common tactic for finding private information posted on unsecured sites.

Titus says Hecht's company failed to use two basic techniques that could have protected the data - requiring a password and instructing search engines not to index the pages. He called the breach "likely a case of felony stupidity."

Large-scale medical data breaches have been on the rise in recent years.

In one of the biggest, government health data was at risk in 2006 when a laptop with data on 26.5 million veterans was stolen from a government employee's home. The computer equipment was recovered, and the FBI said the sensitive files weren't accessed.

.....

This year, hard drives containing health histories, financial information and Social Security numbers of 1.9 million Health Net insurance customers disappeared from an office. State regulators launched investigations into Health Net's security procedures.

The California company declined to comment, saying the incident was still under investigation.

The latest incident is "an eye-opener, and we're going to get eye-opener after eye-opener," says Jim Dempsey, a security and public policy expert at the Center for Democracy & Technology.

As instances of data mishandling become more commonplace, government officials may seek greater control over security policies of companies with access to health care records that aren't currently regulated.

"It should be yet another warning bell for companies: You've got your reputation on the line, and you're also facing enforcement action if you don't pay attention to the security of the data you collect and process," Dempsey says.

The full article is here:

http://techland.time.com/2011/08/22/new-data-spill-shows-risk-of-online-health-records/

There are also issues being raised in managing records in the cloud.

EHR Data In Cloud Needs Strong Security Trail

Presenters at a recent Legal EHR Summit warn healthcare providers to press their vendors for clear answers on security.

By Neil Versel, InformationWeek

August 22, 2011

With healthcare's unique information security requirements, the growth of cloud-based electronic health records (EHRs) is raising a number of new issues regarding data stewardship and organizational responsibility.

According to Gerard Nussbaum, director of technology services at management consultancy Kurt Salmon Associates, the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules do not specify whether a provider using a cloud-based EHR owns data in the medical records or if the information belongs to the service host. Speaking last week at the American Health Information Management Association (AHIMA) Legal EHR Summit in Chicago, Nussbaum recommended that healthcare providers explicitly negotiate data usage in contracts, particularly in case of a breach.

"Nothing is secure from breaches," noted Nussbaum, an attorney. Knowing this, he said it's best to "iron out up front" what each party's legal responsibility is in the event of a breach, such as who must notify individuals whose data may have been compromised.

Health information management consultant Sandra Nunn, who participated in a panel discussion on managing health information in the cloud, said she wants her clients to reach a clear understanding with their vendors about whether information will be sequestered in the cloud if there is a breach and whether there will be an easily accessible audit trail.

"Having multiple cloud vendors can complicate your situation," Nunn said. She surmised that it might be a good idea for providers to ask their vendors once or twice a year to create an audit log just to make sure it's possible.

Lots more here:

http://www.informationweek.com/news/healthcare/security-privacy/231500467

Additionally and quite surprisingly it seems some medical devices might also be at risk.

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

By Mathew J. Schwartz, InformationWeek

August 23, 2011

Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."

The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.

While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.

Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.

Many more details here:

http://www.informationweek.com/news/security/vulnerabilities/231500548

There is no reason to be in any way alarmist about any of this but the messages are clear. First there are many consumers who will need a lot of reassurance about electronic health records. Second that, despite the best efforts, there will be occasional security leaks. These need to be anticipated and managed effectively to minimise possible damage to EHR use. Third we really do need to have a careful planned approach to EHR protection that is continually reviewed and updated.

As a last comment we do need to ensure there is proper disclosure of all significant breaches so that lessons are leant quickly and repeat leaks are prevented.

A large issue indeed!

David.

Looks Like There Is Being A Delay With the Release of the Revised Version of the PCEHR ConOps.

On NEHTA’s website - as of Sep 1 - the following Headline is displayed.

NEHTA - National E-Health Transition Authority

Personally controlled electronic health records (PCEHR) Concept of Operations

Following receipt of submissions, the final Concept of Operations document is scheduled for release in August 2011.

See www.nehta.gov.au

Also from the Government site we have:

PCEHR Draft Concept of Operations Consultation

The Draft Concept of Operations - Relating to the introduction of a PCEHR system (draft Concept of Operations) consultation process closed on 7 June 2011. All submissions received by the deadline were reviewed and will help inform the final personally controlled electronic health record (PCEHR) system Concept of Operations document - scheduled for release in August 2011.

The draft Concept of Operations provides details about how the PCEHR system might look, what information it might contain, and how it will function and connect with existing clinical systems. It also covers participation issues, information management, privacy and security, and matters of implementation, evaluation and consultation.

The content was shaped by a range of consultations which the Department of Health and Ageing and the National E-Health Transition Authority (NEHTA) held with stakeholders — consumer groups, health professionals, the Information and Communications Technology (ICT) industry and state and territory governments.

You can find out more about the draft Concept of Operations by reading the fact sheet and the PCEHR consumer booklet, e-health - have your say, which describes key elements of the proposed PCEHR system, and the impact it will have on health care in the future.

See here:

http://www.yourhealth.gov.au/internet/yourhealth/publishing.nsf/content/pcehr

So the self-imposed deadline has already slipped. I guess we will just have to wait.

David.