Quote Of The Year

Timeless Quotes - Sadly The Late Paul Shetler - "Its not Your Health Record it's a Government Record Of Your Health Information"

or

H. L. Mencken - "For every complex problem there is an answer that is clear, simple, and wrong."

Saturday, April 27, 2013

Weekly Overseas Health IT Links - 27th April, 2013.

Note: Each link is followed by a title and few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.
-----

Think tank puts data sharing as priority

By Tom Sullivan, Editor, Government Health IT
Created 04/19/2013
Delivering what founder and president Jason Grumet described as “one of the most challenging projects we’ve undertaken,” the Bipartisan Policy Center on Thursday put forth what it hopes will be “a viable political plan to reign in the spiraling costs” of healthcare while also improving quality. At the center is a recommendation to prioritize electronic sharing of information among providers.
The plan, "A Bipartisan Rx for Patient-Centered Care and System-Wide Cost Containment," is signed by former Senate Majority leader Tom Daschle, former Senate Majority Leader Bill Frist, MD, former Senate Budget Committee Chairman Pete Domenici, and former Congressional Budget Office Director Alice Rivlin.
“There is no fiscal solution that doesn’t involve healthcare,” said Michael Peterson, president and CEO of the Peter G. Peterson Foundation in Thursday’s event introducing the report, adding that healthcare has its own challenges.
-----

CHIME Comments to HHS on New Initiatives to Accelerate HIE

APR 18, 2013 5:25pm ET
As the federal government looks to further enhance the exchange of health information exchange, the College of Healthcare Information Management Executives suggests the feds model new initiatives after some of their existing programs.
The Department of Health and Human Services in March issued a request for information as it considers policy moves to further accelerate interoperability and health information exchange beyond initiatives previously launched under the Office of the National Coordinator for Health Information Technology. Responding to the request for information, CHIME applauds the certification programs that HHS already has in place for the electronic prescribing and meaningful use programs.
-----

Computational model predicts cancer survival rates

April 19, 2013 | By Ashley Gold
A new computational model highly predictive of breast cancer survival has been developed by Columbia University engineering researchers. Their work is outlined in a study published this week in Science Translational Medicine
Lead researcher Dimitris Anastassiou--a professor of engineering at Columbia's Fu Foundation School of Engineering and Applied Science--and his team identified "attractor metagenes," which are gene signatures present in identical form among many types of cancer, according to an announcement from the school.
-----

Privacy framework necessary as healthcare social networks grow in popularity

April 19, 2013 | By Dan Bowman
As an increasing number of patients and providers flock to health social networking sites to share information and connect with similar individuals, privacy remains a paramount concern. To that end, a comprehensive privacy framework is vital for such environments, according to research published this week in the Journal of the American Medical Informatics Association.
"Empirical and theoretical research suggest that users often lack enough information to make privacy-sensitive decisions and, even with sufficient information, are likely to trade-off long-term privacy for short-term benefits," says author Jingquan Li, an associate professor of computer information systems with the Texas A&M University-San Antonio's school of business. "Users' online practices are also constrained by their degree of digital literacy and by the technical design of the website, which may impede easy management of settings and consent regarding the use and disclosure of personal data."
-----

Bryant backs The Big EPR Debate

17 April 2013  
Beverley Bryant, NHS England’s director of strategic systems and technology, has given her support to EHI’s Big EPR Debate.
“It will be helpful because I want to be more consultative – not just to funnel stuff down from the centre - and this will help achieve that,” she said.
EHI has launched The Big EPR Debate now because the NHS is once again being urged to implement electronic patient records on a tight timescale.
-----

Viewing medical history through HIE reduces readmissions

April 18, 2013 | By Susan D. Hall
Emergency room access to a patient's medical history compiled through health information exchange reduced both readmissions and single-day admissions in a study from Israel.
The study tracked whether ED physicians looked at patient medical histories after an information system was installed linking the state-run HMO's seven hospital and various clinics. Data on patients covered by the HMO would be compiled from these various sources, presumably offering a more complete picture. Other patients' data would be limited to that from the facility where they were being treated.
Only 31.2 percent of ED physicians accessed the medical histories at all, according to the study published in BMC Medical Informatics and Decision Making. The study looked at seven-day readmissions and single-day admissions for frequent diagnoses: chest pain, abdominal pain, gastroenteritis, urinary tract infection (UTI) and pneumonia organism.
-----

Healthcare execs reliant on IT now more than ever

April 18, 2013 | By Ashley Gold
Healthcare executives are becoming more and more reliant on healthcare technology, according to new research from The Economist and RICOH Europe.
Of 432 healthcare executives who responded to the publication's survey, close to 93 percent percent said that they've become more reliant on technology and they're positive about the impact it's having on the industry. Roughly 70 percent said the increased use of technology has increased employees' creativity, while 65 percent agreed there is even more room for efficiency gains
Still, 35 percent of respondents admitted that a computer-automated decision has cost their organization money recently. An accompanying infographic highlights the numbers.
-----

Kinsa launches a smartphone-connected thermometer to create a real-time health map

Summary:
New York-based Kinsa is trying to create a real-time picture of the country’s health with a smartphone and a simplified digital thermometer.
If you want a real-time picture of the country’s health, you can check out Google Flu Trends or insights from social media. And if you want a more official perspective, you can turn to the Centers for Disease Control. But getting information that is both real-time and accurate is tricky business.
-----

Feds say big data rewards 3 years away

By Tom Sullivan, Editor
Despite all the attention, the catchphrase big data is lacking any kind of a clear definition. 
The TechAmerica Foundation last October put together its take and on Monday MeriTalk posted the results of its research into the matter, which involved polling 17 “big data big brains” in the federal government and industry on what exactly big data is, what agencies are doing with it today, and what obstacles remain.
“Most of the respondents shared the view of Big Data as the point at which the traditional data management tools and practices no longer apply,” the Meritalk report explained.
-----
Thursday, April 18, 2013

mHealth Regulation Under the Spotlight on Capitol Hill

by David Collins and Tom Martin
The March House Energy and Commerce hearings on mobile health regulation provided insight into the attention that the mHealth space is garnering on Capitol Hill.
Major topics included the effect of mHealth on health care costs, interoperability of EHRs, the role of FDA in maintaining patient safety and the applicability of the medical device excise tax on tablets and smartphones. The mHIMSS work groups provided an early review of the draft regulations when they were released more than a year ago.
-----

Contest seeks new big data strategies

By Mike Miliard, Managing Editor
Created 04/17/2013
The Bipartisan Policy Center, Heritage Provider Network and The Advisory Board Company announced Tuesday the launch the Care Transformation Prize Series, a nationwide contest to find ways to more effectively deploy big data in healthcare.
As U.S. healthcare organizations grapple with big changes to care delivery and payment reform, the contest seeks to uncover more effectively use data to drive improvements in healthcare cost and quality, officials say.
-----

Cost reminders via CPOE lead to fewer test orders

April 17, 2013 | By Susan D. Hall
Displaying the cost of a test via computerized provider order entry systems prompted a 9 percent reduction in the number of tests ordered, according to a study published in JAMA Internal Medicine.
The study compared the number of tests ordered over six months when the CPOE system at Johns Hopkins Hospital displayed the cost of 61 tests to a six-month baseline when costs were not presented. Meanwhile, 6 percent more tests were ordered when cost information was not presented, according to a MedPage Today article.
"Displaying the Medicare allowable fees of diagnostic tests at the time of ordering can modestly affect provider ordering behavior," the study's authors wrote. "Whether broadening this intervention and coupling it with educational interventions related to cost consciousness and stewardship of resources will increase its effect on clinical practice deserves further study, provided that providers are not inappropriately incentivized to limit needed care."
-----

Hagel promises plan in 30 days for DOD-VA health records sharing

Stars and Stripes                                                                     
Published: April 16, 2013
WASHINGTON — Faced with tough questions from legislators, Defense Secretary Chuck Hagel on Tuesday said he would decide on a plan within 30 days to work through the tangled process to seamlessly share medical records between the Department of Defense and the VA.
At a hearing with members of the House Appropriations Committee, Hagel admitted the process has bogged down, and promised quick action.
“I’m going to acknowledge that we’re way behind,” said Hagel, who took over as defense secretary in February, and previously served as an official at the VA in the 1980s. “We will do better.”
-----

Hagel on iEHR: 'I didn't think we knew what the hell we were doing'

April 17, 2013 | By Dan Bowman
Secretary for the U.S. Department of Defense Chuck Hagel said Tuesday that lack of understanding regarding the creation of a joint electronic health record system with the U.S. Department of Veterans Affairs led him to block DoD from issuing a request for proposals last month, Federal News Radio reports.
Hagel, speaking at a House Appropriations Committee hearing, said that while not all of the money that has been poured into the project has been wasted, the DoD must do better. He said that he has ordered a restructuring of the process that will include "direct management oversight" by his office, according to the article.
-----

GOP Senators: HITECH Program Needs to be Rebooted

April 16, 2013
Six Republican Senators have released a whitepaper that argues Congress and the Obama administration need to reboot the Health Information Technology and Economic and Clinical Health (HITECH) Act and the efforts to deploy health IT, because the current program is deficient.
The whitepaper, “REBOOT: Re-examining the Strategies Needed to Successfully Adopt Health IT,” is the work of Senators John Thune (R-S.D.), Lamar Alexander (R-Tenn.), Pat Roberts (R-Kan.), Richard Burr (R-N.C.), Tom Coburn (R-Okla.), and Mike Enzi (R-Wyo.). The Senators say the failed implementation of health IT through HITECH can be summed up in five points:
  • Lack of Clear Path Toward Interoperability
  • Increased Costs
  • Lack of Oversight
  • Patient Privacy at Risk
  • Program Sustainability
-----

4 questions on HIT in America vs. the rest of the world

By Tom Sullivan, Editor
Among America’s dichotomies:  The country is widely-viewed as a leader in IT, yet the healthcare industry is notoriously perceived as lagging others in tech adoption. But is it really?
To find out, Government Health IT Editor Tom Sullivan spoke with David Lareau, who as CEO of health IT vendor Medicomp Systems, travels the globe and meets with healthcare customers in other nations.
Q: What is the health IT landscape in other countries like right now?
A:
We’re involved in Malaysia and it has the closest thing to what I’d call the Balkanized healthcare system where every enterprise is its own country with its own clinical data definitions. What is it about every one of our hospitals that makes them think they are such a unique and exciting experience that they need to define their own clinical data? And when I see that it drives me crazy, but when you go to other countries, like Malaysia where there are more chains of hospitals, each one reinvents this stuff time and time again. Remember a few years ago when the big, big thing in our industry everybody was talking about was interoperability?
-----

6 ways to avoid breaches

By Diana Manos, Senior Editor
Created 04/16/2013
Healthcare organizations should not assume that compliance with regulations, like HIPAA, automatically makes their organization secure, says Larry Hurtado, CEO of Digital Defense, a risk assessment firm in San Antonio, Texas.
“Organizations need a blended approach,” Hurtado says. “They need to balance out compliance with security.”
More than a decade ago, Digital Defense “cut its teeth” on providing security audits to financial institutions, but these days, the company has clients across all types of industries, including healthcare.
-----

Social media key in enabling quick provider response to Boston bombings

April 16, 2013 | By Dan Bowman
In the wake of two explosions that rocked downtown Boston at the finish line of the Boston Marathon on Monday, technology and social media played a critical role in the coordination of care efforts.
John Halamka (right), CIO at Boston-based Beth Israel Deaconess Medical Center and FierceHealthIT Editorial Advisory Board member, told FierceHealthIT that from his perspective, maintaining a high bandwidth was key for employees at his hospital in keeping care efforts as fluent as possible, as was a reliable and secure infrastructure.
"The demand for communication--voice, email, social media and streaming video--was very high," Halamka said. "The scalability built into the design of all our systems--networks, servers, storage and client devices--served us well."
-----

Boston Marathon tragedy reveals potential EHR, HIE flaws

April 18, 2013 | By Marla Durben Hirsch
The Boston hospitals that have been treating the hundreds of victims of the horrific Boston marathon bombings this week have done a terrific job. They, in turn, have credited technology in helping them communicate to staff, volunteers and the public. I presume that these hospitals also have good electronic health record systems that they can rely on.
But I can't help but wonder: wouldn't their work have been enhanced even further and their jobs made easier if the nation was further along in health IT and interoperability? Would it have helped these hospitals if they had had electronic access to victims as they were rushed in, to know about an allergy to penicillin, a patient's blood type, a heart condition that could affect the outcome of surgery?
-----

IT key for Boston bombing patients

By Bernie Monegain, Editor
Created 04/17/2013
As a Bostonian and an emergency physician, Jonathan Teich's first instinct when the explosions shook the Boston Marathon on April 15 ordinarily would have been to rush to Brigham & Women’s Hospital to help treat the victims, many of whom had life-threatening injuries.
But this Patriot’s Day, it was different. Teich’s son and brother-in-law were both running the marathon. His brother-in-law crossed the finish line at the time of the second explosion – unhurt. Teich’s son, just a couple of miles back, was among the runners diverted off course. So an anxious Teich waited for that first text message saying he was OK. It would be two hours, though, before father and son were reunited.
-----

Are eICUs as efficient as some studies portray?

April 16, 2013 | By Susan D. Hall
While remote monitoring of intensive care units promises to stretch the skills of an inadequate pool of specialists, a recent New York Times article questions whether eICUs actually improve care for patients or the bottom line for hospitals.
According to the article, while some studies linked to companies that sell such systems have produced large declines in mortality in addition to huge return on investment, other independent studies have found just the opposite in terms of the latter, with no significant impact on survival rates, complications or length of stay.
What's more, some hospitals adopted the technology, then ditched it, according to the Times, including NewYork-Presbyterian Hospital and Kaleida Health in Buffalo, as well as hospital systems in Michigan, Texas and Kentucky.
-----

Another view: Neil Paul

EHI Primary Care’s columnist is not sure about giving patients online access to their notes; although he has lots of other ideas for helping them digitally.
16 April 2013
The government is having another push on making sure that patients can get access to their GP-held records. In fact, one of the few, definite, commitments that has made on the NHS IT front is that patients should have online access by 2015.
Yet, I’m not convinced that this is something that people really want; even though there may be some benefits when we get around to implementing the idea that have not been discussed yet.
Why aren’t doctors keen?
Most of the doctors I speak with don’t have an intrinsic problem with patients seeing their notes; they just don’t feel it’s a high priority or that it’s going to help more than it hinders.
Their main fear is that they will have to spend time dealing with the minority that hassle them about trivial inaccuracies: “I said the pain was six hours not five”; “the scar is two centimetres above my left knee not three.”
In the same vein, a number worry that some patients will want every medical term explaining. However, I know of companies that are trying to make front-ends to the patient record that make understanding easier, while providing links to existing sources of further information.
-----

Caldicott recommends 'duty to share'

11 April 2013   Lis Evenstad
The Caldicott2 review of information governance in the NHS recommends a new duty to share information when it is in the interest of the patient.
'Information: to share or not to share' will be launched on 17 April alongside health secretary Jeremy Hunt’s response to the recommendations.
It details how the NHS should share patient information while also protecting patient confidentiality as it moves towards a paperless future.
-----

4 Steps to Engage Patients While Meeting Meaningful Use Requirements

Written by Sabrina Rodak | April 12, 2013
The focus on engaging patients in their care and the need to meet meaningful use requirements converge in one online tool: the patient portal. Patient portals on a health system's website can allow patient to easily schedule appointments, contact their provider and access other resources, which engages them in their care. These portals also help hospitals and physicians fulfill meaningful use stage 2 requirements of providing patients the ability to view their health information online and using electronic health records to identify patient-specific education resources.
-----

Lab Tech Standards, With Benefits

Scott Mace, for HealthLeaders Media , April 16, 2013

Is your laboratory thinking about Meaningful Use yet? In all the hubbub over ONC's mammoth incentive program (and the penalties that follow in a few short years if you don't get on board), technology changes affecting every medical lab will provide their own benefits to healthcare's bottom line.
It's been a long time coming.
As far back as the 1960s, it was already understood that a standardized vocabulary for the multitude of lab tests performed in this country was lacking. Those lab tests now amount to about 30-billion-per-year.
While the industry argues about which version of ICD to agree upon in the diagnostic code area, and just how we would get physicians to agree upon these diagnosis codes, information about lab tests were always more amenable to being digitized. A serum sodium test is a serum sodium test, and once a lab test standard exists, there's no reason not to bake it right into the diagnostic equipment itself.
-----

4 ways health IT can build trust

By Benjamin Harris, New Media Producer, Healthcare IT News
Created 04/04/2013
Medicine is a two-way street; it works best when the patient and the provider trust each other, and can work together for the best outcome. While technology can enable those outcomes, when improperly used -- consider the epidemic of patient data breaches -- it can also raise some eyebrows and scare some people away from embracing it. Scott Zimmerman, president at TeleVox Software, understands these concerns. But he sees technology offering a net gain on the road to improving patien-physician relationships and enhancing trust. He shares four ways health IT can improve the quality of care and enhance trust between the patient and the provider.
-----

E-prescribing in growth mode

By Bernie Monegain, Editor
Created 04/15/2013
The electronic prescribing systems market is estimated to grow to $794 million, at a compound annual growth rate of 26 percent from 2012 to 2017, according to a new study by MarketsandMarkets, which analyzed the major market drivers, restraints and opportunities around the world.
In the U.S., the HITECH Act designates e-prescribing as an essential requirement for meaningful use under the electronic health record incentive programs, thus driving the adoption of electronic prescribing systems, the report found. According to findings, costs can be reduced with the use of eRx systems as these help to improve quality and efficiency and show promise in reducing costs by actively promoting appropriate drug usage; providing information to providers and dispensers about formulary-based drug coverage, including formulary alternatives and co-pay information; and speeding up the process of renewing medications.
-----

The Big Data Revolution: Part 2

APR 12, 2013 4:16pm ET
Last week’s blog introduced a new book, “Big Data: A Revolution That Will Transform How Live, Work and Think,” that I like a lot. Starting from the current obsession with datafication – “taking information about all things under the sun…and transforming it into a data format to make it quantified” – Big Data identifies three major developments, incredibly large data sets, acceptance of messy data, and a tolerance for correlation in lieu of causation, as drivers of the revolution. From Big Data’s perspective, the business and social implications of these shifts are substantial.
The value of data is evolving. Historically seen as ancillary, “in the age of big data, all data will be regarded as valuable, in and of itself.” Indeed, “data’s value needs to be considered in terms of all possible ways it can be deployed in the future, not simply how it is used in the present …Ultimately, the value of data is what one can gain from all the possible ways it can be deployed.” The “option value” of data is the sum of those possibilities.
-----

CDS can make best-practices guidelines more accessible

April 15, 2013 | By Susan D. Hall
Electronic health records offer the opportunity to better integrate clinical practice guidelines (CPGs) at the point of care, but the technology and physician practice must evolve, according to a paper published at BMC Medical Informatics and Decision Making.
Just sending out more reminders to physicians won't do the trick, researchers say. At this point, most information about best practices is "parked" in lengthy documents or graphics, such as decision trees, that are too cumbersome for physicians to parse during a patient encounter.  
-----

Researchers call for national standards for genomic data use

April 15, 2013 | By Ashley Gold
Better standards are needed for how discoveries in genomic medicine are found and recorded as health information technology develops, according to researchers from Harvard and the Mayo Clinic who published a viewpoint in the Journal of the American Medical Association last week.
Advances in genomic medicine, the researchers said, have lead patients and providers to be able to expect large improvements in healthcare effectiveness by 2020. However, institutions must be ready to incorporate "exponentially" larger volumes of genomic, medical, ethical and legal information into electronic health records, which already are fragmented, they added.
-----

Healthcare firms struggle with IT staffing: survey

Posted: April 12, 2013 - 11:45 am ET
Many U.S. healthcare companies—about 67%—report that they're struggling to attract experienced information technology workers, according to a survey.
That's compared with 10% that said they have problems attracting all workers, according to the Towers Watson 2013 Healthcare IT Survey (PDF). Meanwhile, 38% of healthcare companies reported problems with retaining experienced IT workers, compared with 8% reporting problems retaining all types of workers.
The problems may stem from misconceptions about what attracts employees to a healthcare workplace.
-----
Monday, April 15, 2013

Efforts Seek To Improve Drug-Drug Interaction Alert Tools

by Bonnie Darves, iHealthBeat Contributing Reporter
In the realm evolving at the intersection of electronic health records and technology-enabled clinical decision support, few issues have gotten as much attention -- in the negative category that is -- as the pesky problem of electronic alert fatigue resulting from what some view as hyper-vigilant drug-drug interaction (DDI) alert systems.
Although the growing use of computer-accessible knowledge databases that flag potentially dangerous DDIs at or before the point of prescribing have been a boon to medication safety improvement overall, a serious downside has emerged. The alerts are so numerous and, in many cases, also either very low priority or irrelevant that clinicians are increasingly overriding or ignoring them -- which might result in important, pertinent alerts being missed. Recent studies have found override rates as high as 95%.    
-----

Enjoy!
David.

Friday, April 26, 2013

Security In The Cloud For Healthcare Information Needs Decent Planning.

The following appeared a little while ago.

5 steps to managing data security risks in the cloud

By Rick Kam, President and co-founder ID Experts and Doug Pollack, CIPP, Chief strategy officer, ID Experts
Cloud computing. It’s like having a butler for your data — managing them, securing them, and making them available when and where they’re needed. No wonder the cloud is attractive to organizations burdened with time and budget constraints.
But the cloud is not without its risks. The Cloud Security Alliance (CSA) recently released its “Notorious nine,” a list of the top threats associated with cloud computing.  At the top of the charts for 2013: data breaches. With this threat at the forefront, healthcare organizations should determine when, if ever, is an optimal time for placing protected health information (PHI) and personally identifiable information (PII) in the cloud.
Caught in the crosshairs
The cloud offers a “target-rich environment” for those looking to mount cyber attacks, with the intent of either disrupting commerce or more typically monetizing the data through criminal means. It’s logical to assume that cloud providers are better qualified to secure data, given that their job is to provide computing services in a safe and secure manner.  
Unfortunately, the more data that cloud providers are entrusted with, the bigger the target they are for cyber criminals. A recent report from ENISA, The European Network and Information Security Agency, titled “Critical cloud computing,” discusses the importance of preventing large cyber-attacks and cyber disruptions.
It notes that while offering significant benefits, the concentration of IT resources in cloud services represent a “double edged sword … If an outage or a security breach occurs then the consequences could be big, affecting many citizens, many organizations, at once.”
Such is the risk inherent to cloud computing. Cloud providers who are hosting applications or data with mandated privacy protections, such as PII and PHI, are more likely targets for cyber criminals. Consequently, they are more likely to have the “mother of all data breaches,” if they are penetrated and criminals are able to acquire data without detection, at least for a while.
The other problem is cyber disruption, or cloud outages. The loss of service also puts data at risk. According to Gartner, 47 percent of all documented large outages were caused by cloud services going down. In fact, Jay Heiser at Gartner notes that while data breaches are a concern, cloud outages that lead to data loss are even more likely a risk, a perspective that appears in contrast to that of the CSA.
The cloud in healthcare
The cloud has become — and will continue to be — a favored computing model for healthcare organizations.
The Third Annual Benchmark Study on Patient Privacy & Data Security by Ponemon Institute found that 91 percent of hospitals surveyed are using cloud-based services; many use cloud services to store patient records, patient billing information, and financial information. However, 47 percent of organizations lack confidence in the data security of the cloud.
A recent article in Government Health IT highlighted an appeal by Dr. Deborah Peel, founder and chair of Patient Privacy Rights, to the Department of Health and Human Services (HHS) Office for Civil Rights “to create cloud-computing guidelines around the issues of secure infrastructure, security standards and business associate agreements.” Dr. Peel explained. “Issuing guidance to strengthen and clarify cloud-based protections for data security and privacy will help assure patients [that] sensitive health data they share with their physicians and other health care professionals will be protected.”
Lots more here including a plan on what you need to do.
This is a really useful summary with a range of useful links.
Well worth a close read.
David.

Thursday, April 25, 2013

Look After Your Patient’s Electronic Health Information Effectively Or Suffer The Consequences.

The following is a draft short article for a Health Magazine - Comments welcome.
-----
It is quite clear, and very well known, that individuals who entrust their private information to clinicians and organisations have a high level of expectation regarding the protection of the privacy and security of that information. Individuals and organisations that do not meet those expectations can expect to suffer substantial reputational if not associated financial damage.
In the last few months there have been a few incidents that have served to remind both practitioners and hospitals that it is important to really careful with their patient’s private health information.
One spectacular health related recent breach was when a Queensland general practice had its patient records accessed and then encrypted by a foreign hacker and then was asked for a ransom to give back the information. It was a bad few days that followed as the practice suddenly had to revert to paper records as sadly - and incompetently - the practice lacked a recent backup of their patient data. [1] According to Medical Observer the Queensland Police were aware of 11 similar attacks on practices in 2012. [2]
On the broader front we have a recent report from the Commonwealth Privacy Commissioner indicating that there were 46 breach notifications in 2011-2012 - and this figure was reached without there being any current legislation requiring breach reporting. Organisations as large as Sony, Telstra and Dell Australia have all recently been investigated by the Commissioner for significant breaches.[3]
Usefully there has been a recent survey of  patient attitudes and expectations for health information security and privacy. I published a blog with links to reports that summarised attitudes to electronic health record security in both the US and the UK. On the safe assumption that the Australian public would have similar views we can be pretty confident that well over 80% of the population have high expectations for security of their information - especially if the information held contained details of illnesses and conditions which may result in prejudice and discrimination as a result of disclosure. [4]
With that background it is important to realise that there are a range of responsibilities that holders of health information have - noting that the same principles apply to both hospitals and office based practices. First and key they have a responsibility to ensure that health information is not accessed by those who should not have access and also that the same information is indeed accessible to those who have a genuine need for access. Second they have a responsibility to preserve the existence and integrity of the information so that the information is available when needed by an authorised individual and that it is not in any way altered or corrupted (this means that there must be regularly tested backups made of all sensitive patient information and that this must also be protected). Third there is a responsibility when information is being transferred or shared that the path by which it is shared is similarly reliable and secure (Lost backup tapes, disks and laptops where unencrypted information is found account for many of the breaches where thousands of individuals are affected).
In recent years provision of technology solutions that meet there broad principles has been made increasingly difficult by some technology trends. The first and most important is that most holdings in health information are no longer functionally isolated due to the pervasive intrusion of internet connectivity. Back when such holdings were held on standalone computers with no network connectivity securing the information was considerably simpler that it is now. It was clear where the information was held, who controlled it and access could be managed with a high degree of rigor. Further complexity has emerged in the last few years with the location of at least some information becoming very blurred as the use of ‘cloud computing’ techniques (which reduce the cost of computer processing and storage) widens and more and more information is stored in the nebulous and location non-specific cloud. Additionally with the widening use of internet enabled portable devices (phones and tablets) the locations from which information is accessed are vastly increasing in number and making information and access security that much harder. Both cloud computing and the wider deployment of mobile devices are seen as making the health information security challenge harder. [5]
If we accept that it is the responsibility of all health care providers to properly protect and secure health information from breach and unauthorised leakage then there are a few questions that then arise. I will address these in turn.
Health Information Risks.
The first is to understand how and why health information is / can be compromised. Recognising that compromise of electronic information is surprisingly common  (and causes real costs [6]) is a first step. To quote a recent article:
“According to Australia's Computer Emergency Response Team (CERT) 2012 Cyber Crime and Security Survey Report in February, 20 per cent of Australian businesses were the subject of hacking or other cyber-attacks last year.
The most serious involved the use of malicious software including ransomware and scareware, which extort payments for the return of data; trojan or rootkit malware, which lodge in the company's systems to steal information; theft or breach of confidential information; and denial-of-service (DoS) attacks.” [7]
Although detailed statistical breakdowns are not available for Australia there is considerable evidence that - other than malicious hacking as described above that many breaches are due to insider misbehaviour and stupidity (loosing unencrypted information on laptops or having passwords on Post-It Notes beside the computer) and occasionally just bad luck (couriers loosing backup tapes etc.)
In terms of information loss there is little doubt the biggie is to not have a properly developed information backup program which includes regular testing of the backup systems to ensure the backed up information is actually recoverable! Second to this is to not have a reasonably recent backup genuinely off-site to protect against theft, fire, flood and the like. It is worth noting the adequate backups is a useful defence against many woes from equipment failure to computer virus infection etc.
Compromise Prevention Best Practice.
The second is to consider what might be done by an organisation to prevent such compromise happening in the first place. Here is a list of the major points.
1. Accept that there is a ‘clear and present’ danger and risk of digital information loss, compromise or  breach.
2. Develop a plan to address risk. At the very least this plan should cover ongoing staff / user awareness and education, the regular audit of all digital assets,  policies for access and use of both fixed and mobile devices, password and other access control policies and so on.
A recent article quoted Brad  Marden,  Australian Federal Police acting manager for cyber crime operations as suggesting the following specifics for inclusion in any plan which he suggested would prevent 85% of breaches.[8]
“1. Application whitelisting
Application whitelisting helps prevent malicious software and other unauthorised programs from running. The whitelist is a list of specific applications that are permitted to run on a given system.
2. Patch, patch, patch (applications and operating systems)
Patch applications such as PDF readers, Microsoft Office, Java, Flash Player, web browsers and operating systems as soon as patches for known security holes are released.
"A lot of data breaches occur on systems that are not protected, and not up-to-date," says Sean Kopelke, director of security and compliance solutions at Symantec.
3. Passwords and privileges
Minimise the number of users with administrative privileges. Also, check the identity of visiting technicians and change passwords when they leave.
4. Develop information policies
You should treat information in the same way on each platform or device, says Kopelke. "It sounds simple, but implement policies around securing information, not the devices. It is irrelevant where information is stored; the policy on how it is protected should be the same."
5. Educate staff
Often the weakest security link is the human link. Educate staff about how to handle confidential information. Teach them how to assess whether someone who rings asking for information is legitimate and to suspect all emails, links and attachments.
6. Rethink social media
The AFP goes a step further and recommends implementing policies banning employees from accessing social media sites at work, as these sites can allow malware to infiltrate company systems. Many security companies, however, recommend mitigating this risk with specialist applications and security modules to accommodate social media in the workplace.
7. Report
As far as security breaches go, Marden finds it strange that organisations don't report cyber compromises, but they do report burglaries. Australia does not have mandatory breach disclosure laws as is the case in the US.”

Not mentioned here - but also certainly worth considering is the issue of Data Breach Insurance which is increasingly available and makes some sense if handling sensitive information.
Legislative and Ethical Requirements.
The third is to understand clearly just what is required by best practice and legislation.
As indicated above there is a clear expectation on behalf of the public that their health information will be kept both secure and private. In response to the public requirement for information privacy - with respect to all sorts of personal information (financial, health etc.) there has been a range of legislation passed over the years.
At the time of writing Australian legislation is in a state of flux with some major changes to the foundational Commonwealth Privacy Act (1998) having been passed last year (2012) and legislated to comes into effect in March 2014.[7] The modifications harmonise the Privacy Principles, widen the scope of organisations covered by the act, change a range of credit reporting laws and also toughens the enforcement regime.
There is a dedicated web page covering the changes which can be found here:
The biggest change that is relevant to the health sector is the change from the National Privacy Principles to a new set of unified Australian Privacy Principles (APP) which happens in March 2014. Health Information Privacy being a little different there are some specific use cases defined where health information can appropriately be collected, used and disclosed. All those involved in handling health information (in any form both paper and electronic) would be well advised to review present and future obligations. The general web site is found here:
The Commonwealth Privacy Commissioner (who is a key part of the Office of the Australian Information Commissioner (OAIC) also has a role in the administration and enforcement of the special legislation which was developed to cover the privacy aspects of the Health Identifier Service and the Personally Controlled Electronic Health Record (PCEHR) where there are some quite strict rules for breaches and significant penalties available.
Sadly, of recent time there would appear to have been major staff losses within the Office of the Privacy Commissioner so there are some doubts as to just how effective the enforcement regime will be going forward.
The ethical situation when handling sensitive private information …..
Information Sources.
Lastly it is important for organisations to know where  help be sourced?
The key resource provided by Government to manage cyber-attacks and infiltration is, at present, CERT (Computer Emergency Response Team)  Australia. They provide a useful web site here:
In due course CERT Australia is to become part of an expanded Australian Cyber Security Centre which was announced by the Prime Minister in January 2013. [9]
There is guidance available on how information compromise and leakage should be addressed found at this link - which is part of the Office of the Australian Information Commissioner.
Additional information which might assist smaller organisations in preparation and prevention of issues related to information security (especially medical practices)  is available from the Royal Australian College of General Practice (RACGP) web site. The following link provides a very useful set of freely available resources:
These three sites will provide a useful start for any organisation wishing to assess their current and desirable future state in securing the sensitive information they hold.
In summary patients expect their private health information to be managed securely and appropriately in the context of current and future legislative privacy and information protection requirements. To not pay proper attention to these issues invites both reputational and financial damage - to say nothing of the potential damage to patients.
Finally, this headline from Wired Magazine puts the risk in clear perspective - it is not a matter of if but when!

World’s Health Data Patiently Awaits Inevitable Hack

See here for the article.
The next step is yours!
References.
-----
David.