Quote Of The Year

Timeless Quotes - Sadly The Late Paul Shetler - "Its not Your Health Record it's a Government Record Of Your Health Information"

or

H. L. Mencken - "For every complex problem there is an answer that is clear, simple, and wrong."

Sunday, July 16, 2017

Has The ADHA Not Kept The Right And Left Hand In Synch – It Rather Looks Like It.

We had this appear yesterday from the ADHA.

Fact Check: Security of My Health Record

Created on Friday, 14 July 2017

What is My Health Record?

My Health Record is a secure online summary of your health information. An individual can control what goes into it, and who is allowed access. Individuals can choose to share their health information with their doctors, hospitals and other healthcare providers.

Why is there a need for a digital record system?

One in three General Practitioners (GPs) will see a patient for whom they have little or no health information. Many patient records are created as paper files. They are regularly transmitted between healthcare providers using unsecure email, fax machines and by post. The My Health Record offers health professionals secure digital access to a patient’s record at the point of care, wherever that may be.
There are significant benefits of My Health Record for all Australians. These include avoided hospital admissions, fewer adverse drug events, reduced duplication in diagnostic tests, better coordination of care for people seeing multiple healthcare providers, and better informed treatment decisions.
Following unanimous support by all State and Territory governments, the Government will expand My Health Record and create a record for every Australian, unless they prefer not to have one.
The Health Sector Supports My Health Record
‘We all want the My Health Record to work. It has the potential to support much better patient care, particularly when your patients see another doctor or health care provider.’
  • The Royal Australian College of General Practitioners (RACGP) includes helpful case studies on their website on the benefits of My Health Record for GPs:
‘The RACGP has been an advocate for a national shared electronic health record system and understands the clinical benefits of healthcare providers accessing healthcare information not available via normal communications channels.’
‘Community pharmacy, as the most accessible community health care destination, has always been at the forefront of digital innovation and an opt-out model for the operation of My Health Record will enable community pharmacies to enhance their patient care.’

How does My Health Record system protect people’s health information?

My Health Record legislation provides protections for privacy of medical information in the system. The Agency, as the system operator, is responsible for the security of the My Health Record system.
The Agency have in place a comprehensive set of people, process, and technology controls to protect health records from a cyber-attack. The system has bank strength security which ensures information is stored and accessed by only trusted connected health systems.
The system complies with the Australian Government requirements for storing and processing protected information, and is regularly tested and audited to confirm that these requirements are met.
The Agency’s Cyber Security Centre continually monitors the system for evidence of unauthorised access. This includes utilising specialist security real-time monitoring tools that are configured and tuned to automatically detect events of interest or notable events. Examples of this include:
  • Overseas access by Consumers and Healthcare Providers
  • Multiple failed logins from the same computer
  • Multiple logins within a short period of time
  • Logins to the same record from multiple computers at the same time
  • High transaction rate for a given Healthcare Provider
  • Certain instances of after business hours access and all instances of emergency access.
The Cyber Security Centre regularly reviews the events of interest based on its knowledge of the likely threats to the My Health Record and updates them accordingly.

How do healthcare providers protect your health information?

Every time a healthcare provider accesses a My Health Record, a log is automatically created. This allows an individual to monitor every access to their My Health Record in real time, with complete transparency.
An individual’s Medicare card number does not allow My Health Record information to be accessed, additional information is required to authenticate consumers and health care providers.
Healthcare organisations can only access an individual’s My Health Record if they:
  • are directly involved in the individual’s care;
  • have a healthcare provider certificate installed (either with NASH HPI-I or HPI-O certificate) on the device that they are using to access the record;
  • a valid username and password, and;
  • have the Record Access Code (RAC), if an individual has enable restrictions.
Any software that connects to the system undergoes automated checks to ensure that it conforms to the system requirements and has authority to access the information. Write access to My Health Record is only available to healthcare provider organisations via approved clinical software.
If a person were to deliberately access an individual’s My Health Record without authorisation, criminal penalties may apply. These may include up to two years in jail and up to $126,000 in fines.

What controls do individuals have?

A person can arrange to be notified by email or SMS when a healthcare provider organisation accesses their record for the first time. The individual can also view a real time log of every access to their My Health Record by a provider organisation.
Individuals can control what information is in their My Health Record, and which healthcare provider organisations can access their record. A range of privacy controls are available including:
  • Setting a Record Access Code (RAC) which the individual can give to their healthcare provider organisation to allow access to their record, and prevent other healthcare providers from access unless in an emergency
  • Flagging specific documents in their record as ‘limited access’, and controlling who can view
  • Removing documents from view within their record
  • Asking healthcare providers not to upload information and, under the My Health Records Act 2012, healthcare providers must comply with this request.
For more information on managing access, privacy and security of your My Health Record visit www.myhealthrecord.gov.au or call 1800 723 471.

Download 'Factsheet: Security of My Health Record'

Here is the link:
Clearly the message that is intended is that we have it all utterly in hand an – to quote a now dead politician – ‘Don’t you worry about that!’
But then we have this that appeared also last week:

Australian Digital Health Agency MOU Biannual Report 2016-2017 for the period ending 31 December 2016

Mr Tim Kelsey
Chief Executive Officer
Australian Digital Health Agency
Level 25, 56 Pitt Street
Sydney NSW 2000
Dear Mr Kelsey
I am pleased to provide you with the biannual report for the period ending 31 December 2016, in accordance with section 3.3 of Schedule 1, section 3.3 of Schedule 2 and section 10.1 of the Memorandum of Understanding between the Office of the Australian Information Commissioner and the Australian Digital Health Agency, in relation to the provision of dedicated privacy-related services under the Privacy Act 1988, the My Health Records Act 2012 and the Healthcare Identifiers Act 2010.
If you have any queries relating to the report, please contact Melanie Drayton on [contact details removed].
Yours sincerely
Angelene Falk
Deputy Commissioner
21 March 2017
Here is the link to the total report:
Here we discover (about ½ way down the full report) the following:

Details of mandatory data breach notifications relating to the My Health Record system

Mandatory data breach notifications received during the reporting period

The OAIC received two mandatory data breach notifications from the System Operator during the reporting period, in September 2016 and December 2016. It involved the unauthorised access of a healthcare recipient’s My Health Record by a third party. The review of these notifications was ongoing as at 31 December 2016.
The OAIC also received eighteen mandatory data breach notifications from DHS during the reporting period.
  • Eleven notifications resulted from findings under the Medicare compliance program that certain Medicare claims in the name of a healthcare recipient but not made by that healthcare recipient were uploaded to their My Health Record. These notifications totalled 92 breaches, each of which affected a separate healthcare recipient. Seven of these data breach notifications have been closed, totalling 67 breaches, and the review of the other four notifications, totalling 25 breaches, was ongoing as at 31 December 2016.
  • A further seven notifications, affecting fourteen healthcare recipients, eight with a My Health Record and six without, relate to healthcare recipients with similar demographic information having their Medicare records intertwined. As a result, Medicare claims belonging to another healthcare recipient were made available in the My Health Record of the record owner. Review of these notifications was ongoing as at 31 December 2016.

Mandatory data breach notifications closed during the reporting period

The OAIC completed its enquiries into ten data breach notifications received from DHS between April 2016 and October 2016. These data breach notifications relate to the findings under the Medicare compliance program discussed above.
The OAIC requested further information from DHS regarding the data breaches. Following consideration of the additional material and response provided by DHS, the OAIC considers that DHS has acted appropriately in assessing those incidents, sought to cancel the relevant My Health Records and sought to contact affected individuals.

Mandatory Data breach notifications received in previous reporting periods and still open

Two of the data breach notifications received by the OAIC prior to 1 July 2016 were still open at 31 December 2016. These data breach notifications relate to intertwined Medicare records and affected four healthcare recipients and two My Health Records.
-----  End extract.
So not only do we have breaches of the myHR but they don’t seem to be rapidly investigated and resolved.
Go figure – but it is hardly bolstering the confidence of those who have also been a little disquieted by the Medicare Number leaks of last week.
Not very professional as far as I can see, and just what was the point of discussing how many entities love the myHR in the same document?
David.

AusHealthIT Poll Number 379 – Results – 16th July, 2017.

Here are the results of the poll.

Has The Medicare Number Leak Increased Concern Regarding The Security Of Personal Data Held In The myHR?

Yes 76% (120)

Maybe 20% (31)

No 3% (5)

I Have No Idea 1% (2)

Total votes: 158

The numbers speak for themselves. The vast majority are now rather less comfortable with myHR security.

A really great turnout of votes!

Again, many, many thanks to all those that voted!

David.

Saturday, July 15, 2017

Weekly Overseas Health IT Links – 15th July, 2017.

Note: Each link is followed by a title and few paragraphs. For the full article click on the link above title of the article. Note also that full access to some links may require site registration or subscription payment.
-----

The Smart-Medicine Solution to the Health-Care Crisis

Our health-care system won’t be fixed by insurance reform. To contain costs and improve results, we need to move aggressively to adopt the tools of information-age medicine

By  Eric Topol
July 7, 2017 12:04 p.m. ET
The controversy over Obamacare and now the raucous debate over its possible repeal and replacement have taken center stage recently in American politics. But health insurance isn’t the only health-care problem facing us—and maybe not even the most important one. No matter how the debate in Washington plays out in the weeks ahead, we will still be stuck with astronomical and ever-rising health-care costs. The U.S. now spends well over $10,000 per capita on health care each year. A recent analysis in the journal Health Affairs by the economist Sean P. Keehan and his colleagues at the federal Centers for Medicare and Medicaid Services projects that health spending in the U.S. will grow at a rate of 5.8% a year through 2025, far outpacing GDP growth.
Our health-care system is uniquely inefficient and wasteful. The more than $3 trillion that we spend each year yields relatively poor health outcomes, compared with other developed countries that spend far less. Providing better health insurance and access can help with these problems, but real progress in containing costs and improving care will require transforming the practice of medicine itself—how we diagnose and treat patients and how patients interact with medical professionals. In medical training, private sector R&D, doctor-patient relations and public policy, we need to move much more aggressively into the era of smart medicine, using high-tech tools to tailor more precise and economical care for individual patients. This transition won’t be easy or fast—the culture of medical practice is famously conservative, and new technology always raises new concerns—but it has to be part of the solution to our health-care woes.
Radical new possibilities in medical care are not some far-off fantasy. Last week in my clinic I saw a 59-year-old man with hypertension, high cholesterol and intermittent atrial fibrillation (a heart rhythm disturbance). Before our visit, he had sent me a screenshot graph of over 100 blood pressure readings that he had taken in recent weeks with his smartphone-connected wristband. He had noticed some spikes in his evening blood pressure, and we had already changed the dose and timing of his medication; the spikes were now nicely controlled. Having lost 15 pounds in the past four months, he had also been pleased to see that he was having far fewer atrial fibrillation episodes—which he knew from the credit-card-size electrocardiogram sensor attached to his smartphone.
-----

Today's lax medical device security can be fixed. Here's how.

Infosec pros share tips on working with device manufacturers as well as questions that hospitals need to be answering now.
July 06, 2017 10:51 AM
Medical devices are loosely secured, making them a ripe target for cyberattackers, but what’s not as clear is exactly what must happen in the industry to solve this problem and what healthcare information security professionals should focus on in the meantime.
Luckily, there are various ways of attending to this problem, cybersecurity experts said, and various questions that hospitals and medical groups should be asking -- and answering -- now. 
“Health systems historically have taken more time to adopt new practices or processes that have the potential to impact patient care,” said Chris Clark, principal security engineer at Synopsys, a software security firm. “The predominant number of health systems will look to market leaders like the Mayo Clinic and others to develop best practices that can then be modeled to their environment. The same needs to happen for manufacturers, leaders in the industry will be those that factor security into device design and market it as so to their customers.”
-----

Digital health funding is on pace for its biggest year yet

Jul 7, 2017 11:31am
A strong second quarter has put the digital health industry on pace for a record-breaking year of funding.
Digital health companies saw a massive round of funding in the second quarter of 2017, putting the industry on track for a record-setting year.
Investors sunk $3.8 billion into the digital health industry during the second quarter, outpacing funding during every other quarter dating back to 2011, according to data compiled by StartUp Health. By comparison, digital health funding reached $2.1 billion during the second quarter last year.
-----

Telemedicine is wide-reaching but doesn’t always replace doctor’s touch

Jul 7, 2017 1:13pm
Telemedicine is booming, but insurance coverage still lags and some ailments require hands-on care.
Two years ago, Kimberly Griffiths’ week-old daughter, Avery, suddenly became very ill. “She was turning blue and had very labored breathing,” said Griffiths, who rushed her child to the ER in rural Sonora, California.
Doctors there were stumped, and the nearest pediatric specialist was 100 miles away in Sacramento.
Fortunately for Avery, the ER doctors were able to make a two-way online video connection to consult with a UC Davis neonatologist, who viewed high-resolution images of the infant and her vital-signs monitor. The specialist suspected a congenital heart condition and prescribed a drug that stabilized her breathing.
“Without telemedicine, our daughter would have died that night,” Griffiths said. She was relieved that her family’s insurance company reimbursed the cost of the remote services her child received. “Nobody should be denied the healthcare they need because of where they live,” she said.
-----

Data, patient feedback can ease challenge of measuring quality of programs for the seriously ill

Jul 7, 2017 10:20am
Using data already present in electronic health records can help better gauge the quality of programs for seriously ill patients.
Community-based programs for patients with serious illnesses are becoming more common, but there are few strategies to measure the quality of such programs. One way to make data collection easier: Piggyback on established programs.
Many of the quality measures that are used for palliative and end-of-life care can be broadened to encompass more people with serious conditions, according to an article published in Health Affairs. But that would require additional data collection on those patients to make it work.
-----

Diseases infect people—but cyberattacks infect x-rays and MRIs machines

Written by
July 07, 2017
It’s not just your credit-card information that hackers want—it’s your medical records, too. To prevent cyberattacks from taking down hospital systems and infecting life-saving machines, the same blockchains used to decentralize cryptocurrencies like bitcoin and ethereum could be used to safeguard patients both past and present.
The WannaCry cyberattack was a wakeup call for healthcare providers. On May 12, supercharged by a cyber weapon developed by the National Security Agency, WannaCry’s ransomware spread across the world, infecting as many as 300,000 computer systems in 150 countries, including at 48 hospital trusts in the UK. The attack, which forced many hospitals to cancel or delay treatment, is a warning to the healthcare industry: Patient care can be compromised, even causing terminal danger, if computer systems suffer a security breach. For example, the US Food and Drug Administration warned in January 2017 that implanted heart devices made by St. Jude Medical were vulnerable to computer hacking. A cyberattack of this nature could cause the lifesaving device to rapidly deplete its battery.
-----

HIT Think Why longitudinal data is crucial to making better care decisions

Published July 07 2017, 4:04pm EDT
The challenges associated with transforming healthcare can be explained simply: The way that we make important healthcare decisions is fundamentally flawed. When facing a major life decision, even experienced physicians like myself will simply ask our spouse or a close friend for advice or recommendations, rather than conduct the type of rigorous research befitting a life-and-death decision.
The reason we do this is simple. When you begin to peel the onion, you quickly experience a data avalanche of disparate and disconnected data points, but nothing resembling “the truth” for your individual situation.
We lack a longitudinal patient dataset (data that track the same patients over the course of many years) that will guide us to make the best treatment decisions based on actual, real-life experience from patients similar to the individual needing care. For example, longitudinal data helps to answer the question, “I had my aortic valve replaced 15 years ago. Based on the experience of patients with medical histories similar to myself, what course of treatment should I follow when it begins to fail?”
-----

Ponemon: Business continuity management vital for data breach recovery

Average cost per lost or stolen record is less for organizations employing BCM, group finds.
July 05, 2017 02:19 PM
An IBM-sponsored global study examining the impact of business continuity management on the cost of a data breach, concludes companies that use business continuity management and disaster recovery services recover more quickly than those who don’t.
The Ponemon Institute surveyed 1,900 individuals from 419 companies in 16 countries. Of the 419 companies, 226 self-reported they have BCM involvement in resolving the consequences of a data breach. Of these companies, 95 percent rate their involvement as very significant.
The study revealed that companies who employ a BCM program that incorporates disaster recovery automation and orchestration saw a 39.5 percent reduction in average cost per day of a data breach, compared to companies with no BCM or disaster recovery. It means a net difference of $1,655 per day.
-----

Southampton showcases how PHRs benefit patients

Jon Hoeksma

5 July 2017
A variety of different patient groups treated by clinicians from University of Southampton NHS Foundation Trust are all benefitting from the pioneering use of personal health records to help speed up their treatment, reduce hospital visits and better tailor care to their needs.
The patients using PHRs range from young people with renal conditions, making the difficult transition to adult care who require support. Men who are recovering from prostate cancer and traditionally have to visit a hospital every six months to discuss their PSA test results. And patients scheduled for operations, who would usually require a visit for a pre-operative assessment.
A recent CCIO and Health CIO Network Best Practice Site Visit on PHRs, covered presentations from clinicians and academics who described how Southampton’s MyMedicalRecord PHR, is being used to help better tailored and personalised patient care for each of these patient groups.
-----

Wearable Device, mHealth, Telehealth Markets Expected to Grow

Widespread adoption of wearable devices, mHealth, and telehealth has increased the growth rate of their respective markets.

Thomas Beaton

July 05, 2017 - The total valuation of the wearable device, mHealth, and telehealth markets is expected to grow due to accelerated adoption of these tools by providers, hospitals, and patients, according to several market reports.
mHealth solutions that improve the delivery care also help with the associated costs of healthcare by saving millions of dollars for healthcare organizations. Using wearable devices to monitor patients without the need for a hospital bed can help save costs on admissions, while mHealth apps are useful in preventing health risk for patients to lead to costly care and telehealth can help providers determine if more expensive treatments and services are needed before an in-person visit.
Markets for these technologies and services are expected to hit the billions. Software and data applications will be the largest drivers of market growth compared to hardware that hosts mHealth-related technology.
-----

Hospitals, doctor's offices have differing issues with electronic records

The American Medical Association has voiced concerns about Electronic Health Records software usability.
By Amy Wallace   |   July 5, 2017 at 1:23 PM
July 5 (UPI) -- A new study by Brown University has found that maintaining electronic health records, or EHRs, may undermine the connection between physicians and patients.
Federal Meaningful Use standards have expanded the amount of information doctors are required to capture electronically.
However, the American Medical Association has voiced concerns about EHR software usability and other studies have shown that physicians are experiencing burnout from having to meticulously fill out EHRs.
-----

NH-ISAC Issues Petya Ransomware Vaccine, Mitigation

NH-ISAC recently updated its investigation into the Petya ransomware, issuing a vaccine or killswitch and advising organizations of the ransomware capabilities.

Elizabeth Snell

July 05, 2017 - The National Health Information Sharing and Analysis Center (NH-ISAC) announced that it had a Petya ransomware vaccine, and also discussed mitigation tactics that organizations can follow to minimize the potential risk of infection.
Entities can create a “vaccine file,” NH-ISAC explained.
“On execution, the known Petya samples delete themselves and perform a check to verify if this deletion is successful,” the ransomware update stated. “If the file is still present, Petya will exit. This behavior can be turned into a protection mechanism of sorts.”
-----

HIT Think Why Clinical Document Architecture doesn’t solve data quality issues

Published July 05 2017, 3:01pm EDT
Clinical Document Architecture, for all its promises of better-organized and better-quality data, is not perfect. Its weakness is due, in part, to what it is able to do—exchange data.
To be sure, it is no secret that healthcare data has a quality issue, whether it’s technical or otherwise. In fact, from a developer’s perspective, health data is really at the mercy of those who treat patients and enter data into their records.
However, it is possible to give doctors feedback on the data that they are entering to improve its usefulness. Why do they need such feedback? A big reason is the loose definition of Clinical Document Architecture (CDA), which is able to place results in many fields in the typical Electronic Medical Records (EMR).
-----

AHIMA Patient Data Sharing White Paper Open for Public Comment

A collaborative white paper by AHIMA and IHE regarding requirements for patient demographic data collection and exchange is now open for public comment.

Kate Monica

July 03, 2017 - The American Health Information Management Association (AHIMA) and Integrating the Healthcare Enterprise (IHE) are now seeking public comment on a collaborative white paper detailing requirements and constraints for patient demographic data exchange and aggregation.
The paper—titled “Patient Registration Demographic Data Capture and Exchange”—is based on the AHIMA Patient Registration Use Case and was developed by the IHE Patient Care Coordination (PCC) Committee and the AHIMA Standards Task Force.
Specifically, the paper outlines which patient demographic information should be collected and shared for patient registration during an emergency department visit at a healthcare provider’s facility.
-----

Cost of a data breach eased 10% to $3.6M globally

By Enterprise Innovation editors | 2017-07-03
The average cost of a data breach is $3.62 million globally, a 10% decline from $4 million in 2016, according to a study sponsored by IBM Security and conducted by Ponemon Institute.
This is the first time since the global study was created that there has been an overall decrease in the cost. According to the study, these data breaches cost companies $141 per lost or stolen record on average.  
However, many regions experienced an increased cost of a data breach – for example, the cost of a data breach in the United States was $7.35 million, a five percent increase compared to last year.
-----

HIT Think Without real interoperability, are providers paying too much for EHRs?

Published June 30 2017, 2:30pm EDT
Would you pay top dollar for anything—a car, phone, television, whatever—that promises truly transformational technology at some unspecified future date?
I doubt you would. We generally buy products for what they offer now, not what the company says they will eventually do (vaporware, as IT calls it).
And yet, so many hospitals pay multi-billions of dollars for healthcare IT systems that promise to integrate patient care … eventually. Why? Some argue the primary reason is a false market that was created by federal government incentives and boundless faith.
-----

Allina Health extends OpenNotes to 500,000 patients

The hospitals consumers can now read what doctors write about them, message care teams and participate in eVisits.
June 30, 2017 01:22 PM
Allina Health announced this week that approximately half a million patients in the Minneapolis region can now read the notes physicians write about them.
Allina said that its patients can now log into a portal to view not just those notes but also doctor’s instructions and next steps as well as prescriptions and orders. They will also be able to send messages to their care teams and participate in eVisits from computers, tablets or phones.
In deploying the OpenNotes software, Allina joins the likes of Beth Israel Deaconess Medical Center, the U.S. Department of Veterans Affairs, Geisinger Health System and others in giving patients access to doctor’s notes. 
-----

The healthcare industry is having a usability-heavy moment

Transforming usability must include standardization to evaluate effectiveness, efficiency and satisfaction.
June 30, 2017 11:18 AM
In reality, the International Organization for Standardization (ISO) is “an independent, non-governmental international organization with a membership of 163 national standards bodies”. In my daydreams, it is a sacred, mythical place where there are always an equal amount of doughnuts (with an set amount of sprinkles) for everyone in the breakroom, where there is no one who takes more time than anyone else drinking at the water fountain, and where everyone has decided on the exact amount of smile size, head nod angle and wave intensity for greeting colleagues (moderate, 35 degrees of vertical neck thrust, varying dependent on hallway width).
While they may not have agreed to that level of standardization, the wonderful folks at ISO have agreed on a standard definition of usability.
ISO standard 9241 defines usability as “the effectiveness, efficiency and satisfaction with which specified users achieve specified goals in particular environments”.
-----

HIT Think Why proposed healthcare legislation will be ineffective

Published July 03 2017, 2:34pm EDT
With the Fourth of July recess, we have a momentary respite in the race to pass legislation to make some monumental changes in the way the country apportions responsibility for services given to sick people.
I resist the impulse to call this a healthcare bill, a healthcare reform bill or any other such non sequitur. The nation is held captive in a large debate about which governmental entities bear the responsibility in setting healthcare policy. It makes no use of any of the resources that could be brought to bear on making things better, such as information technology.
I could write about this endlessly, because the healthcare reform debate has been going on for years, if not decades. The most recent decade has been one of rancor, politicization, partisan grandstanding and the use of healthcare as some kind of standard around which ideologues posture their beliefs.
-----

Global cyberattack 'Petya' may be worse than ransomware: 3 things to know

Written by Jessica Kim Cohen | June 30, 2017 | Print | Email
A worldwide cyberattack attack — reportedly spread by a ransomware variant called "Petya" — infected computer systems in more than 60 countries June 27. However, upon further inspection, security researchers have hypothesized Petya is not a ransomware — it's a 'wiper.'
Here are three things to know.
1. In an analysis by Kaspersky Lab, security researchers compared the 'installation ID' in Petya code to similar types of ransomware. The installation ID typically contains information about how to unencrypt and recover a target's files. However, in Petya, the information ID is randomly generated.
-----

British hospital trust failed to protect patient data in Google trial

By Staff Writer on Jul 4, 2017 8:30AM

DeepMind also takes responsibility.

A British hospital trust misused patient data when it shared information with Google for work on a smartphone app to help detect kidney injuries, a British data protection watchdog has found.
The Royal Free NHS Trust failed to comply with the Data Protection Act when it passed on personal information of around 1.6 million patients to Google's DeepMind.
"There's no doubt the huge potential that creative use of data could have on patient care and clinical improvements, but the price of innovation does not need to be the erosion of fundamental privacy rights," Elizabeth Denham, head of the Information Commissioner's Office (ICO), said in a statement.
-----

Google DeepMind, NHS partnership violated patient privacy

Jul 5, 2017 12:55pm
British regulators say privacy violations in a partnership between Google and NHS were "avoidable."
A landmark partnership between the National Health Service and Google’s artificial intelligence software violated patient privacy laws, according to British regulators.
An investigation by the Information Commissioner’s Office indicated the Royal Free NHS Foundation Trust failed to comply with the country’s Data Protection Act when it handed over personal data for 1.6 million patients to Google DeepMind in a five-year partnership officially announced last November.
-----

Even the experts probing DeepMind aren’t clear how it uses health data for AI

Written by Joon Ian Wong
Obsession Machines with Brains
July 05, 2017
A second investigation into Google DeepMind’s handling of sensitive medical records from Britain’s National Health Service (NHS) seems likely to further muddy the ability of the Google unit to apply artificial intelligence techniques to health data. The report from an independent panel of reviewers appointed by DeepMind comes two days after the UK’s privacy regulator found that the firm handled the data of 1.6 million patients unlawfully.
The experts who sit on DeepMind’s review panel, who were granted special access to the company’s technical systems and staff to conduct their probe, don’t seem to be entirely sure how the firm uses AI techniques on health data. One of the reviewers, venture capitalist Eileen Burbidge, told journalists at a briefing that DeepMind uses a “different kind” of AI in its Streams app, which is being used by doctors at the Royal Free hospital in London. She was responding to a question about its use of AI on the health data. The app is at the heart of the illegal data-sharing controversy; it sends automatic alerts to doctors if test results imply the presence of conditions like acute kidney injury.
Burbidge’s statement was curious because it appeared to contradict DeepMind’s long-held assertion that Streams doesn’t use any AI techniques. After the briefing, a DeepMind representative contacted Quartz to clarify that Burbidge may have been “misspeaking” and that Streams does not use any AI techniques. The episode suggested that even someone of Burbidge’s long experience and expertise, with a year to conduct the investigation along with eight other eminent figures, hadn’t quite nailed down what DeepMind does or doesn’t use its vaunted AI technologies on.
-----

Enjoy!
David.