Information Sharing in Primary Healthcare

The push to electronic patient information systems to share information between the players in primary health care is not a bad thing, although some implementations may give rise to concern (see: patients-privacy-could-be-compromised ). A peer-reviewed paper on the subject quantifies the effects of the missing information.

Clinicians reported missing clinical information in 13.6% of visits; missing information included laboratory results (6.1% of all visits), letters/dictation (5.4%), radiology results (3.8%), history and physical examination (3.7%), and medications (3.2%). Missing clinical information was frequently reported to be located outside their clinical system but within the United States (52.3%), to be at least somewhat likely to adversely affect patients (44%), and to potentially result in delayed care or additional services (59.5%).

Missing Clinical Information During Primary Care Visits Peter C. Smith, MD; Rodrigo Araya-Guerra, BA; Caroline Bublitz, MS; Bennett Parnes, MD; L. Miriam Dickinson, PhD; Rebecca Van Vorst, BA; John M. Westfall, MD, MPH; Wilson D. Pace, MD JAMA. 2005;293:565-571

.

Patients' privacy could be compromised by health board action

RUTH HILL in The Dominion Post on Wednesday, 25 July 2007 reports that "Patients' privacy could be compromised by a Hutt Valley initiative allowing GPs and hospital clinicians to exchange clinical information, medical ethics experts and patient advocates warn. "
It is good to see the concerns are being discussed within health circles but a wider public debate should be encouraged before this significant erosion of personal privacy becomes more than an exploration of technical capability.

There are two separate issues touched on in the article. Firstly that "A lot of problems in the health sector come about when patients are wrongly identified." and secondly that "Sharing information (between providers in the health sector) closes the loops."
There is an implication here that sharing all information enhances the identification process and, that a common information pool is a necessary requirement for the exchange of clinical information.
Identification of the individual is critical where information flows and the individual become separated. A simple example can be seen in blood testing where the results may be routed through a complex process to ultimate information users and may result in life or death decisions impacting on the subject person. However, there is no indication that the proposed sharing of information would address the issues of identification.

There can be no doubt that there should be a flow of information amongst health providers. However, there has been little or no public debate about what information should be contained in the flows and what rights over the information are retained by the patient.

General Practitioner Access to Hospital Data

From the description of the pilot, the flow of information to GPs from hospitals is to be achieved by allowing GPs to access the internal hospital information systems.

Four GPs also have direct access to the hospital's electronic database, allowing them to access the records of all patients registered with their primary health organisation, or any other patient for whom they have a National Health Index number.

Implicit in this is:

1. It is OK for GPs to access information held in the hospital's electronic database for any patient; not just those registered with their PHO. Hypothetically, a fishing expedition could be mounted using the 12,567,273 valid NHIs.
   
2. A GP would have legitimate access to the records of any hospital by having a single patient in common between PHO and Hospital. Given the concentrations of population and specialist medical services in NZ, the health records of a large proportion of people will be open to many GPs.
   
3. If a patient is referred to a hospital by a GP, the GP's within the PHO have access to that patient's information from the hospital's electronic database regardless of the patient's wishes.

There is a clear risk arising from this. Information that might reasonably be expected to be a matter between the patient and someone with a direct clinical responsibility of care of the patient, will be available to a wider audience which degrades the privacy of the individuals involved.


Potentially, well defined electronic information systems and data-interchange services can enhance privacy and security.

Mr Cook [CIO] said electronic patient information systems were "more secure" than paper-based ones because access could be controlled and audited.

Those of us with even limited contact with public/civil service or legal organisations will have come across "the Registry" where access to paper based records are managed according to right or need to know. Electronic systems may be more cost-effective but they are not inherently more or less secure than the paper-based ones that they replace. Note also use the term "could" in the quotation. Actual control and audit of information retrieval is often omitted from electronic retrieval systems perhaps because IT people focus on the every part of the system be used in the intended fashion. An assertion, from the CIO, that the access to information "will be controlled and audited" would be more comforting.

The privacy requirements do not seem to have been sufficiently addressed.

However, Otago University's bioethics centre director, Donald Evans, said ....

"My concern is, if patients become aware that information given on a confidential basis to their GP is likely to be shared with other people, it destroys the relationship of trust; people will be reluctant to be honest with their doctors; and quality of care will be compromised."

I suggest that the patients' concerns may be associated with any consultation not just with the GP. It may not be good thing medically, but there will be reasons for not sharing information of a specialist consultation with a particular GP. We can debate whether the information belongs to the clinician or the patient, but passing the information about the patient to third parties should generally be controlled by the patient.

Myth and Chips

"Super Gold Card" Issue

Privacy and security hit the broadsheets briefly as the NZ government introduced legislation including microchips in a new entitlement card. The Press reported:

Senior citizens looking forward to their Super Gold entitlement cards have been warned that microchips in the cards could expose them to identity theft and illegal monitoring.

Privacy Commissioner Marie Shroff said yesterday the possible use of the microchips had "far-reaching implications" that must be explored thoroughly before introduction. "Security is a real issue, both for the data stored on the cards and the risk of identity theft."

Under an agreement with New Zealand First leader Winston Peters, the Government plans to make the cards available from August..

They will be sent to people receiving New Zealand superannuation or a veteran's pension, and will provide what Peters calls "meaningful discounts" on a range of goods and services.

However, Shroff said a comprehensive assessment of privacy impacts should be undertaken before decisions were made on whether to introduce smart card technology as part of the scheme.

"A microchipped card may mean many things, especially if it is also used as an identity card for commercial purposes, perhaps with a unique identifying number for each person."

The actual statement of the Privacy Commissioner is more reasoned:

A possible micro chipped SuperGold card has some far-reaching implications that need to be explored thoroughly before a final decision is made. I understand the government intends to do that.

Our office has contributed to the policy discussions and our consistent position has been that a comprehensive assessment of privacy impacts should be undertaken before decisions are made on whether to introduce smart card technology as part of the SuperGold card.

Micro chipped smart cards have not been widely used by state sector agencies in their dealings with the New Zealand public. I am not opposed in principle to the use of smart card technology, but I believe introduction needs to be preceded by a proper assessment of the implications and an opportunity for public debate on the issues.

A micro chipped card may mean many things – especially if it is also used as an identity card for commercial purposes, perhaps with a unique identifying number for each person. There is the potential for ‘function creep’ - where the card ends up being used for far more than was originally intended. Security is a real issue – both for the data stored on the cards and the risk of identity theft.

There appears to be special emphasis being placed on micro-chipped or smart-cards. Introduction of an identifying card that is to be widely used by a large proportion of the population (approximately 1 in 8) has serious privacy issues regardless of the smarts in the card. That proportion of the population is also clearly segmented by age making the effect of identity information more significant. Numbers like those appearing on credit cards would meet the undesirable criteria of a unique identifying number but in a small population like that of New Zealand even the full name with a narrowing of the age-range implicit in a pension entitlement will provide a good opportunity for correlating usages of the card without application of a number. The widespread use of a national identity cards within New Zealand does not have much support. Introducing an identity card with national coverage for a significant proportion of the population seems likely to have the same perceived downside.

Technical Issue

Technically, the micro-chip provides the means to secure the data and protect the privacy of the holder. Only with micro-chips and a selective disclosure regime is the privacy, that is apparently an issue for a few politicians around here, going to be maintained.

Selective Disclosure is a cryptographic means of ensuring that the individual retains control over personal identifying data. Ben Laurie provides a useful technical overview of the subject in his recent paper[LAURIE].

If the requirement is for the card to demonstrate that an entitlement exists, a micro-chipped card can provide confirmation of the entitlement without revealing any other data that could be used for correlating the use of the card with an individual. That is, the use of the card says it represents a pensioner and not that a uniquely identified person is a pensioner nor is the usage necessarily associated with a uniquely identified individual.

Barbara Stewart, MP introduced the subject in parliament (available in this podcast Question Time for 10th May). Reference was made by the minister (Rt Hon. Winston Peters) to the use of micro-chips in NZ Passports protecting the individual. By inference, the usage in passports was held to justify their use elsewhere. Actually, the technology in passports only assures the integrity of the data within the passport and provides no protection of the individual nor of the identifying information within the passport.

Call for Wider Debate

Listening to the issues discussed in parliament does not give me confidence that a reasoned approach will come from there. Judith Collins, MP even confused the issue of physically inserting microchips into dogs with the use of microchips in the super gold card. However, I am sure that wider discussion of both the personal privacy issues and the technological protection of personally identifying data is required before unnecessary exposure becomes routine.

• Citizens should be opposed in principle to identity cards without smart card technology.
  
• The smart card technology should be implemented to utilise selective disclosure where identity cards are implemented electronically.
• Reference can usefully be made to Kim Cameron's Laws of Identity [CAMERON] to review the usage of identity information in the context of the super gold card.
  

References

[LAURIE] Laurie, B;Selective Disclosure (v0.2);http://www.links.org/files/selective-disclosure.pdf;May2007

[CAMERON] Cameron,K;http://www.identityblog.com/stories/2004/12/09/thelaws.html

Secure User Identification

Stefan Brands tackles the thorny problem of user identification without unnecessary privacy loss in a very readable paper (with pictures here ). It seems to offer a greater level of privacy than, for example, the New Zealand Government Logon Service which is targeted at the same risks of exposure.
Apart from Government, there are other arenas where there are compromises to user privacy. In the Health Sector, collating health records into a common picture may be seen as an administrative convenience, a medical necessity and for the 'common good'. However, labelling everyone with a common identity (in NZ the NHI ) has the same potential for privacy loss and the consequential bad things happening as it does within the wider government arena.
There are of course laws covering who has access to what information in the government and health sectors but that does not prevent accidental exposure or covert action.
There are legitimate reasons for the statistical correlation of data about people (especially in the health sector) allowing this without a common identifier is probably worth a bit of study. Otherwise, the potential need for statistics will be an overpowering argument for a single digital identity.

What is an Architect?

I participated in two meetings in two weeks that addressed the question "What is an Architect?"
Mark Carroll and Darryl Chantry of Microsoft got the Wellington Microsoft Architects' forum thinking about what was needed to develop an architect. Horia Slusanschi led a lively discussion about Enterprise Architecture at the NZ Chapter meeting of Association of Enterprise Architects

A stumbling block for Microsoft's approach clearly was the lack of definition of what an architect was or should be. Although Darryl started with a view from the Greeks and history that architecture is about aesthetics, there seemed a split between a desire for certification of ability to construct solutions from Microsoft components; and capability to take on a wider vendor agnostic perspective.

Horia presented a choice for EA "Just technology, or the works?". Although some of those present with EA in their job title were clearly limited to the technology arena, there appeared to be a consensus for EA going well beyond technology application. The functions of EA are mainly strategic and addressing technology alone misses the point of why the technology matters at all.

When I started in IT 37 years ago we had the distinct jobs of Programmer and System Analyst. The programmer role was defined in some detail but the system analyst could best be described as "everything that the programmer did not do". Those may have been the bad old days but I think that a similar situation has arisen with the "architect" job. There are a myriad of specialist functions that are defined in some detail, generally around the arcana of some product or vendor strategy and there is the role that joins it up. As specialisations evolve (security, information, etc) there is a tendency to give the label of "architect" to the job or role that makes it all hang together.

There certainly is a wealth of information in the skyscrapr.net and msdn sites but it is lacking in structure and it is difficult from there to determine what a complete architecture would be (enterprise, solution, infrastructure or ...) made up of in Microsoft terms or vendor agnostic terms. Some consistency in terms would help ... Strategic Architecture or Enterprise Architecture?

I recommend a look at A Better Path to Enterprise Architectures by Roger Sessions (avoid the version in skyscrapr.net which has broken links).

Certification was a hot topic for Microsoft. At $10,000 a time, it must look like an interesting revenue stream. Until the role is specified in terms of what is included rather than the 'any other business' present situation there is dubious value in a certification.

It will be interesting to follow these initiatives.

Wireless hijacking under scrutiny

Following on the heels of the report of the District Health Board insecurely providing access to its network through a wireless port....

Just in case you think there should be a law against it, there is! Accessing other peoples networks seems pretty well covered in New Zealand by Section 249 Accessing computer system for dishonest purpose of the Crimes Act 1961
[Part 10] [Crimes against rights of property] (s [217 to s 305) which shows the forethought of the legislators in describing a computer system by

computer system —

(a)means—

(i)a computer; or

(ii)2 or more interconnected computers; or

(iii)any communication links between computers or to remote terminals or another device; or

(iv)2 or more interconnected computers combined with any communication links between computers or to remote terminals or any other device; and

(b)includes any part of the items described in paragraph (a) and all related input, output, processing, storage, software, or communication facilities, and stored data.]

The BBC reports a British case in which Gregory Straszkiewicz had "piggybacked" on a wireless broadband network of a local Ealing resident, using a laptop while sitting in his car and was fined £500 and sentenced to 12 months' conditional discharge.

The penalties here in NZ (up to 7 years imprisonment) may discourage wholesale assaults on WiFi networks as a pastime but do not absolve the network owner from taking precautions.

The same report also addresses the issue of responsibility for what was done by the unauthorised user of the network where the network is inadequately protected

"There have been incidences where paedophiles deliberately leave their wireless networks open so that, if caught, they can say that is wasn't them that used the network for illegal purposes," said NetSurity's Mr Cracknell.

Such a defence would hold little water as the person installing the network, be they a home user or a business, has ultimate responsibility for any criminal activity that takes place on that network, whether it be launching a hack attack or downloading illegal pornography.

So, if you expose your network deliberately or by negligence to a bad person who manipulates it (perhaps by denial of service attack) so that bad things happen to others , you could carry the can for it legally as well as morally.

Kim Cameron touched on the issue of responsibility for preventing bad people doing things in your name or through your means

There was a security flaw in WordPress 2.0.1 that was exploited to post something in my name .

By what logic was I responsible for it? Because I chose to use WordPress - along with the other 900,000 people who had downloaded it and were thus open to this vulnerability?

I guess, by this logic, I would also be responsible for any issues related to problems in the linux kernel operating underneath my blog; and for potential bugs in MySQL and PHP. Not to mention any improper behavior by those working at my hosting company or ISP.

Clearly this is unlikely to be a black/white issue but a matter of judgement on what the reasonable person could be expected to do in the circumstances.

Health Information Exposed

A scary report from an organisation responsible for the health information of 5% of New Zealand.

An anonymous “war driver” has told Computerworld that it’s possible to access internal systems through the wireless service run by the Otago District Health Board (ODHB). As a result, the Dunedin hospital authority may have to review the security arrangements relating to its wi-fi pilot.

The ODHB’s acting CIO, John Tolchard, says the need to achieve a balance between security and cost-effectiveness was behind the choice of WEP. There are always trade-offs between security and complexity for users, he says.

Tolchard asks: with the WEP key cracked, “then what would he [the attacker] do?”

According to Tolchard, all the systems on the ODHB’s network are password-protected and only select users who need access — and who attend a training programme — get logins. There is no way anyone could access confidential information, such as patient records, without a valid username and password, he says.[my emphasis]

Yeah Right! as they say around here. Generously assuming that any brute force attack would be detected and foiled, the unprotected network can be sniffed to collect user id/passwords of "select users" or passively collect information handled by legitimate users. Aside from that, it would appear possible to mount denial of service attacks on the internal network or worse, subvert network components.

As George Ou reported way back in March 2005, any WEP based network with or without Dynamic WEP keys can now be cracked in minutes!



While I can have some sympathy with an organisation caught with its guard/pants down in this way, there is incredible naivety shown in the report. We may debate the value of information revealed by illicit access to networks or services and the loss an individual may face when medical information is exposed and therefore establish what is to be traded-off. However, loss of confidence in the medical provider's security of information may have the fundamental outcome of people simply not trusting the organisation as a whole.

The legalese that covers the issue in NZ is contained in the Health Information Privacy Code 1994

Rule 5 Storage and Security of Health Information
(1) A health agency that holds health information must ensure:
(a) that the information is protected, by such security safeguards as it is
reasonable in the circumstances to take, against:
(i) loss;
(ii) access, use, modification, or disclosure, except with the authority of
the agency; and
(iii) other misuse;

Perhaps it is time that the protection of information here in New Zealand had the visibility and force of law in the manner of HIPAA in the USA. Then boards and officers would have it brought home to them that protection of information is a requirement and not an optional extra.