An unhealthy invasion of privacy

“The news that the privacy of millions of patients is to be breached by the NHS underlines the first rule of government databases, which is that once any part of the state acquires personal information it comes to regard that data – however sensitive – as the state’s property.
The second rule is also confirmed by the proposal to allow medical researchers access to 50 million records in order to identify patients who might be willing to take part in trials of new drugs. It is that once data is centralised by government or one of its agencies, the function of that database is quietly extended beyond its original purpose and the way it was promoted to the public.”
Article
Henry Porter’s Blog, The Guardian, 17 November 2008

Cayton stakes claim to independence of NIGB

“The new chair of the National Information Governance Board for Health and Social Care has criticised plans to make it easier for researchers to access patient information.
According to the Guardian, Harry Cayton has described plans to give researchers access to patient information to recruit for medical trials as “ethically unacceptable.” The proposals are included in the NHS constitution, on which public consultation closed last month.”
Article
Jon Hoeksma, e-Health Insider, 17 November 2008

Consumers Voice EHR Privacy Concerns

“Even as the federal government and the AAFP focus their resources on ensuring that America’s physicians get onboard with electronic health records, or EHRs, some American consumers are wrestling with confidentiality concerns about the technology.”
Article
Sheri Porter, AAFP News, 12 November 2008

Surveillance On the Average Joe: Another Blow To Patient Confidence In Electronic Medical Records?

“In 2006 I’d commented on Healthcare Renewal about the Wall Street Journal story “Spread of Records Stirs Patient Fears of Privacy Erosion”, by Theo Francis, published Dec. 26, 2006.
As I wrote at “Another Electronic Medical Record Horror Story” here, a patient, Patricia Galvin, was betrayed after medical information she thought was confidential about her psychotherapy was divulged to an insurance company.”
Article
MedInformaticsMD, Health Care Renewal, 30 october 2008

Patients get veto on access as NHS database expands across England

“NHS staff are to be required to seek patients’ specific consent before reading their electronic medical records under tougher rules to protect confidentiality due to be unveiled today.
The government is pressing ahead with plans to upload the records of 50 million patients in England on to a national database known as the Spine. They will contain a summary of key personal data including allergies and current medications.”
Article
John Carvel, The Guardian, 18 September 2008

Automated De-Identification of Free-Text Medical Records

“We have developed a pattern-matching de-identification system based on dictionary look-ups, regular expressions, and heuristics. Evaluation based on two different sets of nursing notes collected from a U.S. hospital suggests that, in terms of recall, the software out-performs a single human de-identifier (0.81) and performs at least as well as a consensus of two human de-identifiers (0.94). The system is currently tuned to de-identify PHI in nursing notes and discharge summaries but is sufficiently generalized and can be customized to handle text files of any format. Although the accuracy of the algorithm is high, it is probably insufficient to be used to publicly disseminate medical data. The open-source de-identification software and the gold standard re-identified corpus of medical records have therefore been made available to researchers via the PhysioNet website to encourage improvements in the algorithm.”
Article
Ishna Neamatullah, Margaret M. Douglass, Li-wei H. Lehman, Andrew Reisner, Mauricio Villarroel, William J. Long, Peter Szolovits, George B. Moody, Roger G. Mark and Gari D. Clifford, BMC Medical Informatics and Decision Making 2008, 8: 32, doi:10.1186/1472-6947-8-32

Act paves way for National Information Governance Board

“The National Information Governance Board is to become a statutory body, replacing the Patient Information Advisory Group, following Royal Assent for the Health and Social Care Act 2008.”
Article
e-Health Insider, 23 July 2008

GMC says patient confidentiality �is absolute�

“Patient confidentiality is absolute; patients must give their consent before their data can be used, General Medical Council president, Sir Graeme Catto, said this week.
Speaking at the BCS Primary Health Care Specialist Group summer conference, Sir Graeme said the insistence on consent was a good thing and would foster the partnership approach with patients.”
Article
e-Health Insider, 2 July 2008

Do you want others to have access to your medical records?

“Do you want others to have access to your medical records?
Half of all GPs will consider refusing to put patient records automatically on to a new national database in defiance of the government, a survey finds.
The Guardian newspaper poll of 1,026 GPs and hospital doctors found many doubted the security of the new system.
Four out of five thought the confidentiality of their patients� records would be at risk.”
Article
Heena R Modi, 31 May 2008

GPs call for halt to centrally-held patient records

“GP representatives must ensure that a halt is put to the development of centrally-held patient records, this year�s local medical committees� conference will hear.
The conference, to be held next month, is to debate a motion calling on the BMA�s General Practitioner Committee (GPC) to stop the development of centrally-held records and to promote a national publicity campaign to warn patients of the risks arising from their records being held on a national database.”
Article
e-Health Insider Primary Care, 28 May 2008

Congress OKs Genetic Data Protection

“The House on a 414-1 vote May 1 passed the Genetic Information Nondiscrimination Act and the White House said President Bush would sign the bill into law. Rep. Ron Paul (R-Texas) was the lone dissenter. The Senate approved the bill 95-0 on April 24.”
Article
Health Data Management, 2 May 2008

ICMCC Panel Discussion

I’m very proud that we have been able to put together a discussion panel on web-based personal health records. It might very well be on of the first of its kind. Although Google probably will not be present at the panel, Microsoft (Healthvault) will be. So will HealthSpace, a secure online personal health organiser delivered by the UK NHS. We also invited the Wellcome Trust, as they do a lot of research involving secondary use of patient data. There will also be a Caldicott Guardian on the panel, a senior person responsible for protecting the confidentiality of patient and service-user information and enabling appropriate information-sharing. Finally a representative of the department of BERR will take part; they deal with IT innovation. From this list it is hopefully more or less clear what the major issues of the discussion will be: privacy, confidentiality, data handling procedures.

I myself will probably also sit on the panel. Not as ICMCC president, but as patient. I think that my experience with Non-Hodgkin and all the mistakes I had to survive on top of the cancer can be of use. And in such a panel it helps to be an informed patient.

Lodewijk Bos

The coming surveillance of our health records by the government

“There’s a long-standing belief that one of the guiding principles of medicine is that our medical records are confidential, and that our health matters are not disclosed to anyone other than ourselves, another physician who is consulting or taking over our care, a person we specifically give permission to see our record and - in the case of certain infectious diseases - the local health department, if it’s mandated by law.”
Article
Thorswitch, TeamSugar, 13 April 2008

Gemalto Rolls Out Electronic Social Security Program Nationwide in Algeria

“Gemalto, the world leader in digital security, today announced that it has started the nationwide roll-out of Algeria�s first electronic healthcare project. Following the success of the pilot phase comprising 700,000 cards in five regions, this pioneering healthcare program in Algeria is poised for nationwide roll-out over the coming two years. This timetable is in line with the deadline set by CNAS (the Algerian national health insurance authority) under the terms of the contract won by Gemalto in 2006. Gemalto is prime contractor for the program, handling end to end implementation of the system for issuing and managing the seven million smartcards used by healthcare beneficiaries and providers.”
Article
Gemalto Press Release, 26 March 2008

Health Records Banks Get Guidance

“To help ensure the credibility of emerging health records banks, the Arlington, Va.-based Health Records Banking Alliance has created a series of 12 principles they should follow.”
Article
Health Data Management, 28 February 2008

The Wrong Way and the Right Way to Frame PHR Privacy/Confidentiality Issues

“During the past week two reports were released discussing privacy/confidentiality issues surrounding PHRs. One of these reports did it the wrong way; one did it the right way.”
Article
Vince Kuraitis and David C. Kibbe, e-Care Management Blog, 25 February 2008

NHS e-records programme launched

“The first patients’ electronic records have been uploaded to the new NHS online database.
Around 20 GP surgeries in Bolton and Bury have added 110,000 patients’ details to the system, part of the �12bn NHS IT upgrade project.”
Article
BBC News, 31 December 2007

Overseas data work under review, say reports

“The government is reportedly reviewing whether sensitive information about NHS patients could be sent overseas for processing.
A leaked internal NHS Connecting for Health (CfH) document, published by Computer Weekly magazine, reveals a review is under way into whether patient data could be processed by �approved organisations� abroad.”
Article
e-Health Insider Primary Care, 26 November 2007

Security, privacy, and confidentiality issues on the Internet

“We introduce the issues around protecting information about patients and related data sent via the Internet. We begin by reviewing three concepts necessary to any discussion about data security in a healthcare environment: privacy, confidentiality, and consent. We are giving some advice on how to protect local data. Authentication and privacy of e-mail via encryption is offered by Pretty Good Privacy (PGP) and Secure Multipurpose Internet Mail Extensions (S/MIME). The de facto Internet standard for encrypting Web-based information interchanges is Secure Sockets Layer (SSL), more recently known as Transport Layer Security or TLS. There is a public key infrastructure process to ’sign’ a message whereby the private key of an individual can be used to ‘hash’ the message. This can then be verified against the sender’s public key. This ensures the data’s authenticity and origin without conferring privacy, and is called a ‘digital signature’. The best protection against viruses is not opening e-mails from unknown sources or those containing unusual message headers.”

Kelly G, McKenzie B, J Med Internet Res 2002;4(2):e12, 22 November 2002

Article

Public standards and patients’ control: how to keep electronic medical records accessible but private

“Electronic medical record systems should be designed so that they can exchange all their stored data according to public standards
Giving patients control over permissions to view their record as well as creation, collation, annotation, modification, dissemination, use, and deletion of the record is key to ensuring patients’ access to their own medical information while protecting their privacy
Many existing electronic medical record systems fragment medical records by adopting incompatible means of acquiring, processing, storing, and communicating data
Record systems should be able to accept data (historical, radiological, laboratory, etc) from multiple sources including physician’s offices, hospital computer systems, laboratories, and patients’ personal computers
Consumers are managing bank accounts, investments, and purchases on line, and many turn to the web for gathering information about medical conditions; they will expect this level of control to be extended to online medical portfolios”

Kenneth D Mandl, Peter Szolovits, Isaac S Kohane, BMJ 2001;322:283-287 (3 February)
Article

BioHealth � The Need for Security and Identity Management Standards in eHealth

Claudia Hildebrand, Peter Pharow, Rolf Engelbrecht, Bernd Blobel, Mario Savastano, Asbjorn Hovsto
GSF - Research Centre for Environment and Health, Neuherberg, Germany;
eHealth Competence Center, University of Regensburg Medical Center, Germany; IBB-CNR - National Research Council of Italy, Napoli, Italy;
ITS-Norway - Norwegian Association for Multi-modal Transport Services, Norway

Abstract

The experience gained in these last years and the several lesson learned have clearly shown that eHealth is more than just a simple change from paper records to electronic records. It necessitates a change of paradigms, on the one hand and the use of new technologies and introduction of new procedures on the other. Interoperability becomes a crucial issue. Security and confidentiality are vital for the acceptance of the new approaches and for the support of eHealth. Shared care and across-border interactions require a reliable and stable normative framework based on the application of standardized solutions, which are often not yet sufficiently known, diffused and implemented. Feeling this gap, a group of international experts in the medical area proposed to the EC the BioHealth project whose main aim is to create awareness about standardization in eHealth and to facilitate its practical implementation. The project will address all the stakeholders concerning their respective domain. It will evaluate the socio-economic and cultural aspects concerning eHealth with particular reference to the growing introduction of emerging technologies such as health cards, biometrics, RFID (radio-frequency identification) and NFC (Near field communication) tags. By providing information and expert advice on standardization and best practices it will raise the acceptance on standardization. Furthermore, the project will deeply approach the ethical and accessibility issues connected to identity management in eHealth, which -together with privacy- represent probably the most significant obstacles for the wide diffusion of eHealth procedures.