No right answer to securing electronic health records: vendors

Equipment vendors need to think about how to develop and implement solutions that will create a greater sense of faith in the security of health information. While some support an outsourced approach, others note there are a variety of possible solutions."The average physician is focused on patient health," said Keith Monrose, senior director, health strategy for Longueuil QC-based Emergis Inc., a provider of IT for the health and financial services sectors. "They have little time to spend focusing on the security of their networks," he said. " When tapping into the electronic health record, they are usually poorly equipped to handle many of the newer threats. The lack of understanding equals poor protection for them. They would benefit from more managed services that can support the services that they need to secure the networks in their organization."In its own research, Emergis found in one small sample that a majority of physicians had software to protect against viruses, but that fewer than half updated the virus protection systems. Similarly, a minority of physicians had spyware detection to protect against external threats, and the vast minority had anti-spyware software that was updated. Monrose and other vendors said that solutions should meet the needs of both healthcare providers and patients. "We need to think about how we can collectively instill more confidence in the health system," said Monrose. "Increasingly, we are recognizing that with the ubiquitous nature of computing in the health space, being able to secure information is crucial."The expansion of the electronic health record is creating new demands, such as the ability to acquire information and have it securely stored in a repository, said Monrose. "We are currently acquiring information from a lot of different systems," he said. "We increasingly recognize the importance of holistic checks, or being able to check the integrity of the data within a database."Checking for data integrity using a paper-based record system is more difficult and time-consuming than if the record is in electronic form, said Monrose. Using an electronic heath record system, data protection is necessary and simplified workflow analysis is critical, he added."At the electronic health record level, there is a need for more activities around data safety," he said. "The question, is how safe is the data collected by an organization? How do we compare the safety of an electronic format to a paper format? What are some of the best-practice workflows that we need to implement to ensure that safety occurs?"Small surveys and anecdotal experience suggest that physicians and healthcare providers don’t have much confidence in the security of the networks or tools such as virus protection or other tools to secure patient data, according to Monrose.Results from a 2003 Ekos study on the patient’s perspective of the electronic health record indicate the public’s concern about the protection of their health information, as well as their right to access their own information.The survey found 85% were moderately to extremely comfortable with their electronic health record; 71% wanted to know who accessed their electronic health record; 64% supported serious criminal changes for breaches and unwanted access to the electronic health record; and 57% wanted access to verify their record was correct."Reducing electronic health record adoption risks and realizing benefit means striking a balance between the provider’s needs to efficiently share information in the circle of care and avoiding lapses that would compromise privacy and security for millions," said Monrose.Vendors need to be increasingly involved in standard setting and end-user adoption to ensure the benefits of the electronic health record are articulated, added Monrose.Brian Dillon, an associate with Omnimed, a software developer based in Cookshire QC that develops regional electronic health record systems and interoperability platforms throughout the province, noted that vendors could take different approaches to data security and protection. "There is no single right answer in this area of protection and security," said Dillon. "There are really only proven successes."There are a total of three million patient files in Omnimed’s regional networks in Quebec. The company has implemented three levels of security: access or authentication; multi-level security to permit regional operation; and database encryption. Dillon noted that an advantage to regional accessibility via physicians’ networks has been a drastic decrease in issues surrounding data integration. The company did two surveys: one on physicians who were part of the regional networks, and one on patients, whose electronic health records belonged to the networks. Omnimed found both groups were satisfied with the electronic health record system. If standards are established in electronic health record systems, and if trust is developed to successfully adopt electronic health records systems, such systems can expand, as long as errors are not made, stressed Dillon."Mistakes cannot be considered a luxury," said Dillon. "The problem is that there have been some false starts that have taken place with such systems in the past. As a result, there is a degree of trepidation on the part of the physicians to look at beginning working with the electronic health record."

No right answer to securing electronic health records: vendors

News | 02/02/2007 5:00 am EST

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us