Bell develops tool to help healthcare organizations comply with privacy legislation

Bell Canada has developed a web-based tool set that enables healthcare-related organizations to upgrade their network and backend systems to maintain compliance with privacy legislation. Working with Agiliance, the system acts as an expert, guiding clients through the compliance process for projects, services and systems. Privacy impact statements (PIAs) have been a staple in terms of ensuring compliance with federal and provincial legislation. PIAs are also required by Canada Health Infoway and are subject to international standards. But according to a privacy expert at Bell, the technology currently used in PIAs is outdated and ineffective. "They have been structured based on technology that was available in the 1970's and 1980's," explains Mike Gurski, director of Bell' s Privacy Centre of Excellence and a former senior technology advisor to Ontario's Privacy Commissioner. "The cost is quite high because it is in a low technical form, and the usefulness is quite low." Gurksi was speaking at the recent Health Information Privacy and Security conference, organized by Insight Information, where he joined other privacy experts to discuss privacy issues in the healthcare setting. Ensuring an organization complies with the various provincial and federal privacy statutes is pricey and complicated. As a result, Bell invested upwards of $12 million to develop a new privacy compliance tool that was easier to use. The new web-based platform enables organizations to quickly ensure compliance with myriad privacy provisions, says Gurski. "You don't have to repeat the PIA in the lifecycle of a project," he says. "It is structured to ask the same set of questions." The questions contained in the tool are designed to ensure privacy compliance and can be directed at various specialists in an organization: technical questions to a systems person, policy questions to the organization's privacy officer, and business-related questions to the business owner. "It does a deconstruction of a piece of legislation, and by answering the questions, you get a quick picture in terms of where you are with compliance of that legislation," explains Gurski. Bell also offers de-identification software to strip out any identifiable characteristics of patients. Other tools include data perturbation and data aggregation to further avoid identifying patients in a database. Privacy protection is also being extended to mobile devices and laptops by ensuring the data is properly encrypted. One of the big advantages of the tool is that it is customizable, and it allows an organization to internalize capacity and knowledge for privacy without looking to external consultants on an ongoing basis, says Gurski. In this way, an organization can grow its own privacy culture. "This allows them to own privacy, and not shop it out to experts," says Gurski. "We conduct this on a perpetual licence basis. We train people how to use it by running PIAs with them. At the end of that, they obtain a perpetual licence and can buy technical and content support packages on top of that licence on an annual basis." For a larger organization, such as a local health integration network (LHIN) that consists of 10 hospitals, the price tag for all participating hospitals to acquire licences would be $350,000. The expense varies depending on the scale of the organization and how many users need to be trained. An annual technical support package contract costs anywhere from $10,000 to $16,000 and provides 24-7 assistance. The tool also contains management software that gives users a playbook on how to manage an incident or breach, for example, by identifying who needs to be notified and who needs to take action. Privacy and security in the healthcare space are growing concerns and represent a burgeoning market for vendors such as Bell, even in a time of economic downturn. Bell is experiencing the uptake from the healthcare sector, according to Gurski. Eight of the 10 projects currently underway at the Privacy Centre for Excellence are for healthcare organizations. A year ago, healthcare clients represented 10% of the Centre's business. "We are swamped with various clients asking for either demonstrations or implementations," notes Gurski, adding he is currently doubling his staff to meet the demands for privacy assessments. Security breaches in the healthcare sector on the rise as well. According to US-based Identity Theft Resource Center, 14.9 % of data breaches in 2008 were in the healthcare arena, a rise from 13% in 2006.

Bell develops tool to help healthcare organizations comply with privacy legislation

News | 02/10/2009 1:29 pm EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us