Free EMR Newsletter Want to receive the latest news on EMR, Meaningful Use, ARRA and Healthcare IT sent straight to your email? Join thousands of healthcare pros who subscribe to EMR and EHR for FREE!

Dogged By Privacy Concerns, Consumers Wonder If Using HIT Is Worthwhile

Posted on May 17, 2017 I Written By

Anne Zieger is veteran healthcare consultant and analyst with 20 years of industry experience. Zieger formerly served as editor-in-chief of FierceHealthcare.com and her commentaries have appeared in dozens of international business publications, including Forbes, Business Week and Information Week. She has also contributed content to hundreds of healthcare and health IT organizations, including several Fortune 500 companies. Contact her at @ziegerhealth on Twitter or visit her site at Zieger Healthcare.

I just came across a survey suggesting that while we in the health IT world see a world of possibilities in emerging technologies, consumers aren’t so sure. The researchers found that consumers question the value of many tech platforms popular with health execs, apparently because they don’t trust providers to keep their personal health data secure.

The study, which was conducted between September and December 2016, was done by technology research firm Black Book. To conduct the survey, Black Book reached out to 12,090 adult consumers across the United States.

The topline conclusion from the study was that 57 percent of consumers who had been exposed to HIT through physicians, hospitals or ancillary providers doubted its benefits. Their concerns extended not only to EHRs, but also to many commonly-deployed solutions such as patient portals and mobile apps. The survey also concluded that 70 percent of Americans distrusted HIT, up sharply from just 10 percent in 2014.

Black Book researchers tied consumers’ skepticism to their very substantial  privacy concerns. Survey data indicated that 87 percent of respondents weren’t willing to divulge all of their personal health data, even if it improved their care.

Some categories of health information were especially sensitive for consumers. Ninety-nine percent were worried about providers sharing their mental health data with anyone but payers, 90 percent didn’t want their prescription data shared and 81 percent didn’t want information on their chronic conditions shared.

And their data security worries go beyond clinical data. A full 93 percent responding said they were concerned about the security of their personal financial information, particularly as banking and credit card data are increasingly shared among providers.

As a result, at least some consumers said they weren’t disclosing all of their health information. Also, 69 percent of patients admitted that they were holding back information from their current primary care physicians because they doubted the PCPs knew enough about technology to protect patient data effectively.

One of the reason patients are so protective of their data is because many don’t understand health IT, the survey suggested. For example, Black Book found that 92 percent of nurse leaders in hospital under 200 beds said they had no time during the discharge process to improve patient tech literacy. (In contrast, only 55 percent of nurse leaders working in large hospitals had this complaint, one of the few bright spots in Black Book’s data.)

When it comes to tech training, medical practices aren’t much help either. A whopping 96 percent of patients said that physicians and staff didn’t do a good job of explaining how to use the patient portal. About 40 percent of patients tried to use their medical practice’s portal, but 83 percent said they had trouble using it when they were at home.

All that being said, consumers seemed to feel much differently about data they generate on their own. In fact, 91 percent of consumers with wearables reported that they’d like to see their physician practice’s medical record system store any health data they request. In fact, 91 percent of patients who feel that their apps and devices were important to improving their health were disappointed when providers wouldn’t store their personal data.

Could Blockchain Tech Tackle Health Data Security Problems?

Posted on March 25, 2016 I Written By

Anne Zieger is veteran healthcare consultant and analyst with 20 years of industry experience. Zieger formerly served as editor-in-chief of FierceHealthcare.com and her commentaries have appeared in dozens of international business publications, including Forbes, Business Week and Information Week. She has also contributed content to hundreds of healthcare and health IT organizations, including several Fortune 500 companies. Contact her at @ziegerhealth on Twitter or visit her site at Zieger Healthcare.

While you might not own any them, you’ve probably heard of bitcoins, a floating currency backed by no government entity. You may also be aware that these coins are backed by blockchain technology, a decentralized system in which all participants track everyone’s holdings on their own individual systems. In this world, buyers and sellers can exchange bitcoins untraceably, making bitcoins perfect for criminal use.

In fact, some readers may have first heard about bitcoins when a Hollywood, CA hospital recently had all its data assets frozen by malware hackers, who demanded a ransom of $3.4 million in bitcoins before the hospital could have its data back. (The hospital ended up talking the ransomware attackers down to paying $17K, and when it paid that sum, IT leaders got back control.)

What’s intriguing, however, is that blockchain technology may also be a solution for some of healthcare’s most vexing health data security problems. That, at least, is the view of Peter Nichol, a veteran healthcare business and technology executive consultant. As he sees it, “blockchain addresses the legitimate previous concerns of security, scalability and privacy of electronic medical records.”

In his essay posted on LinkedIn Nichol describes a way in which the blockchain can be used in healthcare data management:

  1. Patient: The patient is provided a code (private key or hash) and an address that provides the codes to unlock their patient data.  While the patient data is not stored in the blockchain, the blockchain provides the authentication or required hashes (multi-signatures, also referred to as multi-sigs) to be used to enable access to the data (identification and authentication).
  2. Provider: Contributors to patient’s medical records (e.g. providers) are provided a separate universal signature (codes or hashes or multi-sigs). These hashes when combined with the patient’s hash establishes the required authentication to unlock the patient’s data.
  3. Profile: Then the patient defines in their profile, the access rules required to unlock their medical record.
  4. Access: If the patient defines 2-of-2 codes, then two separate computer machines (the hashes) would have to be compromised to gain unauthorized access to the data. (In this case, establishing unauthorized privileged access becomes very difficult when the machines types differ, operating systems differ and are hosted with different providers.)

As Nichol rightly notes, blockchain strategies offer some big advantages over existing security, particularly given that keys are distributed and that multiple computers but need to be compromised for attackers to gain access to illicit data.

Nichols’ essay also notes that blockchain technology can be used to provide patients with more sophisticated levels of privacy control over their personal health information. As he points out, the patient can use their own blockchain signature, combined with, say, that of a hospital to provide more secure access when seeking treatment. Meanwhile, when they want to limit access to the data it’s easy to do so.

And voila, health data maintenance problems are solved, he suggests. “This model lifts the costly burden of maintaining a patient’s medical histories away from the hospitals,” he argues. “Eventually cost savings will make it full cycle back to the patient receiving care.”

What’s even more interesting is that Nichols is clearly not just a voice in the wilderness. For example, Philips Healthcare recently made an early foray into blockchain technology, partnering with blockchain-based record-keeping startup Tierion.

Ultimately, whether Nichols is entirely on target or not, it seems clear that health IT players have much to gain by exploring use of blockchain technology in some form. In fact, I predict that 2016 will be a breakout year for this type of application.

ONC Wants Medical Practices To Have A Privacy and Security Officer

Posted on May 21, 2012 I Written By

Anne Zieger is veteran healthcare consultant and analyst with 20 years of industry experience. Zieger formerly served as editor-in-chief of FierceHealthcare.com and her commentaries have appeared in dozens of international business publications, including Forbes, Business Week and Information Week. She has also contributed content to hundreds of healthcare and health IT organizations, including several Fortune 500 companies. Contact her at @ziegerhealth on Twitter or visit her site at Zieger Healthcare.

The Office of the National Coordinator for Health Information Technology (ONC)  has thrown down the gauntlet on HIPAA, challenging medical practices to select a privacy and security officer.  The ONC recommendation comes as part of a report outlining a 10-step plan to protect patient data.

While the advice it offers might be helpful to a range of providers, the report is largely focused on medical practices which are adopting EHRs and don’t have trained IT staffers to manage privacy protection and security, said Daniel Berger, president and CEO of Redspin Inc. in an interview with InformationWeek.  As practices shift from paper notes to digital records, there’s countless opportunities to slip up and have a data breach.

The problem may get worse as practices move up to Meaningful Use Stage 2, as this level of compliance will force practices to exchange data between providers.  Securing their own health data is hard enough; HIEs poses greater risks yet.

To make sure their data stays secure, a privacy officer is important but not sufficient. Other suggestions include:

*  Do a privacy/security risk analysis, and create an action plan to address problems found during the analysis

*  Develop written policies and procedures for protecting electronic protected health information

*  Educate and train employees thoroughly

*  Make sure business associate agreements  meet HIPAA standards and HITECH breach notification requirements

Though the ONC is trying to be helpful, I suspect that few medical practices are ready to follow these suggestions.  While practices certainly understand that HIPAA is a serious proposition, I’ll submit that few are ready to do a risk analysis. (After all, many medical practices haven’t had their EMR that long and are pretty overwhelmed just making it work for them.)

On the other hand, if practices name a privacy and security officer, train them and get them going now on risk analysis, it could result in a process of learning where knowledge diffuses out into the practice. Yup, I think that step will go along way on its own.