By FRED TROTTER

The Internet is abuzz criticizing Anthem for not encrypting its patient records. Anthem has been hacked, for those not paying attention.

Anthem was right, and the Internet is wrong. Or at least, Anthem should be “presumed innocent” on the issue. More importantly, by creating buzz around this issue, reporters are missing the real story: that multinational hacking forces are targeting large healthcare institutions.

Most lay people, clinicians and apparently, reporters, simply do not understand when encryption is helpful. They presume that encrypted records are always more secure than unencrypted records, which is simplistic and untrue.

Encryption is a mechanism that ensures that data is useless without a key, much in the same way that your car is made useless without a car key. Given this analogy, what has apparently happened to Anthem is the security equivalent to a car-jacking.

When someone uses a gun to threaten a person into handing over both the car and the car keys needed to make that care useless, no one says “well that car manufacturer needs to invest in more secure keys”.

In general, systems that rely on keys to protect assets are useless once the bad guy gets ahold of the keys. Apparently, whoever hacked Anthem was able to crack the system open enough to gain “programmer access”. Without knowing precisely what that means, it is fair to assume that even in a given system implementing “encryption-at-rest”, the programmers have the keys. Typically it is the programmer that hands out the keys.

Most of the time, hackers seek to “go around” encryption. Suggesting that we use more encryption or suggesting that we should use it differently is only useful when “going around it” is not simple. In this case, that is what happened.

Continue reading “Anthem Was Right Not to Encrypt”

By AARON SEIB

You have the choice to get your health information anywhere and any way you want –according to the Office of Civil Rights with some limitations. Today, more and more uses of health information are being presented to consumers as innovators recognize our demand for health related applications. Unfortunately, there is a dilemma. Over the past ten years a lot of things have changed – more and more providers are using technology to improve how they deliver care and, once that care is delivered, how they share information with other caregivers that see the patient. Sadly, other things are still pretty much as they were in the 19th Century, including how patients get access to information about themselves held by their provider.

The release of the National Association for Trusted Exchange’s (NATE) Blue Button for Consumers (NBB4C) Trust Bundle is aimed at simplifying interoperability between the healthcare delivery system and the consumer, enabling you to decide how to use your health information.

NATE is an association focused on enabling trusted exchange among organizations and individuals with differing regulatory environments and exchange preferences. With beginnings back in 2012, NATE emerged from a pilot project supported by the Office of the National Coordinator for Health Information Technology (ONC). NATE was incorporated as a not-for-profit organization on May 1, 2012 in the District of Columbia. NATE has been operating Trust Bundles in production since November 2012 and recently took over administration of the Blue Button Consumer Trust Bundles.  Working with a broad set of stakeholders through multiple task forces, crowdsourcing and a call for public comment, NATE announced the first release of NATE’s Blue Button for Consumers (NBB4C) Trust Bundle February 4th at the ONC’s Annual meeting. Continue reading “NATE: Making Choices Easier”

By DAVID HARLOW

By PAUL FLETCHER-HILL

Over the last five years, the United States has undergone more significant changes to its health care system perhaps since Medicare and Medicaid were introduced in the 1960s. The Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 and the Patient Protection and Affordable Care Act of 2010 have paved the way for tremendous changes to our system’s information backbone and aim to provide more Americans access to health care.

But one often-overlooked segment of our health care system has been letting us down. Patients’ access to their own medical information remains limited. The HIPAA Privacy Rule grants individuals the right to copies of their own medical records, but it comes at a noteworthy cost—health care providers are allowed to charge patients a fee for each record request. As explained on the Department of Health and Human Services’ website, “the Privacy Rule permits the covered entity to impose reasonable, cost-based fees.”

HIPAA is a federal regulation, so the states have each imposed guidelines outlining their own interpretations of “reasonable.” Ideally, the price of a record request would remain relatively constant—after all, the cost of producing these records does not differ significantly from state to state. But in reality, the cost of requesting one’s medical record is not only unreasonably expensive; it is also inconsistent, costing dramatically different amounts based on local regulation. Continue reading “An Open Letter to the People Who Brought Us HIPAA”

By ROBERT WACHTER, MD

Of the nearly 100 people I interviewed for my upcoming book, John Halmaka was one of the most fascinating. Halamka is CIO of Beth Israel Deaconess Medical Center and a national leader in health IT policy. He also runs a family farm, on which he raises ducks, alpacas and llamas. His penchant for black mock turtlenecks, along with his brilliance and quirkiness, raise inevitable comparisons to Steve Jobs. I interviewed him in Boston on August 12, 2014.

Our conversation was very wide ranging, but I was particularly struck by what Halamka had to say about federal privacy regulations and HIPAA, and their impact on his job as CIO. Let’s start with that.

Halamka: Not long ago, one of our physicians went into an Apple store and bought a laptop. He returned to his office, plugged it in, and synched his e-mail. He then left for a meeting. When he came back, the laptop was gone. We looked at the video footage and saw that a known felon had entered the building, grabbed the laptop, and fled. We found him, and he was arrested.

Now, what is the likelihood that this drug fiend stole the device because he had identity theft in mind? That would be zero. But the case has now exceeded $500,000 in legal fees, forensic work, and investigations. We are close to signing a settlement agreement where we basically say, “It wasn’t our fault but here’s a set of actions Beth Israel will put in place so that no doctor is ever allowed again to bring a device into our environment and download patient data to it.”

Continue reading “Black Turtlenecks, Data Fiends and Code. An Interview with John Halamka”

By Matthew Holt

Long time (well very long time) readers of THCB will remember my extreme frustration with Patients Privacy Rights founder Deborah Peel who as far as I can tell spent the entire 2000s opposing electronic health data in general and commercial EMR vendors in particular. I even wrote a very critical piece about her and the people from the World Privacy Forum who I felt were fellow travelers back in 2008. And perhaps nothing annoyed me more than her consistently claiming that data exchange was illegal and that vendors were selling personally identified health data for marketing and related purposes to non-covered entities (which is illegal under HIPAA).

However, in recent years Deborah has teamed up with Adrian Gropper, whom I respect and seemed to change her tune from “all electronic data violates privacy and is therefore bad”, to “we can do health data in a way that safeguards privacy but achieves the efficiencies of care improvement via electronic data exchange”. But she never really came clean on all those claims about vendors selling personally identified health data, and in a semi-related thread on THCB last week, it all came back. Including some outrageous statements on the extent of, value of, and implications of selling personally identified health data. So I’ve decided to move all the relevant comments to this blog post and let the disagreement continue.

What started the conversation was a throwaway paragraph at the end of a comment I left in which I basically told Adrian to rewrite what he was saying in such a way that normal people could understand it. Here’s my last paragraph

As it is, this is not a helpful open letter, and it makes a bunch of aggressive claims against mostly teeny vendors who have historically been on the patients’ side in terms of accessing data. So Adrian, Deborah & PPR need to do a lot better. Or else they risk being excluded back to the fringes like they were in the days when Deborah & her allies at the World Privacy Forum were making ridiculous statements about the concept of data exchange.

Here’s Deborah’s first comment Continue reading “Is Deborah Peel up to her old tricks?”

By ROB LAMBERTS, MD

Dear ACO General Hospital:

Thanks for contacting me about my most recent blog post.  I’m sorry to scare your administration about HIPAA information, but I am equally concerned about that and will always do my best to respect the privacy of my patients.  At your request I hid even more of that information.

I know it’s kind of embarrassing to have that kind of thing made public, and I am overall grateful that you did not take it personally that I put the “transition of care” documents for all to see.  My goal was not to embarrass or ridicule, it was to point out what our healthcare system is driving us all toward: replacing patient care with documentation.  You are being encouraged by the system to produce those ridiculous documents, as they are part of the deal you accepted when you became “ACO General” in the first place.

Continue reading “Dear ACO General Hospital”

By CHARLES ORNSTEIN

This story was co-published with NPR’s “Shots” blog.

In the name of patient privacy, a security guard at a hospital in Springfield, Missouri, threatened a mother with jail for trying to take a photograph of her own son. In the name of patient privacy , a Daytona Beach, Florida, nursing home said it couldn’t cooperate with police investigating allegations of a possible rape against one of its residents.

In the name of patient privacy, the U.S. Department of Veterans Affairs allegedly threatened or retaliated against employees who were trying to blow the whistle on agency wrongdoing.When the federal Health Insurance Portability and Accountability Act passed in 1996, its laudable provisions included preventing patients’ medical information from being shared without their consent and other important privacy assurances.But as the litany of recent examples show, HIPAA, as the law is commonly known, is open to misinterpretation – and sometimes provides cover for health institutions that are protecting their own interests, not patients’.

“Sometimes it’s really hard to tell whether people are just genuinely confused or misinformed, or whether they’re intentionally obfuscating,” said Deven McGraw, partner in the healthcare practice of Manatt, Phelps & Phillips and former director of the Health Privacy Project at the Center for Democracy & Technology.For example, McGraw said, a frequent health privacy complaint to the U.S. Department of Health and Human Services Office of Civil Rights is that health providers have denied patients access to their medical records, citing HIPAA. In fact, this is one of the law’s signature guarantees.”Often they’re told [by hospitals that] HIPAA doesn’t allow you to have your records, when the exact opposite is true,” McGraw said.

I’ve seen firsthand how HIPAA can be incorrectly invoked.

In 2005, when I was a reporter at the Los Angeles Times, I was asked to help cover a train derailment in Glendale, California, by trying to talk to injured patients at local hospitals. Some hospitals refused to help arrange any interviews, citing federal patient privacy laws. Other hospitals were far more accommodating, offering to contact patients and ask if they were willing to talk to a reporter. Some did. It seemed to me that the hospitals that cited HIPAA simply didn’t want to ask patients for permission.

Continue reading “Are Patient Privacy Laws Being Abused to Protect Medical Centers?”

By DAVID SHAYWITZ, MD

At his yearly CEO summit, noted VC Vinod Khoslaspoke with Google co-founders Sergey Brin and Larry Page (file under “King, Good To Be The”).

Towards the end of a wide-ranging conversation that encompassed driverless cars, flying wind turbines, and high-altitude balloons providing internet access, Khosla began to ask about health.

Specifically, Khosla wondered whether they could “imagine Google becoming a health company? Maybe a larger business than the search business or the media business?”

Their response, surprisingly, was basically, “no.”  While glucose-sensing contact lenses might be “very cool,” in the words of Larry Page, Brin notes that,

“Generally, health is just so heavily regulated. It’s just a painful business to be in. It’s just not necessarily how I want to spend my time. Even though we do have some health projects, and we’ll be doing that to a certain extent. But I think the regulatory burden in the U.S. is so high that think it would dissuade a lot of entrepreneurs.”

Adds Page,

“We have Calico, obviously, we did that with Art Levinson, which is pretty independent effort. Focuses on health and longevity. I’m really excited about that. I am really excited about the possibility of data also, to improve health. But that’s– I think what Sergey’s saying, it’s so heavily regulated. It’s a difficult area. I can give you an example. Imagine you had the ability to search people’s medical records in the U.S.. Any medical researcher can do it. Maybe they have the names removed. Maybe when the medical researcher searches your data, you get to see which researcher searched it and why. I imagine that would save 10,000 lives in the first year. Just that. That’s almost impossible to do because of HIPAA. I do worry that we regulate ourselves out of some really great possibilities that are certainly on the data-mining end.”

Khosla then asked a question about a use case involving one of my favorite portfolio companies of his, Ginger.io, related to the monitoring of a patient’s psychiatric state.

Responded Page, “I was talking to them about that last night. It was cool.”

That pretty much captures Brin and Page’s view of healthcare – fun to work on a few “cool” projects, but beyond that, the regulatory challenges are just too great to warrant serious investment.

Continue reading “Google Co-Founders: “Thanks, But No Thanks””

By Adrian Gropper, MD

Today, ONC released a report on patient matching practices and to the casual reader it will look like a byzantine subject. It’s not.

You should care about patient matching, and you will.

It impacts your ability to coordinate care, purchase life and disability insurance, and maybe even your job. Through ID theft, it also impacts your safety and security. Patient matching’s most significant impact, however, could be to your pocketbook as it’s being used to fix prices and reduce competition in a high deductible insurance system that makes families subject up to $12,700 of out-of-pocket expenses every year.

Patient matching is the healthcare cousin of NSA surveillance.

Health IT’s watershed is when people finally realize that hospital privacy and security practices are unfair and we begin to demand consent, data minimization and transparency for our most intimate information. The practices suggested by Patient Privacy Rights are relatively simple and obvious and will be discussed toward the end of this article.

Health IT tries to be different from other IT sectors. There are many reasons for this, few of them are good reasons. Health IT practices are dictated by HIPAA, where the rest of IT is either FTC or the Fair Credit Reporting Act. Healthcare is mostly paid by third-party insurance and so the risks of fraud are different than in traditional markets.

Healthcare is delivered by strictly licensed professionals regulated differently than the institutions that purchase the Health IT. These are the major reasons for healthcare IT exceptionalism but they are not a good excuse for bad privacy and security practices, so this is about to change.

Health IT privacy and security are in tatters, and nowhere is it more evident than the “patient matching” discussion. Although HIPAA has some significant security features, it also eliminated a patient’s right to consent and Fair Information Practice.

Continue reading “What You Need to Know About Patient Matching and Your Privacy and What You Can Do About It”