**Overview of Card Technologies in Health Care**

Daniel L. Maloney

Director of Technology Innovation

Department of Veterans Affairs, VHA

8403 Colesville Road, Suite 200

Silver Spring, MD 20910

**CardTech/SecurTech 97**

**May 22, 1997**

**Overview of Card Technologies in Health Care**

Daniel L. Maloney

Director of Technology Innovation

Department of Veterans Affairs, VHA

8403 Colesville Road, Suite 200

Silver Spring, MD 20910

phone: 301-427-3707, fax 3711

email: maloney.dan@forum.va.gov

VA WWW - http://www.va.gov/

**1. Introduction**

Organizations are finding that this is a good time to review their
options for card systems. Today, a wide variety of card technologies can
be used as part of a systems solution to meet business needs of all
kinds. Many times, different existing systems require different card
technologies These different needs can often be met by a single card
using multiple technologies, such as bar code and magnetic stripe. In
these cases, the card becomes the uniting tool that allows these
divergent legacy systems to work well with each other. At the same time,
new business services can be introduced using a card with additional
technical features. The ultimate goal is to increase customer
convenience by addressing multiple business needs using as few cards as
possible. Combining functions and technologies on one card also can
results in lower business expenses. Multifunction cards can also
decrease the costs of introducing new business services that will
attract new customers.

**2. Functions of Health Care Cards**

There are many functions of a medical cards including the following:

-   Identification - Cards are used to simplify identification either
    visually or by using electronically readable content. Data would
    include patient id, name, issuer, etc.

-   Information Transfer - Information on the card is transferred to
    computer systems or to required paper records. Information is
    transferred to paper either mechanically, or electronically by
    reading the card information and printing it on a form.

-   Access Control - Cards can play a roll in accessing data on local
    systems, on network information systems, in that card or in another
    card.

-   Data Carrier - Data can be carried on a card and read at different
    locations. In this way, the same information can be given to
    organizations that otherwise might not exchange data because of lack
    of connections, technical incompatibility or different
    organizational reporting structures. Data examples include
    administrative, emergency, medical specialty data bases,
    prescriptions, allergies, immunization history, treatment locations,
    pointers to data, primary physician, preventative health care, etc.

Some evolving functions include:

-   Authentication - Cards can carry certificates and keys used for
    generating digital signatures. Electronic communications systems use
    digital signatures to authenticate the sender and demonstrate
    message integrity. Electronic keys carried on smart cards are
    considered more secure than keys carried on other medium, such as
    floppy disks.

-   Encryption / Decryption - A system using a card with encryption
    capabilities is more secure since any secret keys do not need to be
    copied to the terminal device.

**3. Health Care Use of Card Technology**

**3.1 Projects in the United States**

There are many examples of excellent card programs in the US, but we
will only list a few of them.

The Department of Veterans Affairs medical division, the Veterans Health
Administration, is implementing a nationwide upgrade of their patient
card from a simple plastic embossed card to one that is electronically
readable. The cards are plastic with embossing, magnetic stripe, bar
code and black and white picture. The cards function as an identifier
and as a data carrier for a small amount of information. The cards are
personalized at each facility with name and other non changing
information which is downloaded from the Hospital Information System to
the card personalizing devices. The patient picture is taken and the
card is produced in about one minute. The card is currently used as an
electronically readable identifier to speed patient medical record
look-up on the medical information system. The installation of multiple
capture stations and embossers at over 171 facilities should be
completed by the time this paper is published. It is anticipated that
the equipment will be used to make 2.5 million cards in the first year
of operation. Future enhancements are a being planned.

Department of Defense MARC Card initiative is a highly successful
multi-function and multi-technology card project. The cards function as
an identifier and as a data carrier. The testing and deployment has
taken place in Hawaii. There are over 40,000 cards in use. The
technology of the card includes a smart card, bar code, magnetic stripe,
picture, signature block and embossed characters. The non medical
functions of the card include manifesting and deployment, food services
and building access security. Medical information content includes
identification, emergency data, blood type, immunizations, allergies and
registration information. Additional functions planned.

The Oklahoma MediCard Project is an emergency smart card application
developed and operated by Precis Smart Card Systems. The cards function
as an identifier and as a data carrier. There are 8000 cards in use in
the Oklahoma City Area with readers many locations including medical
centers and ambulances. The cards contain identification information as
well as medical information such as emergency data, allergies,
diagnoses, medical procedures, medications, primary physicians, and
insurance information.

The Western Governors Association is sponsoring the Health Passport
Project with a focus on Preventative Health. The cards function as an
identifier and as a data carrier. The objectives of the project are to
improve delivery of benefits from multiple organizations to the
residents of the western states by lowering administrative barriers to
care, and improving data sharing between programs. The vendor bid
responses to the RFP for the system with 47,000 cards were due in April
97 and are being evaluated. The project includes smart cards, terminals,
readers, software and Kiosks. The project will be implemented the 3
states of Nevada, North Dakota, Wyoming. There are 7 Preventative Health
Care Programs including Women's Infant and Children (WIC),
Immunizations, Medicaid (EPSDT), other Medicaid Services, Head Start,
Maternal and Child Health and Indian Health Service.

**3.2 European Projects**

Europe has many examples of excellent card programs. Organizations in
Europe have more experience with smart card technologies than
organizations in the U.S. The following are some activities of
particular interest:

Germany has completed a project distributing 80 million cards to all
citizens during 1994 and 1995, along with the reader/printer
infrastructure. These cards function as an identifier and as a data
carrier. The German cards are serial memory chip cards used primarily
for insurance identification. This was a major national initiative that
was extremely well planned and executed. The reader/printers system
allows patient data contained on the card to be automatically printed as
a completed the insurance form. There are options to generate and send
an electronic submission directly to the insurance fund, eliminating the
paper portion of the transaction. Additional upgrades are planned.

CARDLINK project is a multi country Portable Emergency Record project
implemented with smart cards. The cards function as an identifier and as
a data carrier. The data includes emergency data as well as pointers to
locations where additional patient medical data can be obtained. The
project is user driven and supported by European Commission. It uses a
interoperable European emergency data set. The 5 pilot sites are
Saint-Nazaire, France; Dublin, Ireland; Milan, Italy; Rome, Italy; and
Valencia, Spain. One technical goal is to demonstrate standards based
card and reader interoperability across multiple manufacturers.
Evaluations will include a measure of usefulness in emergency
situations. The project was begun in September, 1994 and the initial
pilot will finish in 1997. CARDLINK 2 will expand to 8 countries and
integrate with the security framework outlined in the TrustHealth
framework project.

The French Carte Vitale program currently has 500,000 smart cards in use
in France. The original Sesam Vitale 1 project initially used a family
card for insurance entitlement. The Sesam Vitale 2 project moved to a
French data card for each patient

The cards function as a patient identifier and as a data carrier for
medical data. Sesam Vital 2 is being distributed starting this year. By
the end of the year there will be an additional 9 million cards
distributed. The medical content contained on the Santal Cards are
converging with the Vitale card. The data sets will be the basis for the
G-7 Healthcare Data Card initiative.

In Germany, the QuaSi Niere Renal Dialysis Card Project is a smart card
project focusing on quality assurance and renal dialysis treatment. The
cards function as an identifier and as a data carrier, as well as a
carrier of keys for user authentication. This project is sponsored by
the Medical Association in Berlin which is part of the Ministry of
Health in Germany. The project is operational with over 35,000 cards in
use as of March 1997. The project will involve 50,000 patients and 3,000
doctors. The project includes the authentication, digital signature and
privacy of communication over Internet as outline in the TrustHealth
framework. The project includes authentication cards for both providers
and patients.

**3.3 Additional Europe plans announced**

-   The French have announced plans to begin implementation of their
    national smart Healthcare Professional Card in January 1998. They
    are also planning national distribution of patient cards, eventually
    reaching a number of 50 million smart cards.

-   The Italian smart card will begin to be sent out in January 1998 for
    the Rome region.

-   The Quebec government has stated that their smart card will be
    compatible with the card in Europe, and that they will also begin a
    project to distribute 7 million cards in January 1998.

**3.4 Framework Projects**

In addition to these projects, there are several framework projects
which describe a structure to development

EUROCARDS is a European Union (EU) Advanced Informatics in Medicine
(AIM) Concerted Action on Data Card Applications in the Healthcare
system. The project was created in late 1993 and delivered the final
reports in 1995. The project developed a technical, social and legal
framework for data card applications in Europe. There is a framework for
professional and patient cards. The Healthcare Professional Cards uses
include electronic identification, access control to information systems
(local and remote), keys for electronic signatures of stored and
transmitted electronic documents, access control to patient data based
on the possession of cryptographic class keys indicating certain
professional status. EUROCARDS identified the following priorities for
implementation: Administrative Cards and the creation of the
infrastructure (readers, workstations), Healthcare Professional Cards as
a means of enhancing Security, Emergency Cards for national and
international purposes, and Patient Cards containing medical and
pharmaceutical information, or pointers to the data. The EUROCARD
framework is described in the book "Healthcare Card Systems, EUROCARDS
Concerted Action Results and Recommendations" by A. Pernice, H. Doare
and O. Rienhoff, (IOS Press, 218 pages)

The TrustHealth Project is a framework to demonstrate trustworthy
telematic systems using modern security techniques in an open systems
connectivity environment with trans-European interoperability. The
framework uses smart cards and RSA asymmetric encryption to enhance
health care information security. Aspects of the framework include user
authentication, digital signatures and exchange of session keys for
confidentiality protection, proof of professional registration and as
access control devices. The European Commission sponsored and started
the project in 1995. An infrastructure of National Trusted Third Parties
is a necessary component to issue key cards and maintain the link
between the user and the public key. The project involves 9 countries
and multiple suppliers. Spri in Sweden played a major part in
TrustHealth development.

The G-7 Healthcare Data Card Project is one of 6 healthcare
international cooperative initiatives to demonstrate the positive
potential of the Global Information Society. First initiated at the
Ministerial Conference held in Brussels on February 25-26, 1995, the G-7
and the European Commission established a number of projects where
international cooperation could be an asset. This project's goals are to
demonstrate:

-   an International Emergency Card with an international harmonized
    emergency and administrative data set,

-   an International Professional Card that will allow the secure
    identification of healthcare professionals when accessing medical
    data and network services, and

-   Technical Interoperability with the functional goal to allow data to
    be exchanged between different projects in multiple countries using
    equipment and cards from multiple vendors

**4. Events Influencing the Use of Health Care Cards**

There are many reasons to use cards in the medical environment. In our
ever changing environment, there are also several recent events that may
influence organizations to reevaluate their use of card technologies in
medical systems.

-   A major reason to use cards in a medical environment is to reduce
    the time for the identification of the individual and the transfer
    of information. A card can assist in retrieving information from
    local systems or other healthcare information systems connected to
    the network. If the card allows electronic reading of the contents,
    errors will be decreased and staff will the save time since they
    will no longer need to hand enter the required information.

-   Health Insurance Portability and Accountability Act of 1996 -
    Department of Health and Human Services (HHS) is responsible for
    developing proposed security standards for protecting computerized
    health records to comply with the law. Congress has set a February
    1998 deadline for HHS to propose security standards, a "universal
    patient identifier" capable of linking a patient's files throughout
    the nation's health care system and a provider identifiers.

-   The Prepublication copy of a report was released by a committee of
    the National Research Council (NRC) on March 5, 1997 titled "For the
    Record: Protecting Electronic Health Information". The report states
    in chapter 4 that "The most prudent and safe approach to
    authentication today in health care environments appears to be the
    use of a unique account identifier for each user with an encrypted
    password or PIN system in conjunction with a token. ,,,. This
    approach combines something you know with something you have and
    will be the basis, for example, for authentication in Internet
    commerce systems." These new systems may depend upon the building of
    a public/private key infrastructure which could be used for
    authentication, digital signatures and encryption of communication
    channels (privacy). The National Library of Medicine asked the
    Computer Science and Telecommunications Board of the NRC to
    undertake the study in cooperation with the Institute of Medicine.

-   The rapid expansion of the International network called the Internet
    has identified the need to create a better way of identifying the
    true identity of the individual or the server that is receiving our
    data transmissions It also has identified the need to encrypt our
    data to protect the content if the transmission is copied as it
    crosses this non-secure communications channel. The solutions being
    developed t solve these problems could be adopted by the medical
    field. Some of these solutions include cards that will play a secure
    transport role for certificates and private keys, as well as an
    active encryption role.

-   There are coordinated actions taking place in the European and G-7
    nations to establish an interoperable framework for medical data
    cards. These activities could stimulate additional activities in the
    United States. Examples include the EUROCARD framework, TrustHealth
    framework, and G-7 Healthcare Data Card initiative.

-   As other industries increase their use of any card technologies, the
    unit costs for that technology should continue to decrease. These
    lower costs will make a more cost effective business case in the
    medical field.

-   Additional agreements on data content standards will benefit data
    exchange using cards and/or the network.

**5. Card Technologies**

Various types of cards technologies are available for use in the Health
Care environment. Cards are often made of paper or a variety of
plastics. They can contain printed human readable information . Cards
can carry information in machine readable format in a magnetic stripe, a
bar code, an optical memory strip, an electronic serial memory chip or a
computer chip. They can be embossed, carry graphics, identification
photographs, signature panels, holograms to discourage fraud, or
combinations of these. For any card technologies, select standards based
systems. Standards based systems can be read by equipment from more
manufacturers at more locations with fewer systems integration problems.
Standards based systems expand the market and lower prices for all. The
following are some of the technologies available.

  --------------------------- --------------- ----------------------------
  **Card Technologies**       **Unit Cost     **Major Benefits**
                              (\$)**          

  Paper with bar code option  .01-.04         Inexpensive, bar code

  Plastic, embossed           .10-.15         familiar, paper transfer

  Serial Memory card          1.50-4.00       additional storage

  Computer chip card          3.50-15.00      additional data security,
                                              difficult to copy

  Optical card                6.00- 8.00      much more storage

  PC Cards                    50.00 to 100.00 more storage and
                                              computational capability
  --------------------------- --------------- ----------------------------

Table 1: Major Card Technologies

  --------------------------- --------------- ----------------------------
  **Card Technology Options** **Unit Cost     **Major Benefits**
                              (\$)**          

  add Magnetic stripe         .02-.10         electronic readable

  add Bar Code                .00-.10         electronic readable

  add signature panel         .02-.05         visual authentication

  add photograph, B+W         .00-.15         visual authentication

  add photograph, color       .20-.25         visual authentication

  add hologram laminate       .06-.07         deter fraud

  add hologram stamp          .05-.06         deter fraud
  --------------------------- --------------- ----------------------------

**Table 2:** Major Card Technology Options

5.1 Paper card with a bar code printed on a laser printer.

The advantages of a paper card is that it would be easy to produce on a
wide variety of equipment and would be very inexpensive. The
disadvantages include that it would wear out quickly unless it were
protected by a plastic cover. A paper card could easily be printed with
a machine readable bar code using a laser printer. A paper card could
not be embossed. It could be easily copied. Estimated costs vary from
fractions of a cent to a few cents per card.

5.2 Plastic Embossed Card

Plastic, wallet-sized card can be embossed allowing the mechanical
transfer of information to paper records currently used in many medical
facilities. Plastic cards can be printed with human readable and bar
code machine readable characteristics. A plastic card can be easily
copied, but it would be more difficult to copy than the paper card.
Estimated costs are approximately 10 to 15 cents per card.

5.3 Swipe Card - Plastic Embossed Magnetic Stripe Card.

The common swipe card is a plastic card with embossed characters and a
machine readable magnetic stripe (credit card or ATM model). A maximum
of 226 characters can be stored on a low-density magnetic stripe on the
card. Time can be saved by swiping the card through a device instead of
requiring keyboard entry of the information. A bar code stripe can also
be added as an alternate input device but it stores less information and
is not changeable. A major advantage is that the card would be fairly
easy to produce on a wide variety of equipment and would be moderately
inexpensive. There are billions of magnetic stripe cards in use in the
United States today. There are many vendors who manufacture the
equipment. The disadvantages are that it can be easily copied and it
carries a small amount of data. Estimated costs are approximately from
12 to 25 cents per card.

5.4 Serial Memory Card:

Serial memory card is a plastic, machine readable, wallet-sized card. It
contains memory chips that would allow more information to be stored on
the card. It does not contain a computer to provide the additional
security to protect the data. Without data protection, this card would
not be used to store private information. It is well suited to store non
medical, non sensitive information such as name, address, insurance
company and other information commonly needed at the provider\'s office
for administrative or payment purposes. The storage capacity can vary
with this type of card. A version with 256 characters capacity (256
bytes or 2048 bits) is being used by 80 million German citizens today as
a national medical insurance card. The major goal of the project is
administrative simplification for identification and claim submission.
Cost is about \$2.50 per card for the German project including the card,
the personalization of the card and delivery to the mail box of the
citizen. A 2000 character serial card would cost about \$4.00.

5.5 Computer Chip (Smart) Card:

Computer Chip Cards is a plastic, machine readable, wallet-sized card.
In addition to memory, it contains a programmable computer. A computer
chip card supports additional functionality including data segregation
and several levels of security to protect the data on the card. Computer
Chip Card are used extensively in Europe. Smart cards are used to
transport information, in isolated environments or in situations
requiring enhanced card or network security and authentication. The
storage capacity varies with the type of card. 3000 characters and 8000
character cards are common today and cost between \$3.50 and \$8.00.
Larger capacity cards are being introduced at a higher cost. Computer
Chip Cards are extremely difficult to copy.

5.6 Optical or Laser Card

The optical card has a much larger storage capacity. One card available
for the past few years has a formatted storage of around 1600 pages of
text (4 Mega Bytes). This is a Write Once (WO) technology, meaning that
an area cannot be reused once data has been written in that area. Since
the data is not erasable, there will always be an audit trail and
tampering with the data is very difficult. Disadvantages include a more
expensive cost for the cards, the readers and writers. Costs are
approximately \$6.00 to \$8.00 per card.

7.  PC Cards

PC Card are thicker than the traditional credit card sized card. They
are made to fit into the PC Card or PCMCIA card slot like those found on
many portable computers. Since these devices are thicker and are made
not to flex, they can carry many computer and memory chips. These
devices can have a much larger memory capacity and faster computer
chips. The costs of these devices vary depending on their
characteristics but may fall in the range of \$50.00 to \$100.

5.8 Biometrics

Other personal identifiers include finger prints, voice prints,
signature dynamics, retina patterns, hand geometry or your DNA sequence.
Costs for manipulating many of these identifiers is decreasing to the
point that some of them are becoming more practical. For example, for
less than \$400, equipment can be purchased that will capture the image
of a finger print in order for a personal computer to compare it to an
image of the finger print electronically stored in a card. As prices of
these recognition technologies fall, it will become more practical to
create a business case to use biometrics to meet an established need.

5.9 Additions

Options can be added to almost all of the cards for additional costs.
Bar codes can be added to nearly all cards allowing the data in the bar
code to be read electronically by a scanner. The Bar Code capacity on
all cards is limited by the size of the card. 2D Bar codes are much
denser and can therefore contain many more characters. Magnetic stripes
can be added to nearly all cards. Fraud can be reduced by including an
identification photographs on the card. Black and White pictures can be
added for less than 15 cents per card. Color photographs can be added
for 20 to 25 cents per card. Adding holograms can make it harder to copy
the card. A hologram laminate can be added like some States are adding
to their drivers licenses for 6 to 7 cents. Postage stamp holograms
could be added for about 5-7 cents per card. Signature panels can be
added for 2 to 5 cents.

6.  **Conclusion**

Card technologies of all types are being used in the health care field
to meet business needs. From the simplest to the most complex need,
there is a combination of card technologies that can be used to deliver
an appropriate solution for the user. As new needs are identified, there
is usually a smooth migration path to the new solution. While the
majority of US organizations continues to rely on traditional card
technologies, some are investigating the suitability of the newer
technologies. In the past, the interest in using a card as a portable
data carrier has been of more interest in other countries than in the
US. Outside of the US, there has also been a focus on techniques to
increase health care system privacy and security. This area of security
and privacy is rapidly gathering interest in the US as more medical
information is electronically stored and capable of being accessed from
widely available networks. If we observe the activities and experiences
in Europe, we have to wonder when these new technologies will begin to
playing a larger part in the US health care environment.

This is a time of growing opportunities. The impact of Internet
connectivity is beginning to be felt by organizations throughout the
world. Instant access to published information, such as product
specifications, is becoming a daily business tool. Businesses are now
using the Internet to introduce features such as on-line direct ordering
and access to personal or business data. Large and small companies are
focusing their resources on solving the problems associated with
easy-to-use and affordable authentication and encrypted private
communication channels over the Internet. Because of the importance of
privacy and security in all aspects of health care data, these
developments will be of great interest to individuals and health care
providers. Hopefully, these events will result in the refinement of the
next wave of integrated technical solutions which will be used by both
business and health care users.