# Presentation: 525038

## 

Security Issues in Connected Healthcare Communities

Fitting Solutions to Your Emerging Community

Presented by:  Holt Anderson
Executive Director, NCHICA

**Security Issues in Connected Healthcare Communities**
**Fitting Solutions to Your Emerging Community**
**Presented by:  Holt Anderson**
**Executive Director, NCHICA**

## Presentation Outline

**Emerging Models for Connected Communities – Fitting Privacy & Security Solutions to the Structure**
**Key Factors in Building Your Local Health Information Network**
**Examples of Collaborative Activities and Lessons Learned**

## Emerging Models for Connected Communities

***Fitting Privacy and Security Solutions to the Structural Model***

## “Connected Communities”

_**Connected Community**_
- A collaborative, consumer-centric collaboration or organization focused on facilitating the coordination of existing and proposed e-health initiatives within a region, state, or other designated local area.

## Types of Connected Communities

_**Federations**_
- Includes large, “self-sufficient” enterprises
- Agreement to network, share, allow access to information they maintain on peer to peer basis
- May develop system of indexing and/or locating patient data (e.g., state or region-wide MPI)

## Types of Connected Communities (cont.)

_**Co-ops**_
- Includes mostly smaller enterprises
- Agreement to pool resources and create a combined, common data repository
- May share technology and administrative overhead

## Types of Connected Communities (cont.)

_**Hybrids**_
- Includes combinations of Federations and Co-ops
- Agreement to network, share, allow access to information they maintain on peer to peer basis
- Allows aggregation across large areas (statewide or regional)

## Key Factors in Building Your Local Health Information Network

## Challenges to Broader Exchange of Information

**Business / Policy Issues**
- Competition
- Internal policies
- Consumer privacy concerns / transparency
- Uncertainties regarding liability of organization
- Difficulty in reaching multi-enterprise agreements for exchanging information
- Economic factors and incentives
**Technical / Security Issues**
- interoperability among multiple parties
- Authentication
- Auditability

## Security Challenges

**The anticipated:**
- Authentication
- Maintenance of List of Authorized Individuals
- Secure Communications
- Method of encryption / decryption
- Risk Assessment / Analysis for Community
- Coordinating Investigation, Response, Mitigation
- Vendor Interpretation of Standards
**The unanticipated:**
- Changes in Technology
- Changes in Membership of Community Effort

** **

** **

**Alleged Holly Springs Hacker Wanted To Show Flaws In Security**
***Clayton Dillard Accused Of Unlawfully Accessing Hospital Computer System***** **
- POSTED: 11:06 a.m. EDT September 9, 2003 **RALEIGH, N.C. -- **A Holly Springs man is in trouble after being accused of hacking into a medical office's wireless computer network.

| Clayton Dillard is accused of hacking into a hospital computer system and accessing information of hundreds of patients.  |
| --- |

- Raleigh police said Clayton Taylor Dillard, a 29-year-old information security consultant, is charged with one felony count of computer trespass, one felony count of unlawful computer access and one misdemeanor count of computer trespass.  They said the charges against Dillard resulted from an intrusion that occurred to a wireless computer network at Wake Internal Medicine Consultants Inc.  After Dillard accessed the information, he contacted patients and insurance companies. He also wrote WRAL a letter, stating, "These guys are a bunch of bozos." **He also mailed WRAL copies of checks and insurance forms with patient names and procedures.**

- _[http://www.wral.com/news](http://www.wral.com/news)__ _

- Copyright WRAL News 2003

**Security Case - Wireless**

**Notes:**
Just this past September, there was an incident in North Carolina in which a man hacked into the new wireless network at Wake Internal Medicine.  He was able to download the records of some 2000 patients.  Had the HIPAA Security Standards been in effect this hospital would have been confronting potential lawsuits.  Today this is unacceptable on the part of the hospital but not fatal financially, after April 2005 the only way to potentially forestall or mitigate such lawsuits will be the ability to show adequate compliance with the HIPAA Security Standards.

## HIPAA as Enabler

**HIPAA Privacy and Security Regulations provide a baseline of standards that permit the diffusion of electronic health records capabilities and the appropriate exchange of information.**

## Examples of Collaborative Activities and Challenges Incurred

## NCHICA Background

- Established in 1994 by Executive Order of Governor
- 501(c)(3) nonprofit - research & education
- _Mission_:  *Improve healthcare in NC by accelerating the adoption of information technology*
- 250 members including:
**Providers**
**Health Plans **
**Clearinghouses**
**State & Federal Government Agencies**
**Professional Associations and Societies**
**Research Organizations**
**Vendors and Consultants**

## Successes and Challenges Raised in NCHICA Projects

## Statewide Master Person Index

**1994 Goal: **
- Develop Voluntary Patient Information Locator (VPIL) so that records could be accessed for care
**Business / Policy: **
- Shared “customer lists”
**Legal: **
- Privacy & Liability
- No State or Federal Laws covering electronic health info
**Consumer:  **
- Privacy
**Technical:**
- Availability of standardized MPIs from all providers and sectors
- Synchronizing databases
- Standards for data

## Lessons Learned: 
Technology is the easy part
Business and Policy Considerations are much harder and “Show Stoppers”
Privacy and Confidentiality and Consumer Concerns are essential to satisfy
Develop clinical leadership for project with technologists in support role

- Technology is the easy part
- Business and Policy Considerations are much harder and “Show Stoppers”
- Privacy and Confidentiality and Consumer Concerns are essential to satisfy
- Develop clinical leadership for project with technologists in support role

**Statewide Master Person Index**

## HIPAA Efforts

**1995-1999 Privacy & Confidentiality Focus Group**
- Model Privacy Legislation
**1998-2003 HIPAA Implementation Planning Task Force**
**1998-Present**
- Privacy Work Group
- Security Work Group
- Transactions, Code Sets and Identifiers Work Group
- Privacy & Security Officials Work Group
_**Deliverables**_**:  Compliance tools, model documents, education and training programs**
- _and_, method of **building community consensus**

## Statewide Immunization Registry

**1998 Goal:**
- Combined registry of public and private children’s immunization records from multiple sources available via secure Internet
**Business / Policy:**
- Internet access to public health database
**Legal:**
- Privacy and Security
- Non-stigmatizing data
**Consumer:**
- Well understood need vs. confidentiality concerns
**Technical:**
- Move from mainframe to server with SSL Web technology and authentication
- Data quality and matching individuals from different sources
- User Identification and Authentication

## Lessons Learned: 

- Choose project with clear benefits
- Enlist Clinical and CEO-level champions
- Share the load
- Celebrate success
- Probabilistic matching can provide reasonable identification of individuals
- PKI is not like falling off a log
- Proof is in the utility of the project and user demand for sustaining it past pilot stage

**Statewide Immunization Registry**

## Statewide Emergency Dept. Database

**1999 Goal:**
- Standardize and electronically collect clinical data from emergency departments for:
- Best Practice Development & Community Assessments
- Public Health Surveillance (2001)
**Business / Policy:**
- Participation Agreement covering access and use of data
**Legal:**
- Privacy and Security
- No state mandate for collection of certain data elements with identifiers (Limited Data Set and Data Use Agreement)
**Consumer:**
- Collected and transmitted to aggregation point as deidentified data
**Technical**
- Standards for data elements (CDC’s DEEDS Standard)
- Mapping of systems so extracts could be transformed into DEEDS
- No standards for coding of Chief Complaint and First Report of Injury

## Statewide Emergency Dept. Database

- Provide neutral table for collaboration
- Make it easy for IT Departments to provide data
- Keep it simple and cheap
- Expect new opportunities for data use
- Professional associations are better at policy issues than technology implementation
- While HIPAA is permissive, providing information voluntarily (e.g. without safe harbor) makes legal counsel very uncomfortable
- Public Health Use and State Law Cover
- Deidentification

**Statewide Emergency Dept. Database**

## North Carolina Healthcare Quality InitiativeMedications Management Project

*Improving Healthcare in North Carolina by Accelerating the Adoption of Information Technology*

## NC Healthcare Quality Initiative

_**Goal**_**:**
- Phase I - Provide list of medications at point of encounter to save time, improve accuracy of treatment and avoid medication errors
- Include ability to automate refills, e-Rx, and access to formularies
- Phase II – Electronic handling of Lab and Radiology data
_**Business / Policy**_**:**
- Access to data from health plans, PBMs, pharmacies and other providers
- Cost of operation; Sustainability
_**Legal**_**:**
- Privacy and Security (limit use to Treatment)
- Rights to data; Liability
_**Consumers**_**:**
- Who has been looking for and at my information?
- Drugs for behavioral health, communicable diseases, etc.
_**Technical**_
- Accessing records from multiple sources and linking same patient data

## Medications Management Initiative

**Data Integration**

- INQUIRY HISTORY DATABASE

- IDENTITY** **HUB

**EAI**

**Web portal**** **

**eRx**

**EHR**

**Transaction**
**Services**

**RxHUB**

**SureScripts**

**Direct**

- Electronic
- Prescriptions
- & Refills

**Community Medication History Porta****l**

**Medications Management Initiative**

## NC Medications Mgmt. - Project Management

## 
Holt Anderson, Executive Director
Holt@nchica.org   (919) 558-9258 ext. 27
North Carolina Healthcare Information and Communications Alliance, Inc. www.nchica.org

- Holt Anderson, Executive Director
- _[Holt@nchica.org](mailto:Holt@nchica.org)__ _  (919) 558-9258 ext. 27
- North Carolina Healthcare Information and Communications Alliance, Inc. www.nchica.org

**Thank You**