Source: http://jaapl.org/content/39/4/571.full
Timestamp: 2019-04-26 14:12:08+00:00

Document:
The Internet has grown into a world of its own, and its ethereal space now offers capabilities that could aid physicians in their duties in numerous ways. In recent years software functions have moved from the individual's local hardware to a central server that operates from a remote location. This centralization is called cloud computing. Privacy laws that speak to the protection of patient confidentiality are complex and often difficult to understand in the context of an ever-growing cloud-based technology. This article is a review of the legal background of protected health records, as well as cloud technology and physician applications. An attempt is made to integrate both concepts and examine Health Insurance Portability and Accountability Act (HIPAA) compliance for each of the examples discussed. The legal regulations that may inform care and standards of practice are reviewed, and the difficulties that arise in assessment and monitoring of the current situation are analyzed. For forensic psychiatrists who may be asked to provide expert opinions regarding malpractice situations pertaining to confidentiality standards, it is important to become acquainted with the new digital language from which these questions may arise.
Many people remember playing the telephone game with friends when they were younger. The basic premise of the game is that one person whispers a secret into another's ear, and that person whispers it to another. As that process is repeated from person to person, large distortions emerge from cumulative small errors as the information is passed along. As health care professionals, physicians know that ensuring the accuracy of confidential information in a collaborative setting involves more technical approaches, to avoid a telephone game outcome. Information is recorded on secured systems, backups, hard drives, flash drives, shared folders, professional networks—the list can go on endlessly. Just as information management in the digital era was finally getting worked out in legislation and practice, a new modality appeared, one that physicians may be ill-prepared to accommodate. Cloud computing is the term used for the concept of operating from a remote server, without information or executable files in the physical hardware that is being manipulated by the user. Software for virtually all purposes is moving toward this approach, as it offers many advantages from the perspectives of accessibility, maintenance, and cost. A comprehensive discussion of the advantages and disadvantages of cloud computing extends beyond the purposes of this article.
This article is a review of privacy rulings as technology moves toward web-based applications and storage. Included is a review of the clinical, legal, and ethics-related implications of these changes. Cloud computing has been widely available for several years, yet the literature speaks scantily if at all about its impact on the practice of medicine. Concrete application of current confidentiality safeguards may prove insufficient to meet the standards of care or to allow for effective use of the advantages that the cloud has to offer.
A brief review of a few definitions may be useful here. Covered entities include health care providers and health management plans that transmit information in electronic form for the purposes of certain standard transactions, such as analysis of patient safety and health care claims.6 A protected health record (PHR) is an electronic record of an individual's health information by which the individual controls access to the information and may have the ability to manage, track, and participate in his or her own health care. An electronic health record (EHR), on the other hand, is held and maintained by a health care provider and may contain, in electronic form, all the information that once existed in a patient's paper chart.7 The HIPAA Privacy Rule does not apply to PHRs unless they are offered or accessed by a covered entity.
In December 2008, the Secretary of HHS stated: Consumers need an easy-to-read, standard notice about how their personal health information is protected, confidence that those who misuse information will be held accountable, and the ability to choose the degree to which they want to participate in information sharing…. Over time, consumer confidence in the handling of health information is likely to grow just as consumer confidence in online banking has grown, but that won't happen without similar protections and transparency about the use of their information [Ref. 8]. The Secretary noted eight principles that should govern the legislation and implementation of such standards: individual access; correction; openness and transparency; individual choice; collection, use, and disclosure limitations; data integrity (data should not be destroyed or altered in an unauthorized manner); safeguards; and accountability.
All covered entities must have been in compliance with the Security Rule no later than April 20, 2005. To achieve compliance, the Privacy and Security Toolkit10 implements the principles in The Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information (privacy and security framework). The safeguards of the toolkit include the three areas with requirements shown in Table 1.
The standards11 set forth by HIPAA speak to identifiable patient information.12 De-identification requires the elimination of primary (name, date of birth, treating provider, and medical record number) and secondary (those from which the patient's identity can be deduced) identifiers. In order for information to be de-identified, 18 elements of identification must be removed (Table 2).
De-identified information should be preferred whenever possible for matters of utilization review, monitoring, and research. Providing such anonymity, however, may be difficult, especially when trying to disseminate the practice to a broader scope of users.13 An authorized user who wishes to encrypt PHI when creating de-identified information must ensure that the code or other means of record identification is not derived from or related to information about the individual that it is not otherwise able to be translated so as to identify the individual and that anyone involved does not use or disclose the code or other means of record identification and does not disclose the mechanism used for re-identification.
The scientific literature speaks briefly14 about the impact of legal regulations on the use and manipulation of clinical information. The legal regulations may have shortcomings, as digitalized manipulation of data grows in scope and dissemination, ultimately resulting in decreased protection of privacy.
Cloud-based computing presents itself as a modality that offers increased access to data regardless of patient or provider location. It offers efficient technical management through a centralized system that regularly updates and monitors functioning of software. Furthermore, it reduces the risk of unauthorized tampering by drastically reducing the number of devices containing critical software or information that can be tampered with. It may also offer reduced costs, although this is an area of ongoing debate. Many services are available free, steep purchase prices are eliminated, and service costs are reduced. However, a required monthly fee for those services may prove more costly in the long run. On the other hand, cloud computing poses some conflict, in that the server itself cannot be monitored by a security-trained officer of the covered entity. Finally, while the conditions for technical safeguards may be agreed on at the moment of contracting with the cloud service, the service providers ultimately hold the right to change their safety standards in the future. Examples of these may include degree of safety of password requirement, level of encryption, and collaboration features.
The discussion acquires another layer of complexity when certain sociopolitical views are taken into account. Multiple businesses based on HIPAA compliance have arisen to assist institutions or providers, given the ever-increasing complexities of the law.16 These services can be costly, often much more so than web-based services, which exposes the contradiction of HIPAA's aiming to reduce costs of health care while triggering staggering expenses for compliance.17 Especially for the small practice covered entities, moving forward in record management in the digital age while satisfying compliance regulations may prove to be inefficient or outright impossible to achieve.18 There are financial incentives,19 but the upfront investment could be insurmountable for many entities. Furthermore, the commercial interest of HIPAA compliance-based businesses introduces a bias that raises the question of whether improved patient care is the priority. Finally, consideration must be given to the argument of who should ultimately decide on the scope and method of access: the patient, the practitioner, or the government. Some advocate for it to be the patient, as it would increase patient empowerment and decrease governmental involvement.20 Others believe that the practitioners are best for assessing the needs of their particular practice. Advocates of legislative decision-making emphasize the need for federal regulations to prevent individual indiscretions.
The security standards were designed to be technology-neutral, to accommodate changes that arise in technological developments. They also allow for certain flexibility in consideration of the fact that needs may differ from one institution to the next, from one software program to the next, or from one software program to its newer version. HIPAA does not certify software as compliant or noncompliant, and it is therefore up to the institution to ensure that the requirements are met. In cloud computing, the software is dynamic, and monitoring of functionality or security parameters occurs far removed from the covered entity.
When Does the Cloud Rain on Us?
Dropbox stores information in an individual folder on a web server and automatically synchronizes the information in that folder with any computer or smartphone in which Dropbox is installed. It is offered free, with an option to increase storage space for a fee or through referrals. It allows for sharing of folders. Information is available from the Dropbox website or directly from the updated folder in the computer or device where it has been installed. Dropbox is password protected, but password requirements are not specified. The password does not have to be periodically updated, and the website does not offer information on the level of encryption the server uses. However, differential access is achieved, as individuals only have access to their own information or that specifically shared with them by another user.
Grubba is a cloud database that can be built easily by any user at no cost. Security is limited to password-protected entry into the website, which does not have specific requirements or scheduled updates. No information is available on the website regarding encryption.
Samedi offers a network-based system for management of workflow, medical appointments, and transmittal. It emphasizes a collaborative relationship between doctors and patients, with benefits for both. It is available for a fee, and it is approved in its country of origin, Germany, for use across institutions. Medicine Brain offers a cloud-based, comprehensive electronic medical record (EMR) system that uses some Google parameters while ensuring privacy standards.
BillingBoss and Billing Manager both offer free cloud-based billing services. Invoices are stored in the server and are accessible through a password protected site or through a smartphone.
LuxSci is a cloud-based management system for e-mail transmittal and website hosting. The website states that the service is HIPAA compliant and is protected against threats by well-known systems such as McAfee and Truste. The service is available for a fee, although the fee schedule is flexible according to the provider's need.
E-mail protection can be achieved in different ways. As Microsoft Outlook moves to a cloud-based operation, other cloud-based services must also be considered. The use of Gmail or Yahoo global servers as e-mail hosts has been advised against because of the potential for breaches. However, compliance with HIPAA would require only the lack of identifiable information, an e-mail notice or disclosure of confidentiality, and informed consent.24 Furthermore, with services such as Google Voice, voicemails are transcribed and sent via e-mail or text message to the provider's computer or cell phone device. The current standards do not speak to situations in which the security level cannot be accurately measured. Doximity offers a private physicians' network service that facilitates locating other health care professionals and health institutions and offers HIPAA-compliant text messaging among physicians.
Skype is a teleconferencing (voice-over Internet protocol) service that is free of charge and allows international phone calls for a fee. It is cloud based and can be accessed directly through the website or by installing the application in the user's computer or cell phone. Users are required to set up a user name and a secure password. It uses the same encryption as banks do. Because of its video capabilities, hacker impersonators could easily be identified through video. Malware has been designed that masquerades as Skype and prompts for password disclosure; however, such scams have occurred with many reputable services and software programs, including those of banks. Skype proposes itself as a viable option for telepsychiatry.
Cell phones and cell phone applications (Apps).
Many cloud-based services are available on portable devices such as cell phones, netbooks, and e-readers, among others. These services allow for continuity of care, prompt response to patients' needs, coordinated access to updated information, ubiquitous access to information, and automatized backups for protection of information. Cell phone security systems, including encryption options, are different from computer-based applications and browsers, and currently available safeguards do not incorporate such technologies into consideration of standards.
It is pertinent to review the legal impact of standards on every day clinical practice.
HIPAA is a federal law, and violations are therefore tried in federal courts. Statutory damages can also be applied. All violations are considered felonies, and the person tried is the person considered to have breached security or leaked information inappropriately. According to § 1177 of HIPAA, a person is in violation of HIPAA regulations who knowingly uses a unique health identifier or causes one to be used, obtains individually identifiable health information relating to an individual, or discloses individually identifiable health information to another person. Such persons are subject to the following penalties: a fine of up to $50,000, or up to 1 year in prison, or both (Class 6 felony); if the offense is committed under false pretenses, a fine of up to $100,000, or up to 5 years in prison, or both (Class 5 felony); or if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of up to $250,000, or up to 10 years in prison, or both (Class 4 felony). HHS can also impart civil penalties for HIPAA violations on a tiered scale on any person who participates in such a violation. For a person who was unaware of compliance requirements, the maximum is $100 for each violation, with the total amount not to exceed $250,000 for all violations of an identical requirement or prohibition during a calendar year (Class 3 felony). For persons who willfully neglect to comply with HIPAA, penalties range from $10,000 to $50,000 per violation up to $1.5 million per calendar year for an identical violation, if corrective action is not taken.
Case precedents have been argued on the basis of the right to privacy derived from the Fourth Amendment. In the case of Goldman v. United States,26 electronic surveillance without physical penetration of the premises by a tangible object was deemed not to violate constitutional protections. However, this decision was overruled in the case of Katz v. United States.27 Justice Harlan famously wrote, “privacy may be defeated by electronic as well as physical invasion.” In Kyllo v. United States,28 the Supreme Court ruled that law enforcement's use of thermal imaging technology to view the interior of a residence was impermissible.23 Pertinent to HIPAA violations specifically, in Acosta v. Byrum,29 the appellate court stated that a HIPAA violation constitutes negligence per se and awarded accordingly to the plaintiff. Numerous cases have followed suit, rendering it impossible to cite them comprehensively in this article. As recently as June 2010, in Connecticut v. Health Net, Inc.,30 a settlement of $250,000 was reached for what was considered a HIPAA violation under the HITECH (Health Information Technology for Economic and Clinical Health) Act of 2009.
The literature has shown that fear of HIPAA violations has negative affects on patient care.31 I propose a series of measures that a clinician can take to prevent such negative effects on patient care or legal breaches.
In the event that a security breach or data loss occurs involving e-PHI, HIPAA requires that specific steps be taken to address such an incident and that actions be documented.
Ultimately, patients' awareness of and consent for how their health information will be kept, accessed, transferred, or protected are pivotal aspects that can determine to a large extent the choice of service utilized. Obtaining informed consent may also be a legal protection in the event of a subsequent lawsuit.
HIPAA compliance businesses have arisen and provide service to medical practices to assist with compliance regulation according to the particular needs of the institution. There is some literature35 regarding software selection as it pertains specifically to psychiatry that may orient a provider seeking digital directives while remaining HIPAA compliant.
Communication within an institution, as it extends among coworkers, trainees, and other members of the treatment team, or among patients directly, is not just inevitable, but desired in favor of optimizing patient care. The technology available to practitioners during this digitalized era should be utilized to its full extent if it serves the purposes of furthering education and patient care. Unfortunately, useful tools are often neglected or discarded due to a perceived threat of litigation that stems from a law that originated from a common goal: to further patient care as health information moves into an electronic format. While compliance with HIPAA is crucial, technology appears to be growing faster than the legislation that covers it, leaving certain legal aspects unresolved. There are several solutions to this conundrum. We have mentioned a few in this article, but on a broader level, there are projects under way, such as the Hippocratic Database,36 which attempt to bring patient care, HIPAA, and the cloud together. In the meantime, physicians should become versed on the concept of cloud computing and how it may clinically and legally affect their practices.
45 C.F.R. § 164.506, 510, 512, 514(e) (2002).
45 C.F.R. § 160.103 (2002).
Goldman v. United States, 316 U.S. 129 (1942).
Acosta v. Byrum, 638 S.E.2d 246 (N.C. Ct. App. 2006).
Connecticut v. Health Net, Inc., 383 F.3d 1258 (11th Cir. 2004).

References: § 1177
 v. 
 v. 
 v. 
 v. 
 v. 
 § 164
 § 160
 v. 
 v. 
 v.