The reality of delivering an integrated health IT vision is extremely complicated. Countries, regions and institutions are progressing at different rates and in the meantime crises related to inefficiencies with paper records, drug recall and inaccessible and illegible data are frequent and ongoing, often resulting in the wrong treatment, or in some cases, the death of a patient.
In addition to the budgetary, supplier and software problems being faced, the continued controversy surrounding the security of electronic health records is impeding the desired progression rate and weakening confidence in electronic patient data records.
Go deeper with GlobalData
The NHS National Programme for IT (NPfIT) in the UK was launched in June 2000 and has encountered many problems, including being years behind deadline, escalating costs, supplier difficulties and a lack of support from medical professionals and the general public.
The NPfIT incorporates an ambitious networked electronic patient data vision for the UK and involves a ‘choose and book’ system, a national electronic health record, broadband infrastructure and e-prescriptions. Each has evoked much criticism and controversy, but none more than the national patient database known as ‘The Spine’, which contains details on approximately 50 million patients, promising patients more ‘joined-up care’.
With this goal of creating a centralised patient data system it is becoming even more vital that internal IT systems improve as networking and data storage requirements soar. The increased use of picture archiving and communications systems (PACS) and increasing levels of patient data means that more and more storage is required.
Where funding and budgets allow, hospitals are implementing storage area networks (SANs) to speed up data access and consolidate data storage. Systems need to be able to store somewhere in the region, and in excess, of 20 terabytes and must be capable of disaster recovery. Most importantly, any system storing patient data needs to be secure.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataPAPER VS ELECTRONIC
But security goes beyond good IT. INPUT, the authority on US government business, is focused on developing health IT in the US. “Data breaches are a threat regardless of whether the health information is in paper form or electronic form,” explains Kristina Mulholland, INPUT’s social services and healthcare analyst.
“Electronic health information is more easily transmitted, but technical security measures can be implemented and audit trails maintained to address patient privacy. However, with paper-based health systems there is typically no trail of who has snooped at patients’ records.”
PRIVACY AND SECURITY
So how can we be sure that the correct procedures are implemented and patient data is secure when dealing with electronic health records? Best practice is managed in a variety of different ways. “A lack of privacy and security policies remains a chief barrier to widespread adoption,” says Mulholland. “Providers, hospitals, clinics etc are advised to select health IT products which have been certified by the Certification Commission for Healthcare Information Technology (CCHIT).”
The CCHIT standardises health IT fundamentals such as encryptions, user authentication and firewalls. In connection with this, the Health Insurance Portability and Accountability Act (HIPAA) has been extended to cover electronic health records.
In the UK NHS staff can only access data if they have been issued with a smart card and the level of access depends on their role. “Smart cards are issued only after stringent identity checks,” says a spokesperson from the Department of Health. “Access to patient information is only available to authorised care professionals who must be authenticated users and must be directly involved in the delivery of the patient’s care.”
DEALING WITH DATA EXPOSURE
Legal procedures and consequences, along with each medical worker’s personal integrity, are paramount to the secure running of an electronic record system in any industry. “The issue of record management is taken very seriously,” a UK Healthcare Commission spokesperson confirms.
“If a patient data error is exposed then a series of recommendations are made and an action plan with timescales are created. If the healthcare commission feels that the trust does not have the skills or resources to put these recommendations into place then ‘special measures’ are undertaken, the Secretary of State is involved and restructuring takes place, which usually involves bringing in new senior managers and so on.”
However, the highly publicised celebrity patient data exposure reports do nothing to help the continuing debate around electronic patient data security. The recent newspaper stories of employees’ unauthorised access to Britney Spears’ confidential medical records at the UCLA Medical Center shows that one celebrity story makes double the impact of other patient data exposure stories.
It also presents a slightly different problem in that the deterrents in place for improper administrative behaviour are undermined by the unhealthy and overwhelming desire to gain ‘private’ celebrity information. In this situation medical workers ignored protocols despite knowing the consequences of doing so.
With these types of scenarios or other heavily-publicised patient data exposure cases, how should a medical institution react? Albert Tortorelli, managing director of Oglivy Public Relations Worldwide and crisis management expert, recommends firstly that the hospital must be committed to admitting publicly what has occurred, followed by instant dismissal of the staff member(s) in question.
“In crisis management, there is no more powerful a message than the person responsible for inappropriately looking, leaking or anything else with a patient’s records getting discharged as soon as the breach is uncovered,” says Tortorelli. “There can be no stronger signal to the public than this single act and the press will acknowledge your efforts.”
Tortorelli also recommends that the institution must install whatever state-of-the-art record protection is available with all the protections that technology offers along with new policy adoption. “A highly functioning executive team will put as much as they can in written policies that follow and will make sure that the patient and the hospital staff know what the consequences are should there be serious breaches of the code,” he concludes.
