Wednesday, March 14, 2012

Meaningful Use Stage 2 seems to support Security, Privacy, and HIE Transport

In looking closely at the Meaningful Use Stage 2 criteria for both Certification and Incentives. I looked at the areas of my focus: Security, Privacy, and HIE transport. I mostly ignored everything else, so you will need to go to Keith’s blog for those details or any of the other really good resources.

My overall conclusion is that CMS and ONC have done a fantastic job of addressing Security, Privacy, and HIE transport. Yes I did say ‘fantastic’. There are some issues, but they can be fixed. There are improvements, but in many cases we need to take stepping stones today that are on the trajectory of the future. There are clear things that can and will happen in the future.

Security:They have made mostly minor changes to the security criteria. They are leveraging well known best practices and applying them only to Healthcare when there is something specific. They are leveraging the existing HIPAA Security rule and HITECH. The main changes this time around are added detail for Audit Logging, references to cryptography experts at NIST/FIPS, synchronization of clocks, and recommendations around encryption on end-user devices.

Privacy:They have included Privacy! They should be given kudos for this. Nothing earth shocking for any well done EHR or operational environment, but welcome guidance and encouragement for those that had not yet addressed Privacy. Their changes are directly to support HIPAA Privacy and HITECH. They have identified that security audit logging is an input to an Accounting of Disclosures, and a Access Log. They have defined what these reports would include. They have given stronger guidance on Amendments.

HIE Transport:They have given us one or two Push style transports, and recognized that they interoperate by way of a proxy service that can convert forward and backward. There is no real surprises here as ONC has spent much time developing the Direct Project. Healthcare Providers and EHR developers should really be focusing beyond Direct, but supporting minimal Direct is a good thing to do. It allows us as an industry to move away from the FAX, and start universally communicating and manipulating Documents. I will note that these more Exchange like HIE models would still be considered compliant under the optional third transport.

Conclusion:I will have more detailed blogs on all these topics. I will also be explaining why some want an Exchange style HIE vs using a Push style HIE. I will be discussing what should be done regarding Consent for nationwide exchanges. And I will be discussing other suggestions for Stage 3, with explanation of why I think it is ok for CMS/HHS/ONC to wait. I do still encourage vendors and providers to go above and beyond the minimum required by Meaningful Use.

Updated with links to further discussion:
No comments:

Tuesday, March 13, 2012

Huge HIE -- the Care Continuity Consortium

The acceptance of IHE profiles for building federation of Health Information Exchanges has reached another milestone. The IHE XCA/XCPD profiles are at the core of the exchange. I worked with this group as an adviser on the standards and their use within the NwHIN-Exchange. I so wanted to blog about it, but needed to keep quiet until HIMSS 2012.

In April 2011 five leading US health systems joined forces to create the Care Continuity Consortium, and promised to achieve a clinically operational secured sharing of health information between them by early 2012, this seems an aggressive challenge. But it also drew some respect to see pioneers in the use of electronic medical records systems such as Geisinger Health System, Kaiser Permanente, Mayo Clinic, Intermountain Healthcare and Group Health Cooperative, engage into national level of information exchange. 

They committed to leverage existing standards and IHE profiles already selected by the Nation-wide Health Information Network (NwHIN-Exchange) to enable a national-scale health information query service. At HIMSS last month they showed how this group supports their clinicians in their practice to access patient summaries information from different health systems.

They are sending the message that the current available standards and profile, do work and can be successfully implemented. This interoperability serves well the clinicians, and patient consent can be managed effectively with large scale interoperability being a matter of political will.

Further development will continue to be done to dial in more and more functionality, efficiency, and privacy. An important message is that the system can fill a need, does support more use-cases than Direct, and is more automateible due to a mature metadata model.  

Add the CCC network to the likes of NwHIN-Exchange and the European wide epSOS. There are more to come, but of course I must keep them a secret.

Reference:
3 comments:

Tuesday, March 6, 2012

Healthcare is not secure - trust suffers

There are a couple of articles on the subject of security in healthcare that clearly were prepared for release around HIMSS. They show up after HIMSS because Meaningful Use - used up too much of the news coverage.
Given that the excuses found in the articles are all over the spectrum this is revealing that there simply is a lack of a specific reason. This lack of a specific reason, as well as the stated financial investment ones, are an indication that it simply is not an important priority. To be blunt, lack of security doesn’t kill people, and there are a lot more treatment deaths to worry about. To be a priority in healthcare it needs to raise very high.  

I want to be very clear, to me this is the top priority. It is right there in the title of my blog. I do worry daily about indirect affects of poor security on patient treatment and safety. But as a subject matter expert, one must be able to see things from other perspectives in order to really understand your subject.

HHS/ONC/CMS have made small, but important, adjustments to Meaningful Use stage 2 statements that focus attention on the largest category of breaches, those caused by the loss of mobile devices that contain databases of PHI. For EHR certification criteria, the focus is first on smart EHR design that doesn’t leave PHI on end-user-devices, second if PHI is left behind it needs to be controlled using encryption. In the CMS rule this breach category is simply indicated as a reminder that covered entities are already obligated by HIPAA Security to do risk assessments and planning, so remember to assess and mitigate the risks of mobile devices that contain PHI getting stolen or lost. I knew this was going to be the case, since I worked with the writers of the NPRM as a member of the HIT Standards privacy and security workgroup and SME. See my blog article written last month - Encryption is like Penicillin. 

Trust suffers
The biggest negative of a lack of priority on security overall in healthcare, one that I don’t see any solution for, is ‘trust’. More specifically the lack of trust. Patients don't trust the system to protect them, Doctors don't trust the system to deliver good results or represent their work properly. This worry is holding back so much potential. Trust is a very hard thing to build, and even harder to hold onto. 

I have spent a half-dozen years creating standards for Health Information Exchanges; small, medium, and large. These standards designed in security layers, and privacy protections (that was my job after all). But if there isn't the perception of trust, all this technology can’t make things better. This perceived lack of trust is not completely due to just the breaches in Healthcare, but also the breaches everywhere on the internet. It is hard for the common man to believe that Healthcare industry will do better than other industries (e.g. video-gaming, banking, social-networking). We, the healthcare industry, are at the mercy of all industries. I really don’t think it would matter if we somehow magically made the healthcare industry the model of perfect security and privacy.

Baby steps are more effective than giant steps
I truly think that healthcare industry can continue to be relatively secure and privacy protecting. Yes losing control of 10 million patients records is actually low-profile. That is, there are plenty of other industries that are far more the focus of malicious acts. Most of healthcare breaches are due to carelessness and sloppiness.  It is not clear they were for any  malicious gain, or even resulted in any malicious gain. The rewards for attacking healthcare are simply not as fungible. This might change, I can't predict what dastardly things might be thought up. I do however think that the harm done so far has been minor in comparison. I don't like it, I want it better, but reality is that as long as there are higher priorities, those priorities will get the funding and resources.

The healthcare industry simply needs to continue to make reasonable advances (like promulgated in Meaningful Use). These advances are made easy because others have paved the way. Security mitigation technology is readily available like multi-layer networks, network based intrusion detection, data loss prevention proxy, host-based firewalls, automated patching, asset discovery/analysis, network encryption, host encryption, centralized/federated user identity/authentication, and audit-logging/management. Under a Risk Assessment scheme, these will be applied in proportion to the threats.

This is not just about prevention, but detection and action. We must detect security and privacy failures, and punish the one that caused the failure. We do this when the exposure is to a VIP, we need to do it just as strongly when it is Joe Everyone.

Note: This is not much different than 2010:
No comments:

Monday, March 5, 2012

FYI: Conference on Trusted Digital Identities and Cloud Collaboration in Bio-pharmaceutical Industry

This just crossed my desk. I won't be able to go, but would love to hear about it.





REGISTRATION OPEN FOR ONE-DAY CONFERENCE ON
TRUSTED DIGITAL IDENTITIES AND CLOUD COLABORATION
IN BIOPHARMACEUTICAL INDUSTRY

Co-hosted by DIA and SAFE-BioPharma


Fort Lee, New Jersey ( March 3, 2012) -- Registration is now open for a one-day conference exploring the use of standardized digital identities and cloud collaboration to improve speed, cost containment, and other efficiencies in the biopharmaceutical industry. Co-hosted by the DIA and SAFE-BioPharma Association, the conference -- Trusted Identities for Cloud Collaboration -- is scheduled for Sunday, June 24, 2012 in Philadelphia, PA, the day before the start of the DIA 2012 48th Annual Meeting. Discounted rates are available for attendees to both meetings.

The conference will feature presentations by company personnel using standardized global digital identities in a broad range of applications. These include ePatient data entry with iPads, cloud-based clinical trial initiation, ePrescribing, digital signing and exchange of adverse events, eSubmissions, and electronic Laboratory Notebooks.

Presenters include…
  • Jeremy Grant, National Strategy for Trusted Identities in Cyberspace, the White House initiative to improve online security, increase privacy, and foster economic growth and innovation.
  • Randy Sabett, international authority on security and privacy law
  • Deb Gallagher, Federal PKI Policy Authority, provider of trusted identities to all federal agency personnel, and
  • Speakers from Astellas, AstraZeneca, Bristol-Myers Squibb, Exostar, Merck, National Cancer Institute, National Institutes of Health, sanofi-aventis, and Verizon
  • Pulitzer Prize winning journalist/author, Michael Waldholz (Wall Street Journal; BloombergNews/Businessweek) will discuss the future of the global biopharmaceutical industry.


The first SAFE-BioPharma Digital Identity Awards recognizing innovative uses of the global SAFE-BioPharma® digital identity and digital signature standard will be presented during the closing reception.

For more information and registration visit http://www.diahome.org/en/FlagshipMeetings/27170/Trusted+Identities+for+Cloud+Collaboration

###

ABOUT SAFE-BIOPHARMA
For more information on the SAFE-BioPharma standard for digital identity and digital signatures used in life science and healthcare settings, visit http://www.safe-biopharma.org.
SAFE-BioPharma® is a trademark of SAFE-BioPharma Association. Any use of this trademark requires approval from SAFE-BioPharma Association.

ABOUT DIA
DIA is a nonprofit, global, professional, member-driven association of nearly 18,000 professionals involved in the discovery, development, and life cycle management of pharmaceuticals, biotechnology, medical devices, and related medical products. Through our international educational offerings and myriad networking opportunities, DIA provides a global forum for knowledge exchange that fosters the innovation of products, technologies, and services to improve health and well being worldwide. Headquarters are in Horsham, PA, USA, with offices in Basel, Switzerland, Tokyo, Japan, Mumbai, India, and Beijing, China. For more information visit: www.diahome.org.


No comments:

Thursday, March 1, 2012

IHE - ITI NEW Educational Webinar Series

This just crossed my desk ------

Greetings IHE members,
 
IHE International is pleased to announce the upcoming ITI Educational Webinars.  Register today!
 
v  Cross-Enterprise Document Workflow
Presented by Arianna Cocchiglia and Luca Zalunardo
03/06/12  9:00am CT
Attendee Registration
 
"The Cross-Enterprise Document Workflow (XDW) profile enables participants in a multi-organizational environment to manage and track the tasks related to patient-centric workflows as the systems hosting workflow management applications coordinate their activities for the health professionals and patients they support. This profile defines an instrument, called a "Workflow Document", to manage and track a shared workflow. It is designed to support the complexity of health services delivery with flexibility to adapt as workflows evolve."
 
v  Patient Identity Management
Presented by Eric Heflin
03/07/12  10:00am CT
Attendee Registration
 
"The HIE has several profiles, actors and transactions designed to enable participants to manage patient identities across different assigning authorities (and/or organizational boundaries).  In this presentation, these profiles will be introduced."
 
v  Healthcare Provider Directories
Presented by Eric Heflin
03/14/12  10:00am CT
Attendee Registration
 
"Several IHE profiles have been created to assist managing providers within, and across, organization boundaries. This presentation will introduce each of these profiles, including the actors, transactions, and options.  Deployment examples will be provided."
 
v  Enabling Document Sharing through IHE Profiles
Presented by Karen Witting
03/21/12  10:00am CT
Attendee Registration
 
"The purpose of this webinar is to provide an overview of the collection of IHE profiles which are intended to be used by communities for exchanging health information. The collection of profiles includes support for patient identification, health document location and retrieval, provider directories, and the protection of privacy and security. This white paper will show how various profiles work together to provide a standards based, interoperable approach to community and cross-community health information sharing."
 
Thanks to each of our presenters!
 
Note that prior ITI Webinars and presentations can be accessed at:
http://wiki.ihe.net/index.php?title=Current_Published_ITI_Educational_Materials


No comments:

Tuesday, February 28, 2012

Suite of Network Infrastructure and Protocol Training courses

This just crossed my desk For more go www.gehealthcare.com/hcit
Yes, I work for GE Healthcare


From Essentials of Healthcare IT to Introduction to IHE Cross Enterprise Document Sharing Profile, our suite of Network Infrastructure and Protocol Training courses can help regardless of your facility's EMR Stage.
» Essentials of Healthcare IT» Essentials of DICOM» Essentials of HL7» Wireless in the Healthcare IT Environment» Securing the Healthcare IT Environment» Introduction to HL7 CDA 2.0» Introduction to IHE Cross Enterprise Document Sharing Profile
All designed to meet your needs regardless of your equipment choices.

For more information, visit us at:
www.gehealthcare.com/hcit
Questions? Contact us today: edservices@ge.com or 888-799-9921

No comments:

Saturday, February 25, 2012

ATNA auditing of CCOW context changes

On the IHE mailing list the following question came in: “Are there any commonly accepted or standard ATNA message structures for auditing CCOW context changes?”

The short answer is that the CCOW transactions are not particularly ‘Security Relevant’. The thing that happened before or because of the transaction usually are. Those security relevant events that happen before or after should be recorded as ATNA events. For example it should be the User Authentication application that records that a user was authenticated. The actual CCOW transaction to set the context or to read the context is not that interesting.

Deeper Discussion:
For many other IHE Profiles (e.g XDS, PIX, EUA) we have identified the security audit message that would be appropriate to capture that the transaction happened. This is done now days as part of the Security Cookbook. Where we do a risk assessment to identify reasonable security and privacy controls, including if there is a need for a security audit event to be recorded.

IHE does have a profile that leverages CCOW, The “Patient Synchronized Applications” Profile was written around the same time that “Audit Trails and Node Authentication” Profile was written; but was written before the Security Cookbook. So one can see how it might be possible that IHE simply hasn’t thought about the relationship between PSA and ATNA; or hasn’t fully executed the Security Cookbook. I can’t say that this is not the case, but I don’t think that there would be a strong reason to define the ATNA events for PSA.

Not all transactions are going to be security auditable events, and more important there are far more security auditable events than there are network transactions. Far more security relevant events happen in the normal workflow of an application that have no external transaction. This is something that I have tried to cover multiple times, as many people get a false impression that the only ATNA events are those that are defined by IHE. The main security relevant events that IHE defines are ‘Import’ or ‘Export’ events. This is the reason why XDS was so highly covered with ATNA, as everything about XDS is either an Import or an Export event; and one that is most likely not just to the application but to the organization – hence Cross-Enterprise prefix.

Surveillance:
Another factor is that the IHE ATNA audit message is about Surveillance, not forensics or even debugging. The statement that the CCOW transactions are not security relevant does not mean that there should be no log, but that log is more of a debugging log, something that might be called upon if deeper analysis is needed (forensics).

Who did what when:
As stated above the CCOW transactions are not that interesting, but the events leading up to a context change and the events caused by a context change are very interesting.
  1. User Authentication: This event should be logged by the application that actually authenticated the user. It is important that this responsibility be here, as it is more important to log failed attempts to authenticate. The failed attempts would never hit the context, so the context changes would not be helpful to detect an attack at the user authentication.
  2. Patient Selected: The application that is used to select a new patient should be recording that a new patient was selected. 
  3. Patient Changed: All applications that change their display because of the context change likely are showing the user something new, and thus there is a need to record that that new thing is being shown to the user.
  4. Object Changed: The CCOW specification allows for other objects within the patient record to also be changed and thus synchronized.
Gap in ATNA?:
It is at this point that a potential gap in the current ATNA specification comes into discussion. There is clear ways to indicate that the user is being shown a patient study, document, order result, or other specific object. There is not a clear way to say to simply say the patient identity has changed and that no-specific information is being shown.

The one case where this comes up and I think makes this a bit harder is the typical EHR/EMR case or the Nurse Station, where the first screen is a high-level view. I have heard this referred to as the ‘chart’. There is clearly information on this screen, but it isn’t a discrete object, but rather made up of the most interesting values in the EHR. I covered this before, and am still not clear what is security relevant.

If nothing in particular was shown to the user, was there really any security relevant event? This might simply be the case, that one doesn't record an ATNA event until there is some data shown to the user.

Conclusion:
I don't think I have come up with a gap or a reason why CCOW events should be recorded using IHE ATNA. That is not to say that they can't be, just that I don't see a compelling reason to specify it.

References:
3 comments:
Subscribe to: Posts (Atom)