Stepping stone off of FAX to Secure-Email

The original goal of the Direct Project was to find something better to replace the FAX machine in small doctor offices. The short answer is to use secure email. This is a great replacement for a FAX.

The Direct Project really is as simple as that. There are deployment issues, but those are really much like deploying any software today: Inside, Outside, or outsourced. The part that makes Direct, or anything secure, hard is that in order to provide security into email one needs a trust infrastructure to base the security on. Trust is always based on either faith or proof. In security circles we try to use proof more than faith. So we need to build a way to prove that someone is who they say they are. Fortunately this is a well established concept in security, but the build for healthcare still needs to be done.

------------The longer answer---------

Secure e-Mail
Under the “Direct Project”, which is just using secure e-mail (S/MIME). The following is not special, it is just restating every-day secure e-mail. This is implemented by many off-the-shelf e-mail clients. To make secure e-mail work, both the sender and receiver must have a digital certificate. It is used to:

1. Content is integrity protected using a hash method
2. Sender digital certificate signs the hash values of each document. This is used as proof the sender was the only one that could have sent these documents.
3. Sender digital certificate is included in the message
4. Each Document (attachment)  is encrypted using a symmetric encryption method.
5. The encryption key for symmetric encryption is randomly invented new for each document.
6. For every intended Receiver, their digital certificate used to encrypt each symmetric encryption key used for each document -- allowing the content to be sent to multiple receivers with the same encryption across the documents. The one message simply contains one copy of the encrypted document, and multiple small sections with each 

This is all just normal secure e-mail. It is included in almost every off-the-shelf e-mail client such as Thunderbird or Microsoft Outlook. For those wanting to integrate workflow more tightly, this is also implemented in many programming APIs (e.g. MAPI) and toolkits. It is also fully available in general purpose secure email services (e.g. Astaro). So, even the Full-Service-HISP is not a new thing.

Trust

The Secure e-mail is the easy part. The hard part is

A) How does the sender ‘find’ the certificate of the receiver?
B) How do the two parties know they should trust each other?

The solutions for both (A) and (B) can be different based on scalability and automatability needs. 

Small Scale - ad hoc trust

In the case where a small number of individuals need to communicate securely, this can be done very one-by-one. Meaning I find your certificate from previous conversations that you have signed. This is indeed why one tends to simply sign every message as it enables anyone you have ever communicated with to send you secret (encrypted) messages. This is the typical method used in normal secure e-mail use.

There are two problems with this model:

• Not easily automated
• Can be subverted

The trust model is mostly ad hoc, given that you are primarily trusting that the prior signed conversation was actually from the individual you think it is. Generally this is how we do many personal relationships, building trust because of prior conversations. It is possible that a malicious individual has sent their own message and their faked certificate making it look like the good individual. In a one-by-one scale, it is likely you would notice this and get suspicious.

Automation - Directories
You can see that the previous trust model is very dependent on personal relationships. This also leads to problems with automation. The Direct Project knows that although personal relationships are very important in Healthcare, probably more important than one might want to admit. There is a need to have some implementations able to fully automate the sending of secure e-mail. One of these, not the only one, is the Full Service HISP, as it must add security to the e-mail while the message is flying through the internet and it has no ability to interact with the user.

Fully automated computers can’t have a one-by-one relationship, so to fully automate one needs a way to discover the certificate of the recipient. This is where directories come in. So for fully automated approaches one needs to have an infrastructure to lookup the certificate. In the Direct Project they are endorsing two different methods: both DNS-CERT and LDAP.

DNS-CERT is the method originally promoted by the Direct Project. It is a creative use of the DNS system, the system that helps us with the Internet name to address translation. It is based on IETF published specifications that were implemented originally mostly as an experiment, not taken seriously by most. Thus this solution is NOT supported by off-the-shelf secure e-mail.

The LDAP method is the additional one added by the S&I Framework -- Healthcare Provider Discovery. It is a more classic solution using Directory (LDAP). This is supported by off-the-shelf secure e-mail, but isn't typically used on a nationwide basis. So there are some questions on how well this will scale.

Larger Scale - Trusted 3rd Parties
As the scale of a Trust infrastructure gets big, one needs common trusted-third-parties. This is a system where you trust some third-party to attest that the individual is who they say they are.  This is seen in real life when we go to a party, the host of the party will introduce us to all the other people the host knows but for which we don't know them. The host of the party is the 'trusted third party'. The more well connected the host of the party is, the more people we will be introduced to. This is seen as well when we speak to someone and they explain that we met at the party, or they explain that they are a friend of a friend of ours. In social terms this is an inexact system, but it has worked for millenia. 

So in security we do similar with Digital Certificates. We have a trusted third party that issues Digital Certificates. Digital Certificates can be proven that they could only have been issued by that third party that you trust. In this case the trusted third party is called a "Certificate Authority" (CA). One model for a CA is to use  the company that the Healthcare Provider is employed by. This presumes that I have a reason to trust your company. The model of trusting the Healthcare Provider Organizations does change the trust relationship from Millions of Individual Healthcare Providers, to 6000 healthcare providing organizations. But that is still way too hard to manage. 

Ultimately this is where very large scale Certificate Authorities would fill in. There are even mechanisms where there could be a trust relationship of trusted third parties, called a Cross-Certification. 

Conclusion

The technology behind the Direct Project is really just secure e-mail. Being just secure e-mail is a good thing as it is proven technology that is readily available. This solution is a great solution for replacing the FAX machine, but is not quite a mature and robust exchange. The Direct Project technology still does need Policies and a Trust infrastructure. The good news here is that there is a small scale and moderate scale solution that is readily available. Growing this to Large is much harder. I hope that we keep the Direct Project at the original purpose, of replacing the FAX; and rather use robust Exchanges for longer term healthcare.

Meaningful Use Stage 2 -- 170.202 Transport

Updated August 2014 - Seems people are still reading this post. To find useful articles on the topic also reference to the Secure Communications, HIE, and Direct topics.

Meaningful Use Stage 2 seems to support Security, Privacy, and HIE Transport

In looking closely at the Meaningful Use Stage 2 criteria for both Certification and Incentives. I looked at the areas of my focus: Security, Privacy, and HIE transport. I mostly ignored everything else, so you will need to go to Keith’s blog for those details or any of the other really good resources.

My overall conclusion is that CMS and ONC have done a fantastic job of addressing Security, Privacy, and HIE transport. Yes I did say ‘fantastic’. There are some issues, but they can be fixed. There are improvements, but in many cases we need to take stepping stones today that are on the trajectory of the future. There are clear things that can and will happen in the future.

Security:They have made mostly minor changes to the security criteria. They are leveraging well known best practices and applying them only to Healthcare when there is something specific. They are leveraging the existing HIPAA Security rule and HITECH. The main changes this time around are added detail for Audit Logging, references to cryptography experts at NIST/FIPS, synchronization of clocks, and recommendations around encryption on end-user devices.

Privacy:They have included Privacy! They should be given kudos for this. Nothing earth shocking for any well done EHR or operational environment, but welcome guidance and encouragement for those that had not yet addressed Privacy. Their changes are directly to support HIPAA Privacy and HITECH. They have identified that security audit logging is an input to an Accounting of Disclosures, and a Access Log. They have defined what these reports would include. They have given stronger guidance on Amendments.

HIE Transport:They have given us one or two Push style transports, and recognized that they interoperate by way of a proxy service that can convert forward and backward. There is no real surprises here as ONC has spent much time developing the Direct Project. Healthcare Providers and EHR developers should really be focusing beyond Direct, but supporting minimal Direct is a good thing to do. It allows us as an industry to move away from the FAX, and start universally communicating and manipulating Documents. I will note that these more Exchange like HIE models would still be considered compliant under the optional third transport.

Conclusion:I will have more detailed blogs on all these topics. I will also be explaining why some want an Exchange style HIE vs using a Push style HIE. I will be discussing what should be done regarding Consent for nationwide exchanges. And I will be discussing other suggestions for Stage 3, with explanation of why I think it is ok for CMS/HHS/ONC to wait. I do still encourage vendors and providers to go above and beyond the minimum required by Meaningful Use.

Updated with links to further discussion:

• Meaningful Use Stage 2 -- 170.202 Transport
• Stepping stone off of FAX to Secure-Email
• What is the benefit of an HIE
• Meaningful Use Stage 2 FINALLY means Secure and Privacy Protecting

Huge HIE -- the Care Continuity Consortium

The acceptance of IHE profiles for building federation of Health Information Exchanges has reached another milestone. The IHE XCA/XCPD profiles are at the core of the exchange. I worked with this group as an adviser on the standards and their use within the NwHIN-Exchange. I so wanted to blog about it, but needed to keep quiet until HIMSS 2012.

In April 2011 five leading US health systems joined forces to create the Care Continuity Consortium, and promised to achieve a clinically operational secured sharing of health information between them by early 2012, this seems an aggressive challenge. But it also drew some respect to see pioneers in the use of electronic medical records systems such as Geisinger Health System, Kaiser Permanente, Mayo Clinic, Intermountain Healthcare and Group Health Cooperative, engage into national level of information exchange. 

They committed to leverage existing standards and IHE profiles already selected by the Nation-wide Health Information Network (NwHIN-Exchange) to enable a national-scale health information query service. At HIMSS last month they showed how this group supports their clinicians in their practice to access patient summaries information from different health systems.

They are sending the message that the current available standards and profile, do work and can be successfully implemented. This interoperability serves well the clinicians, and patient consent can be managed effectively with large scale interoperability being a matter of political will.

Further development will continue to be done to dial in more and more functionality, efficiency, and privacy. An important message is that the system can fill a need, does support more use-cases than Direct, and is more automateible due to a mature metadata model.  

Add the CCC network to the likes of NwHIN-Exchange and the European wide epSOS. There are more to come, but of course I must keep them a secret.

Reference:

Kaiser: Care Connectivity Consortium Celebrates Milestone at 2012 Annual HIMSS Conference

PR News Wire: Care Connectivity Consortium Celebrates Milestone at 2012 Annual HIMSS Conference 

Health Data Management: Five Provider Heavyweights to Share Data 

Health IT News: Pioneers in EHR use to create data exchange model 

Healthcare is not secure - trust suffers

There are a couple of articles on the subject of security in healthcare that clearly were prepared for release around HIMSS. They show up after HIMSS because Meaningful Use - used up too much of the news coverage.

• Bloomberg - Digital Health Data at Risk From Manager Support, Study Finds 
• Modern Healthcare -  Health IT lawyer decries 'epidemic' of privacy breaches
  
• Information Week - 5 Steps To Assess Health Data Breach Risks
• HIMSS Security Survey: Insights Security Issues for Hospitals and Medical Practices

Given that the excuses found in the articles are all over the spectrum this is revealing that there simply is a lack of a specific reason. This lack of a specific reason, as well as the stated financial investment ones, are an indication that it simply is not an important priority. To be blunt, lack of security doesn’t kill people, and there are a lot more treatment deaths to worry about. To be a priority in healthcare it needs to raise very high.  

I want to be very clear, to me this is the top priority. It is right there in the title of my blog. I do worry daily about indirect affects of poor security on patient treatment and safety. But as a subject matter expert, one must be able to see things from other perspectives in order to really understand your subject.

HHS/ONC/CMS have made small, but important, adjustments to Meaningful Use stage 2 statements that focus attention on the largest category of breaches, those caused by the loss of mobile devices that contain databases of PHI. For EHR certification criteria, the focus is first on smart EHR design that doesn’t leave PHI on end-user-devices, second if PHI is left behind it needs to be controlled using encryption. In the CMS rule this breach category is simply indicated as a reminder that covered entities are already obligated by HIPAA Security to do risk assessments and planning, so remember to assess and mitigate the risks of mobile devices that contain PHI getting stolen or lost. I knew this was going to be the case, since I worked with the writers of the NPRM as a member of the HIT Standards privacy and security workgroup and SME. See my blog article written last month - Encryption is like Penicillin. 

Trust suffers

The biggest negative of a lack of priority on security overall in healthcare, one that I don’t see any solution for, is ‘trust’. More specifically the lack of trust. Patients don't trust the system to protect them, Doctors don't trust the system to deliver good results or represent their work properly. This worry is holding back so much potential. Trust is a very hard thing to build, and even harder to hold onto. 

I have spent a half-dozen years creating standards for Health Information Exchanges; small, medium, and large. These standards designed in security layers, and privacy protections (that was my job after all). But if there isn't the perception of trust, all this technology can’t make things better. This perceived lack of trust is not completely due to just the breaches in Healthcare, but also the breaches everywhere on the internet. It is hard for the common man to believe that Healthcare industry will do better than other industries (e.g. video-gaming, banking, social-networking). We, the healthcare industry, are at the mercy of all industries. I really don’t think it would matter if we somehow magically made the healthcare industry the model of perfect security and privacy.

Baby steps are more effective than giant steps
I truly think that healthcare industry can continue to be relatively secure and privacy protecting. Yes losing control of 10 million patients records is actually low-profile. That is, there are plenty of other industries that are far more the focus of malicious acts. Most of healthcare breaches are due to carelessness and sloppiness.  It is not clear they were for any  malicious gain, or even resulted in any malicious gain. The rewards for attacking healthcare are simply not as fungible. This might change, I can't predict what dastardly things might be thought up. I do however think that the harm done so far has been minor in comparison. I don't like it, I want it better, but reality is that as long as there are higher priorities, those priorities will get the funding and resources.

The healthcare industry simply needs to continue to make reasonable advances (like promulgated in Meaningful Use). These advances are made easy because others have paved the way. Security mitigation technology is readily available like multi-layer networks, network based intrusion detection, data loss prevention proxy, host-based firewalls, automated patching, asset discovery/analysis, network encryption, host encryption, centralized/federated user identity/authentication, and audit-logging/management. Under a Risk Assessment scheme, these will be applied in proportion to the threats.

This is not just about prevention, but detection and action. We must detect security and privacy failures, and punish the one that caused the failure. We do this when the exposure is to a VIP, we need to do it just as strongly when it is Joe Everyone.

Note: This is not much different than 2010:

• Much said lately about Security/Privacy, but really nothing new
• A Look into the HHS Posts Data Breach Notifications
• EHR not used securely

FYI: Conference on Trusted Digital Identities and Cloud Collaboration in Bio-pharmaceutical Industry

This just crossed my desk. I won't be able to go, but would love to hear about it.

REGISTRATION OPEN FOR ONE-DAY CONFERENCE ON

TRUSTED DIGITAL IDENTITIES AND CLOUD COLABORATION

IN BIOPHARMACEUTICAL INDUSTRY

Co-hosted by DIA and SAFE-BioPharma

Fort Lee, New Jersey ( March 3, 2012) -- Registration is now open for a one-day conference exploring the use of standardized digital identities and cloud collaboration to improve speed, cost containment, and other efficiencies in the biopharmaceutical industry. Co-hosted by the DIA and SAFE-BioPharma Association, the conference -- Trusted Identities for Cloud Collaboration -- is scheduled for Sunday, June 24, 2012 in Philadelphia, PA, the day before the start of the DIA 2012 48^th Annual Meeting. Discounted rates are available for attendees to both meetings.

The conference will feature presentations by company personnel using standardized global digital identities in a broad range of applications. These include ePatient data entry with iPads, cloud-based clinical trial initiation, ePrescribing, digital signing and exchange of adverse events, eSubmissions, and electronic Laboratory Notebooks.

Presenters include…

• Jeremy Grant, National Strategy for Trusted Identities in Cyberspace, the White House initiative to improve online security, increase privacy, and foster economic growth and innovation.
• Randy Sabett, international authority on security and privacy law
• Deb Gallagher, Federal PKI Policy Authority, provider of trusted identities to all federal agency personnel, and
• Speakers from Astellas, AstraZeneca, Bristol-Myers Squibb, Exostar, Merck, National Cancer Institute, National Institutes of Health, sanofi-aventis, and Verizon
• Pulitzer Prize winning journalist/author, Michael Waldholz (Wall Street Journal; BloombergNews/Businessweek) will discuss the future of the global biopharmaceutical industry.

The first SAFE-BioPharma Digital Identity Awards recognizing innovative uses of the global SAFE-BioPharma® digital identity and digital signature standard will be presented during the closing reception.

For more information and registration visit http://www.diahome.org/en/FlagshipMeetings/27170/Trusted+Identities+for+Cloud+Collaboration

###

ABOUT SAFE-BIOPHARMA

For more information on the SAFE-BioPharma standard for digital identity and digital signatures used in life science and healthcare settings, visit http://www.safe-biopharma.org.

SAFE-BioPharma® is a trademark of SAFE-BioPharma Association. Any use of this trademark requires approval from SAFE-BioPharma Association.

ABOUT DIA

DIA is a nonprofit, global, professional, member-driven association of nearly 18,000 professionals involved in the discovery, development, and life cycle management of pharmaceuticals, biotechnology, medical devices, and related medical products. Through our international educational offerings and myriad networking opportunities, DIA provides a global forum for knowledge exchange that fosters the innovation of products, technologies, and services to improve health and well being worldwide. Headquarters are in Horsham, PA, USA, with offices in Basel, Switzerland, Tokyo, Japan, Mumbai, India, and Beijing, China. For more information visit: www.diahome.org.

IHE - ITI NEW Educational Webinar Series

This just crossed my desk ------

Greetings IHE members,
 
IHE International is pleased to announce the upcoming ITI Educational Webinars.  Register today!
 
v  Cross-Enterprise Document Workflow
Presented by Arianna Cocchiglia and Luca Zalunardo
03/06/12  9:00am CT
Attendee Registration
 
"The Cross-Enterprise Document Workflow (XDW) profile enables participants in a multi-organizational environment to manage and track the tasks related to patient-centric workflows as the systems hosting workflow management applications coordinate their activities for the health professionals and patients they support. This profile defines an instrument, called a "Workflow Document", to manage and track a shared workflow. It is designed to support the complexity of health services delivery with flexibility to adapt as workflows evolve."
 
v  Patient Identity Management
Presented by Eric Heflin
03/07/12  10:00am CT
Attendee Registration
 
"The HIE has several profiles, actors and transactions designed to enable participants to manage patient identities across different assigning authorities (and/or organizational boundaries).  In this presentation, these profiles will be introduced."
 
v  Healthcare Provider Directories
Presented by Eric Heflin
03/14/12  10:00am CT
Attendee Registration
 
"Several IHE profiles have been created to assist managing providers within, and across, organization boundaries. This presentation will introduce each of these profiles, including the actors, transactions, and options.  Deployment examples will be provided."
 
v  Enabling Document Sharing through IHE Profiles
Presented by Karen Witting
03/21/12  10:00am CT
Attendee Registration
 
"The purpose of this webinar is to provide an overview of the collection of IHE profiles which are intended to be used by communities for exchanging health information. The collection of profiles includes support for patient identification, health document location and retrieval, provider directories, and the protection of privacy and security. This white paper will show how various profiles work together to provide a standards based, interoperable approach to community and cross-community health information sharing."
 
Thanks to each of our presenters!
 

Note that prior ITI Webinars and presentations can be accessed at:
http://wiki.ihe.net/index.php?title=Current_Published_ITI_Educational_Materials