Personalized medicine, or tailoring medicine to individuals based on genetic and other information, promises major benefits to improve the quality of healthcare. This key trend is also sure to accelerate in the next few years to a major change driver as DNA sequencing becomes more affordable and algorithms to derive meaning from this data become more powerful. Many new types of sensitive data and intellectual property are used through the personalized medicine information lifecycle from collection, to use, retention, disclosure and disposal.

HIPAA, HITECH Act, GINA, and state level regulations such as CA SB 1386 regarding healthcare / genetic information and breach notification present a complex legal and regulatory compliance landscape. Privacy and security concerns about regulatory compliance, breaches and theft of IP abound, and often impede realization of the full benefits of personalized medicine. Advancing the science of personalized medicine requires vast databases of sensitive healthcare and genetic information, and access for research.

De-identification, for example based on the HIPAA 18 identifiers commonly found in protected health information, is often applied to enable research and help mitigate privacy and security concerns and risks. However, there have been several successful high profile re-identification attempts that have correlated de-identified data with the correct patients.

Clearly, even with de-identification, there is residual risk. Compounding this, genetic information is far from fully understood, and the genetic “dark regions” we don’t yet fully understand, may well hold information that increases re-identification risks.

In my next few blogs, I’ll apply best practices in healthcare privacy and security to take an objective approach to assess risks, apply safeguards using a multi-layered approach to effectively reduce residual risk to acceptable levels. I’ll look at various types of sensitive data used through the personalized medicine information lifecycle from collection, to use, retention, disclosure and disposal, assessing risks to confidentiality, integrity and availability of the data.

I’ll also look at recent healthcare security research underscoring the importance of usability of solutions and security, how a lack of usability can adversely impact compliance and risk, and practical strategies to implement strong and usable security. Hardware based security is enabling stronger and more usable security controls that can be used as part of a holistic multi-layered approach to effectively mitigate risks in personalized medicine, enabling benefits to be fully realized sans privacy and security incidents such as breaches.

What approach are you using to manage privacy and security risks and enable personalized medicine in your organization?

If you were at HIMSS this year, you saw how mobility is dominating the current health IT landscape. Today’s healthcare industry demands the latest technology and solutions from companies that are in touch with complex IT challenges. That’s why Toshiba, Intel and Microsoft have joined forces to provide next-generation mobile devices, applications and solutions that improve quality of care while reducing costs and meeting all compliance and security requirements.

The best way to understand the advancements in mobile devices is to see them for yourself. If you live or work near Dallas, Chicago, Los Angeles, or San Jose, you are invited to attend our special healthcare mobility events in June. These mobility roadshows are great opportunities to join other healthcare IT professionals in your area and hear from a panel of experts as they present the latest innovations in applications and devices. You’ll also have an opportunity to ask questions, demo new products and even win an Ultrabook™.

What will you learn? The healthcare panel will give you insight on:

• The latest breakthroughs in mobile healthcare technology

• Deciding which clinical workflows are most relevant for a secure mobile solution

• How to provide a range of hardware solutions that clinicians will love

• How the right management infrastructure can support both existing and new devices as you roll them out

Find out more about the events, which start June 4 in Dallas, and register here. The event will move to Chicago on June 5, Los Angeles on June 11, and San Jose on June 12.

What questions do you have?

In my previous blog, I discussed how the 4 V’s of Big Data apply to healthcare. This time around, I would like to focus on a specific class of Big Data solutions; distributed computing solutions that utilize Hadoop. So what is it exactly? 

Hadoop is essentially a software framework that supports the storage and processing of large data sets in a highly parallelized manner.  Two of the obvious benefits that Hadoop brings to Big Data solutions are scale and flexibility:

• Scale: You might remember from my last blog that “volume” is one of the key Big Data challenges facing health-IT organizations. Hadoop is typically deployed on a cluster of commodity servers. As computing or storage demand grows, the system is scaled by adding new nodes to the cluster. This is the “scale out” model, as opposed to “scale up” where an existing system is replaced with a new, more powerful system. The “scale out” model is less disruptive (and typically less expensive) for IT organizations than the “scale up” model.

• Flexibility: Variety of data is another consideration that is driving interest in Hadoop. While much of healthcare data is structured, resides in a traditional relational database, and conforms to a well-defined schema, there is also a lot of unstructured information such as images, faxes, and dictated/narrative notes. This unstructured information contains significant clinical and analytical value, but many organizations are not making effective use of it today. Hadoop includes the HDFS (Hadoop Distributed File System) and HBase, a non-relational, distributed database that has no problem storing these differing data types in a schema-less fashion. Furthermore, all of this data is triple-replicated across the cluster improving the resiliency of solutions that make use of this infrastructure.

So how are healthcare organizations making use of Hadoop today? Take a look at a new paper which describes in more detail how the healthcare industry can take advantage of Hadoop. Examples from three domains are highlighted; provider, payor and life sciences:

Read Intel Distribution for Apache Hadoop Software Helps Cure Big Data Woes

You might have gleaned from the title of the link above that Intel is among the growing list of companies convinced that Hadoop is a critical component of the data center, and at Strata a few weeks ago, Intel announced the North American release of the Intel Distribution for Apache Hadoop (IDH). Details can be found here.

Do you have any thoughts or experiences to share? How has Hadoop helped your organization? Please add to the discussion below. For information on the role Intel plays in Big Data for healthcare, please visit this site: Big Data and Analytics in Healthcare and Life Sciences. You can also follow me @CGoughPDX on Twitter.

Healthcare IT is moving away from the top down, “command and control” model of 10 years ago. Back then, IT provisioned all devices and the mobile device environment was more homogeneous, strongly managed and secured, to a much more diverse heterogeneous environment including BYOD, often with less manageability and security. In this new diverse and rapidly changing environment, a strong and effective detection and response capability becomes much more important. We can compare the new environment and this security model to an immune system where when a pathogen appears it is detected by the body and an immune response starts to eliminate the pathogen and put out antibodies to prevent a future recurrence.

In this analogy a pathogen in healthcare IT security could be a new type of malware or phishing attack, or some risky healthcare worker action such as attempting to copy unencrypted patient records onto a USB key, or attempting on impulse a post of sensitive healthcare data to social media. SIEM, DLP and global threat intelligence capabilities are just a few great examples of security detection controls. An effective immune response in healthcare IT security needs to be holistic and multi-layered in the sense of incorporating several administrative, physical and technical controls complementing each other for effective risk mitigation. Administrative controls may include updates to policy, risk assessments, effective training, audit and compliance, and security incident management controls. Physical controls may include locks and other physical access and tamper proofing controls for data, assets and facilities. Technical controls may include anti-malware, IPS, whitelisting, encryption, anti-theft and many others.

Of this mix of safeguards, and with key healthcare trends such as BYOD, social media, mobile healthcare and others increasingly empowering healthcare workers with more tools and options to get their work done, the human factor and effective training is becoming incredibly important. Recent HIMSS research shows if solutions or security are lacking usability, healthcare workers use these tools and options to get their job done in workarounds that add non-compliance issues and additional risk.

Compounding this challenge, recent HHS OCR audit findings shows that many healthcare organizations lack effective training. To be effective training must move beyond the “once a year scroll to the bottom and click accept model” to a much more continuous, bite-sized, gamified, engaging form, and enable the healthcare worker to apply and solidify their knowledge as a part of their daily job. Penetration testing needs to include the human factor to help detect vulnerabilities in end user behavior that can then be remedied. Some innovators such as Wombat Security Technologies have emerged with capabilities in this area. Security safeguards such as DLP also offer special value in helping educate healthcare workers on the job in “teachable moments” where at the point where they attempt an action that is out of compliance with policy the DLP control can inform them and educate them on safer alternatives.

What kinds of trends and risks, and detection and response safeguards, are you seeing in your healthcare organization?

At HIMSS 13, Dave Diamond, chief strategist at EMC, talked about how the IT and business sides of healthcare are now more aligned than ever, and how meeting Meaningful Use advanced that relationship. Watch the above video as he explains the opportunity going forward to analyze unstructured data and use that knowledge to benefit patient care.

What questions do you have?

When security technologies are introduced together with usability improvements in healthcare solutions they have a much greater chance of being approved and winning acceptance by healthcare workers. This is in contrast to introducing security technologies into healthcare organizations without usability improvements which at best have no usability impact, and may in fact have negative usability impact.

In my last blog, Improving Healthcare Solution Usability with Single Sign-On, I describe how too many layers of login is one of the most cumbersome usability challenges that compels healthcare workers to do risky workarounds out of compliance with privacy and security policy. Single Sign On (SSO) solutions provide a solution that can greatly reduce the number of sets of credentials as well as the number of actual logins required by healthcare workers during their day, providing major usability benefits. When such a solution is combined with more usable forms of multi-factor authentication such as wireless proximity cards (RFID, NFC or other) it can greatly improve both security and usability. In this type of solution once the healthcare worker has logged into a device they can start up multiple apps within their session without having to re-authenticate to each app. As more healthcare apps are integrated with such a SSO solution the number of separate credentials needed for the healthcare worker can be reduced, eventually to a single set of credentials required to login to the SSO solution.

Many SSO solutions also enable healthcare organizations to implement policy where the first login of the day requires 2 factors, perhaps the proximity card and a password, but thereafter as long as the clinician authenticates at another point in the network with their proximity card within a configurable amount of time defined by policy, eg 2 hours, then the proximity card alone is sufficient to authenticate and no password is required. This effectively enables the clinician to move between devices throughout the day with a simple tap of their proximity card.

SSO may also provide patient context sharing where different healthcare apps running in the same session track the same patient automatically so a clinician that searches and finds a patient in the Electronic Health Record (EHR) system can then switch over to a Picture Archiving and Communication System (PACS) and it has already automatically found the same patient, freeing the clinician from having to search for the patient again in each application. Such patient context capability may be based on the Clinical Context Object Workgroup (CCOW) standard. Clearly another major usability benefit that also mitigates risk of a clinician accidentally looking at different patients across different apps.

Just as important as easy login is minimizing risk of a live session being hijacked once the authenticated healthcare worker moves away from the device with the open live session. This can be done by setting an inactivity timeout to a low number of minutes, which in practice is workable from a usability standpoint since a simple tap of the wireless proximity card gets the healthcare worker back into their session. In the future technologies such as facial recognition may also enable the device to detect when the healthcare worker moves away, closing the session automatically and further reducing the window of opportunity for session hijacking.

Biometrics holds promise in further freeing the healthcare worker from having a wireless proximity card. This is especially compelling in healthcare where not having to touch anything can be a significant healthcare improvement since healthcare workers need to keep sterile hands. To achieve this improvement biometrics need to be both highly reliable and resilient to spoofing. For example viable facial recognition would need to have negligibly low false accept and false reject rates, and would have to be able to detect if a face in front of a device was a picture or a real person. Several strategies are emerging for this including multiple cameras able to detect depth, and facial recognition strategies that require some motion such as blinking to ensure the subject is not a static picture. The reality in healthcare is many healthcare workers, such as doctors working in multiple healthcare organizations, need separate credentials for each organization, and in a worst case a separate proximity card for each facility. As more healthcare organizations implement biometrics this has potential to reduce the number of tokens such as proximity cards required by a given healthcare worker. Furthermore, strategic initiatives such as National Strategy for Trusted Identities in Cyberspace (NSTIC) have the potential to separate Identity Providers from Service Providers where healthcare workers have one set of credentials to authenticate with the Identity Provider and could then access multiple Service Providers such as healthcare organizations without having to be issued a separate set of credentials from each healthcare organization.

Another technology that holds major promise is virtualization with “follow me session” where a healthcare worker that has logged into a given device to start up a secure session, started up healthcare apps within their session, and located a given patient medical record, may then move to another device, login and get access to the same session without having to start the apps and search for that patient again. This becomes particularly compelling as the number and types of devices healthcare workers use increases and their use cases require them to move between the devices seamlessly. This capability can also be especially beneficial where healthcare workers must use many shared workstations throughout their day and switching of devices is frequent even within a given patient encounter. Along with this type of compute model one can do centralized patching and management, leading to major security, manageability and operational efficiency benefits. Where virtualized healthcare clients running on mobile devices have the ability for secure local storage of limited healthcare data, for example just records for the patients a healthcare worker will see that day, they enable healthcare workers to be productive even in areas lacking network coverage or performance, such as rural areas or patient homes. This improved availability is particularly important has healthcare becomes more decentralized.

What kinds of solutions that combine usability and security improvements are you seeing in your healthcare organization?

Middle East oil producers have accumulated handsome budget surpluses thanks to sustained oil prices during the last decade and governments are doing the right thing by spending these on social development. Healthcare and education are the key sectors that are benefiting from this boon and information technology is claiming a fair share of government spending.

Qatar has already been spending a good part of its oil wealth in education and the Kingdom of Saudi Arabia is investing heavily into healthcare services including large IT deployments which include setting up three data centres and one of the largest national PACS deployments in the world. All these initiatives are tapping on cutting edge cloud solutions which offer seamless access to patient data across the care continuum as well as securely and cost effectively storing patient data.

Intel and our technology partners are increasingly shifting focus to healthcare IT projects in the region. We recently held a workshop in Riyadh with Dell on mobile healthcare to learn from leading healthcare providers how they are planning to improve care coordination with technology. Hamad Medical Corporation in Qatar has just delivered a Clinical Information System (CIS) Conference in Doha to more than 1,400 clinicians which offered CME, CNE and CPD credits to participants. How is that for a change that awards our caregivers for learning effective use of technology?

While the region is on a fast track preparing their health workforce for improved patient care, we have been researching how the Middle East is faring with respect to mobility and care coordination vis-à-vis the developed world. We have just completed a regional survey with HIMSS Analytics and the results are fairly surprising.

In some aspects, the region is way ahead and in some respects catching up. Among mobile devices provided to clinicians, tablets specifically for healthcare use is expected to rise to 41 percent this year from about 24 percent, while all types of cellular phones and pagers are on decline. This does not mean clinicians won’t be using them. They will simply become Bring Your Own Devices, a big challenge for device manageability. Only 3 percent of the health workforce is expected to get a smartphone or feature phone compared to as high as 45 percent procured by the healthcare institutions before.

I will present the survey details at a HIMSS Middle East Regional Event in Riyadh next week, and have the honor of addressing distinguished participants from regional governments, healthcare industry and the IT sector. I would like to share one worry that keeps me awake at night. A recent report from Bank of America is forecasting that the oil price will halve within two years due to a number of factors including yet again greater use of technology. Should this occur, would the Middle East governments have the same enthusiasm to continue with the social investments in healthcare and education or start to cut back just like the developed world is doing today?

How do we keep the momentum going to finally reap the benefits of current investments in healthcare IT? What do you think?

Rick Cnossen is the Worldwide Director, Healthcare IT, at Intel Corp.

At HIMSS 13, Will Morris, MD, associate chief medical information officer at Cleveland Clinic, unveiled the organization's new patient care app that is a heads-up dashboard of clinical care information for physicians. This application allows clinicians to view a risk-stratified list of patients based on their health status via a live Windows* 8 interface tile. Users can then select a patient and view the updated medical record in the Windows 8 touchscreen experience.

In the above video, learn how the app was designed and the benefits that clinicians, and patients, will realize with its deployment on the front lines of healthcare.

What questions do you have?