1. Design of Health Technologies lecture 22 John Canny 11/28/05

2. Healthcare IT Security Security is a critical aspect of Health IT performance: without secure systems, privacy protection is impossible. The Health and Human Services Agency published a proposed “security rule” in August 1998. Final rule was adopted Feb. 2003. It’s a set of best practices for securing information systems. Compliance is mandatory for health providers, plans, and clearinghouses.

3. Security Rule Compliance Large organizations were required to comply by April 21, 2005. Small organizations must comply by April 21, 2006. Final rule is available here: http://www.cms.hhs.gov/hipaa/hipaa2/regulations/security/default.asp

4. Security Rule Compliance The security rule creates an additional burden on providers to improve their IT infrastructure. On the flip side, the same improvements might actually improve service (e.g. enabling internet-based secure health information access, or secure wireless). A more sanguine perspective is that any mandatory IT upgrade is an opportunity for global improvement – many problems can be fixed at once.

5. Data CIA (Confidentiality, Integrity, Availability) The security rule is divided into 3 parts: 1. 1. Administrative safeguards 2. 2. Physical safeguards 3. 3. Technical safeguards

6. Administrative safeguards These steps are required at the highest level: 1. 1. Risk Analysis must be performed 2. 2. Risk Management sufficient for compliance 3. 3. Sanction Policy: against employees who don’t comply 4. 4. Information System Activity Review: records & logs 5. 5. Security Responsibility: assign a security official

7. Administrative safeguards Some required steps: 1. 1. Isolate Health Clearinghouse from rest of organization 2. 2. Access Control for protected records 3. 3. Access Establishment and modification 4. 4. Security Reminders: updates and messages 5. 5. Protection from Malicious Software 6. 6. Log-in Monitoring: all login attempts 7. 7. Password Management

8. Administrative safeguards Standards for availability: 1. 1. Data Backup Plan 2. 2. Disaster Recovery Plan 3. 3. Emergency Mode Operation Plan 4. 4. Testing and Revision of contingency plans 5. 5. Applications and Data Criticality Analysis: Identify the critical components in an emergency

9. Physical Safeguards Here are some: 1. 1. Facility Access Control 2. 2. Emergency Facility Access 3. 3. Physical Access to Workstations 4. 4. Media Access Controls 5. 5. Disposal Policies 6. 6. Media Erasure before Re-use

10. Technical Safeguards Here are some: 1. 1. Access Controls 2. 2. Unique User IDs 3. 3. Emergency Access Procedures 4. 4. Automatic Logoff (optional) 5. 5. Encryption and Decryption (optional) 6. 6. Audit Controls (optional)

11. Technical Safeguards Some more optional sections: 1. 1. Access Records: who accessed PHI 2. 2. Personal Identity: is the user really who they claim to be? Biometrics? 3. 3. Transmission Security: Secure communication channels

12. Over the Atlantic… The European Parliament has been passing security and privacy rules as well. “On the protection of medical data” (Recommendation R(97)5) is still a recommendation. The most recent is Directive 2002/58 “Privacy and electronic communications: Processing of personal data and the protection of privacy in electronic communication”

13. R(97)5 summary The European recommendation covers a lot of ground in the short document. It specifies both HIPAA-style privacy rules, as well as data-protection procedures. Stronger emphasis on results of genetic testing: 1. 1. Patients should have access 2. 2. It should not be illegal in the country 3. 3. The information is not likely to cause harm (?)

14. Gritzalis et al. paper This paper is based mostly on EU directives on general electronic privacy, as well as the medical security proposal. The paper also includes a sample RA (Risk Analysis) for the Beta-Thalassemia unit using CRAMM (CCTA Risk Analysis and Management Methodology).

15. Risk Analysis

17. Gritzalis et al. paper Proposals: Authentication: Smart cards, X.509 certificates, CHAP, EAP Communication: SSL, application-level security Disclosure from client machines (discourage): Through explicit web form fields Cookies and client-side script engines Anonymization methods: various technical approaches are listed, not clear any of these are intended to be used.

18. Gritzalis et al. paper ASP model: Control local code execution. Any code to be executed locally must be signed by someone (e.g. Microsoft or Verisign). Aside: Smart phones typically include additional quality control for locally-run code: e.g. “True Brew” certification for Qualcomm Brew phones. Other Certification Programs: Sony (Playstation) Microsoft (Xbox) Nintendo etc…. Microsoft for Windows device drivers

19. Medical service provider responsibilities Inform users about their services, ask for consent for required uses of client information. Use standards such as CEN and HL7 Use RBAC (Role-Based Access Control) Moderated Mailing Lists (?) w/ usage permissions Do not downgrade functionality to users who refuse to provide specific information

20. Discussion Questions Q1: Is Quality Certification a viable method for helping to secure medical software? Points of comparison: phone and driver software just mentioned, medical equipment, drugs,… How could it be implemented? Q2: Implementation of the security rule usually requires a significant overhaul of IT infrastructure. Discuss the trade-off in building secure systems “from scratch” vs. a “generalized firewall” approach which puts secure screens around vulnerable IT.