Health network surveillance

Last updated

Health network surveillance is a practice of health information management involving a combination of security, privacy and regulatory compliance with patient health information (PHI). Health network surveillance addresses the rapidly increasing trend of electronic health records (EHR) and its incompatibility with information security practices that ‘lock down’ access through methods such as: modern firewalls, intrusion detection and prevention devices, and anti-virus and end-point protections. [1]

In contrast to restrictive security measures, health network surveillance runs in the background of networks through a combination of hardware and software devices that allow for real time monitoring that do not impede the day-to-day health care operations that make up healthcare systems and deliver essential services to patients and clients. Surveillance, in this context, means tracking the connections that are made between computers. These connections can be between computers within a health network or from a computer outside the health network. Effectively, this approach has the capacity to provide additional assurance that standard protective devices and approaches are working.

Governments at all levels have increased legislation and regulation of the ways health information should be handled, for both public and private health organizations in many countries. Major regulatory bodies and legislation in Canada and the United States include but are not limited to: the Health Insurance Portability and Accountability Act (HIPAA), the Personal Information and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act (PHIPA), International Organization for Standardization (ISO), PCI Security Standards Council, and Canada Health Infoway. [2] Health network surveillance is able to address the increasingly complex legislation, regulations and policies imposed on health organizations in a way that restrictive security measures can only reduce the service levels of these organizations.

Health network surveillance also has a proactive impact by providing business intelligence and network monitoring that can improve a health organization's efficiency and effectiveness through real time information that can support decision making about network architecture, business processes and resource allocation. Two approaches enable the development of health network surveillance tools. Commonly used flow measures based on a number of flow protocols available on the market use the capacity of routers and switches to provide data regarding the functioning of networks. [3] The use of connection tracking works to record every connection between devices in a monitored network. There may be advantages in connection tracking techniques as they avoid sampling, produce more data in real time and put less load on the functioning of networks.

See also

Related Research Articles

Packet analyzer Computer network equipment or software that analyzes network traffic

A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer, is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network. Packet capture is the process of intercepting and logging traffic. As data streams flow across the network, the analyzer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.

Closed-circuit television Use of video cameras to transmit a signal to a specific place on a limited set of monitors

Closed-circuit television (CCTV), also known as video surveillance, is the use of video cameras to transmit a signal to a specific place, on a limited set of monitors. It differs from broadcast television in that the signal is not openly transmitted, though it may employ point-to-point (P2P), point-to-multipoint (P2MP), or mesh wired or wireless links. Even though almost all video cameras fit this definition, the term is most often applied to those used for surveillance in areas that require additional security or ongoing monitoring.

Surveillance Monitoring something for the purposes of influencing, protecting, or suppressing it

Surveillance is the monitoring of behavior, many activities, or information for the purpose of information gathering, influencing, managing or directing. This can include observation from a distance by means of electronic equipment, such as closed-circuit television (CCTV), or interception of electronically transmitted information like Internet traffic. It can also include simple technical methods, such as human intelligence gathering and postal interception.

Computer and network surveillance is the monitoring of computer activity and data stored locally on a computer or data being transferred over computer networks such as the Internet. This monitoring is often carried out covertly and may be completed by governments, corporations, criminal organizations, or individuals. It may or may not be legal and may or may not require authorization from a court or other independent government agencies. Computer and network surveillance programs are widespread today and almost all Internet traffic can be monitored.

Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. An RFID system consists of a tiny radio transponder, a radio receiver and transmitter. When triggered by an electromagnetic interrogation pulse from a nearby RFID reader device, the tag transmits digital data, usually an identifying inventory number, back to the reader. This number can be used to track inventory goods.

Mass surveillance Intricate surveillance of an entire or a substantial fraction of a population

Mass surveillance is the intricate surveillance of an entire or a substantial fraction of a population in order to monitor that group of citizens. The surveillance is often carried out by local and federal governments or governmental organizations, such as organizations like the NSA, but it may also be carried out by corporations. Depending on each nation's laws and judicial systems, the legality of and the permission required to engage in mass surveillance varies. It is the single most indicative distinguishing trait of totalitarian regimes. It is also often distinguished from targeted surveillance.

Medical privacy or health privacy is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also refer to the physical privacy of patients from other patients and providers while in a medical facility, and to modesty in medical settings. Modern concerns include the degree of disclosure to insurance companies, employers, and other third parties. The advent of electronic medical records (EMR) and patient care management systems (PCMS) have raised new concerns about privacy, balanced with efforts to reduce duplication of services and medical errors.

Center for Democracy & Technology (CDT) is a Washington, D.C.-based 501(c)(3) nonprofit. The organization which focuses on topics such as the rights of individual users in relation to technology policy, with the potential to affect the architecture of the Internet. The CDT has established a set of five key objectives which the organization is centered around. As described on the organization’s website, their first objective is to focus on promoting any legislation that may enable individuals to use technology for purposes of well-intent, while at the same time preventing its usage for harmful purposes. CDT’s second objective is to advocate for transparency, accountability, and a regard for human rights in the context of online platforms; this objective places a particular emphasis on setting a precedent for limiting the collection of the personal information of the average user. CDT’s third objective is to mitigate issues of online media censorship by governments, along with enabling individuals to access information freely without retaliation or punishment. Their fourth objective is to limit the ability of governments to perform surveillance activities on citizens. Lastly, their fifth objective is to highlight the importance of maintaining and supporting the globalized nature of the internet. These objectives are further defined within in the CDT’s six areas of focus including, Cybersecurity and standards, Equity in civic technology, free expression, government surveillance, open internet, privacy, and data.

Privacy International

Privacy International (PI) is a UK-based registered charity that defends and promotes the right to privacy across the world. First formed in 1990, registered as a non-profit company in 2002 and as a charity in 2012, PI is based in London. Its current executive director, since 2012, is Dr Gus Hosein.

Electronic health record Digital collection of patient and population electronically stored health information

An electronic health record (EHR) is the systematized collection of patient and population electronically stored health information in a digital format. These records can be shared across different health care settings. Records are shared through network-connected, enterprise-wide information systems or other information networks and exchanges. EHRs may include a range of data, including demographics, medical history, medication and allergies, immunization status, laboratory test results, radiology images, vital signs, personal statistics like age and weight, and billing information.

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to the deterrence theory, according to which punishing a behavior will decrease the violations both by the wrongdoer and by others. This view has been supported by economic theory, which has framed punishment in terms of costs and has explained compliance in terms of a cost-benefit equilibrium. However, psychological research on motivation provides an alternative view: granting rewards or imposing fines for a certain behavior is a form of extrinsic motivation that weakens intrinsic motivation and ultimately undermines compliance.

The ISO/TC 215 is the International Organization for Standardization's (ISO) Technical Committee (TC) on health informatics. TC 215 works on the standardization of Health Information and Communications Technology (ICT), to allow for compatibility and interoperability between independent systems.

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk related to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

Employee monitoring is the surveillance of workers' activity. Organizations engage in employee monitoring for different reasons such as to track performance, to avoid legal liability, to protect trade secrets, and to address other security concerns. This practice may impact employee satisfaction due to its impact on the employee's privacy. Among organizations, the extent and methods of employee monitoring differ.

The United States Federal Trade Commission's fair information practice principles (FIPPs) are guidelines that represent widely accepted concepts concerning fair information practice in an electronic marketplace.

Managed Trusted Internet Protocol Service (MTIPS) was developed by the US General Services Administration (GSA) to allow US Federal agencies to physically and logically connect to the public Internet and other external connections in compliance with the Office of Management and Budget's (OMB) Trusted Internet Connection (TIC) Initiative.

Computer surveillance in the workplace is the use of computers to monitor activity in a workplace. Computer monitoring is a method of collecting performance data which employers obtain through digitalised employee monitoring. Computer surveillance may nowadays be used alongside traditional security applications, such as closed-circuit television.

Information policy is the set of all public laws, regulations and policies that encourage, discourage, or regulate the creation, use, storage, access, and communication and dissemination of information. It thus encompasses any other decision-making practice with society-wide constitutive efforts that involve the flow of information and how it is processed.

The Health Information Technology for Economic and Clinical Health Act, abbreviated the HITECH Act, was enacted under Title XIII of the American Recovery and Reinvestment Act of 2009. Under the HITECH Act, the United States Department of Health and Human Services resolved to spend $25.9 billion to promote and expand the adoption of health information technology. The Washington Post reported the inclusion of "as much as $36.5 billion in spending to create a nationwide network of electronic health records." At the time it was enacted, it was considered "the most important piece of health care legislation to be passed in the last 20 to 30 years" and the "foundation for health care reform."

Medical device connectivity is the establishment and maintenance of a connection through which data is transferred between a medical device, such as a patient monitor, and an information system. The term is used interchangeably with biomedical device connectivity or biomedical device integration. By eliminating the need for manual data entry, potential benefits include faster and more frequent data updates, diminished human error, and improved workflow efficiency.

References

  1. For a discussion of these issues see G. Griener at the University of Alberta Law School. From a physician’s perspective see Eli Finkelstein, MD and PhD, Electronic Health Records: The Threat to Privacy, For Us Docs.
  2. As one exhaustive sample among many, see Canada Health Infoway, “Electronic Health Record (EHR) Privacy and Security Requirements”, www.infoway-inforoute.ca The provisions in all of the extent regulations track closely the security provisions of ISO 27000.
  3. IP Flow Information Export An alternative to the use of flow protocols is connection tracking. Netfilter Connection Tracking