Health network surveillance

Last updated

Health network surveillance is a practice of health information management involving a combination of security, privacy and regulatory compliance with patient health information (PHI). Health network surveillance addresses the rapidly increasing trend of electronic health records (EHR) and its incompatibility with information security practices that ‘lock down’ access through methods such as: modern firewalls, intrusion detection and prevention devices, and anti-virus and end-point protections. [1]

In contrast to restrictive security measures, health network surveillance runs in the background of networks through a combination of hardware and software devices that allow for real time monitoring that does not impede the day-to-day healthcare operations that make up healthcare systems and deliver essential services to patients and clients. Surveillance, in this context, means tracking the connections that are made between computers. These connections can be between computers within a health network or from a computer outside the health network. Effectively, this approach can provide additional assurance that standard protective devices and approaches are working.

Governments at all levels have increased legislation and regulation of the ways health information should be handled, for both public and private health organizations in many countries. Major regulatory bodies and legislation in Canada and the United States include but are not limited to: the Health Insurance Portability and Accountability Act (HIPAA), the Personal Information and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act (PHIPA), International Organization for Standardization (ISO), PCI Security Standards Council, and Canada Health Infoway. [2] Health network surveillance can address the increasingly complex legislation, regulations and policies imposed on health organizations in a way that restrictive security measures can only reduce the service levels of these organizations.

Health network surveillance also has a proactive impact by providing business intelligence and network monitoring that can improve a health organization's efficiency and effectiveness through real time information that can support decision making about network architecture, business processes and resource allocation. Two approaches enable the development of health network surveillance tools. Commonly used flow measures based on a number of flow protocols available on the market use the capacity of routers and switches to provide data regarding the functioning of networks. [3] The use of connection tracking works to record every connection between devices in a monitored network. There may be advantages in connection tracking techniques as they avoid sampling, produce more data in real time and put less load on the functioning of networks.

See also

Related Research Articles

<span class="mw-page-title-main">Surveillance</span> Monitoring something for the purposes of influencing, protecting, or suppressing it

Surveillance is the monitoring of behavior, many activities, or information for the purpose of information gathering, influencing, managing, or directing. This can include observation from a distance by means of electronic equipment, such as closed-circuit television (CCTV), or interception of electronically transmitted information like Internet traffic. It can also include simple technical methods, such as human intelligence gathering and postal interception.

Computer and network surveillance is the monitoring of computer activity and data stored locally on a computer or data being transferred over computer networks such as the Internet. This monitoring is often carried out covertly and may be completed by governments, corporations, criminal organizations, or individuals. It may or may not be legal and may or may not require authorization from a court or other independent government agencies. Computer and network surveillance programs are widespread today and almost all Internet traffic can be monitored.

<span class="mw-page-title-main">Mass surveillance</span> Intricate surveillance of an entire or a substantial fraction of a population

Mass surveillance is the intricate surveillance of an entire or a substantial fraction of a population in order to monitor that group of citizens. The surveillance is often carried out by local and federal governments or governmental organizations, but it may also be carried out by corporations. Depending on each nation's laws and judicial systems, the legality of and the permission required to engage in mass surveillance varies. It is the single most indicative distinguishing trait of totalitarian regimes. It is often distinguished from targeted surveillance.

Medical privacy, or health privacy, is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also refer to the physical privacy of patients from other patients and providers while in a medical facility, and to modesty in medical settings. Modern concerns include the degree of disclosure to insurance companies, employers, and other third parties. The advent of electronic medical records (EMR) and patient care management systems (PCMS) have raised new concerns about privacy, balanced with efforts to reduce duplication of services and medical errors.

Center for Democracy & Technology (CDT) is a Washington, D.C.-based 501(c)(3) nonprofit organisation that advocates for digital rights and freedom of expression. CDT seeks to promote legislation that enables individuals to use the internet for purposes of well-intent, while at the same time reducing its potential for harm. It advocates for transparency, accountability, and limiting the collection of personal information.

<span class="mw-page-title-main">Electronic health record</span> Digital collection of patient and population electronically stored health information

An electronic health record (EHR) is the systematized collection of patient and population electronically stored health information in a digital format. These records can be shared across different health care settings. Records are shared through network-connected, enterprise-wide information systems or other information networks and exchanges. EHRs may include a range of data, including demographics, medical history, medication and allergies, immunization status, laboratory test results, radiology images, vital signs, personal statistics like age and weight, and billing information.

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to the deterrence theory, according to which punishing a behavior will decrease the violations both by the wrongdoer and by others. This view has been supported by economic theory, which has framed punishment in terms of costs and has explained compliance in terms of a cost-benefit equilibrium. However, psychological research on motivation provides an alternative view: granting rewards or imposing fines for a certain behavior is a form of extrinsic motivation that weakens intrinsic motivation and ultimately undermines compliance.

A personal health record (PHR) is a health record where health data and other information related to the care of a patient is maintained by the patient. This stands in contrast to the more widely used electronic medical record, which is operated by institutions and contains data entered by clinicians to support insurance claims. The intention of a PHR is to provide a complete and accurate summary of an individual's medical history which is accessible online. The health data on a PHR might include patient-reported outcome data, lab results, and data from devices such as wireless electronic weighing scales or from a smartphone.

Health technology is defined by the World Health Organization as the "application of organized knowledge and skills in the form of devices, medicines, vaccines, procedures, and systems developed to solve a health problem and improve quality of lives". This includes pharmaceuticals, devices, procedures, and organizational systems used in the healthcare industry, as well as computer-supported information systems. In the United States, these technologies involve standardized physical objects, as well as traditional and designed social means and methods to treat or care for patients.

<span class="mw-page-title-main">Canadian Institute for Health Information</span>

The Canadian Institute for Health Information (CIHI) is an independent, not-for-profit organization that provides essential information on Canada's health systems and the health of Canadians. CIHI provides comparable and actionable data and information that are used to accelerate improvements in health care, health system performance and population health across Canada.

Protected health information (PHI) under U.S. law is any information about health status, provision of health care, or payment for health care that is created or collected by a Covered Entity, and can be linked to a specific individual. This is interpreted rather broadly and includes any part of a patient's medical record or payment history.

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

Health information technology (HIT) is health technology, particularly information technology, applied to health and health care. It supports health information management across computerized systems and the secure exchange of health information between consumers, providers, payers, and quality monitors. Based on a 2008 report on a small series of studies conducted at four sites that provide ambulatory care – three U.S. medical centers and one in the Netherlands, the use of electronic health records (EHRs) was viewed as the most promising tool for improving the overall quality, safety and efficiency of the health delivery system.

Computer surveillance in the workplace is the use of computers to monitor activity in a workplace. Computer monitoring is a method of collecting performance data which employers obtain through digitalised employee monitoring. Computer surveillance may nowadays be used alongside traditional security applications, such as closed-circuit television.

The Health Information Technology for Economic and Clinical Health Act, abbreviated the HITECH Act, was enacted under Title XIII of the American Recovery and Reinvestment Act of 2009. Under the HITECH Act, the United States Department of Health and Human Services resolved to spend $25.9 billion to promote and expand the adoption of health information technology. The Washington Post reported the inclusion of "as much as $36.5 billion in spending to create a nationwide network of electronic health records." At the time it was enacted, it was considered "the most important piece of health care legislation to be passed in the last 20 to 30 years" and the "foundation for health care reform."

The Fast Healthcare Interoperability Resources standard is a set of rules and specifications for exchanging electronic health care data. It is designed to be flexible and adaptable, so that it can be used in a wide range of settings and with different health care information systems. The goal of FHIR is to enable the seamless and secure exchange of health care information, so that patients can receive the best possible care. The standard describes data formats and elements and an application programming interface (API) for exchanging electronic health records (EHR). The standard was created by the Health Level Seven International (HL7) health-care standards organization.

Digital health is a discipline that includes digital care programs, technologies with health, healthcare, living, and society to enhance the efficiency of healthcare delivery and to make medicine more personalized and precise. It uses information and communication technologies to facilitate understanding of health problems and challenges faced by people receiving medical treatment and social prescribing in more personalised and precise ways. The definitions of digital health and its remits overlap in many ways with those of health and medical informatics.

Medical device connectivity is the establishment and maintenance of a connection through which data is transferred between a medical device, such as a patient monitor, and an information system. The term is used interchangeably with biomedical device connectivity or biomedical device integration. By eliminating the need for manual data entry, potential benefits include faster and more frequent data updates, diminished human error, and improved workflow efficiency.

Health data is any data "related to health conditions, reproductive outcomes, causes of death, and quality of life" for an individual or population. Health data includes clinical metrics along with environmental, socioeconomic, and behavioral information pertinent to health and wellness. A plurality of health data are collected and used when individuals interact with health care systems. This data, collected by health care providers, typically includes a record of services received, conditions of those services, and clinical outcomes or information concerning those services. Historically, most health data has been sourced from this framework. The advent of eHealth and advances in health information technology, however, have expanded the collection and use of health data—but have also engendered new security, privacy, and ethical concerns. The increasing collection and use of health data by patients is a major component of digital health.

Indiscriminate monitoring is the mass monitoring of individuals or groups without the careful judgement of wrong-doing. This form of monitoring could be done by government agencies, employers, and retailers. Indiscriminate monitoring uses tools such as email monitoring, telephone tapping, geo-locations, health monitoring to monitor private lives. Organizations that conduct indiscriminate monitoring may also use surveillance technologies to collect large amounts of data that could violate privacy laws or regulations. These practices could impact individuals emotionally, mentally, and globally. The government has also issued various protections to protect against indiscriminate monitoring.

References

  1. For a discussion of these issues see G. Griener at the University of Alberta Law School. From a physician’s perspective see Eli Finkelstein, MD and PhD, Electronic Health Records: The Threat to Privacy, For Us Docs.
  2. As one exhaustive sample among many, see Canada Health Infoway, “Electronic Health Record (EHR) Privacy and Security Requirements”, www.infoway-inforoute.ca The provisions in all of the extent regulations track closely the security provisions of ISO 27000.
  3. IP Flow Information Export An alternative to the use of flow protocols is connection tracking. Netfilter Connection Tracking