In Virginia, hackers penetrate a database for monitoring prescription drug use and remove 8 million patient records, demanding a huge ransom for the information’s return.
In California, immunization records and health insurance info fall prey to hackers who breach a University of California Berkeley database of 160,000 patients.
In Dallas, a security guard stands accused of hacking into a local medical clinic’s computer system, allowing him to upload a virus into the patient database.
Such are the dangers of posting private information on the very public Internet, even though that access is so vital to companies and consumers today.
To make sure that medical workers privilege privacy, a recent federal mandate requires that health data be encrypted so it can be safely shared among physicians, specialists and others in the fragmented industry.
“If somebody sends an innocent fax to a specialist, and it sits there on the machine, or if they send something to an individual in a public place, that would be a breach,” says Bill Campbell, chief financial officer of Manage-Trak, a Baton Rouge-based company that is selling a new, secure messaging program to health professionals.
The software, called Encrypt-A-Note, is designed for nontechnical users to work like a typical Web-mail application, but it incorporates an algorithm that scrambles data for viewers who don’t have the right key or password.
The carrot for buyers is that Encrypt-A-Note is a software-as-a-server program, meaning a company does not have to invest in expensive server equipment but licenses the application for use online and stores data on a remote server.
The stick is that government overseers are expected to start levying big fines on health care providers and their business associates that transmit personal information electronically without proper encryption.
“It puts the teeth or the enforcement arm into HIPAA,” says Aaron Blackledge, chief technology officer for Manage-Trak, referring to the Health Insurance Portability and Accountability Act, which requires health care providers to ensure patient privacy. “It will be very lucrative for [officials] to get involved and go out and enforce these violations.”
As part of the federal stimulus plan approved in February, the Health Information Technology and Clinical Health Act establishes tiered penalties for those who violate patient privacy rules, from $100 to $50,000 per incident up to $1.5 million total per year.
The HITECH Act clarifies HIPAA’s rules to extend to contractual associates of doctors, clinics, hospitals and so on by next February. It also gives an obvious financial incentive both to health care companies to comply, and to state attorneys general to go after violators.
On the other hand, while a federal Department of Health and Human Services document indicates that funding will be provided to “train state attorneys general in their new enforcement role,” lawyers with the Louisiana Attorney General’s office say they had not heard of the plan before Business Report’s inquiry.
“We have received no formal notification of our role in the enforcement,” spokeswoman Laura Gerdes says. “Nothing has come to us at all.”
Thomas Sawyer, former CEO of Baton Rouge’s General Health System and a consultant for Manage-Trak, says physicians he has talked with are “very aware and very concerned” about the potential costs to business of the new penalties.
“There’s been a lot of vagary in terms of the penalties in not being HIPAA-compliant. They’re fairly specific now,” he says. “There’s a great intent to enforce this fairly intensely.”
Of course, federal intent and action aren’t always in sync, but when they align in this case, Sawyer says patients will benefit from streamlined communication between health workers.
Quicker consultations involving the instant exchange of health data could mean dramatic improvements in quality of care, he says.
“This could greatly expedite medical intervention. Many times you could circumvent the need for hospitalization,” he says. “There’s potentially a big dollar savings, but it also facilitates a much better well-being for the patient.”
For example, a telemedicine pilot program connects East Baton Rouge Parish Emergency Medical Services crew with physicians at Our Lady of the Lake Regional Medical Center. By videoconferencing with paramedics, a doctor can make a diagnosis before the patient arrives at the ER. The system was scheduled to go entirely paperless this month, requiring a secure data exchange.
Manage-Trak isn’t the only game around. Blackledge, a Baton Rouge native, cites his competition as Arizona-based Tumbleweed Communications, Massachusetts-based Ipswitch and California-based Voltage Security.
Grudgingly, he also acknowledges Microsoft’s Exchange Server and Outlook, programs that encrypt messages but are not primarily Web-based.
Blackledge says secure messaging is a jumping off point for his company to develop a range of applications to connect private databases with the online universe. Another growth area he sees is encrypted E-consultations, where doctors can consult with patients through the Internet.
“This is really a springboard into other secure portal applications,” he says.
