Securing Images in the Cloud

By: Neil Buckley, VP Technical Solutions, CynergisTek Inc.

November 30, 2012

Take a moment to reflect on the decades of digital imaging development that have produced “public embarrassment 2.0” in the public sector. Digital imaging has showcased people with all the colors of the emotional rainbow and unparalleled stupidity — but also has been an amazing media to improve lives the world over. Now, take a moment to consider the images of our family, friends and indiscretions, live on a global stage, and then imagine what it would be like if the images that your doctor views were to reside on that same global stage.

As you do so, ask yourself how securely Facebook, YouTube, Pintrest, Photobucket, Flickr or Shutterfly are designed to protect the images your doctor uses to diagnose your condition from public view. Also imagine that you have been in an accident and the Emergency Department doctor needs to see your images before he performs surgery. Can Amazon, Rackspace or Google provide the infrastructure to support the confidentiality, integrity and availability required of business-critical image storage?

Of course, you might be thinking at this point, it’s just a picture, right? So, let’s examine that for a moment. The digital image rendered by the camera on your phone can range in size from very small to very large. The larger the photo, the steeper the cost to process and transfer the image. Anyone with a teenager and a shared data plan knows the value of teaching them to send small pictures. Businesses everywhere are running into this challenge, and where there are challenges, there are opportunities. Those opportunities are gaining traction in lowering the TCO of image lifecycle management.

Imaging has been in place at hospitals for decades. Traditionally this technology was a bulky piece of specialty imaging equipment that supported input to the process of a clinical diagnosis. This technology was supported by the development of the Digital Imaging and Communication (DICOM) protocol in the mid-‘80s, which served as a universal standard for image sharing in the clinical setting. When coupled with the HL7 transport protocol, this process became a catalystfor change in the clinical decision-making process. It became possible to support image review remotely. Like most things designed in the ‘80s and reengineered in the ‘90s, it was a specification meant to solve a problem and facilitate a better transaction. Confidentially, integrity and availability were afterthoughts on this solution. Later specifications of the protocol bolted on security to the solution without the same unilateral success as the earliest specifications.

Today, in 2012, our imaging technology has come a long way, but the images are no more secure or private than they were when we started decades ago. Clinicians want the most detailed imagery they can get when making a diagnosis. If we think about sending these large images, we quickly see the magnitude and complexity of the healthcare clinician’s use; these images are only dwarfed by the CGI industry.

As healthcare providers look to reduce their expenses, they will look to outsource image storage and delivery to cloud service providers. That outsourcing process can put patient data at risk. The obligation to keep the data safe, secure and private remains in effect, regardless of the competing demands to lower costs and improve care security, and privacy cannot be sacrificed.

There is no such animal as free-IT; all services, infrastructure and business processes come with costs. They also come with risk. Businesses and consumers utilizing digital imagery need to be aware of these risks. Those risks might seem obvious, but let’s examine the most common and relevant ones for the purposes of this article.

Unauthorized access and disclosure of personal information. Typically at the top of most healthcare IT initiatives, not the clinical initiatives. Migrating private services to a public cloud infrastructure will place the data on those cloud infrastructures at greater risk than data supported, administered and delivered internally. In addition, organizations will need to open their infrastructure to those cloud services to ensure that the clinical workflow is not impacted adversely by the transition to the new service offering.

Ensuring the integrity of the data and service. Healthcare typically equates integrity and privacy with encryption. Traditionally, encryption has come in two distinct flavors, data encryption and transport encryption. For reasons I would attribute to poorly written legislation and regulatory guidance, data encryption has become device encryption, and the impact is still being felt on the internal infrastructures of most healthcare organizations across the country.

Managing an encryption model that adequately protects the data while facilitating the demand of the clinical workflow will be challenging for most information security programs. In translation, the security provided by the cloud providers will be accepted and remain untested to satisfy the demands of the clinical data, and the images will be at risk.

Availability of clinical data is a risk to the business for a whole host of reasons, but for the purposes of this discussion we’ll focus on patient safety. Cloud services utilize the Internet and shared infrastructure to keep the costs of their services lower than what your practice could theoretically reproduce them for internally, though I think we’re too soon to tell whether the ROI on the cloud services industry has been properly calculated. The risk to organizations is that the Internet or Amazon EC2 is down (well, it did happen). This will translate into potential patient safety issues. If you can’t process the image, it will be tough to render a clinical decision.

Of course I’ve used an example that will undoubtedly raise some eyebrows as to why folks would even consider this service as a cloud candidate. Consider for a moment; healthcare- clinical data is regulated and must be retained for a period of no less than 7 years

Now ask yourself if this is core business to healthcare? It’s not, taking care of sick people is. To accomplish the improvements demanded by the people, healthcare will need to be able to take advantage of these cost savings.

Well, damn the torpedoes, we’re going to do it, we’re out of options, our budgets have been flat since 2008, patient census is down, referrals are down, and we need to reduce costs so we can ensure the continuity of the mission to take care of sick people!

Take heed. Prepare the battlefield you’ll be fighting on. Shape it as much as you can to ensure victory (if that’s even possible). Ensure that you understand the risks and exposures of the cloud architecture options in painstakingly technical detail. Ensure that you understand the use of images to support the business of healthcare. Ensure that you have the support of the clinical community. Most IT practitioners in healthcare spend very little time in the point-of-care areas, and this can be disastrous when migrating an internal workflow to an external workflow. Embrace the SLA, be the SLA, and please use a seasoned contract professional to ensure that the provider is contractually obligated to deliver on your needs and requirements.

So, what should you do first?

Businesses should invest in the proper training and support staff to assist you in transitioning from an internal infrastructure to a cloud-based infrastructure. This means that you’ll need to accept that you’ll need to cultivate, hire or partner with the right talent. Given my experience on the inside of a large healthcare IT shop for a decade, I would advocate for hiring or partnering to deliver the right solution to your community.

Get educated and keep your eye on the next-generation horizon. The next-generation cloud service products that look to support an SLA model that embrace confidentiality, integrity and availability as part of the base feature sets, not a bolt-on, not an afterthought in response to pending legislation. CIA is actually considered part of the base specification and as history has taught us, when features are considered part of the base specification, and implemented smartly, our lives just become easier.

Consumers should just be cautious and smarter about the images they post. There is no privacy or security in the cloud or on the Internet. If you wouldn’t shout it in a quiet public setting like yoga, church or a high-end restaurant or perform it in the middle of the park on the busiest day of the year, don’t post it. It’s that simple.

Health Breach Tally Tops 500; But Do the Stats Reflect Real Progress?

By Marianne Kolbasuk McGee, Managing Editor, HealthcareInfoSecurity

Major U.S. healthcare data breaches have surpassed a significant milestone: More than 500 breaches have been confirmed since September 2009, when the U.S. Department of Health and Human Services began keeping tabs.

Those incidents, each affecting 500 or more individuals, have impacted a combined total of 21.2 million individuals.

Hitting the 500-breach milestone is a signal that “healthcare continues to lag in its commitment to resources for privacy and security programs,” says Mac McMillan, CEO of CynergisTek, a data security and privacy consulting firm. Until organizations pay more attention to breach prevention, “we’re going to continue to see these kinds of results,” he says.

HIPAA compliance audits conducted on behalf of HHS “have identified a critical gap in organizations’ ability to monitor what users are doing in their enterprises,” McMillan adds.

But McMillan is somewhat encouraged that fewer huge breaches have been reported so far in 2012, compared with 2011. Only one incident has affected more than 500,000 individuals in 2012; last year, there were five such incidents.

“While we still lag in several critical areas, organizations are doing better,” he acknowledges.

Increased awareness of breaches is leading to the reporting of more incidents, the consultant contends. “I think the numbers today are far more accurate that those reported in past years,” says McMillan, who is also chair of the Healthcare Information and Management Systems Society’s Privacy & Security Steering Committee.

To continue to reduce the number of serious breaches, McMillan says healthcare organizations need to invest more in security technology, training and improving how they monitor their business associates.

The Latest Numbers

In the past month, only four incidents affecting about 14,000 individuals were added to the HHS’ “wall of shame” tally of breaches, bringing the total to 502 incidents since September 2009, when the HITECH Act-mandated HIPAA breach notification rule took effect.

The HHS Office for Civil Rights adds – and sometimes deletes – breaches as it conducts investigations and confirms the details. OCR recently consolidated two entries involving Howard University, which are now listed as one incident affecting 66,000, an OCR spokeswoman confirms.

Since 2009, 54 percent of the data breaches reported have involved lost or stolen unencrypted electronic devices or media. That includes three of the four breaches added to the list over the last month. Breaches involving business associates account for more than 20 percent of all incidents.

So far, OCR has posted about 91 incidents occurring in 2012 affecting about 2.06 million individuals. Only four of those incidents have affected 100,000 or more individuals.

By comparison, the OCR list includes about 148 incidents in 2011 affecting 10.8 million. That includes five huge incidents accounting for 86 percent of all those affected by breaches last year.

Largest 2012 Breaches

The largest 2012 breaches reported so far include:

• Utah Department of Health: A March hacking incident that affected 780,000 individuals.
• Emory Healthcare: A February incident involving 10 missing computer disks that affected 315,000 individuals.
• South Carolina Department of Health and Human Services: A January incident affecting 228,000 Medicaid recipients. That case involved a now-fired employee who was arrested for allegedly transferring patient information to his personal e-mail account.
• Memorial Healthcare System in Hollywood, Fla.: A July breach involving improper access to patient information via a physician web portal by an employee of an affiliated doctor’s office affected 102,000 individuals.

Reason for Optimism?

Although the number of breaches, and the number of individuals affected, appears to be declining so far in 2012, “I wouldn’t put too much weight on that yet,” says Dan Berger, CEO of IT security audit firm Redspin. That’s because the totals still could rise in the weeks ahead.

“Certainly the ‘carrot and stick’ impact of [HITECH Act EHR] meaningful use incentives, which require a HIPAA security risk analysis, and recent [OCR] breach penalties has elevated IT security in importance among providers,” Berger says. “But we’ve yet to see widespread improvements in two critical areas – business associate oversight and employee security awareness training.”

A security risk analysis is only the starting point in any breach prevention effort, Berger stresses. “Many organizations put the emphasis on compliance which, while important, is not synonymous with security. We believe IT security in healthcare is an ongoing process.”

Healthcare organizations must maintain a state of breach prevention readiness through a persistent cycle of testing, remediation and validation, he adds. “The same is true for employees and business associates. It is not enough for an employee to attend HIPAA training once per year or a BA to simply agree to security provisions in a contract. Security requires more engagement.”

Introducing PhysBizTech and Mac’s Blogspot

From the publishers of Healthcare IT News comes PhysBizTech, a media resource designed to fill this information gap by offering business and technology intelligence to forward-thinking physician practices looking to increase their profitability while enhancing patient care.

We were delighted to accept PhysBizTech’s invitation for Mac to support on ongoing blogspot on issues of privacy and security.  We will try to “keep it real” (like we always do) for the subscribers, who as physician practices, have real challenges keeping up with the regulatory realities of HIPAA and HITECH, and the business of privacy and security in the practice operations.

So, read on and enjoy Mac’s inaugural post!

http://www.physbiztech.com/blog/make-healthcare-data-security-2012-priority