BETTER TOGETHER. We take content seriously. Leave no application data behind. Content apps for the digital era.

Transcription

1 BETTER TOGETHER We take content seriously. Content apps for the digital era. Leave no application data behind. 1

2 ENERGY & ENGINEERING LIFE SCIENCES HEALTHCARE FINANCIAL SERVICES PUBLIC SECTOR COURIER SNAP CONCERT EXPRESS FOCUS CAPTURE CONTENT PROCESS COMMUNICATE TRUST DECOMMISSION CONTROL OPTIMIZE ANALYZE Documentum as a Service InfoArchive as a Service Private Cloud Hybrid Cloud Public Cloud

3 Securing Patient Rights, Privacy & Informed Consent in the Digital Age Ari Mattila, Nordics Dmitry Etin, EMEA Copyright 2016 Dell.. All rights reserved. 3

4 JOIN THE CONVERSATION! #MMTM16 #HealthIT ECD SERVICES Take the LEAP personality quiz and win! Genius Labs Garden Level Foyer Connect with us 4

5 Introduction Patient Privacy and Consent is a corner stone of every national healthcare transformation program. With all the leakages and ransom cases happened lately in the industry, there is no bigger concern than patient data security. During this session you will learn how different countries approached this challenge and how technologies can enable seamless and secure access to sensitive data. 5

6 Stereotypes and reality 6

7 Is there a real issue? Transition from hospital centric to patient centric healthcare Society concerns (irrational) Security & Privacy Legacy legislation struggles to address modern reality State concerns (rational) 7

8 Mindset slows down the development Locked potential 360 patient view Data sharing Patient engagement Shared workflows (e-referral, e-consult etc) Results to Malpractice, duplications - lower qaulity and higher cost Local hospital regulations are sometimes more restrictive than they have to be Long cycle legistlation 8

9 Unlocking the value 9

10 Do we really need to change anything? Fears Value 10

11 Is it a technology challenge? Cultural Regulatory Inertial Organizational 11

12 Technology decreases the risk Sharing technologies, security technologies exist 20+ years Don t look for a magic product this is a solution to meet legislation and cultural nuances Every country has different flavors for example in patient privacy and concent regulations Combination of technology peices flexible enough to implement the whole puzzle Profiles mapped to Security & Privacy Controls Security & Privacy Controls IHE Profile Profile Issued Audit Log Identification and Authentication Data Access Control Audit Trails and Node Authentication 2004 Consistent Time 2003 Enterprise User Authentication 2003 Cross-Enterprise User Assertion 2006 Basic Patient Privacy Consents 2006 Personnel White Pages 2004 Healthcare Provider Directory 2010 Document Digital Signature 2005 Document Encryption 2011 October 10, Secrecy Data Integrity Non-Repudiation Patient Privacy 12

13 Experiences - Finland Legislation Legislation about the national Kanta system Revised legislation on consent management Information to patient Medical records stored in the Patient Data Repository may only be used by healthcare employees who have access rights to the archive. The treatment relationship is also verified electronically. Consent from patient A consent is valid until further notice and covers all medical records already held in the Patient Data Repository, as well as any records entered into it later. Refuse the use records of certain healhtcare unit Refusals Patients may limit the coverage of their consent by entering a refusal. Refuse the use of e.g. records relating to a specific treatment visit or a certain healthcare unit. 13

14 Experiences - Georgia Centralized approach Rapid change in legislation 14

15 But there are more things to solve How to secure the endpoints and clients? There are sharing models where the parties are equal like two regions. If enforcement of policies happens elsewhere for your data you have to trust that enforcement. DON T TRY TO SAVE THE WORLD YOU HAVE TO START SOMEWHERE 15

16 Logical components Patient Privacy and Informed Consent 1. Consent Capture 2. Policy Administration 3. Policy Enforcement Informing the Patient Capturing the Patient s Decisions Defining the Policies Specifying Policy Attributes Authentication Authorization 16

17 Patient Privacy and Informed Consent (PPIC) Server Access Doc. #123 PEP Access Doc. #123 Enforce the policies Policy Enforcement Point (PEP) Can Alice access Document #123? PDP Yes, Permit Decide Policy Decision Point (PDP) Retrieve user role and document classification PIP PRP Supporting information Policy Information Point (PIP) Policy Retrieval Point (PRP) Load policies PAP Manage the policies Policy Administration Point (PAP) 17

18 Before Privacy Enforcement Integrated Patient Record 18

19 With Privacy Enforcement PEP PEP PRP Integrated Patient Record PAP PIP PDP 19

20 Take aways Value vs. Risk Non-technical Collaboration Centralization Build the case where value is higher than the risk. We as technology and solution provider help to decrease the risk and enable the value creation. Complexity comes from combination of patient corcerns old regulations from paper times, policies rich with details and expections. Success requires collaboration between legistlator such as ministy of health, hospitals, healthcare organization and technology. Less points you need to secure, more robust the solution is. Our experience tells that centralized approach is proven to work in practice. 20

21 LET US KNOW WHAT YOU THOUGHT Take the Session Survey 1. Open the schedule with the Momentum App 2. Go to the session you attended 3. Open Session Survey 4. Answer the 4 questions and submit. Thank you! 21

22 MOMENTUM BARCELONA APP AND WIN! BEYOND SILOS Play the BEYOND Game and win a Raspberry Pi pre-loaded with InfoArchive 22

23 23