BLOG on IT/IS in Healthcare & Life Sciences Joerg Schwarz on Healthcare [Health + Care]

Wednesday Apr 23, 2008

This weblog entry provides a visual documentation of the first installation of a Sun Modular Datacenter for a health care institution, the University Medical Center in Nijmegen, NL. The pictures were taken by Bart Meursing, “our man in Holland”, who thankfully provided them for this Blog.
[Read More]

Tuesday Apr 22, 2008

Eloy Rodriguez, Sun's business development manager for health care and education in Iberia, started a new health care blog in Spanish. Since Eloy is very experienced in his field, I recommend to check his blog, especially if you are interested in the Spanish or Latin-American health care market. You will find in his first blog entry about a health care conference and trade show with over 1,000 health care professionals in Madrid, that Sun's contribution was a vision of health care information systems based on open source technology. You will also find that the exhibits were similar to our HIMSS booth and included a focus on Sun Rays (of which Spain has a number of excellent reference installations) and the Sun Modular Datacenter, otherwise known as project blackbox.

Monday Apr 21, 2008

At HIMSS'08, Medsphere announced that they will wrap OpenVistA around a Tolven core. This is an interesting development, now reflected in ZDnet. See what's possible with open source? Tolven's rigouros data structure seems to emerge as a standard, which would be really helpful for the industry. And VistA has still a lot to give in clinical application knowledge. Certainly a match we'll have to observe.

Tuesday Apr 15, 2008

Nolte and McKee (2008), two British researchers, compare preventable deaths in 19 industrialized countries around the world and find the U.S. health care system to be least effective in preventing avoidable deaths. This is in stark contrast to the fact that the U.S. spends more on health care than any other nation. Root cause of this idiosyncratic statistic could be a focus on intervention medicine rather than prevention, amplified by the fact that the growing number of uninsured in the U.S. do not have preventive coverage at all.

[Read More]

Monday Apr 14, 2008

Health care is a major challenge for America. Since Senator McCain asked, here is an answer why health care should be a top agenda item for the new President.[Read More]

Thursday Apr 10, 2008

We did a scalability benchmark with the open source EMR/PHR package from Tolven. Yon can find a detailed report here. If you are a developer or ISV, and would like to perform a similar exercise, feel free to contact me. In order to get started, you can easily get a free Sun SPARC CMT server through our Try-and-Buy program and join our Sun Developer Network (SDN)
New Sun SPARC CMT single and dual socket servers T5140 and 5240 provide great performance for eHealth infrastructure using web service and relational database technologies. An attractive try-and-buy program allows testing of this technology without risk, and for quick movers there is a special bonus.[Read More]

Wednesday Apr 09, 2008

This entry is a response to a badly researched comparison between Windows VISTA and MAC OS. As a recent convert, I collected experience with both and comment that in my experience MAC OS is clearly the better OS and a better "deal" than VISTA, contrary to the PC World blog entry.[Read More]

Tuesday Apr 08, 2008

The Committee for Economic Development (CED), a reputable think tank with significant participation from industry and government, published a report about the benefits of openness for the advancement of health care, both in research and clinical practice.[Read More]

Saturday Apr 05, 2008

Sun is a founding member of the Open eHealth Foundation, together with Agfa Healthcare of Belgium and Intercomponentware (ICW) of Germany. The open source eHealth stack leverages many of Sun's web services components and it's widely used SOA framework, thus building the foundation for interoperable health care information systems that benefit both health care institutions and health care IT vendors.[Read More]

Friday Apr 04, 2008

HIMSS 2008 was a great success for Sun. We showed the Blackbox, a self contained datacenter, and featured SunRay care giver mobility in several different settings.[Read More]

Sunday Jan 27, 2008

This blog entry reflects on globalization in healthcare and it's impact and dependencies on IT/IS in light of a large health care conference in Dubai.[Read More]

Wednesday Jan 23, 2008

Sun hosted the NorCal HIMSS chapter last month (December 2007) in our Santa Clara campus. I waited with my blog entry for the presentations to be posted, and here they are. Ted Eytan from Group Health did a fantastic job - I really recommend his presentation and his blog entry. When we talk about PHR, it often sounds like science fiction. But Group Health is using personal health records extensively already in their daily practice. It's also impressive (and entertaining when watching the respective TV commercials) to see how Group Health uses secure email for the communication between physicians and consumers. 

Dr. Linares from Anthem gave a strong endorsement for PHR from the point of view of the the largest health plan in the US. Their PHR pilot works with our partner CentriHealth on Sun CMT technology

The bottom line: for HMOs like Group Health and Kaiser (they were in the audience and were interactive with Ted), PHRs are already reality. It might be that the economic model for HMOs is a strong driver for this - better, more efficient health care (based on available medication records) create healthier, happier subscribers and more profit - sorry - surplus for research and lower premiums. But also conventional payers like Anthem see the benefits and look for ways to include the different stakeholders to make PHRs useful. 

 

Thursday Jan 17, 2008

Yesterday was the day of acquisition announcements: Sun intends to buy mysql and Oracle intends to buy BEA. And one way to look at is shows how both moves are related: companies engaged in middle ware are building out their LAMP stacks.

LAMP as Jonathan blogged yesterday w/o further explanation stands for Linux, Apache (as a placeholder for Apache's Tomcat app server), MySQL (as a placeholder for an RDMS) and PHP (as a placeholder for database to web middle ware). Sun now has a complete LAMP stack in open source: Open Solaris, Glassfish, MySQL and  JDBC, while Oracle has a similar stack completely in a conventional proprietary license model.

In both cases developers and users will be able to get integrated products and professional support. The difference of the Sun stack is that we can optimize innovative technology to servers like our SPARC CMT, achieving mind blowing price performance. Do we need this in Healthcare? Absolutely!

Modern EMR applications, PHR's, and HIE all can be designed in a classical web tier architecture, as demonstrated by Tolven.  Put Tolven on the Sun stack, which we are doing, actually, in our benchmark center right now, and you will see unprecedented price performance. We will be able to deliver EMR, practice management systems, e-prescribe solutions and so on in a SaaS delivery to millions of physicians at the fraction of the cost. Today, our Niagara servers are heavily taxed by Oracle because their performance is so good they charge licenses fees that easily quadruple  the system price. With MySQL we can even improve performance and further lower cost per user. Entire Hospitals can run on a small blade center, including all their desktops. Sounds like Science Fiction? We'll show it to you at the upcoming HIMSS show.

So the bottom line for Health Care is that an open source LAMP stack from Sun will combine the best of two worlds: mission critical support (for a fee), which we need for production in health care, combined with the open and flexible data architecture of open source at zero license cost.

Watch this space for upcoming performance results on some open source stacks - you'll be amazed!
 

Friday Nov 16, 2007

The key thing with medical images is that you have to keep them for a long, long time. A mammography scan taken on a 40 year old woman today will have to be retained for about 40 years, maybe fifty or sixty-  for the life of the patient. The average life expectancy of data media is five years - disk or tape. Even if you archived on optical media, like a WORM, that can keep data for 50 years, there is no guarantee reading devices will still be around in 50 years (has anyone seen a 5 1/4 inch floppy disk drive lately?). This is just to say that data migration of large amounts of data is not a trivial, yet essential design element for medical image archive solutions.

Read Jonathan Batchelor's article in HealthImaging, and it will become clear 
why our SAM-FS  technology is such a big deal. Dr. Cecil describes it very simple and correct: just add new media, and it'll fill up. The file handle never changes, from media to media, so a data recall after 20 years will access data that has moved four or five times, maybe more often, its physical location.

RSNA is around the corner. Come see us at booth 5155 in McKCormick Place South Building, Hall A. We will demonstrate a few cute things and we'll be happy to discuss our archiving technology with you. Also, we have an exhibit of our new content addressable storage system, the Sun Storagetek 5800 (also known to many under the code name Honeycomb). We'll be happy to discuss with you how content addressable storage will change the way we can drive science and medical practice alike to new efficiencies, while maintaining the cost leadership and reliability you can expect from a Sun StorageTek product.

Friday Oct 12, 2007

Musings about open source and open standards in health care, or the need thereof, after attending AHIMA 2007 in Philadelphia.[Read More]

George Mason University is working on a great tool for research citation libraries, called zotero - check it out.

Usually I use Endnote from Thompson - my University provides free access and its truly a life saver for the vast amount of papers one has to write in a doctoral program. But it has of course limitations. Zotero  adds some very nice and interesting features. Academic research is, both from a philosophical and practical standpoint, probably the most appropriate field for using open source tools accelerating the free flow of ideas and concepts.

For now, I won't ditch Endnote, but I can't wait to try the OpenOffice plug-in. Zotero for OpenOffice is promising and badly needed, and I just hope the plug-in will also work with NeoOffice. The fact that the zotero plugin for Mozilla works on a Mac is certainly a good step in that direction.

Let's see what Kevin has to say on the topic.

Friday Oct 05, 2007

 

So, today I read in both the Mercury news and the Chronicle  about Microsoft's launch of Health Vault. Isn't that interesting?

Don't we all love to update our virus scanners, pop up blockers and so on every day, because Windows is designed so bad that it has all those vulnerabilities. And now the company with the track record in building such faulty systems applies their knowledge to storing sensitive health information. Let's all go sign up right away!

Wait a minute - I was just kidding. First, I was so sick and tiered of my 15-minute-boot-up and virus scanning laptop that I switched to Mac, and never looked back. And apparently a lot of people are doing this now, so not everybody likes to run virus scanners all day. Second, signing up to Microsoft and partners web site might not be without peril. Read for example this review. Smells like passport to me, smells like collecting information and disclosing it to all kinds of affiliate parties. Of course, all for the good. Who would ever assume evil marketing ploys when it comes to Microsoft - exactly!

But maybe we are all jumping to conclusions. Maybe Microsoft will run the site using Solaris with trusted Solaris extensions, so the data is secure (confidential, complete & right, and available when needed). And maybe they will encrypt all the data, all transactions and identities all the time. Yes, and maybe they will open the data standard for everyone to build a connected system, so professional data can be connected?

yeah, right. Maybe.

 

Thursday Sep 27, 2007

If you are interested in a job as business development manager for the payer segment, where you can help to build and shape our industry strategy and alliances, check out this job posting.  And if you know someone, let him/her know, too.

 

ICW, one of our PHR partners, got more startup money. Anybody who's been involved with startups knows how difficult it is to get through the initial phase before the revenue starts flowing, let alone in a new field of health care. So: herzlichen glueckwunsch!

 

Read this blog by Esther Dyson, one of the final reactor panelists of Health 2.0 and you'll notice I'm not the only one recognizing the potential, yet critical need for aggregation and integration.

Tuesday Sep 25, 2007

The "World of Health IT" conference (WHIT'07), a European HIMSS derivate, is coming up in October in Vienna, Austria. My journey will take me to Brussels and Berlin before finally venturing to Vienna.

It's kind of odd, but a number of things are happening in recent weeks that make this trip to Berlin quite special.

Our partner for PHR, ICW, will hold a partner summit in Berlin the week before WHIT. As stated many times, I'm a big fan of connected PHRs as a center piece for consumer directed health care, and I'm looking forward to learn what is next for ICW.

It also gives me a chance to go back to Berlin. A journey to Berlin is always very emotional for me, mainly because I love Bertholt Brecht. I grew up in what was then called West Germany (now there is only one Germany, but growing up this distinction was important) and had not had a chance to visit East Berlin during my trips to West Berlin. So in May 1990 I took for the first time the S-Bahn to Alexanderplatz, which was still divided into an East and West partition, and walked to the Brecht monument in front of the Theater am Schiffbauer Platz. There, I just stood next to Brecht and read along with the statue "Questions of a worker who reads", crying tears of joy and excitement. That's unification for me. ("Fragen eines Zeitung lesenden Arbeiters" is, however, not my favorite poem - but that's another story)

Last time in Berlin, I met my long time friend who had moved to Berlin, at this very place, the Brecht monument. We paid homage to Berthold before walking to the "Staendige Vertretung". There we were, two high school friends twenty years later, both traveled and far from home, close to our spiritual godfather Brecht, drinking our local brew Koelsch in a place that is full with memories of the Bonner Republic that doesn't exist anymore - the Republic of Konrad Adenauer, Willy Brandt, Herbert Wehner and Helmut Schmidt.

But that's not all. The last two weeks I was watching "Das Leben der Anderen", making of and background, which invokes yet other memories of the "other" German post-war republic. Interesting that the author and director of this movie was born in Cologne, West Germany (like me). Maybe it takes some distance to gain perspective. Anyway. ICW sent me a model of a Trabant car as an invitation token. They will organize a rally through Berlin using those cars at the eve of their event. But I'm going to skip that. The Trabant reminds me too much of the Republic portraited in "Das Leben der Anderen", the other republic.  And I'm sure Brecht, could he blog today, would agree with me that the Stasi Republic betrayed much of what Brecht believed in. So I will instead go see Brecht and remember the Bonner Republic.

Finally, the "Aeltestenrat des Deutschen Bundestages" will be here at the EBC tomorrow and I'm looking forward to host them. While I'm a bit scared to do a presentation in German, it's good to speak the language of Brecht and Heine once in a while, and a good preparation for the time in Berlin and Vienna. Maybe I should do my next Blog entry in German?


Saturday Sep 22, 2007

In order to give you another view on the Health 2.0 conference, read Amy Tenderich's summary of Health 2.0 at Diabetes Mine, one of the, if not THE most popular health care blogs. Amy was also a moderator of one of the panels, and she provides a good overview of some of the companies that launched at the conference. She also posted a link to the opening video, which is great and worth a look!

 

Friday Sep 21, 2007

In order to stay connected with the Health 2.0 community. Matthew Holt recommended to join their Facebook group - so I did. What can I say - I'm a linkedin kind-a-guy

View Joerg Schwarz's profile on LinkedIn

 

 

What would a new frontiers conference like Health 2.0 be without some brand new launches a the show?

Here are two of them:

Enhanced Medical Decisions launched DoublecheckMD The idea is brilliant: patients type in the data about their prescriptions and the site comes back with information about reported drug interactions. The idea is that the MD doesn't know all potential interactions while making the prescription.

However, wouldn't it be nice if there was a personal health record that already did this kind of check while the doctor makes the prescription? Old economy, brick-and-mortar guys like me would call this CPOE, and Dr. Greenes at HBW gave many talks about CPOE systems that do this (checking interactions and reported allergies) when the doctor makes the order entry to avoid, prevent risky prescriptions. Greenes reports that it's hard to do in the controlled environment of a Hospital. One can only speculate that DoublecheckMD might be better off since patients care about themselfs, but also question where the data will come from, how patients find it and what they will do with the info.

Another new startup was peerclip.com, a social networking site like sermo.com. I enjoyed Sermo's free water, coffee mug and after show party, so I'm maybe biased towards them, but fact is that there was little info about peerclip at the conference. Fact is there is at least two of everything, so why not two social networking sites exclusive to Physicians?

Anyway - my final remark on Health 2.0 - somehow I have to think about that sock puppet from pets.com all the time. Why? Don't know. Maybe because they put so much money into advertising so everyone knew the sock puppet, but somehow there was not enough margin in shipping a 40 lbs bag of dog food across the country (free shipping, of course) for 10 bucks (undercutting the Petco around the corner) to feed that sock puppet past the dog com....ehm dot com bust. I had to think about that sock puppet. No offense to peerclip, or healia or doublecheckMD, but I wonder where the dog food will come from this time around, if you know what I mean.

Reflecting on Health 2.0 - What did and what did not happen, what was there and what was not there

My Mac ran out of power yesterday, so I had to stop live blogging half way through the conference. But that's maybe a good thing, because it provided some time to reflect on what happened and what didn't happen yesterday.

So first, we know what happened: the entire crowd was very pleased. Great panels and panelist, good organization, exciting topics. In the audience were many big companies (I was, for example, by sheer happenstance, on a table with Pfizer and United Healthcare and a Venture Capital representative), something we used to call "old economy" in the .com days, and on stage were the young start-ups, the ".com's". It felt like 97 or 98'ish - I was in Silicon Velley then, and boy, it felt much like it at Health 2.0 yesterday. For the good, and for the bad.

Health 2.0 is about using Web 2.0 technology to personalize health experience. From personalized health search on specific sites like healia.com, to social networking sites for patients, like patientslikeme.com, or care professionals, like sermo.com, or the linkedin for physicians, within3. I could go on and on describing these sites, but that's not the point.

Jay Silverstein from RevolutionHealth and Esther Dyson from EDventure made excellent remarks in the final feedback panel: the conference was great, lots of innovation and enthusiasm, but Health 2.0 is too fragmented, too complex right now. Too many sites to go to. People, Life is not one dimensional.

While google and yahoo are not as good for health searches as healia, they are good to find sites like healia, and people do not search for health related things all the time and exclusively. One might b e a patient at one time and use a site like patientslikeme, but why would that patient have to go to quickenhealth or HealthEquity to keep track of medication expenses, or go to ? Why does that patient already registered in a patient community need to go to Vimo or Careseek to find a doctor rating? Shouldn't all health plans do what BCBS of Minnesota does with Healthcare Facts, anyway?

Marty Tenenbaum had, like me, a deja vu feeling, and said he felt like the first e-commerce meeting before companies like Amazon and eBay figured out that they have to build an entire supply chain, not just offer a point solution and a good idea.

That brings us to the other side of the day and to what did not happen. google, for example, did not announce it would acquire WebMD (or anyone else of the startups present at Health 2.0). No, google will instead look carefully at the evolution of Health 2.0 said Missy Krasner. Maybe I was right, and google discovered that the true value comes from connecting personal health records to the legacy systems.

And that's what was not discussed - how data from existing and future EMR/EHR systems could be used to populate PHRs with quality data, instead of relying on data provided by patients. Besides quality concerns, who has time to update detailed health information all the time? But once one has a PHR, that PHR could become the central hub for managing finances, searching for good providers or joining social networking groups. But none of this joining, aggregating and connecting was discussed yesterday. Maybe I think too much in old economy, but it was a common sentiment in the audience.

Esther Dyson made another good point when she said that is was also not discussed how to keep someone from becoming a patient - the whole lifestyle, wellness and prevention story was absent from Health 2.0. Why? No good ideas?

There will be a next Health 2.0 conference, maybe soon, and those questions need to be addressed, or the people who were there in 1999 will have another deja vu in regards to Health 2.0, but this time one the reminds of 2002....



Thursday Sep 20, 2007

As promised - live from San Francisco and the Health 2.0 conference.

Half an hour to go and the room is filling up. Looks like a number of VCs are here looking to find investment targets.  They have an interesting audience response system here (wireless dell handhelds). Nice idea to involve the audience and the price to pay for free wireless. Great tool for polls during the panels - let's see how that works out.

First question on the ballot is who will be the next President of the United States. I didn't know Lindsey Lohan was running. Maybe I should pay more attention to the presidential primaries. Anyway, turns out Hillary Clinton won and Lindsey Lohan got a respectable 11%.

Room is packed, intro video about the history of Health care by scribe media is really cool.

Matthew describes what "health 2.0" means. Definition of Web 2.0 from Tim O'Reilly 9/2005.

Holt's best guess: personalized search that finds the right answer for the "long tail", better presentation of integrated data, communities, putting people in charge of their own health) enablement. The key is really personalization when contrasted to conventional tools.

Continuum from user generated health care to users connected to providers to eventually impacting drug development (personalized drugs).

Allegedly 120 mio adult Americans use the web already for health search, 2/3 of the physicians, and the

Doesn't sound like google is going to buy webMD - in fact, they are very careful in regards to monetization. Yahoo, and of course Microsoft, are way more aggressive. Neupert announced that they now have nine customers for their own clinical software. [Must be interesting to be a Microsoft partner, rely on their middleware AND compete on applications. Sun doesn't do applications]

Dr. Brailer: "health care services users do not overlap with the web 2.0 / health 2.0 users". "tech is not the only solution"  ...."by the time web 2.0 users become health service users, we'll be at health 3.0 or so". 2007 and 2008 is the shake out o health verticals - some companies will be there for the long run, others will find out it's a marathon, not a sprint.

Really nice search presentation by healia.com (google type search specialized on health, includes medline) - announced new feature to search clinical trials. The key discussion, however, is the business model of specialized health search engines. Anyone can use google or yahoo every day, but is looking for health info only once in a while - for example after returning from a doctor consultation. There is no question that the specialized engines are helpful, but the business models need work. An audience question covers how web 2.0 content is included. Quality control is of course an issue, and some sites allow tagging and comments (ala wikipedia)

Tuesday Sep 18, 2007

When is the last time to heard about a sold out conference in Silicon Valley? 

Tomorrow I'll have to drive to San Francisco [sighh]- the city that introduced a 200 million dollar universal health care plan this week - and stay overnight. I do this very rarely, since I live closeby in Silicon Valley and hate the SF traffic and parking mess. So what's the big deal? Matthew Holt's Health 2.0 conference on Thursday, that's the big deal.

Matthew posted on his Blog (and sent in an email to registered attendees) details about his troubles: Health 2.0 is sold out, and he encourages everyone to be there early, like at 7am, to avoid standing room for the day. Ok, so I'll get there the night before and bring a sleeping bag (kidding). What is this fuzz about?

Could it be the rumor about google and WebMD (the "google situation")? Sure. First there is a general craziness about web 2.0, and then there is generally craziness about everything google. Mix the two, and you get a sold out conference. Nobody wants to miss the train departing for the next 'youtube' ride. But what would google gain with a WebMD acquisition? I'm not a big fan of disconnected PHRs. A PHR without data feed from EMR and EHR is basically useless for care professionals. And if google was to buy WebMD and leave it at this level, I don't think it would be worth their money. Professional, connected PHRs will outperform disconnected PHRs as they become available, because they are more valuable to consumers, providers AND health plans alike.

Disconneced PHRs with nice flashy portals are easy, and there is actually not much web 2.0 about them. We had user communities for certain disease communities from the early days of the Internet. Connected PHRs on the other hand are a lot of work, because they require interfaces and data, and the data needs to come from physiscians who are today reluctant to adopt EMRs.

However,  google coming to the party could change dynamics. Their gameplan could be to use claims data collected by WebMD's lesser known clearing house to populate the PHR. Throw in some e-prescribe service and you got something interesting going. google could also give a free PC (or better yet, a Sun Ray :-) to every doctor who subscibes to their service (800,000 " $500 = $400,000,000, a mere joke given google's cash) and build up the database with physician interaction in no time. Now this would be exciting!

So, Health 2.0 shall indeed be an interesting conference this Thursday, and since I registered early, I got a ticket to ride. Watch this space on Thursday for a live report from the scene!

One of the most attractive exhibts of our booth at RSNA last year was the GE Medical 3D visualization software demonstrated on a pair of  Sun Rays. People were literally looking for the catch - but there is none.

Dr. Linda Feliingham and her team have developed 3D visualization software that uses an off load renmdering engine (= bunch of graphics cards) to allow true 3D on Sun Rays. Good enough for ultra hi res 3D recontruction models, for example for surgical planning, that would otherwise need full blown Workstations.

And the cool thing is that you can test it yourself. Check out Linda's blog and read instructions how to play with 3D on a ultra thin client.

 

 

Friday Sep 14, 2007

My 13 year old son Magnus sometimes reads my BLOG - salve filius meus - and he complained that I'm too US centric for someone with a global scope. Magnus lives in Germany, I live in California, so its understandable that he questions the international scope of my BLOG.

So, with all this said, I will still write about HIPAA (Health Insurance Portability and Accountability Act of 1996). For Magnus and all other international readers - HIPAA is the data privacy standard for healthcare in the United States. As far as I know, every country has some privacy laws, and usually they cover health data. Fact of the matter is, many privacy standards are more strict then the privacy standards here in the US. So please allow me to use HIPAA as a placeholder for the many laws and regulations around the world that protect privacy in health care.

HIPAA's security rule from 2003 with a compliance requirement of April 2005 is, as the name says, about keeping health records secure. In information security, e.g. ISO 17799, we always refer to three different aspects when it comes to information assurance:

  • data security, which means only authorized persons can access data, (this is also called confidentiality)
  • data integrity, which means means the data needs to be correct and complete, and
  • data availability, which means authorized users can access data they need whenever they need it.  

And what do you know, that's exactly what you can find in the code of federal regulation (CFR), title 45 (public welfare), subtitle A (Department of Health and Human Services), part 164 (Security and privacy), paragraph 306 (Security standards, General rules):

"(a) General requirements. Covered entities must do the following:
  (1)  Ensure the confidentiality, integrity and availability of all electronic protected health information the covered entity creates, maintains or transmits." 

HIPAA regulates furthermore who can access health information and establishes standards that allow auditing who actually accessed and/or altered data. Latter aspect is important to create accountability, a namesake of the act and thus one of its chief goals. You can read a summary for consumers at the website of the Departement of Health and Human Services website.

Now, many times we read articles like this:


 

computer stolen 

 Ivy league universities like Johns Hopkins are not immune:


 



 
And, for our international readers, it doesn't happen only in the US, but also in Canada (and elsewhere in the world):


Common in all these cases is one thing: patient data was stored on a PC or harddisk and got lost, hence exposed to whoever might find the disk or has stolen the PC.  Errare human est, as the romans said, people make mistakes. If you look for it, you can find incidents almost weekly where someone leaves a laptop behind, or a PC gets stolen. As a consequence, hundreds or thousands of records are exposed and CFR 45, 164.306 is violated.

This is so unnecessary. Steve Nelson, our resident security expert and passionate sandal bearer (see his picture in the Singapore blog entry) is always upset to find these reports, and he actually provided the links used in the blog entry.  I actually had to promise a blog entry to him so he would calm down this morning.

Sun in Healthcare defined "mobility with security" as one of our focus areas. We know that health providers need access to data, and they roam in the hospital all day and night long. But why would anyone want to load data on a PC or Laptop and take the risk of exposing records, a clear HIPAA violation?

Our model is to keep the data safe in the data center, where we have physical access control in place, and provide access to it over the network. We call this concept Secure Global Desktop.  And if you need devices all over the hospital, we virtualize the desktop, be it Windows or Mac or Linux or Unix or Mainframe or all of the above, still keep it in the datacenter, and deliver the encrypted desktop bitstream to an ultra thin device called the Sun Ray. And voila, all a care giver has to carry around is a smart card for access control. Maybe a smart card with a picture, as that would establish what security experts call three factor authentication:

  • something you must have (the card)
  • something you must know (password)
  • something you are (the picture on the smart card)

Is there any better way to achieve HIPAA compliance and avoid embarrassing exposure of health records, while saving money and the planet (a SunRay consumes only 6 watts or so, substantially less than a PC or Laptop)?

 We know we can do this, because we have many references. Here in the US for example UAB - see the blog entry and video - in Canada - also on this blog - and (nota bene, filius) elsewhere in the world, like in Korea, Spain and Germany. In all these places, hospitals use Sun Ray ultra thin client devices in day-to-day operation, avoiding any HIPAA or other privacy law violations. It's just a better model.

Steve - I said it. I'll say it again. Next week we will probably still have another case, but don't worry, one by one, we will get this message across!