Monday, February 19, 2007
Legally eHealth
A study in the European Union is looking at the legal aspects of eHealth. Titled Legally eHealth it will look at a range of legal issues, albeit from an european point of view. The study will be completed in the spring and may provide useful guidance for other countries on the right legal questions to ask about eHealth.
Friday, February 16, 2007
eHealth Project Risk Challenges
Check this out from the eHealth-Insider
"A senior executive from local service provider to the Southern cluster, Fujitsu, has said that the intense pressure suppliers are under to deliver short-terms risks the wider aims of the NHS National Programme for IT systems, resulting in a danger of it delivering 'a camel, and not the racehorse that we might try to produce.'"
"A senior executive from local service provider to the Southern cluster, Fujitsu, has said that the intense pressure suppliers are under to deliver short-terms risks the wider aims of the NHS National Programme for IT systems, resulting in a danger of it delivering 'a camel, and not the racehorse that we might try to produce.'"
How Serious is Privacy Risk?
It’s important to keep things in perspective. I have spent much of the past few years addressing privacy risks associated with eHealth systems. But how pervasive and how serious are the risks to privacy in Canadian health care.
When dealing with health care the numbers are very big: 30 million potential patients, 1.5 million people working in the health care system, hundreds of millions of health care transactions each year. When dealing with privacy breaches in health the numbers are very small.
A review of the most recent Information and Privacy Commissioner annual reports from those provinces with health privacy legislation is most revealing. In Ontario in 2005 (first full year of the Personal Health Information Protection Act) there were 177 privacy complaints . In Alberta in fiscal year 2004-2005 97 cases were opened under the Health Information Act (note that this number excludes 217 PIAs submitted to the OIPC for review). In Manitoba in 2005 9 new cases were opened under the Personal Health Information Act. In Saskatchewan 88 cases were opened of which 13% related to the Health Information Protection Act (although the report does note that many cases may have been referred to Professional colleges for review and disposition). Of these cases, only a handful resulted in orders issues by the Information and Privacy Commissioners. My guess is that there are fewer than 1000 significant health privacy issues across Canada each year.
Compare the number of privacy issues with the current estimate by CIHI that somewhere between 9,250 to 23,750 deaths occurred in Canadian health care in 2000-2001 due to “adverse events” . In 2003, 5.2 million Canadians reported that they or a family member had experienced a preventable adverse event related to their health care.
I don’t want to suggest for a moment that privacy issues are not important. The reputational damage to patients, health care providers and organizations as a result of infrequent privacy breaches can be considerable. I only suggest that we keep privacy in perspective. Canadian health care workers and organizations do an AMAZING job protecting the privacy interests of patients. They should be lauded for that.
In fact, I am concerned that the most serious threat to privacy, that of government intrusion into our lives permitted as a result of law enforcement and anti-terrorism legislation is not really addressed at all in our privacy control systems. I also think we are pretty weak on addressing the issue of identity theft associated with health information systems, which is more of a security issue.
With an over-emphasis on the privacy issue, there is a concern that resources are diverted from other issues such as system availability (security) and safety, which may be more serious risks for patients. I have seen projects where hundreds of thousands of dollars were spent on privacy impact assessments, but not a penny on an analysis of safety risk. Balance is the operative word here. We need to balance privacy concerns with our mandate to provide safe and effective health services.
References
1. Information and Privacy Commissioner/Ontario, Annual Report 2005, Toronto, p.59
2. Office of the Information and Privacy Commissioner for Alberta, 2004/2005 Annual Report, Edmonton, p.43
3. Manitoba Ombudsman, 2005 Annual Report: Access and Privacy, Winnipeg, p.16
4. Office of the Information and Privacy Commissioner for Saskatchewan, 2005-2006 Annual Report, Regina, p.7
5. Office of the Information and Privacy Commissioner for Saskatchewan, 2005-2006 Annual Report, Regina, p.41
6. Canadian Institute for Health Information, Health Care In Canada, CIHI Website,
When dealing with health care the numbers are very big: 30 million potential patients, 1.5 million people working in the health care system, hundreds of millions of health care transactions each year. When dealing with privacy breaches in health the numbers are very small.
A review of the most recent Information and Privacy Commissioner annual reports from those provinces with health privacy legislation is most revealing. In Ontario in 2005 (first full year of the Personal Health Information Protection Act) there were 177 privacy complaints . In Alberta in fiscal year 2004-2005 97 cases were opened under the Health Information Act (note that this number excludes 217 PIAs submitted to the OIPC for review). In Manitoba in 2005 9 new cases were opened under the Personal Health Information Act. In Saskatchewan 88 cases were opened of which 13% related to the Health Information Protection Act (although the report does note that many cases may have been referred to Professional colleges for review and disposition). Of these cases, only a handful resulted in orders issues by the Information and Privacy Commissioners. My guess is that there are fewer than 1000 significant health privacy issues across Canada each year.
Compare the number of privacy issues with the current estimate by CIHI that somewhere between 9,250 to 23,750 deaths occurred in Canadian health care in 2000-2001 due to “adverse events” . In 2003, 5.2 million Canadians reported that they or a family member had experienced a preventable adverse event related to their health care.
I don’t want to suggest for a moment that privacy issues are not important. The reputational damage to patients, health care providers and organizations as a result of infrequent privacy breaches can be considerable. I only suggest that we keep privacy in perspective. Canadian health care workers and organizations do an AMAZING job protecting the privacy interests of patients. They should be lauded for that.
In fact, I am concerned that the most serious threat to privacy, that of government intrusion into our lives permitted as a result of law enforcement and anti-terrorism legislation is not really addressed at all in our privacy control systems. I also think we are pretty weak on addressing the issue of identity theft associated with health information systems, which is more of a security issue.
With an over-emphasis on the privacy issue, there is a concern that resources are diverted from other issues such as system availability (security) and safety, which may be more serious risks for patients. I have seen projects where hundreds of thousands of dollars were spent on privacy impact assessments, but not a penny on an analysis of safety risk. Balance is the operative word here. We need to balance privacy concerns with our mandate to provide safe and effective health services.
References
1. Information and Privacy Commissioner/Ontario, Annual Report 2005, Toronto, p.59
2. Office of the Information and Privacy Commissioner for Alberta, 2004/2005 Annual Report, Edmonton, p.43
3. Manitoba Ombudsman, 2005 Annual Report: Access and Privacy, Winnipeg, p.16
4. Office of the Information and Privacy Commissioner for Saskatchewan, 2005-2006 Annual Report, Regina, p.7
5. Office of the Information and Privacy Commissioner for Saskatchewan, 2005-2006 Annual Report, Regina, p.41
6. Canadian Institute for Health Information, Health Care In Canada, CIHI Website,
Monday, February 5, 2007
HIMSS and the Clinical Engineer (CE)
24x7 just published an article discussing the value of HIMSS to the CE (clinical engineer).
You can read it at: http://www.24x7mag.com/issues/articles/2007-01_07.asp .
For more information about the IHE and how it is advancing the cause of healthcare, you can follow up at http://www.ihe.net .
What does this have to do with risk management and eHealth?
The IHE recently published a risk management whitepaper that encourages CIOs and standards developpers within the IHE community to use risk management concepts when planning their eHealth solutions.
The intent was to send out the "old" method of planning technological solutions based on what vendors were selling and to bring in the "new" method of planning, identifying actual needs and opportunities (ie: positive risks) to meet those needs, and then prioritizing according to cost, impact (positive and negative impact to the community), and likelihood of success.
Hopefully once the IHE has operationalized this method of risk-aware planning, it will share it's lessons with the rest of the eHealth community. In the meantime, the IHE is an excellent place to begin eHealth project due to the maturity of it's processes and documentation.
You can read it at: http://www.24x7mag.com/issues/articles/2007-01_07.asp .
For more information about the IHE and how it is advancing the cause of healthcare, you can follow up at http://www.ihe.net .
What does this have to do with risk management and eHealth?
The IHE recently published a risk management whitepaper that encourages CIOs and standards developpers within the IHE community to use risk management concepts when planning their eHealth solutions.
The intent was to send out the "old" method of planning technological solutions based on what vendors were selling and to bring in the "new" method of planning, identifying actual needs and opportunities (ie: positive risks) to meet those needs, and then prioritizing according to cost, impact (positive and negative impact to the community), and likelihood of success.
Hopefully once the IHE has operationalized this method of risk-aware planning, it will share it's lessons with the rest of the eHealth community. In the meantime, the IHE is an excellent place to begin eHealth project due to the maturity of it's processes and documentation.
Thursday, February 1, 2007
eHealthRisk Workshop
The Waterloo Institute for Health Informatics Research (WIHIR) is presenting an intensive one day workshop on eHealth risk management on April 18, 2007 at the University of Waterloo. It is based on the eHealthRisk Report Card methodology which will be discussed in depth in this blog. The following day (April 19, 2007) an intensive one day Privacy Professional Workshop will be presented. Attendance is limited. Sign up now.
Wednesday, January 31, 2007
E-Health and Risk Management
Brendan, I appreciate you inviting me to respond to some of your comments.
It seems that many e-Health projects have had difficulty in delivering effectively. The three largest problems usually are being over-budget, not meeting appropriate deadlines and not meeting needed requirements. I wholeheartedly believe, being a risk management practitioner and having seen the value of risk management, that it could be a powerful tool in reducing the likelihood of delivery challenges.
I think there are two main obstacles in terms of managing risk in e-Health. One is actually doing the risk management. The other is doing it well. To me, the second obstacle is the greater challenge.
Other sectors (financial, energy, technology, government) have seen the value of risk management. They have risk management programs in place. Their projects keenly include risk management as part of overall implementation. But they have run into critical barriers in ensuring that their risks are managed in meaningful way.
If the e-Health establishment really wants to look closely at effective management of risk, it should look at some of the lessons learned from other sectors. This could prevent us from going through the same growing pains that other sectors have gone through.
It seems that many e-Health projects have had difficulty in delivering effectively. The three largest problems usually are being over-budget, not meeting appropriate deadlines and not meeting needed requirements. I wholeheartedly believe, being a risk management practitioner and having seen the value of risk management, that it could be a powerful tool in reducing the likelihood of delivery challenges.
I think there are two main obstacles in terms of managing risk in e-Health. One is actually doing the risk management. The other is doing it well. To me, the second obstacle is the greater challenge.
Other sectors (financial, energy, technology, government) have seen the value of risk management. They have risk management programs in place. Their projects keenly include risk management as part of overall implementation. But they have run into critical barriers in ensuring that their risks are managed in meaningful way.
If the e-Health establishment really wants to look closely at effective management of risk, it should look at some of the lessons learned from other sectors. This could prevent us from going through the same growing pains that other sectors have gone through.
Thursday, January 25, 2007
Risk Assessment for eHealth Projects
The University of Manchester has developed an interesting tool for assessing the risk of failure for eHealth projects. Its worth a close look.
Wednesday, January 24, 2007
eHealth Safety Risks
While eHealth is often promoted as a tool to reduce health care risk, particularly with regard to medical error, little is known or understood about the risks that eHealth poses itself for patient and health care provider safety. By safety risk we mean the risk of physical or mental harm to patients and health care providers, including death.
Its not surprising that there is relatively little empirical information on the subject… eHealth itself is in its infancy and quite frankly, few if any people are tracking eHealth safety incidents. The odd incident is occasionally reported in the press such as a lab system failure in Calgary. One would expect some number of errors caused as a result of systems problems, but at the moment we’re not hearing about them.
That being said, it behooves us to address the question of eHealth safety before it becomes a significant issue. It seems that there are at least 3 areas where eHealth safety problems can originate:
Security issues – are the most likely sources of eHealth safety problems. Security concerns itself with the confidentiality, integrity and availability of information. Confidentiality concerns are not likely to give rise to safety issues (except in very rare circumstances, such as releasing the identities of doctors who perform abortions making them vulnerable to personal physical attack). Integrity and availability issues will certainly impact patient and health provider safety, particularly as we become more dependent on telemedicine services and electronic health records. Consider what could happen to a patient if a denial of service attack brought down an ehealth portal that provided access to critical health information systems, or if a virus corrupted or destroyed health data.
Quality of Product Issues – where software and hardware products fail to provide essential information when required, or deliver corrupted data. Software glitches are an example such as when a lab system fails to deliver accurate test results.
Human factors issues – where the human/ information system interface fails such as confusing user interfaces or overly complex procedures that promote error or fail to catch common user errors (e.g. input procedures that make it easy to enter the wrong data or displays that make it easy to misinterpret data).
There may well be others factors that give rise to safety issues. We need to identify such factors, understand them and then act to ensure that the systems we are putting in place to help people are not harming them.
Its not surprising that there is relatively little empirical information on the subject… eHealth itself is in its infancy and quite frankly, few if any people are tracking eHealth safety incidents. The odd incident is occasionally reported in the press such as a lab system failure in Calgary. One would expect some number of errors caused as a result of systems problems, but at the moment we’re not hearing about them.
That being said, it behooves us to address the question of eHealth safety before it becomes a significant issue. It seems that there are at least 3 areas where eHealth safety problems can originate:
Security issues – are the most likely sources of eHealth safety problems. Security concerns itself with the confidentiality, integrity and availability of information. Confidentiality concerns are not likely to give rise to safety issues (except in very rare circumstances, such as releasing the identities of doctors who perform abortions making them vulnerable to personal physical attack). Integrity and availability issues will certainly impact patient and health provider safety, particularly as we become more dependent on telemedicine services and electronic health records. Consider what could happen to a patient if a denial of service attack brought down an ehealth portal that provided access to critical health information systems, or if a virus corrupted or destroyed health data.
Quality of Product Issues – where software and hardware products fail to provide essential information when required, or deliver corrupted data. Software glitches are an example such as when a lab system fails to deliver accurate test results.
Human factors issues – where the human/ information system interface fails such as confusing user interfaces or overly complex procedures that promote error or fail to catch common user errors (e.g. input procedures that make it easy to enter the wrong data or displays that make it easy to misinterpret data).
There may well be others factors that give rise to safety issues. We need to identify such factors, understand them and then act to ensure that the systems we are putting in place to help people are not harming them.
Monday, January 22, 2007
Why do EMR Implementations Fail?
Dr. Karim Keshavjee has written a brief article in Technology for Doctors addressing the reasons why half of all EMR implementations fail. Its worth a read.
Perfection is the Enemy of the Good
Why do so many eHealth projects fail or fizzle out? Is it because too big a risk was taken? Or is it the opposite? Is it because we don’t take enough risks? In my experience the biggest failures and the most mediocre successes were the result of playing it safe to the point of failure.
I had a boss who said that "perfection is the enemy of the good". When we strive for perfection in information systems we often become paralyzed. This is particularly acute in government-sponsored initiatives where any flaw can become a political hot potato. In an environment where mistakes are not permitted, a system cannot go live until perfection is achieved… which is never.
I have seen project managers overcome by fear and trepidation concerning privacy and security when in reality the risks were very low. Costs were escalated and implementations delayed because of the perceived need to address every possible risk, no matter how remote.
This is not to minimize privacy or security risks. These are important issues that must be addressed. They must also be balanced against the risk of not proceeding with a critical information system. Are we going to delay implementation of a potentially life-saving system because privacy or security risks exist? Maybe.... but maybe not. That's the kind of risk decision CIO's and other health system managers must make all the time.
Hence the need for risk management. Risk Management doesn’t mean that there are no risks. It means managing real risks that are there and aren’t going away. We must do what we can to minimize risk, but at the end of the day we must also ensure that we deliver on our primary mandate, which is to deliver effective health care.
I had a boss who said that "perfection is the enemy of the good". When we strive for perfection in information systems we often become paralyzed. This is particularly acute in government-sponsored initiatives where any flaw can become a political hot potato. In an environment where mistakes are not permitted, a system cannot go live until perfection is achieved… which is never.
I have seen project managers overcome by fear and trepidation concerning privacy and security when in reality the risks were very low. Costs were escalated and implementations delayed because of the perceived need to address every possible risk, no matter how remote.
This is not to minimize privacy or security risks. These are important issues that must be addressed. They must also be balanced against the risk of not proceeding with a critical information system. Are we going to delay implementation of a potentially life-saving system because privacy or security risks exist? Maybe.... but maybe not. That's the kind of risk decision CIO's and other health system managers must make all the time.
Hence the need for risk management. Risk Management doesn’t mean that there are no risks. It means managing real risks that are there and aren’t going away. We must do what we can to minimize risk, but at the end of the day we must also ensure that we deliver on our primary mandate, which is to deliver effective health care.
Subscribe to:
Posts (Atom)