Undoubtedly, the adoption of digital technologies will make the Indian health system more accessible, equitable and technologically advanced. But as this digital shift happens, there will also be lingering safety and security challenges that need to be addressed and resolved
The world has been reeling under a sustained and coordinated global cyber attack through a potent ransomware software that hit institutions and functions across the spectrum. WannaCry has malignantly targeted hospitals, health systems like the National Health Service (NHS), schools, corporations and civic institutions. The cyber threat to economies and our way of life has been an emerging and evolving risk that the world will increasingly need to grapple with.
The increasing digitisation of all aspects of our lives, the surge in adoption of digital technologies and the use of technology for identification, transactions and civic functions etc, have led to an exponential rise of risks from cyber attacks. The recent US and French presidential elections were affected by malicious cyber attacks, hacks, data capture and manipulations. The 2014 joint report by Internet security firm McAfee and think-tank, Centre for Strategic and International Studies, estimated the global annual economic cost of cyber crimes to be approximately $400 billion.
The report indicates that in 2013 alone, personal data of “hundreds of millions” of people were stolen through cyber crimes. Studies further estimate that the Internet economy annually generates between two to three trillion dollars, of which it is estimated that cyber crime “extracts between 15-20 per cent of the value created by the Internet”. The threat from cyber attacks and crimes are crippling the global economy even as countries, Governments and institutions seem ill prepared to manage it.
Healthcare and health systems seem to be at particular risk when it comes to cyber attacks. A report by the global services company, Experian, predicts that this year “healthcare organisations will be the most targeted sector, with new sophisticated attacks emerging”. The report found Electronic Health Records (EHR), digital copies of an individual or family’s health records, to be the top target for hackers. The proof of this discomforting reality was witnessed in 2015 when 78.8 million patient records held by Anthem Healthcare in the US were hacked.
According to the United States’ Department of Health and Human Services, “more than 113 medical records had been compromised in 2015”. To put this in perspective, only 67 per cent of all medical records in the US are currently in standardised EHR format, of which 113 medical records seemed to have been compromised. As the number of EHRs grow, the risk will only expand. The recent ransomware attack crippled the UK’s NHS and led to service delays across hospitals in countries like China and Indonesia. The threat, like everything in today’s globalised technologically flattened world, is para-boundaries and systems.
That India was left relatively unscathed by this wave of attack is both fortuitous and suggestive of our current adoption levels of health information technology. The current bric-a-brac nature of health IT adoption has meant that most of our health information systems remain standalone or in varying degrees of integration. For the cause of healthcare delivery, this is a challenge, while in cases when cyber attacks like the ransomware occur, they are paradoxically ‘protective’.
This self-limiting danger, given the haphazard technology adoption status in healthcare, is only momentary and as more data is stored digitally; securing it will be a key challenge. The Union Ministry of Health and Family Welfare, which is proactively working with healthcare stakeholders, created and notified the standards for EHR’s in India. This, along with the creation of a governing e-health body will help shape and standardise health IT adoption and landscape in India. But as the adoption of EHR’s and the constitution of the governing mechanism evolve, it will be important to place data security at the very top of the list of concerns. Data theft of patient information and records will emerge as a key challenge for Indian healthcare.
As interoperability improves, data and information moves from single to multiple repositories, along with the proliferation of mobile, health technologies that capture and store patient information, safety and confidentiality must remain the key concern for providers, stakeholders and Governments. Health data thefts can be exploited for commercial gains, sold to enterprises that hold value for such data or even be used as a tool for commercial rivalry.
Amongst other emerging threats, manipulation of electronic medical devices like pacemakers and monitors, which has been demonstrated by ethical hackers in the past, remains an area of concern for continuity and sustentation of care. Similarly, exploitation — commercial or social — through a breach in confidentiality of patient records is not uncommon. Other challenges include the manipulation of data that can impact disease surveillance, epidemiological trends and altering or faking data for success of health interventions and programmes.
At last, the adoption of Aadhaar as an identifier and its linking to patient records and the soon to be issued health cards, is a welcome step and a game-changer. However, concerns on the inviolability of data breaches in the Aadhaar system remains an area of concern. Further, the linking of payments and reimbursements for health services by payers, insurance companies and individuals through digital means hold challenges.
There is no doubt that the adoption of digital technologies and health IT will make the dream of creating an Indian health system that is accessible, equitable and technologically advanced in reality. As this digital shift emerges, the lingering challenges that pitch convenience and ease of access against safety and security will need to be addressed and resolved. This would need the combined will, intellect and intent of Governments, their various functions and functionaries, providers, the IT industry, the citizen and the patients.
(The writer is general manager, Operation and Public Affairs, Indraprastha Apollo Hospitals)