Skype, Security and HIPAA

I had a discussion recently with a state IT administrator who scoffed at using Skype video for telemedicine connections because it was “insecure”. Since we’re doing exactly that for family connections and proposing it for (at least), connections for health-care interventions other than direct physician-to-patient conversations, I thought it would be helpful to do some more research; I found an interesting 3 part thread about using Skype, particularly for psychiatric consultations.

Skype hasn’t made all the details of its security system known, but it does have a lot of information online, and, assuming that they are telling the truth, it sounds like Skype is at least a secure as a cellphone conversation, and, as far as I know, every psychiatrist I know talks to people on cell phones without worrying that much about HIPAA violations.

Skype and modern cellphones use the same basic protocol to communicate (packet switching), but basically what happens is that when you make a call, Skype or your cellphone operator sets up a connection between you and the person you are calling and then steps out of the way, leaving you and that person to talk as if you had your own circuit. Both Skype and cellphones encrypt the data they send. If anything, the AES encryption method used by Skype is probably more secure than the 30-year old A5/1 encryption method used in most cellphones. AES is approved by the government for top secret information while A5/1 has already been partially broken.

I think that the real security issues with Skype (or with cellphones) are probably more with things like whether the government can compel Skype or your cellphone operator to tap into your conversations than with details of encryption or firewalls.

Until then, I think that doctors should give up talking to patients on cellphones before they get worried about whether Skype is secure.

Give up talking on cellphones?

The Telehealth.net discussion cited above is a little more nuanced…

On one end of the spectrum are professionals, both licensed and unlicensed who claim that HIPAA is not relevant to telecommunication video interactions with clients or patients. Some of these people state that even if HIPAA compliance is an issue, public VoIP platforms already have met HIPAA compliance requirements by being more than 128-bit encrypted. They consider themselves safe or safe enough, and many of them are already practicing on the open, public Internet, using systems such as Oovoo, Google Talk, Skype or any of a number of other VoIP video platforms.

At the other end of the spectrum are professionals who are more conservative. They seem to be choosing to either wait for more secure systems to be developed, or work in institutional settings where using equipment with stated HIPAA complaint technologies.

So … “It depends”. My guess is my IT manager friend is of the more conservative persuasion and that we would need to come up with some kind “compliance certification” to satisfy him.

Posted in Uncategorized

EHR for real people

The medical advocacy blog chronicles one women’s attempt to participate and advocate in the care of her terminally ill husband, and the wider implications of the Electronic Health Record.

I now sit in meetings for hours and watch power point lectures about electronic medical records. I listen to people dissect HIPPA regulations and incentive time tables. I hear arguments comparing ICD-9 code to ICD-10. And sadly, I hear many people tell me that patients should never see the entire medical record. I think they have no concept of the word meaning in “Meaningful Use.” For too long the medical record has been considered a billing document or a legal document: property of the physician or institution, instead of what it is, the story of the patient. “Meaningful Use” is not just a government buzz word or an unrealistic timetable of obligation, it is that childhood question: “What is the moral of this story?”

Posted in Uncategorized

Telemedicine Myths

The executive director of the American Telemedicine Association, John Linkous, posted a list of telemedicine myths. Two caught my eye:

Telemedicine is all about video conferencing and, therefore, requires broadband. There are many critical needs and uses of video conferencing in telemedicine. But a live image is not always needed. Two of the most common applications in telemedicine: remote monitoring and teleradiology rely primarily on sending still images and data and don’t require live video. Medical images may need high speed lines but typically not two way and not at the same speed as high-quality video. Furthermore, the required quality of the video image also varies. Sometimes, a simple video image from a video-phone may be enough depending on the use. Broadband is important but not for every telemedicine application.

Telemedicine can be a significant threat to patient privacy. Enough already with the privacy fears. Just like in the use of networks for banking, the use of telemedicine can provide a secure, efficient way to transmit medical information without compromising privacy. With the use of data encryption, information flowing over telecommunications lines can be just as private, or even more private, that paper-based records kept in doctors’ offices and hospitals.

The requirement of broadband is an interesting one. I found myself cringing slightly as I gave my presentation in Lafayette last week, and admitted under my breath that our box would work with 384 Kbs symmetrical, and that we had even had occasion to connect at 256Kbs. Not bad since we’re striving for full-motion video. Reading Dr Likous’ blog and the additional material from the ATA suggests that they are taking a catholic view of telemedicine technology. Although remote robotic surgery is the latest and sexiest manifestation of telemedicine… it can also embrace things like iPhone apps that count calories.

Posted in Uncategorized

Challenges for Home Telehealth

I spent much of the day working on a series of questions for a grant proposal. One of the questions was, “what are the challenges that you found, and how did you manage to work around them?” I wrote:

We strive to make the technology as transparent as possible for both patients and providers. As far as patient trust is concerned, we feel that patients need to be prepared for the project. In most cases we have found it works well for us to make a preliminary visit to the patient’s home, not just to do an evaluation, but also to explain how the program works, and to introduce ourselves. When we arrive for the actual installation, the patients know us, and are comfortable with us being in their home. It is not unusual for us to contact the patient via the phone during the course of the project, and with virtually all of them we ended up on a first-name basis, and they recognized our voices on the telephone.

In one case a patient asked us to remove the equipment and they terminated their participation. This was an Alzheimer patient living independently with no family support. In two or three other cases were were able to determine from the patient that they wouldn’t be a successful candidate for the project; either they asked us to remove them from consideration, or we made a recommendation that the person not be included.

In several cases, after visiting an especially frail patient for an evaluation, we were skeptical that the unit would work for a patient; these patients became our dramatic success stories.

It is not unusual that a patient will ask us to explain the project to a family member so that the family member can advise them if it is OK. Especially with dementia or Alzheimer patients, it is very helpful to have family involved.

For patients with memory problems, we found that if they hadn’t turned the unit on in preparation for a scheduled class, we could call them on the phone, and ask them if they intend to participate. Almost always they said they had forgotten, and if we would give them a few minutes, they would join in.

In cases with existing Internet connections, we need to be sure that the unit can be called from outside the person’s home, and it usually requires that we have one-time access to their home internet router to make adjustments.

In some cases, an existing internet connection goes to a computer in the den, (i.e away from the DocBox, attached to the TV in a living room). One solutions to this problem include stringing wire from the den to the living room TV. In several cases we ended up installing a separate dedicated internet connection. This isolates our unit from their existing home network, which makes troubleshooting easier.  We don’t do internal home wiring.  Although we have attempted using wireless connections, we haven’t had success. This may be something to try again however, as the wireless technology has improved.

Sometimes people joke about “Big Brother”, i.e. the ability to view the patient without their knowledge. We try to make the following points:

  • Our camera has an orange light on it, which when lit, means that the camera is active. If the light is not on, then there is no way any image is being transmitted
  • There is a limited set of people involved in the project, including our tech support personnel, and the medical personnel running the project. The patient will see some of these people on their TV as part of the project (especially us… as well as whoever is facilitating that day’s session) but the number of people viewing are limited. They are not broadcasting on the internet or YouTube.
  • We do make the point that even though the viewership is very limited, the connections are “quasi-public”… that they can be seen by several other people and so patients should be comfortably dressed and ready to be “seen” by their peers and other project participants once the session starts. (This has never been a major problem.)
  • We will typically record some parts of sessions mid-way throughout a project. We will obtain their written permission and explain how we would use these recordings Typically we make these recordings available after an individual request by other medical personnel.
Posted in Uncategorized

Fiber Network: Lafayette’s Advice for Seattle

Glenn Fleishman has a comprehensive article which describes the Lafayette LA. fiber network and implications for Seattle. Lots of lively comments on this one too.

Posted in Uncategorized

Municipal Fiber Broadband:Cool Things from Fiberfête

The Fibefête is over, a few of us are hanging out for for bits of the Festival Internationale held here in Lafayette, Louisiana. The participants included a group of feisty (to say the least) advocates for open access networks, real network neutrality, and fiber cable installed in individual homes to facilitate a new generation of (especially) HD video-types of applications. Videos of many of the presentations have been archived. My remarks on telemedicine / telehealth are in there on the one archived on April 21, at 8:33.  Some ideas:

“The old rules no longer apply, and the new rules haven’t been invented yet.” — John Lebkowsky

The LITE center has state-of-the-art 3-D immersive environments used for visualization of everything from complex molecules, to sunken oil rigs, to the planets of the solar system. This is something to experience…it is almost impossible to describe.

We have to go beyond triple-play (using broadband to deliver internet, cable, and telephone service), to deliver new applications which can take advantage of high speed broadband capacity.

Lafayette’s fiber network offerings for home users begins on the low end at US$28.99 per month for ten megabit, symmetrical service. Virtually all cable and DSL offerings from other vendors are asymmetrical.  By comparison, I’m paying $64.00/month for advertised speeds of 8 megabit download and 1 megabit up.  Frequently, I’m showing 5-6 megabits download speeds, and upload speeds of 600K.

Trying to figure out how to interest the public, Benoit Felton suggested installing “telepresence walls”, floor to ceiling video screens, with cameras and microphones in public places, especially where people have to stand in line or wait.  As we kicked around this idea further, we thought you could start with two walls within a single municipality, taking advantage of bandwidth available from the municipal fiber network, and then eventually extend connections to walls in “sister cities”, who also had a fiber network…. so that you could feel you were standing and talking with someone located far away, just as you would if they were physically standing in front of you.  Once several cities had these walls, (and given sufficient connecting bandwidth), your wall could rotate through a series of different places.

Art, and art installations, are a great way to demonstrate the potential of high speed fiber networks.

Virtual Music Lessons. We saw a fiddle lesson, given in real time by from Lafayette to Brooklyn N.Y. via Skype.  Hmmm…maybe I can no longer justify a trip to Spain to learn flamenco guitar….

Much discussion for the benefit of outsiders of how Lafayette pulled off their implementation of fiber to the home (FTTH).  It wasn’t without struggle or opposition, but in fact the opposition from the incumbents, BellSouth and Cox cable actually made it possible.

Every time they started lying we’d hold a press conference. 

It was crucially important for no time to lapse between a false statement and the truth squad presenting the truth.  

Afterwards the community no longer trusted the incumbants and they did trust us —-  we set up a special blog.  “The myth of the day”.  

The city is interested in the future.  The network would allow them to do these things. (applications). 

They kept telling us “you shouldn’t play in this arena.  You are just too small.”

The public’s embrace of the system made the system THEIRS…  

   

Posted in Uncategorized

Bogus CWA Survey on Internet Speeds

Many TFHHC applications require a broadband internet connection.

According to an article in the LA Times, Vermont ranks 45th among 50 states and two territories, with an average download speed of 3.32 megabits. Neighbor New Hampshire ranked 8th with an average download speed of 7.17 megabits.

Using data gathered from Speed Matters, a site that promotes greater Internet speeds, the Communications Workers of America compiled a list of broadband speeds in U.S. states and territories, and came up with the average speed for the nation — about 5 megabits per second. That’s a quarter of South Korea’s 20.4 Mbps, and about a third of Japan’s 15.8 Mbps.

The article states that the survey was not scientific. This is a gross understatement, as certainly the data can be skewed depending on where the readings are taken within a state and the number of samples. Large swaths of Vermont have no access to broadband connections, two years after our governor declared us an “e-State”. (!)

They survey only reports download speeds. Since most internet connections are “asymmetrical” upload speeds are a fraction of the download speeds. For high-bandwidth applications like videoconferencing, cheap DSL and cable connections are inadequate… and that suits the vendors just fine.

My speeds are: 12762 down and 1265 up at 9:44 EST on a Wednsday morning with a Comcast “business” account. Asymmetrical at a 10:1 ratio. Fortunately, our video application works at 384Kb.

It would be easy to dismiss the survey as junk. But the larger points are:

Broadband is the infrastructure of our time, much as rural electrification, copper telephone lines, and the interstate highway system were in the 1930’s, 1940’s and 1960’s. We haven’t had a national commitment for a “transformational” infrastructure since the middle of the last century.

Despite the fractional cost of broadband, compared to the previous infrastructures, (the poles are already in place!) symmetric, high-speed broadband to homes isn’t happening out in the boondocks, and the prospect of fully wiring rural states like Vermont is years away. Compare the cost of a mile of fiber-optic cable with the cost of a mile of interstate highway.
For all the breast-beating about great the U.S. is, we are going to get our clocked cleaned in the technological revolution of telecommunications. (We’re already getting hosed on renewable energy and battery technologies ).

Posted in Uncategorized

American Telemedicine Association Annual Conference 2008

The following notes are cribbed from techfornonprofits.com from two years ago (!), but summarize opportunities to enhance home health care.

I attended the ATA annual meeting in Seattle a couple of weeks ago. This is a roughly two-day affair with pre and post sessions available for those who wish to take full or half-day seminars. The ATA is one of the largest associations for implementers and practitioners of telemedicine in the U.S. There was a good-sized trade show with impressive exhibits by well-known companies like Intel, Polycom and Tandberg as well as dozens of smaller companies. A portion of the show floor was given over to about eight enormous mobile clinics, large buses or recreational vehicles transformed into mobile hospital or clinic facilities.

The meeting was divided into several different tracks. These included:

  • Emergency and Remote Telemedicine
  • Patient sensors and home telemonitoring
  • Videoconferencing
  • Business models, management and finance

This was my first ATA meeting, and the first time I had been in Seattle.
The format for most presentations was a fifteen minute lecture followed by a few questions. Presentations fell in to the tracks as described above. I was interested in particular in hardware, including video and sensors. While there were a couple of presentations that described work similar to ours, nobody described a program delivered over multi-point videoconferencing. Some random notes:

Every person in the United Kingdom is registered with a family doctor

Virtually all primary care in the UK is computerized

When an entity (like the National Health Service in Britain, or Kaiser Permanente in California) is both the payer and the health-care provider barriers to automation and improved productivity via electronic medical records and telemedicine are reduced.

Much of the lag in the U.S. of implementing the electronic medical record is due to the lack of clarity over who benefits, and who pays for its implementation. When these are not the same entity, there is conflict.

The Continua Health Alliance is an industry group implementing interface standards for sensor data transmission using exisisting hardware; Bluetooth, USB and Zigbee.

Vital sign sensors are a big deal. There was a great deal of discussion of patient self-administered readings of weight, glucose levels, and blood pressure which are sent via a wireless connection to a hub connected to a telephone.

Some patients may have a different perception of “good health”, than might otherwise be expected. Some patients described themselves to be in good health, although they are on oxygen, confined to a scooter or wheel chair, and have had a third heart bypass operation.

In focus group studies patients said they liked being able to take readings at home. It allowed for more privacy, and allowed the patient to be involved in their own care.

Things that people didn’t like about home health-care equipment; having to move it around, “smells like a hospital”, disruptive of routine.

The “smart home” for assisted living could involve sensors and motion detectors . Think of smoke detectors, which are an example of a sensor.

All medical students have PDAs or smart phones. When they get out of medical school they are going to be expecting digital connections. They don’t expect to see patients for 12 hours a day. There may be a whole new group of physicians in areas like correctional telemedicine.

We don’t have “real-time” now. I have to walk across the street to get my meds, down the hall to get blood drawn. Patients wearing sensors are already much faster (whether tele or not).

The American crisis in health care is THE opportunity for Telemedicine.

Find a forward-thinking governor in a small state that would be willing to grasp the opportunity with long-term care and telehealth, Opportunities under medicaid “308″? Pennsyvania “ERA” program. Remote monitoring and chronic disease management Several very large self-insured employers are taking this on.

Posted in Uncategorized