Cybercriminals: Eye on Your Health Records

Features@ITRealms:

The report of over 1m health records being compromised was not a smiling matter. REMMY NWEKE writes on the need for patients to care about what happens to their personal health records, especially at this digital era.

Mbong goes to hospital:
Recently, Kemsi Mbong went to a medical facility where he registered his family for usage any time his health fails him or that of any member of his family. In the cause of a surgical operation, he was charged and a few days later was discharged to go home, while he continues with his check-ups eventhough the stitches were very much intact on him.

During his first check-up from him, after seeing his medical doctor, he was furious to discover he was being charged some extras, which he protested and along the line had a shouting match with the medical doctor, although he later apologised when he calmed down, the doctor wrote off the supposed bill and the pharmacist was asked to give him his medication.

However, Kemsi Mbong was not satisfied as he suspected the drugs may have been reduced for the doctor to have written off the medications, thereafter he requested to see his health records or his ‘file’ as the local parlance accommodates. Surprisingly, his request was turned down by the front-desk and pharmacist.

Why you need a personal health record:
Everyone has a fundamental right as a patient to have a Personal Health Record, which is a collection of all of those lab results, x-rays, treatments, prescriptions, appointments, weight-loss plans and medical records in one place. This record, experts say, must be in an accessible place to the patient because it matters and is your health we are talking about here.

Some of the reasons, experts offer on the importance of patient having access to their records to include allowing them or a physician to make better health decisions in the long run; it improves accurate medical response in a crisis and reduces misdiagnosis and the hazards or expenses associated to it. In addition, experts canvassed  that PHR saves you time and money in routine checkups; reduces the number of medical appointments, by allowing a direct connection between physician and patient; enables self-monitoring, which means you can keep your own track on glucose, blood-pressure, diet, medications and many more.

Just as it makes care-giving for the elderly, disabled, or physically and or mentally impaired easier and more effective by way of putting you as a patient, or caregiver, in control of the health, and medical, decisions that affect you and the ones you love.

FOA and personal medical records:
Though Kemsi Mbong persisted and advised they seek a senior management approval to allow him access to his medical records at the private hospital, which they sought, but the doctor on hearing the request was made by the patient who just had a shouting match, reportedly alarmed and promptly declined the offer.

Getting the wind of this development, DigitalSENSE Business News contacted a Freedom of Information (FOI) lawyer, who was identified as Barr. Chukwuemeka, on whether a private hospital qualified for a public institution? He responded by saying that “Yes indeed it is a public institution since it renders services to the public. I should think what applies to government hospitals as a public institution does to a private hospital,” stressing that a public institution is defined in the FOI Act ... Sections 2(7) and 30, insisting that a patient need not apply under the FOI for his or her personal information.

Another lawyer, Barr. Esther Ani noted that a patient could see her own personal records, based on the general law and not FOI Act, explaining that “Personal medical history...is not public information.”
According to Barr. Ejike, the question raised is ideally best addressed under a Data Protection Law, stressing that under Section 14(2)(a) of the FOI Act, a patient has the right to see his/her medical records, if the records are held by a public institution, that is an institution to which the FOI Act applies.  The provision states that “A public institution shall disclose any information that contains personal information if the individual to whom it relates consents to the disclosure.”

He also said, the Doctor-Patient privilege...protects the ‘Patient’s’ information from being disclosed to the public; The Patient however can waive this exemption by giving consent to allow another person access to her personal information but the doctor/hospital cannot; The patient does not have to apply under FOI for her personal information,for the simple reason that it is hers.

Ejike equally stated that the situation would have been different if it was not patient-doctor privilege, pointing out that if it was employee personal information maintained in the cause of employment and functions as a staff of a Public Institution.

As said by him, Section 14, subsection (2) envisaged a “situation where a person (other than the person to whom the information relates) requests access such a request shall be denied...except the person to whom the information relates gives consent.... under s.14 at least 2 different persons are involved.... The patient cannot be an applicant for access ....which is subject to exemption....and also be the person to lift the exemption by giving consent.”

Data Protection Law and FOI:
For Barr. Omenauya, since the discussion is on the patient having access to his or her records, its completely illogical and makes no sense at all as the only reason for the protection of personal information, including information subject to doctor-patient privilege, is to protect the person to whom the information relates.  

“Once the person to whom the information relates consents to disclosure, the institution has no more discretion in the matter and has no reason whatsoever not to disclose the information. The Law states that the institution shall disclose the information. There would be no other reason permissible under the Law for the institution to withhold the information,” he said.

Further, Omenauya said, there is nothing in the FOI Act barring anyone from requesting any information on the ground that the information is about him or her.  And there is nothing in the Act similarly exempting any information from disclosure on the ground that it is about the person asking for it.  A person can ask for information relating to him or her.

100m medical records compromised:
This came as DigitalSENSE Business News gathered that medical records have been touted as increasingly being targeted by cybercriminals, just as 100 million records have been lately compromised.

According to the Area Manager for East and West Africa at Check Point Software Technologies, Rick Rogers, at the recent Healthcare Innovation Summit (HIS), quoted the data from the United States (US) which showed that 89 per cent of healthcare institutions suffered a security breach and were twice more likely to be targeted than other organisations.

Underlining the fact that prevention is better than cure, he noted that the healthcare industry, arguably is one of the most technologically advanced considering the gadgets and devices now used to monitor health statistics and perform medical procedures, is ironically among the most ‘unhealthy’ when it comes to network security.

Medical records more valuable to cybercriminals than credit cards:
Rogers emphasized that healthcare record theft increased a shocking 1,100 per cent this year with more than 100 million records compromised worldwide, stressing that the biggest threat, according to KPMG, comes from external attackers at 65 per cent, while malware tops the list of information security concerns. Pointing out that with technological abilities, there is multi-faceted hindering good information security comprising valuable data, ageing infrastructure, complex networks, no budget and easy targets, coupled with lack of understanding and awareness.

He posted that valuable data comprises data collected and stored by hospitals and other organisations, such as medical aid schemes, is up to 10 times more valuable to cybercriminals than credit card information. Roger noted that due to the sheer volume of information gathered about individuals and the fact that people see an increased shift to digital medical records, which makes it easy to commit fraud and identity theft. He stressed that given the value of this data on the black market, cyber-attacks are becoming ever more sophisticated in their attempts to hack healthcare institutions, to name a few.

Buttress the point on 100 million records compromised, cyber security experts at securityintelligence.com, quoted the Director, Department of Health & Human Services (HHS) Office for Civil Rights, Jocelyn Samuels, as saying that “One of the biggest current threats to health information privacy is the serious compromise of the integrity and availability of data caused by malicious cyberattacks on electronic health information systems, such as through ransomware.”

Samuel identified prevention and protection as essential, since paying cybercriminals does not always guarantee getting required information back, stressing that researchers have discovered a ransomware variant that just deletes files even if it has been paid for according to recent Dark Reading report.
Further, SecurityIntelligence.com reported that the health care industry has continued to experience significant changes in security risk, driven by rapid digitization, changing patient expectations, regulatory pressures from Health Insurance Portability and Accountability Act (HIPAA) and limited budgets, where such exist to name a few.

According to experts at an free online encyclopedia, Wikipedia, the terms medical record, health record, and medical chart are used interchangeably to describe the systematic documentation of a single patient’s medical history and care across time within one particular health care provider’s jurisdiction.The health record includes a variety of types of “notes” entered over time by health care professionals, recording observations and administration of drugs and therapies, orders for the administration of drugs and therapies, test results, x-rays, reports to name a few. Also, experts said that the maintenance of complete and accurate medical records is a requirement of health care providers and is generally enforced as a licensing or certification prerequisite.

Thus, the terms are used for both the physical folder that exists for each individual patient and for the body of information found therein.

Over time, health records have traditionally been collated and maintained by health care providers, but given advances in online data storage have led to the development of personal health records (PHR) that are maintained by patients themselves, often on third-party websites. In Nigeria, this kind of service has not gained momentum, yet this concept was supported by the United States (US) national health administration entities and by the American Health Information Management Association (AHIMA).

Another school of thought argued that a health record is simply a collection of your health information, including your dietary habits, fitness, physical abilities or status, hormonal balance, age, weight, blood pressure, among others, whereas your medical records, are those files that your physicians keep and update whenever you pay them a visit for a checkup, or go into the emergency room. They posited that medical records are usually not available to patients and in times of need, it can be ridiculously expensive to gather all of your medical records. Hence, the sad part is you may not even have the time to do that at emergency period.

Is Nigeria medical records digitized?:
The Chairman ofa cybersecurity organization, Consultancy Support Services (CS2) Alhaji Abdul-Hakeem Ajijola, in his reaction described the situation as certainly an impending challenge, wondering how many Nigerian medical records are currently digitised? He went on to ask how safe or secureis even themanual medical records, currently in use largely, adducing that a visit to a typical medical facility will answer that.

He further asked whetherNigeria as a society really care about such privacy?Just as emphasized that it would evolve a world class medical sector to deploy world class best practices for securing medical data.

Summary:
The importance of access to information and especially health records cannot be over-emphasised. This is moreso given the number of patients who may have lost their lives due to poor medical attention, records and wrong diagnosis to mention a few.
The urgency with which the insurance could respond to health care system and attacks on health records by men of cybercriminals cannot be over-looked or waived, just as extra education is needed for more Nigerians to continue to embrace and learn further on their undeveloped access to information and their records cannot but be encouraged as that will make more medical doctors to live up to their oath of medical profession, otherwise known as ‘Hippocratic Oath.’ 
DigitalSENSE Business News recalls that the historical oath by medics is usually taken by physicians and stands out as one of the most widely known of Greek medical texts; which in its original form requires a new physician to swear, by a number of healing gods, to uphold specific ethical standards, which at this modern times should include preservation of patients privacy and protection of such rights.
Above all, every patient, has the right to his or her health records, if not a constitutional matter, at least, the Freedom of Information (FOI) Act comes handy to endorse access to information including your own records beyond health institutions, to way of life.
So, when next at your hospital, make effort to ask for your medical records and see how they will react, which definitely will tell you if they cherish your right.

ITREALMS ... everything news digitally!