Eva Henriksen

Risk analysis of information security in a mobile instant messaging and presence system for healthcare

INTRODUCTION Instant messaging (IM) is suited for immediate communication because messages are delivered almost in real time. Results from studies of IM use in enterprise work settings make us believe that IM based services may prove useful also within the healthcare sector. However, todays public instant messaging services do not have the level of information security required for adoption of IM in healthcare. We proposed MedIMob, our own architecture for a secure enterprise IM service for use in healthcare. MedIMob supports IM clients on mobile devices in addition to desktop based clients. METHODS Security threats were identified in a risk analysis of the MedIMob architecture. The risk analysis process consists of context identification, threat identification, analysis of consequences and likelihood, risk evaluation, and proposals for risk treatment. RESULTS The risk analysis revealed a number of potential threats to the information security of a service like this. Many of the identified threats are general when dealing with mobile devices and sensitive data; others are threats which are more specific to our service and architecture. Individual threats identified in the risks analysis are discussed and possible counter measures presented. DISCUSSION The risk analysis showed that most of the proposed risk treatment measures must be implemented to obtain an acceptable risk level; among others blocking much of the additional functionality of the smartphone. To conclude on the usefulness of this IM service, it will be evaluated in a trial study of the human-computer interaction. Further work also includes an improved design of the proposed MedIMob architecture.

Electronic Symptom Reporting Between Patient and Provider for Improved Health Care Service Quality: A Systematic Review of Randomized Controlled Trials. Part 1: State of the Art

Background Over the last two decades, the number of studies on electronic symptom reporting has increased greatly. However, the field is very heterogeneous: the choices of patient groups, health service innovations, and research targets seem to involve a broad range of foci. To move the field forward, it is necessary to build on work that has been done and direct further research to the areas holding most promise. Therefore, we conducted a comprehensive review of randomized controlled trials (RCTs) focusing on electronic communication between patient and provider to improve health care service quality, presented in two parts. Part 2 investigates the methodological quality and effects of the RCTs, and demonstrates some promising benefits of electronic symptom reporting. Objective To give a comprehensive overview of the most mature part of this emerging field regarding (1) patient groups, (2) health service innovations, and (3) research targets relevant to electronic symptom reporting. Methods We searched Medline, EMBASE, PsycINFO, Cochrane Central Register of Controlled Trials, and IEEE Xplore for original studies presented in English-language articles published from 1990 to November 2011. Inclusion criteria were RCTs of interventions where patients or parents reported health information electronically to the health care system for health care purposes and were given feedback. Results Of 642 records identified, we included 32 articles representing 29 studies. The included articles were published from 2002, with 24 published during the last 5 years. The following five patient groups were represented: respiratory and lung diseases (12 studies), cancer (6), psychiatry (6), cardiovascular (3), and diabetes (1). In addition to these, 1 study had a mix of three groups. All included studies, except 1, focused on long-term conditions. We identified four categories of health service innovations: consultation support (7 studies), monitoring with clinician support (12), self-management with clinician support (9), and therapy (1). Most of the research (21/29, 72%) was conducted within four combinations: consultation support innovation in the cancer group (5/29, 17%), monitoring innovation in the respiratory and lung diseases group (8/29, 28%), and self-management innovations in psychiatry (4/29, 14%) and in the respiratory and lung diseases group (4/29, 14%). Research targets in the consultation support studies focused on increased patient centeredness, while monitoring and self-management mainly aimed at documenting health benefits. All except 1 study aiming for reduced health care costs were in the monitoring group. Conclusion RCT-based research on electronic symptom reporting has developed enormously since 2002. Research including additional patient groups or new combinations of patient groups with the four identified health service innovations can be expected in the near future. We suggest that developing a generic model (not diagnosis specific) for electronic patient symptom reporting for long-term conditions may benefit the field.

Managing communication availability and interruptions: a study of mobile communication in an oncology department

Wireless phones and text messaging are tremendously popular in many areas of society. However, they are still relatively unused in hospitals where pagers are a pervasive communication device that is notoriously difficult to replace. This paper studies pager and wireless phone use at the oncology department at University Hospital of North Norway. Participatory observation and interviews with physicians are used to provide qualitative analysis about the use, drawbacks and benefits of both technologies. A number of important issues are addressed that should aid designers of next generation mobile communication systems for hospitals. In particular, the data points towards specific features that will be crucial for the overall usability and acceptance of an integrated device that supports paging, voice and text services. Of particular importance will be features that allow users to manage their communication availability and avoid interruptions.

Electronic Symptom Reporting Between Patient and Provider for Improved Health Care Service Quality: A Systematic Review of Randomized Controlled Trials. Part 2: Methodological Quality and Effects

Background We conducted in two parts a systematic review of randomized controlled trials (RCTs) on electronic symptom reporting between patients and providers to improve health care service quality. Part 1 reviewed the typology of patient groups, health service innovations, and research targets. Four innovation categories were identified: consultation support, monitoring with clinician support, self-management with clinician support, and therapy. Objective To assess the methodological quality of the RCTs, and summarize effects and benefits from the methodologically best studies. Methods We searched Medline, EMBASE, PsycINFO, Cochrane Central Register of Controlled Trials, and IEEE Xplore for original studies presented in English-language articles between 1990 and November 2011. Risk of bias and feasibility were judged according to the Cochrane recommendation, and theoretical evidence and preclinical testing were evaluated according to the Framework for Design and Evaluation of Complex Interventions to Improve Health. Three authors assessed the risk of bias and two authors extracted the effect data independently. Disagreement regarding bias assessment, extraction, and interpretation of results were resolved by consensus discussions. Results Of 642 records identified, we included 32 articles representing 29 studies. No articles fulfilled all quality requirements. All interventions were feasible to implement in a real-life setting, and theoretical evidence was provided for almost all studies. However, preclinical testing was reported in only a third of the articles. We judged three-quarters of the articles to have low risk for random sequence allocation and approximately half of the articles to have low risk for the following biases: allocation concealment, incomplete outcome data, and selective reporting. Slightly more than one fifth of the articles were judged as low risk for blinding of outcome assessment. Only 1 article had low risk of bias for blinding of participants and personnel. We excluded 12 articles showing high risk or unclear risk for both selective reporting and blinding of outcome assessment from the effect assessment. The authors’ hypothesis was confirmed for 13 (65%) of the 20 remaining articles. Articles on self-management support were of higher quality, allowing us to assess effects in a larger proportion of studies. All except one self-management interventions were equally effective to or better than the control option. The self-management articles document substantial benefits for patients, and partly also for health professionals and the health care system. Conclusion Electronic symptom reporting between patients and providers is an exciting area of development for health services. However, the research generally is of low quality. The field would benefit from increased focus on methods for conducting and reporting RCTs. It appears particularly important to improve blinding of outcome assessment and to precisely define primary outcomes to avoid selective reporting. Supporting self-management seems to be especially promising, but consultation support also shows encouraging results.

Privacy and information security risks in a technology platform for home-based chronic disease rehabilitation and education

BackgroundPrivacy and information security are important for all healthcare services, including home-based services. We have designed and implemented a prototype technology platform for providing home-based healthcare services. It supports a personal electronic health diary and enables secure and reliable communication and interaction with peers and healthcare personnel. The platform runs on a small computer with a dedicated remote control. It is connected to the patient’s TV and to a broadband Internet. The platform has been tested with home-based rehabilitation and education programs for chronic obstructive pulmonary disease and diabetes. As part of our work, a risk assessment of privacy and security aspects has been performed, to reveal actual risks and to ensure adequate information security in this technical platform.MethodsRisk assessment was performed in an iterative manner during the development process. Thus, security solutions have been incorporated into the design from an early stage instead of being included as an add-on to a nearly completed system. We have adapted existing risk management methods to our own environment, thus creating our own method. Our method conforms to ISO’s standard for information security risk management.ResultsA total of approximately 50 threats and possible unwanted incidents were identified and analysed. Among the threats to the four information security aspects: confidentiality, integrity, availability, and quality; confidentiality threats were identified as most serious, with one threat given an unacceptable level of High risk. This is because health-related personal information is regarded as sensitive. Availability threats were analysed as low risk, as the aim of the home programmes is to provide education and rehabilitation services; not for use in acute situations or for continuous health monitoring.ConclusionsMost of the identified threats are applicable for healthcare services intended for patients or citizens in their own homes. Confidentiality risks in home are different from in a more controlled environment such as a hospital; and electronic equipment located in private homes and communicating via Internet, is more exposed to unauthorised access. By implementing the proposed measures, it has been possible to design a home-based service which ensures the necessary level of information security and privacy.

Video calls from lay bystanders to dispatch centers - risk assessment of information security

BackgroundVideo calls from mobile phones can improve communication during medical emergencies. Lay bystanders can be instructed and supervised by health professionals at Emergency Medical Communication Centers. Before implementation of video mobile calls in emergencies, issues of information security should be addressed.MethodsInformation security was assessed for risk, based on the information security standard ISO/IEC 27005:2008. A multi-professional team used structured brainstorming to find threats to the information security aspects confidentiality, quality, integrity, and availability.ResultsTwenty security threats of different risk levels were identified and analyzed. Solutions were proposed to reduce the risk level.ConclusionsGiven proper implementation, we found no risks to information security that would advocate against the use of video calls between lay bystanders and Emergency Medical Communication Centers. The identified threats should be used as input to formal requirements when planning and implementing video calls from mobile phones for these call centers.

Difficulties in moving routine medical checks from the specialist level to the general practitioner level

We began a project to move routine medical checks for appropriate patients from the specialist level to the patients normal general practitioner (GP). The GPs analysis and conclusions would be checked by the specialist, using electronic messaging. The idea for the project came from the top level of the regional health authority. Despite that, the project was closed down before pilot testing began. We used stakeholder theory as a post-project evaluation to analyse what happened and where it went wrong. A common mistake in project planning is to focus the planning effort on system tasks and not to pay attention to a well-thought-out handling of the projects stakeholders. This was what happened in our project. Ideal objectives and good political intentions are not enough to implement a new e-health service.