Table Of ContentSpringer-Verlag Berlin Heidelberg GmbH
Ross Anderson (Ed.)
Personal Medical
Information
Security, Engineering, and Ethics
Personal Information Workshop
Cambridge, UK, June 21-22, 1996
Proceedings
Volume Editor
Ross Anderson
University of Cambridge, Computer Laboratory
New Museums Site, Pembroke Street, Cambridge CB2 3QG, UK
E-mail:
Foreword
In the last few years, the protection of computerised medical records, and
of other personal health information, has become the subject of both technical
research and political dispute in a number of countries.
In Britain, the issue arose initially as an argument between the British Me-
dical Association and the Department of Health over whether encryption should
be used in a new medical network. In Germany, the focus was the issue to all
patients of a smartcard to hold insurance details and facilitate payment; while
in the USA, the debate has been whether federal law should preempt state re-
gulation of computerised medical records, and if so, what technical and legal
protection should be afforded the patient.
Whatever the origin and evolution of this debate in specific countries, it has
become clear that policy and technical matters are closely intertwined. What
does 'computer security' mean in the medical context? What are we trying to
do? What are the threats that we are trying to forestall? What costs might
reasonably be incurred? To what extent is the existing technology - largely
developed to meet military and banking requirements - of use? And perhaps
hardest of all, what is the right balance between technical and legal controls?
As the debate spread, it became clear that there was little serious contact
between the people who could state the requirements - clinical professionals,
medical ethicists and patients - and the people who could explore how to meet
these requirements, most (but not all) of them from the computer security com-
munity. How could this gap be bridged?
It so happened that from January to June 1996, I was organising a six-month
research programme in computer security, cryptology, and coding theory at the
Isaac Newton Institute for Mathematical Sciences in Cambridge. This would be
attended by most of the top researchers in the field, and seemed too good an
opportunity to miss. I brought it to the attention of the BMA, and it was agreed
that the Isaac Newton Institute and the BMA would jointly sponsor a two-day
interdisciplinary workshop focussed on medical computer security and entitled
'Personal Information - Security, Engineering and Ethics'.
The conference was opened by the President of the BMA, Sir Terence English,
and the first item of business was the announcement of an agreement between
the BMA and UK health data processing companies on standards for the de-
identification of personal health information kept for such purposes as computing
hospital readmission rates and referral patterns. The papers presented here were
then delivered, and for the following two days we had a lively exchange of views
between doctors, lawyers, privacy activists, medical informatics professionals,
and the computer security community.
The papers in these proceedings reflect this breadth of interest. The origin
of the debate between the BMA and the British government are described in
the papers by Simon Jenkins and Fleur Fisher, while its history is set out in
the paper by Ross Anderson who also describes the BMA's approach to safety
and privacy that developed out of it. A pilot project to implement the BMA's
VI
recommendations is reported on by Alan Hassey and Mike Wells. Alternative
views are presented by Ruth Roberts, Joyce Thomas, Mike Rigby, John Williams,
and Andrew Blyth. Mary Hawking sets out the viewpoint of a primary care
physician, while Peter Landrock and John Williams describe a prototype system
for securing clinical messages between primary carers and the hospital.
Four German papers were given. Anja Hartmann and Otto Ulrich present the
viewpoint of the BSI (the German government's information security agency);
Bernd Blobel discusses the measures taken to bring the former East German
cancer registries up to Western standards of privacy protection after the fall
of the Berlin Wall; Ulrich Kohl describes an access control system built for a
German hospital; while Gerrit Bleumer and Matthias Schunter show how cryp-
tographic mechanisms can provide ways to clear healthcare payments so that
patients remain anonymous while insurers can still control costs.
Compared with Britain and Germany, the US concerns are more at the policy
level, and concern how the interests of insurers and patients can be reconciled
by legislative mechanisms (absent the kind of system described by Bleumer and
Schunter). The privacy activists' position is stated by Beverly Woodward; Reid
Cushman asks why healthcare systems are at all special; and the practical pro-
blems are elucidated by Agneta Breitenstein. Having heard of the situation in
the USA, delegates endorsed the motion that: "This meeting deplores the di-
saster in medical privacy threatened in the USA by proposals to legitimise the
widespread sharing of personal health information without patient consent; and
would also deplore similar developments in Europe and elsewhere."
The remaining three papers each come from different countries. Ronald Dra-
per discusses how an Irish hospital's systems deal with the privacy of mental
health information; a Japanese health smartcard project is described by Yoshi-
kazu Okada, Yasuo Haruki, Youichi Ogushi, and Masanobu Horie; while finally
Roddy Neame describes the healthcare system in New Zealand. This appears to
meet many of the privacy requirements and aspirations of other countries, with
the data kept centrally for research and audit purposes being de-identified.
Taken together, the papers in this volume give a snapshot not merely of
the state of the medical computer security art at the middle of 1996, but of the
complex interplay between the technical, political, and human aspects of medical
informatics which make it so fascinating.
We hope that this volume of proceedings will contribute to the development
of policies and mechanisms to protect the safety and privacy of clinical informa-
tion, and to establishing clinical information security as a distinct engineering
discipline. The ultimate goal is that both patients and healthcare professionals
should derive the greatest possible benefit from information technology; and we
are grateful to the BMA and the Isaac Newton Institute for enabling us to take
a few small but important steps in this direction.
Ross Anderson
January 1997
PERSONAL INFORMATION
Security, Engineering and Ethics
Cambridge, England
June 21-22, 1996
Sponsored by the
Isaac Newton Institute for Mathematical Sciences
and the
British Medical Association
Chair
Ross Anderson, University of Cambridge, UK
Programme Committee
Ab Bakker .......................................... Bazis, The Netherlands
David Banisar .................. Electronic Privacy Information Center, USA
Gerrit Bleumer .......................... University of Hildesheim, Germany
Paula Bruening ............. Formerly Office of Technology Assessment, USA
Ian Cheong .............................................. RACGP, Australia
Fleur Fisher ................................ British Medical Association, UK
Elizabeth France ............................. Data Protection Registrar, UK
Bob Frankford ........................ Formerly Ontario Legislature, Canada
Peter Landrock .................................. Arhus University, Denmark
Robert Morris ................................................... NSA, USA
Roderick Neame ......................... Health Information Consulting, UK
Roger Needham ............................... University of Cambridge, UK
Beverly Woodward ................................ Brandeis University, USA
Contents
Information and the NHS (For me or for them?)
Simon Jenkins ......................................................... 1
Chances, Risks and Side Effects of Chip Cards in Medicine:
A Technology Assessment Study from Germany
Anja Hartmann, Otto Ulrich .......................................... 19
Exceptionalism Redux: How Different is Health Care Informatics?
Reid Cushman ........................................................ 27
Clinical Record Systems in Oncology. Experiences and Developments
on Cancer Registers in Eastern Germany
Bernd Blobel ........................................................... 39
Organisation of General Practice: Implications for IM&T in the NHS
Mary Hawking ........................................................ 57
Practical Protection of Confidentiality in Acute Health Care
Ruth Roberts, Joyce Thomas, Michael Rigby, John Williams ........... 67
Clinical Systems Security - Implementing the BMA Policy and
Guidelines
Alan Hassey, Mike Wells .............................................. 79
User-Oriented Control of Personal Information Security in
Communication Systems
Ulrich Kohl ........................................................... 95
Information Management as Risk Management
Beverly Woodward .................................................... 109
Responsibility Modelling: A New Approach to the Re-alignment
and Re-engineering of Health-Care Organisations
Andrew Blyth . ........................................................ 117
Keeping Confidence in Confidentiality: Linking Ethics, Efficacy,
and Opportunity in Health Care Computing
Michael Rigby ....................................................... 129
Electronic Patient Records: Usability vs Security, with Special
Reference to Mental Health Records
Ronald Dmper ........................................................ 151
x
Security and Confidentiality Issues Relating to the Electronic
Interchange of Clinical Data
Peter Landrock, John Williams ....................................... 165
Privacy Oriented Clearing for the German Health-Care System
Gerrit Bleumer, Matthias Schunter ................................... 175
Personal Health Data on Optical Memory Cards in Isehara City
Yoshikazu Okada, Yasuo Haruki, Youich Ogushi,
Masanobu Horie ..................................................... 195
The Perspective of Medical Ethics
Fleur Fisher ......................................................... 199
Legal Requirements for Computer Security: An American Perspective
David Banisar ....................................................... 207
u.S. Health Information Privacy Policy: Theory and Practice
Agneta Breitenstein .................................................. 209
Managing Health Data Privacy and Security: A Case Study from
New Zealand
Roderick Neame ..................................................... 225
An Update on the BMA Security Policy
Ross Anderson ....................................................... 233
Author Index ......................................................... 251
Information and the NHS
(For me or for them?)
Simon Jenkins MBE FRCGP
General Practitioner, The Minden Medical Centre, Bury
Chairman of BMA' s Information Technology Committee
21 June 1996
Before discussing the Information and Technology strategy of the NHS, we must consider
the objectives of that strategy and whether they are legitimate.
Government objectives are to provide for and protect the health of the public they serve.
They must ensure that all citizens have access to necessary care, free at the time of need;
they must enSure that the public health is maintained and improved; and they must
provide the necessary finance to fund these objectives primarily out of general taxation.
(These principles are set out in parliamentary language in the various NHS Acts, since
1946).
These objectives generate a central government imperative to "control expenditure", and
to get the best possible "value for money". They imply a mechanism for monitoring
expenditure; for measuring what is being provided; for identifying gaps in provision, and
for closing those gaps.
There are further considerations that derive from these objectives and apply to any area of
public spending. For example:
I. How efficient, effective and equitable are the resource distribution, control and
monitoring mechanisms?
2. Can fraud be detected?
3. Is money being spent effectively or wasted, and how is it being wasted?
4. Is the service responsive to the changing (health care) needs of the popUlation?
5. Are the bureaucratic mechanisms consuming more of the (health care) resources than
they should, and how can excessive bureaucracy be reduced?
These questions are posed from the legitimate prospective of government. The other quite
different but equally legitimate approach is to ask what individual patients want from the
people who provide their healthcare services. The patients perspective is by its very
nature different from that of government.
The medical profession (and the BMA) must ask is which set of principles should doctors
follow in providing their services to individual patients and the community.
R. Anderson (ed.), Personal Medical Information
© Springer-Verlag Berlin Heidelberg 1997
2
These can be considered as follows:
Principle One: Standards - "Best Possible Care"
Doctors must provide the best possible care to the individual patient who consults them
within the resources (time, facilities, and funding available), referring to other health care
providers where appropriate.
Principle Two:Confidentiality
In pursuing the first principle, doctors must ensure the confidentiality of the consultation
is protected, subject to clearly defined exceptions which must be clarified by legislation
(see draft bill on Disclosure of Personal Health Information - The Lord Walton Bill'). To
ensure that the confidentiality of iriformation given in consultations is maintained, they
should adhere to the nine principles set out in the BMA Security Policy' commissioned
from Dr Ross Anderson, which are derived from the GMC's Guidance "Good Medical
Practice"".
Principle Three: Public health advice
Doctors must advise on matters of "public health" that relate to their communities or to
larger groups of the population.
Doctors and other healthcare professionals may act as policy makers in their own right or
may advise others who are responsible for determining the resources, nature and range of
healthcare services.
The role of the doctor as a provider of medical advice and treatment to individuals must
not be confused with the separate and arguably equally important role as an advisor to
healthcare organisations. The cash limiting of resources for healthcare will inevitably
force a conflict of interest between these two roles.
Compromise solutions must be arrived at through honest and open debate between those
who advocate and those who allocate on behalf of patients.
A single doctor can carry out both functions but it should be clear to all when he or she is
acting as advocate or allocator and for whom they are acting at any given time. Lack of
clarity leads to mistrust by individual patients or accusations by healthcare organisations
that the doctor has a vested interest and cannot give unbiased advice.
Education, teaching and research are other aspects of the responsibilities of doctors
referred to in the GMC's Guidance on "Good Medical Practice", but it is the first three
principles enunciated above that are the rock upon which ethical medical practice can
flourish in a system of healthcare provision where a third party (ie. neither the doctor nor
the patient) have accepted responsibility for paying for the consultation and the
interventions that flow from it, which together form the health services.
There is a view that where a third party is paying for health care, that third party has a
right to know what they are paying for, and whether it represents value for money.
If the patient is paying directly for the medical services then there is no conflict.
