HIPAA - The Hippocratic Oath for Techies

As technology proliferated into healthcare, especially in the radiological practice, privacy protection once again entered the limelight as new issues concerning electronic data have been raised. In the medical imaging industry alone, which is a small subset of the healthcare sector, IXICO can testify that vast numbers of medical images exist in electronic format for compact storage, easy maintenance and rapid retrieval.

However, the convenience of data access across networks extending far beyond clinical sites or hospitals means that the patient’s personal information is potentially at risk of becoming publicly available. For example, every level of image transfer presents a potential security threat: (i) the images could be accessed by unauthorized parties at the clinical site (confidentiality) (ii) during the image transfer, images could be intercepted and modified (integrity) (iii) the intended receiver of the images might not receive them (authentication).

To meet the demands of rapidly developing technology, the US instituted in 2003 the Health Insurance Portability and Accountability Act (HIPAA) in order to set and enforce the standards for protecting the privacy and security of healthcare data. Indeed, privacy protection in the healthcare sector has always been an important issue. One part of the Hippocratic Oath, penned more than two millennia ago, stated that ‘Whatever I see or hear, professionally or privately, which ought not to be divulged, I will keep secret and tell no one’. HIPAA can be seen as the equivalent of the Hippocratic Oath for anyone dealing with electronic medical data. Non-compliance with HIPAA regulations can have severe consequences, including heavy fines and potential prison time.

Patient privacy is clearly an area of increasing focus for both the healthcare and technology industries. The difficulty for medical practitioners and clinical trial sponsors alike is that compliance with the regulations is difficult to maintain; the regulations are often not clear in their application to new and emerging technologies and individuals are often faced with rather laborious routes to compliance. The goal is to simplify the process as much as possible through automation. Many medical technology companies, including IXICO, are developing tools to help comply with HIPAA regulations through computer-based automation. Promising technologies include data encryption, virtual private networks, data embedding, and audit trails. These tools will undoubtedly improve personal data security and may potentially provide the basis for updating the laws governing the practice of medicine in the modern medical arena.