Springer-Verlag Berlin Heidelberg GmbH Ross Anderson (Ed.) Personal Medical Information Security, Engineering, and Ethics Personal Information Workshop Cambridge, UK, June 21-22, 1996 Proceedings Volume Editor Ross Anderson University of Cambridge, Computer Laboratory New Museums Site, Pembroke Street, Cambridge CB2 3QG, UK E-mail: Foreword In the last few years, the protection of computerised medical records, and of other personal health information, has become the subject of both technical research and political dispute in a number of countries. In Britain, the issue arose initially as an argument between the British Me- dical Association and the Department of Health over whether encryption should be used in a new medical network. In Germany, the focus was the issue to all patients of a smartcard to hold insurance details and facilitate payment; while in the USA, the debate has been whether federal law should preempt state re- gulation of computerised medical records, and if so, what technical and legal protection should be afforded the patient. Whatever the origin and evolution of this debate in specific countries, it has become clear that policy and technical matters are closely intertwined. What does 'computer security' mean in the medical context? What are we trying to do? What are the threats that we are trying to forestall? What costs might reasonably be incurred? To what extent is the existing technology - largely developed to meet military and banking requirements - of use? And perhaps hardest of all, what is the right balance between technical and legal controls? As the debate spread, it became clear that there was little serious contact between the people who could state the requirements - clinical professionals, medical ethicists and patients - and the people who could explore how to meet these requirements, most (but not all) of them from the computer security com- munity. How could this gap be bridged? It so happened that from January to June 1996, I was organising a six-month research programme in computer security, cryptology, and coding theory at the Isaac Newton Institute for Mathematical Sciences in Cambridge. This would be attended by most of the top researchers in the field, and seemed too good an opportunity to miss. I brought it to the attention of the BMA, and it was agreed that the Isaac Newton Institute and the BMA would jointly sponsor a two-day interdisciplinary workshop focussed on medical computer security and entitled 'Personal Information - Security, Engineering and Ethics'. The conference was opened by the President of the BMA, Sir Terence English, and the first item of business was the announcement of an agreement between the BMA and UK health data processing companies on standards for the de- identification of personal health information kept for such purposes as computing hospital readmission rates and referral patterns. The papers presented here were then delivered, and for the following two days we had a lively exchange of views between doctors, lawyers, privacy activists, medical informatics professionals, and the computer security community. The papers in these proceedings reflect this breadth of interest. The origin of the debate between the BMA and the British government are described in the papers by Simon Jenkins and Fleur Fisher, while its history is set out in the paper by Ross Anderson who also describes the BMA's approach to safety and privacy that developed out of it. A pilot project to implement the BMA's VI recommendations is reported on by Alan Hassey and Mike Wells. Alternative views are presented by Ruth Roberts, Joyce Thomas, Mike Rigby, John Williams, and Andrew Blyth. Mary Hawking sets out the viewpoint of a primary care physician, while Peter Landrock and John Williams describe a prototype system for securing clinical messages between primary carers and the hospital. Four German papers were given. Anja Hartmann and Otto Ulrich present the viewpoint of the BSI (the German government's information security agency); Bernd Blobel discusses the measures taken to bring the former East German cancer registries up to Western standards of privacy protection after the fall of the Berlin Wall; Ulrich Kohl describes an access control system built for a German hospital; while Gerrit Bleumer and Matthias Schunter show how cryp- tographic mechanisms can provide ways to clear healthcare payments so that patients remain anonymous while insurers can still control costs. Compared with Britain and Germany, the US concerns are more at the policy level, and concern how the interests of insurers and patients can be reconciled by legislative mechanisms (absent the kind of system described by Bleumer and Schunter). The privacy activists' position is stated by Beverly Woodward; Reid Cushman asks why healthcare systems are at all special; and the practical pro- blems are elucidated by Agneta Breitenstein. Having heard of the situation in the USA, delegates endorsed the motion that: "This meeting deplores the di- saster in medical privacy threatened in the USA by proposals to legitimise the widespread sharing of personal health information without patient consent; and would also deplore similar developments in Europe and elsewhere." The remaining three papers each come from different countries. Ronald Dra- per discusses how an Irish hospital's systems deal with the privacy of mental health information; a Japanese health smartcard project is described by Yoshi- kazu Okada, Yasuo Haruki, Youichi Ogushi, and Masanobu Horie; while finally Roddy Neame describes the healthcare system in New Zealand. This appears to meet many of the privacy requirements and aspirations of other countries, with the data kept centrally for research and audit purposes being de-identified. Taken together, the papers in this volume give a snapshot not merely of the state of the medical computer security art at the middle of 1996, but of the complex interplay between the technical, political, and human aspects of medical informatics which make it so fascinating. We hope that this volume of proceedings will contribute to the development of policies and mechanisms to protect the safety and privacy of clinical informa- tion, and to establishing clinical information security as a distinct engineering discipline. The ultimate goal is that both patients and healthcare professionals should derive the greatest possible benefit from information technology; and we are grateful to the BMA and the Isaac Newton Institute for enabling us to take a few small but important steps in this direction. Ross Anderson January 1997 PERSONAL INFORMATION Security, Engineering and Ethics Cambridge, England June 21-22, 1996 Sponsored by the Isaac Newton Institute for Mathematical Sciences and the British Medical Association Chair Ross Anderson, University of Cambridge, UK Programme Committee Ab Bakker .......................................... Bazis, The Netherlands David Banisar .................. Electronic Privacy Information Center, USA Gerrit Bleumer .......................... University of Hildesheim, Germany Paula Bruening ............. Formerly Office of Technology Assessment, USA Ian Cheong .............................................. RACGP, Australia Fleur Fisher ................................ British Medical Association, UK Elizabeth France ............................. Data Protection Registrar, UK Bob Frankford ........................ Formerly Ontario Legislature, Canada Peter Landrock .................................. Arhus University, Denmark Robert Morris ................................................... NSA, USA Roderick Neame ......................... Health Information Consulting, UK Roger Needham ............................... University of Cambridge, UK Beverly Woodward ................................ Brandeis University, USA Contents Information and the NHS (For me or for them?) Simon Jenkins ......................................................... 1 Chances, Risks and Side Effects of Chip Cards in Medicine: A Technology Assessment Study from Germany Anja Hartmann, Otto Ulrich .......................................... 19 Exceptionalism Redux: How Different is Health Care Informatics? Reid Cushman ........................................................ 27 Clinical Record Systems in Oncology. Experiences and Developments on Cancer Registers in Eastern Germany Bernd Blobel ........................................................... 39 Organisation of General Practice: Implications for IM&T in the NHS Mary Hawking ........................................................ 57 Practical Protection of Confidentiality in Acute Health Care Ruth Roberts, Joyce Thomas, Michael Rigby, John Williams ........... 67 Clinical Systems Security - Implementing the BMA Policy and Guidelines Alan Hassey, Mike Wells .............................................. 79 User-Oriented Control of Personal Information Security in Communication Systems Ulrich Kohl ........................................................... 95 Information Management as Risk Management Beverly Woodward .................................................... 109 Responsibility Modelling: A New Approach to the Re-alignment and Re-engineering of Health-Care Organisations Andrew Blyth . ........................................................ 117 Keeping Confidence in Confidentiality: Linking Ethics, Efficacy, and Opportunity in Health Care Computing Michael Rigby ....................................................... 129 Electronic Patient Records: Usability vs Security, with Special Reference to Mental Health Records Ronald Dmper ........................................................ 151 x Security and Confidentiality Issues Relating to the Electronic Interchange of Clinical Data Peter Landrock, John Williams ....................................... 165 Privacy Oriented Clearing for the German Health-Care System Gerrit Bleumer, Matthias Schunter ................................... 175 Personal Health Data on Optical Memory Cards in Isehara City Yoshikazu Okada, Yasuo Haruki, Youich Ogushi, Masanobu Horie ..................................................... 195 The Perspective of Medical Ethics Fleur Fisher ......................................................... 199 Legal Requirements for Computer Security: An American Perspective David Banisar ....................................................... 207 u.S. Health Information Privacy Policy: Theory and Practice Agneta Breitenstein .................................................. 209 Managing Health Data Privacy and Security: A Case Study from New Zealand Roderick Neame ..................................................... 225 An Update on the BMA Security Policy Ross Anderson ....................................................... 233 Author Index ......................................................... 251 Information and the NHS (For me or for them?) Simon Jenkins MBE FRCGP General Practitioner, The Minden Medical Centre, Bury Chairman of BMA' s Information Technology Committee 21 June 1996 Before discussing the Information and Technology strategy of the NHS, we must consider the objectives of that strategy and whether they are legitimate. Government objectives are to provide for and protect the health of the public they serve. They must ensure that all citizens have access to necessary care, free at the time of need; they must enSure that the public health is maintained and improved; and they must provide the necessary finance to fund these objectives primarily out of general taxation. (These principles are set out in parliamentary language in the various NHS Acts, since 1946). These objectives generate a central government imperative to "control expenditure", and to get the best possible "value for money". They imply a mechanism for monitoring expenditure; for measuring what is being provided; for identifying gaps in provision, and for closing those gaps. There are further considerations that derive from these objectives and apply to any area of public spending. For example: I. How efficient, effective and equitable are the resource distribution, control and monitoring mechanisms? 2. Can fraud be detected? 3. Is money being spent effectively or wasted, and how is it being wasted? 4. Is the service responsive to the changing (health care) needs of the popUlation? 5. Are the bureaucratic mechanisms consuming more of the (health care) resources than they should, and how can excessive bureaucracy be reduced? These questions are posed from the legitimate prospective of government. The other quite different but equally legitimate approach is to ask what individual patients want from the people who provide their healthcare services. The patients perspective is by its very nature different from that of government. The medical profession (and the BMA) must ask is which set of principles should doctors follow in providing their services to individual patients and the community. R. Anderson (ed.), Personal Medical Information © Springer-Verlag Berlin Heidelberg 1997 2 These can be considered as follows: Principle One: Standards - "Best Possible Care" Doctors must provide the best possible care to the individual patient who consults them within the resources (time, facilities, and funding available), referring to other health care providers where appropriate. Principle Two:Confidentiality In pursuing the first principle, doctors must ensure the confidentiality of the consultation is protected, subject to clearly defined exceptions which must be clarified by legislation (see draft bill on Disclosure of Personal Health Information - The Lord Walton Bill'). To ensure that the confidentiality of iriformation given in consultations is maintained, they should adhere to the nine principles set out in the BMA Security Policy' commissioned from Dr Ross Anderson, which are derived from the GMC's Guidance "Good Medical Practice"". Principle Three: Public health advice Doctors must advise on matters of "public health" that relate to their communities or to larger groups of the population. Doctors and other healthcare professionals may act as policy makers in their own right or may advise others who are responsible for determining the resources, nature and range of healthcare services. The role of the doctor as a provider of medical advice and treatment to individuals must not be confused with the separate and arguably equally important role as an advisor to healthcare organisations. The cash limiting of resources for healthcare will inevitably force a conflict of interest between these two roles. Compromise solutions must be arrived at through honest and open debate between those who advocate and those who allocate on behalf of patients. A single doctor can carry out both functions but it should be clear to all when he or she is acting as advocate or allocator and for whom they are acting at any given time. Lack of clarity leads to mistrust by individual patients or accusations by healthcare organisations that the doctor has a vested interest and cannot give unbiased advice. Education, teaching and research are other aspects of the responsibilities of doctors referred to in the GMC's Guidance on "Good Medical Practice", but it is the first three principles enunciated above that are the rock upon which ethical medical practice can flourish in a system of healthcare provision where a third party (ie. neither the doctor nor the patient) have accepted responsibility for paying for the consultation and the interventions that flow from it, which together form the health services. There is a view that where a third party is paying for health care, that third party has a right to know what they are paying for, and whether it represents value for money. If the patient is paying directly for the medical services then there is no conflict.