Dr. Oommen John, Senior Research Fellow, George Institute says, India is a hub for digital health innovations, however very few of these innovations have achieved the scale for impact within the health systems. It is important therefore to pause, reflect and use the WHO digital health guidelines as framework of the innovation ecosystem in India and help guide energy and enthusiasm of the start-ups to develop, evaluate and implement digital health innovations that can help achieve the universal health coverage.

The guideline encourages policy- makers and implementers to review and adapt to these conditions if they want digital tools to drive tangible changes and provides guidance on taking privacy considerations on access to patient data.

“Digital health is not a silver bullet,” says Bernardo Mariano, WHO’s Chief Information Officer. “WHO is working to make sure it is used as effectively as possible. This means ensuring that it adds value to the health workers and individuals using these technologies, takes into account the infrastructural limitations, and that there is proper coordination.”

Mr. Mariano also said: “Digital Health is the future of healthcare. As we take the big leap into digital health, we must ensure that it is people centric, delivers positive health outcomes, does no harm to people and it actually improves the healthcare system as a whole.”

It is a ‘Living Guideline’ i.e. it will be updated regularly as new evidence becomes available. This Guideline has been completed under the newly formed section at the WHO: Norms and Standards section in the WHO. This Guideline has been regarding: Reproductive Health & Research and has four outcomes:

• Health systems to have health data for accountability
• Helping health workers to work efficiently
• For tracking medical commodities to provide services
• Making sure health coverage for all

Since it is a developing guideline and is meant to be stringent based on evidence alone; it is a path finder for a whole gamut of health issues. For each recommendation, a summary of the evidence on the positive and the negative effects has been provided.

Dr. Garrett Mehl, Scientist, Digital Innovation and Research, WHO says: “Digital interventions depend heavily on the context and ensuring appropriate design. This includes structural issues in the settings where they are being used, available infrastructure, health needs they are trying to address, and the ease of use of the technology itself.” Importantly, it must be noted that: “Digital health interventions are not sufficient on their own.”

The guideline recommendations about telemedicine, which allows people living in the remote locations to obtain health services by using mobile phones, web portals, or other digital tools. WHO points out that this is a valuable complement to face-to-face- interactions, but it cannot replace them entirely. It is also important that consultations are conducted by qualified health workers and that the privacy of individuals’ health information is maintained. The guideline emphasizes the importance of reaching vulnerable populations, and ensuring that digital health does not endanger them in any way.

Trusted Exchange Framework and Common Agreement (TEFCA)

On 19th April 2019, US Department of Health and Human Resources (HHS’) announced the next steps in advancing operability of health information by opening up the second draft of the Trusted Exchange Framework and Common Agreement (TEFCA) for public comment. TEFCA, would support the full, network-to-network exchange of health information nationally. Specifically, the documents being released for comments are: (1) a second draft of the Trusted Exchange Framework (TEF), (2) a second draft of the Minimum Required Terms and Conditions (MRTCs) for trusted exchange, and (3) a first draft of a Qualified Health Information Network (QHIN) Technical Framework. These documents will form the basis of a single Common Agreement that QHIN’s and their participants may adopt. This Common Agreement will create baseline technical and legal requirements for sharing electronic health information on a nationwide scale, across disparate networks.

“The seamless, interoperable exchange of health information is the key piece of building a health system that empowers patients and providers and delivers better care at a lower cost,” said HHS Secretary Alex Azar. “The 21st Century Cures Act took an important step towards this goal by promoting a national framework and common agreement for the trusted exchange of health information. We appreciate the comments and input from stakeholders so far and look forward to continued engagement.”

In developing a TEFCA that meets industry’s needs, HHS’ Office of the National Coordinator (ONC) for Health Information Technology focused on three high-level goals:

• Provide a single “on-ramp” to nationwide connectivity
• Ensure electronic information securely follows you when and where it is needed; and
• Support nationwide scalability for network connectivity

ONC will maintain the TEF, while a non-profit, industry-based organization, known as the Recognized Coordinating Entity (RCE), will be awarded funds to develop, update, implement, and maintain the Common Agreement. Through this effort, ONC will define the minimum required terms and conditions needed to bridge the current differences among data sharing agreements that are preventing the flow of electronic health information. The industry-based RCE will be tasked with developing additional required terms and conditions necessary to operationalize the Common Agreement and meet the interoperability requirements of the 21st Century Cures Act.

“The updated Trusted Exchange Framework and Common Agreement we issued today considered more than 200 comments we received on our previous draft and reflects extensive work with our federal partners,” said Don Rucker, National Coordinator for Health Information Technology. “The future Common Agreement, made possible by the steps we take today, will provide the governance necessary to meet the interoperability demands of diverse stakeholders, including patients, healthcare providers, and health plans.”

The drafts released are responsive to stakeholder comments by making key changes to the draft requirements that health information networks who choose to participate would have to follow. These changes include updating the purposes for which information can be exchanged, adding a “push” method of data exchange, adding a technical framework for QHIN’s, and extending timelines for participating entities to implement changes that will be required by the Common Agreement.

These changes will help improve the flow of information between networks where needed and appropriate. In public health settings, for example, “reporting from providers is a foundational capability for effective public health action,” said Chesley Richards, Deputy Director for Public Health Scientific Services at the Centers for Disease Control and Prevention & that “The TEFCA will not only strengthen this capability, but will create the ability for timely and true bi-directional information sharing that is essential for responding to public health threats and epidemics.”

Designed to fill the gaps that currently impede the secure and appropriate flow of health information and to continue to enable the progress that has already been made in the private sector, the success of TEFCA depends on coordination with the private sector. “We expect that the implementation of the Trusted Exchange Framework and the Common Agreement, will bring us all that much closer to achieving the administration’s goals of nationwide interoperability,” said Dr. Rucker.

General Data Protection Regulation (GDPR), One Year On

It is a very recent piece of legislation in the European Union and the European Economic Area regions (continuation to the previous article on GDPR in InnoHEALTH volume 3 issue 1 Jan-Mar 2018). The GDPR was adopted on 14th April 2016, and became enforceable on 25th May 2018. As the GDPR is a regulation and not a directive, it is directly binding and applicable, but does provide flexibility for certain aspects of the regulation to be adjusted by individual member states. the UK granted royal assent to the Data Protection Act 2018 on 23rd May 2018, which contains equivalent regulations and protections as the GDPR.

After the first year of implementation of the GDPR over 200,000 cases have been reported. European data protection agencies have issued fines in excess of 55 million Euros for GDPR breaches since it was enforced last May, but this seems to be just the tip of the iceberg, thus making a strong possibility that enormous number of GDPR breaches are occurring but probably are yet going unreported. An assessment from the European Data Protection Board (EDPB) which is made up of regulators across the region, found that, in the first nine months, there were 206,326 cases reported under the new law from the supervisor authorities in 31 countries in the European Economic Area. One thing that has changed since the implementation of the GDPR is the massive increase in the reported number of incidents and more importantly that the companies have been reporting themselves to the data commissioner over the past year. The main emphasis under the GDPR Regulation is that companies must notify the regulators very quickly once the company losses any personal data. Consequently, of the breaches huge fines can be levied on the companies if they are found to have not done what they should have done to protect the personal data or specifically be able to display that they did all they could to clean up after the breach occurred in the first place.

Considering the developments all around the world, in terms of guidelines and regulations, specifically relating to the digital health, it is only right & more essential to emphasize the pressing need for India to have specific laws too for this area as practice carries on while laws don’t exist, which will result in exponential damage in the coming times.

About the author

Sapna Singh is a lawyer with years of experience in Telehealth law research. She possesses Diploma in Hospital Administration from India; Masters of Law in Intellectual Property Rights from US; Masters of Science in Telemedicine & ehealth from UK.

Ransomware today accounts for 85 per cent of the malware in the healthcare industry. As the IoT ecosystem expands, so does the attack surface for cyber criminals.

In other words, the more hospitals rely on connected technology in our day-to-day lives, the more vulnerable these become to the cyber threats that are increasingly tailored to exploit vulnerabilities and security design flaws in IoT devices at healthcare facilities.

In a recent blog post, Salwa Rafee, IBM Security Industry Leader (Public Sector) says that new cybersecurity threats are emerging in healthcare almost daily.

“Today, hackers target medical and IoT devices that provide, transmit, and access confidential data because they can exploit the fact that most manufacturers did not consider cybersecurity when designing those devices,” she writes.

All of this increases vulnerability to ransomware. Many healthcare providers are forced into paying to get their data back.

Attackers are getting more sophisticated, organized and less obvious as they attempt to snare staff and administrators with rapidly changing tools.

Therefore, security training and guidance is critical to minimize staff exposure to phishing attacks and malware intrusion, as is reasserting policy and penalties for staff with bad intentions.

Tech giant Microsoft which aims to transform the healthcare sector through effective use of analytics- driven insights decoding the complex data available, is very seriously looking at securing the data.

For David Houlding, Principal Healthcare Programme Manager, Industry Experiences at Microsoft, healthcare is drowning in data. “Every patient brings a record that could span decades, with x-rays, MRIs, and other data that can affect every decision. Providers and payers bring their own collateral to the table. Skills, policies, and certifications are just the start,” he said in a blog post recently.

Global cyber security leader Sophos has also found that the healthcare industry in India is the most vulnerable and weak while implementing cyber security solutions for protecting IT infrastructure.

“The ‘State of Endpoint Security’ in Indian hospital needs more attention and preparedness for handling cyber threats like ransomware and malware attacks,” emphasizes Sunil Sharma, Managing Director Sales at Sophos India and SAARC, adding that more and more advanced cyber threat actors are turning their attention to attacks against the healthcare sector.

The attacks are growing exponentially across the world. In July last year, the personal health data of 1.5 million people, almost a quarter of the Singapore’s population, including the details of the city-state’s Prime Minister Lee Hsien Loong, was hacked. The hackers broke into the government health database in a deliberate, targeted and well-planned attack. The hack compromised patients’ names, identity card (NRIC) number, address, gender, race and dates of birth.

Following the hack, SingHealth temporarily banned staff from accessing the Internet on all 28,000 of its work computers. According to IBM’s Rafee, finding the right security staff also poses many challenges to a healthcare organization. “Security is a competitive field and attracting the right talent with limited resources has proven to be difficult. Expanding your applicant pool to people with more diverse backgrounds is effective,” she advises.

Not just Singapore, Hong Kong’s Department of Health became the next big victim of a cyber attack after its computers were hit by ransomware which left data inaccessible. In the meantime, the fifth annual Healthcare Breach Report published by Bitglass has found that total number of records exposed in the healthcare sector globally rose to 11.5 million in 2018. On average, nearly 40,000 people were affected per breach, which is more than double the average number affected in 2017.

Is there any full-proof remedy against such malicious activities?

Sophos says that healthcare business needs to move from traditional security software like antivirus and deploy sophisticated security solutions. “Given the speed at which IT threats are evolving and becoming more persistent and coordinated, it is a deep concern to see the adoption of the next- generation predictive technologies. While we all do our best to assure the integrity and confidentiality of sensitive data, the methods we use leave us with a staggering number of false positives and logs to manage.

“It is important for organizations to keep up in this dynamic world of IT threats. Organizations need effective anti-ransomware, anti-exploit, and deep learning technology to stay secure,” Sharma emphasizes. Transparency is key. Reporting details of a breach to the public quickly and efficiently is now a requirement. “No organization wants the perception that they don’t disclose information that should be reported timely. I believe the public, and your patients, understand the risk that any organization is likely to be hacked or attacked at some level,” says Rafee.

Healthcare firms have made progress in bolstering their security and reducing the number of breaches over the last few years. “However, the growth in hacking and IT incidents does deserve special attention. As such, healthcare organizations must employ the appropriate technologies and cybersecurity best practices if they want to secure the patient data within their IT systems,” said Rich Campagna, CMO of Bitglass. As you read this, an unauthorized user accessed a “limited number” of employee email accounts at UConn Health (branch of the University of Connecticut), compromising personal data of more than 326,000 patients.

The US Department of Health and Human Services (HHS) reported that organisations paid out more than $28 million in settlement fees in 2018 – an all-time high in healthcare breach enforcement activity. “In October, the US health insurance provider agreed to pay a whopping $16 million and introduce “substantial corrective action” following a series of cyber-attacks that led to the largest US health data breach in history,” said HHS. The Cloud environment has changed the way companies manage, store and share their data, applications and workloads. Along with a wide range of benefits, though, the Cloud infrastructure also introduces a new, fertile and attractive environment for attackers who crave the enormous amount of available computing resources and sensitive data it holds.“

While we consider the cloud to be an organization’s weakest link, threats posed to them via their employee’s mobile and IoT devices are also to be taken seriously as one of many attack vectors from which sensitive data can be stolen or leveraged to launch an attack,” informs Check Point. As cyber attacks grow and hackers aim patients’ data to make quick money, what patients are carefully watching is how well the healthcare providers are prepared to respond, mitigate future threats and move forward.

About the author

Meenakshi Iyer is a New Delhi-based freelance journalist covering health, technology and latest innovations. With more than 15 years of experience, she has worked with top media publications in the country.

Conductive gels and patch sensors resembling fashion accessories are also being developed to record cardiac, brain and muscle activity which could complement the traditional blood analysis and clinical examinations. Mechano-acoustic skin sensors that measure speech patterns and internal body sounds, like swallowing, are being explored to quantitatively measure the impact of rehabilitation in patients, such as those recovering from a stroke.

In treatment, miniscule implants placed inside the body can cross the blood-brain barrier and deliver the drug directly at the target site, even in hard-to-reach internal organs. Such devices have shown promising results in laboratory settings in reducing side effects and toxicity while increasing overall drug efficacy. This could also ensure patient compliance, a step further to the recently approved digital pill, especially in patients on long care and those with compromised cognition.

Certain implants can also electrically stimulate cardiac or brain tissues to treat conditions like irregular heartbeat, certain motor disorders, and cognitive impairments. Other implants like artificial retina and cochlear implants, restore functionalities of damaged tissues. These interventions, being referred to as ‘Bioceuticals’, could restructure conventional therapeutic options for more efficient outcomes.

In India, a lot of work has now started in this sphere. Results from a few studies have started trickling in, with most of them in development or early stages of testing. Research findings in the journal Scientific Reports by researchers from IIT Kharagpur earlier this year reported bio impedimetric analysis of cancer cells that efficiently distinguishes their aggressiveness by measuring electric field impedance in laboratory conditions. In another study published in the journal Sensors earlier this year, researchers at IIT Delhi developed a novel low-cost prosthesis based on sensors to enable normal gait kinematics, i.e. motion analysis, for lower limb amputees.

IIT Kharagpur is setting up a Bioelectronics Innovation Laboratory that aims to develop battery-free implantable miniaturized engineering systems for treatment of brain, nerve, muscle or spinal cord disorders by restoring missing neural functions. The proposed coin-sized implant will be powered wirelessly and will combine brain activity testing like electrical simulation, bio-potential recording and neuro-chemical sensing for use in rehabilitation and prosthesis.

Also Read: India’s First Smartphone Insertable Cardiac Monitor

Round-the-clock data collected from bioelectronic devices could replace the present time-point investigations and lead to better management of the health condition of patients. In addition, data from multiple people can help develop artificial intelligence algorithms and predictive tools. Such tools have already started showing analytic performance similar, and sometimes better than manual inspection by a specialist physician. In countries like India, that suffer from a shortage of qualified doctors in remote areas, such devices have immense potential. However, data standardization, data security, and privacy protection must be addressed and regulated before rolling out such interventions.

In the next few years, health monitoring, neural prosthetics, and biochemical prosthetics are expected to drive major developments in this space. Although the monitoring devices have already started testing the market in niche patient segments, it may take the implants another 5-10 years to reach health centers as they make their way through developmental and regulatory checkpoints.