Where India stands today?

According to the International Telecommunication Union (ITU), a UN telecommunications agency, India ranked 23rd amongst 165 nations on the Global Cybersecurity Index (GCI) in 2017. GCI ranks nations for their commitment towards cybersecurity using various measures – legal, technical, organizational, capacity building, and cooperation. With the rapid rise in cyber threats, India’s growing investment in protecting its data is absolutely a positive development. Nevertheless, a quick look at the current status on cybersecurity and data protection laws in India highlights the gap we must fill in as we move towards complete digitizing of various infrastructures in the 21st century.

For instance, it was last in 2000 when the legal provisions related to cybersecurity were formulated in the Information Technology Act (ITA) when the nature of threats revolved only around viral or malware attacks. The ITA was later amended in 2008 and now deals with cyber crimes such as hacking, tampering, data or identity theft, cheating, phishing, etc. Sections 43 and 63–74 provide provisions for civil and criminal prosecution in case of different cyber offenses. The ITA requires entities holding private data of users to maintain specified security standards and provides provisions to users for airing grievances in case of the data breach.

India established its first cybersecurity policy – the National Cyber Security Policy (NCSP), in 2013, after much mayhem caused by Edward Snowden’s allegations of NSA snooping on India. The policy designated CERT-In (Indian Computer Emergency Response Team), a national nodal agency to respond to and analyze incidents of cybersecurity breaches. CERT-In provides alerts of cybersecurity incidents, conducts emergency measures for handling such incidents, coordinates necessary response activities and issues guidelines, etc., regarding cybersecurity measures. In the case of a data breach, an organization holding confidential user data must report to CERT-In promptly.

Also Read:
Cyber4Healthcare: An Issue of Today & Tomorrow
DISHA – Need of the hour

Healthcare specific provisions

While the above-mentioned regulations provide a general legal cybersecurity framework for all the organizations, no separate provisions are in place viz a viz the healthcare sector. India decided to fill in this gap last year when the Ministry of Health and Family Affair, the Government of India proposed the Digital Information Security in Healthcare Act (DISHA) and placed it in public domain on 21 March 2018 for comments by various stakeholders. DISHA aims to ensure reliability, data privacy, confidentiality, and security of digital health data. The act, applicable to entire India except for Jammu and Kashmir, establishes eHealth Authorities and Health Information Exchanges at the state and national levels while also outlining the guidelines on standardizing/ regulating the processes related to the collection, storing, transmission and use of digital health data (DHD) in India.

Accordingly, DHD means any electronic record of health-related information

• concerning the physical or mental health of a person
• on any health service provided to an individual
• on a donation of any body part of any bodily substance
• derived from testing or examination of a body part or bodily substance
• collected during providing health services
• relating to details of the clinical establishment accessed by a person

DISHA also specifies the rights of the owner of digital health data, outlines the purposes for which DHD can be collected and explicitly mentions all clinical establishments holding DHD to be duty-bound in maintaining privacy and confidentiality of the patient’s data. Importantly, DISHA touches upon what constitutes a breach of digital health data, compensation in the event of one happening and what punishments an individual or a company might face if convicted of a cybercrime.

Marching ahead

The breach of data far more often in the healthcare sector compared to other sectors highlights the value of information stored in digital health records. It is, therefore, important that cybersecurity takes precedence for all the healthcare providers. Proactive measures include identifying likely targets, securing and updating systems in a timely manner, constant monitoring for malware or security breaches and reinforcing good user behavior among the employees. Similarly, the response to data breach incidents needs to be swift to minimize the extent of damage when a cybercrime occurs. Like the adage, ‘prevention is better than cure’, the healthcare providers also have a necessary task ahead of themselves to up their security measures in accordance with the current legal framework, before a patient’s data or the trust gets compromised.

About the author

Dr. Urvashi (Raheja) Bhattacharyya is a Senior Research Analyst at StudyMode. She indulges in machine-learning methods during office hours and enjoys writing about healthcare and education in her free time.

In a recent healthcare conference, the people were unaware when I spoke about how on October 21, 2013, the former US Vice President Dick Cheney’s doctors disabled his pacemaker’s wireless capabilities to thwart possible assassination attempts. To this, everyone had an issue on accountability. It remains unanswered that who would be liable, the doctor, hospital, company which provided pacemaker or the insurance company. Amidst all this, nobody was concerned about the patient as none present there questioned it. Maybe we are awaiting a major catastrophe to happen to put our minds to work. It is our endeavor to equip the healthcare community to this aspect of digital health.

Cybersecurity is a major concern for patient safety and healthcare infrastructure. The health records, data, hospital information system and individual medical devices are all targets. The vulnerability is in technology and lack of awareness of staff. There are many examples to quote wherein hospitals have become the victim of attacks. A recent audit of a corporate hospital in Delhi by our team revealed that 80% of equipment is vulnerable to cyber attack, thus, risking the patients. Healthcare providers are not sensitized to issue as required hence this magazine is dedicated to Cybersecurity. We have named it Cyber4Healthcare and even launched a training program in the healthcare domain to update knowledge of this extremely important topic. There is an immediate necessity that we invest in staff and equipment to make our systems robust enough to protect them from cyber-attacks.

We at InnovatioCuris always strive to sensitize the healthcare providers with new technologies and our next issue would focus on IoMT or connected healthcare which is overtaking the segment rapidly. However, we should always keep in mind that we are master of technologies and not the other way around. Can humane touch be replaced by technology? The trend nowadays is that we are leaving human ingenuity behind and are being heavily dependent on technology. There is a need to understand the benefits and challenges of newer devices, technology, and thinking. Let us consider how we can balance traditional to modern approach in today’s world and get the best of both worlds. Let our readers share their experiences by writing for the magazine to benefit all.

The need to change the way of delivering care/service should be our priority. A paradigm shift in the way of offering services through connected health services and emphasizing that privacy and security concerns are of utmost importance when it comes to connected health. Responsibility and accountability after acquiring data are very important. The question is how to analyze the data and get actionable insight. Analytics and IoT should be considered together for actionable insight. The challenge of interoperability has turned up with an increase in the number of devices being used.

Trends and Opportunities of Medical IoT

IoT or Internet of Things is not new, but it has been gaining traction at a very high pace. Since the inception of the word IoT, there has been an ongoing conversation about how it might change healthcare, improve patient safety, affordability and accessibility for patients.

Healthcare in India has a huge potential in terms of IoMT or medical IoT solutions. There will always be challenges and opportunities in this sector. Connected health is contributing towards the growth in space of IoT, but is lagging behind many other connected sectors.

One of the key challenges in developing the algorithm for medical devices such as CT scans and X-rays. Application of artificial intelligence and machine learning in healthcare should be cautiously done because in case of a CT scan if we miss a module it has life risk and hence should be used carefully and should be a well-validated clinical algorithm.

Since the infant mortality rate in India is twice the rest of the world, and that is certainly alarming as the bottom of the pyramid is affected; there is a company which focuses on the mortality rate of low weight birth babies. They have come up with developing a bracelet which diagnoses hypothermia in low birth weight babies. This was a very simple and innovative device, but then they analyzed the intermissions they can work on and came up with baby cradle. The main challenges to develop and design such a product is to cope with the cost factor and the startups definitely need funds to develop such a technology.

The goal of connected health is not just early identification of health issues, but also effective patient care and safety. Today IoT platforms support integration of medical devices and wearables. The need for security is as important as when it comes to IoT and accessing healthcare data and strengthening advocacy for connected health.

Things change very rapidly and in very small time, and IoT is taking shape with it. But who will fund the cost of development/ Can government help the industry in making such policies?

Business Models of Successful IOMT in India and Challenges

The IoT healthcare business strategy is not yet robust because it involves a set of elements with new requirements such as new operational processes and policies, new infrastructure systems, distributed target customers and transformed organizational structures. Therefore, there is a need for a new business model. The IoT technology opens a new dimension of business opportunities for healthcare companies and the IoT platform becomes a key artifact in this transformation. Early movers who are taking a proactive approach to establishing their IoT healthcare ecosystem will tap into new business models. In this part of the business model, the panel discussed the basis of pricing and the way of charging for a product or service. Besides this, the panel also discussed the ways of revenue generation.

While there are many benefits of the Internet of things in healthcare, it isn’t without its challenges. As with any new technology in healthcare, hospital and IT executives are concerned about data security and IoT device management. What are the potential barriers to IoT adoption and how healthcare IT can overcome those obstacles?

AI and IoT change the way healthcare is delivered and we obviously are on the cusp of a revolution. This definitely poses a fair amount of concerns but also huge possibilities. The panel also discussed how Medicare is 100th the cost per person when compared to Obama care. So clearly, there must be more innovations coming from IoT and AI; they are going to help us reduce the cost.

In the past, how people tried to use the data for the benefit of both patients and providers, starting from the patient side faced huge failures, as nobody was willing to pay. And that’s where the thinking came from that; how do we really make this work? How do we really turn this data into a business model? And that’s where they pivoted the model, working with providers and using their data sets. But then the question comes up, “Why the providers would share their data?”. Thus, the first pitching that started was to use the provider’s data for their patient care. And it didn’t work well. The whole narrative was, “What’s in it for providers?”.Therefore, the business model turned out to be, as we kept on talking to people, we realized that the data is going to be useful for provider’s revenue success, and then the same datasets will help the patients. A solution that they projected is to help retain the provider with patients’ data, grow their revenues and help in patient care.

The MedTech certainly seems more complex. Where they are trying to come out with a dermatology solution and oral health solution for serious diseases where a cell phone image taken from an off the shelf mobile phone camera is sent to an AI backend and it gives a diagnosis and possible treatment options for a variety of skin diseases, particularly oral cancer. Such cases are very prevalent. What the panelist found is a landscape extremely complex in terms of the business model because when someone comes out with something like this, then figuring out who would it be paying is difficult. And suddenly the AI and IoT thing comes up and say that it can perform this diagnosis at par the level and in certain cases better than certain trained specialists. This does not support their case.

One of the panelists shared her thoughts on important factors to concentrate and realize why health care has not moved digitally as compared to other industries like banking, insurance and how a lot of digital interventions can happen in healthcare. There are a whole lot of opportunities.

The main thing to focus on is What is the problem? What is the solution? And who’s going to pay you? Because that’s where the panelists believe that lots of startups have a scope.

The customer is one, the doctor is another and hospital, the other spectrum. So how to manage this change and address the change management. If you give a thought on what to overcome, it gives you a kind of value that you try and achieve success and how do we overcome the quality assurance issues, change issues, challenges that one sees in terms of adoption. Let’s say for the doctors, it took a hundred years to the doctor to adopt stethoscope. Today, it’s widely accepted. IoMT is something that is obviously very innovative, very useful. But then not every doctor will accept it right away. How does one plan to overcome that barrier? So, they might just want one to focus on change management issues.

There are three components of the IT embedment in a hospital. One is the business side of it, which gets adopted immediately. There’s just no resistance to it. The second side is the paramedical side of it; it has pathology, radiology, and other such things. They take a little time but they come on board. The learning curve is much shorter over there. The third one is the clinical side, which is the most difficult, as in a hospital system there are doctors who are most resistant to changes and the reason being their upbringing and learning of clinical practices in a certain way.

The question arises “How does one change their practices?” Changed management is already happening at the college level. The medical students who are coming out now are more hands-on and are accepting the new technological changes. We will have to wait a little while, but they will accept it. When we talk about a change in the management, the problem that arises is not specific to India only. In the USA, George Bush had said that he wanted EMR to be adopted by everyone within the next ten years. Surprisingly, he didn’t even get 15% conversion in those ten years.

It is important to secure the data and look over the cost implications of data security issues in connected health work moving forward. There is a need for appropriate interventions at the transition level of doctors and patients, as well as the importance of advocacy and awareness‐raising at community level about connected health. There is also a need for financial support for encouraging the tech enthusiasts of the country to address health issues in India with connected health solutions. One needs to understand customer value as well. How do we speak the right language in terms of what would appeal to that particular user or customer or doctor or hospital for that matter only then we will see more IoMT adoption happening. Yes, there is a need to understand the regulatory framework. Startups needs to adopt a lean structure in collaboration with the medical partners and come up with innovative solutions. India has a fantastic opportunity, but clearly it does need elements to come together and work together.