Q1. When the Lal Path Labs started 68 years back, what was the scenario of Indian healthcare industry? How do you see the market now? And how has been the journey?

My late father Dr. Major S.K Lal started this lab in April 1949. He was a displaced person from the partition and came to India from Rawalpindi in 1947. After coming to Delhi he worked in a government lab for one-and-a-half years and then started the first pathology lab in North India. At that point of time there were hardly any pathology tests as we know neither there were any routine tests like, HP, TLC, ESR, Urine Test, Blood sugar Test, Cholesterol test. So there was not any competition then.

Q2. What is your future business plans both at National and International level?

We are running 1700 laboratories in India and about 1600 collection centers. In addition we take another 5000 collections of blood samples from our pick up points. For example Medanta, Fortis, Moolchand and Apollo are some of the pick-up points we have.

Last year we tested about 1.35crore patients, so the average of the samples we can test is about 55000 in a day. We are the biggest Histopathology Biopsy Centre in the world.

Histopathology Biopsy is a test basically to detect cancer. Suppose if a lady has a lump in her breast, so she feels something has to be done about the lump, a part of the lump is surgically taken out which is known as the biopsy, it is the biopsy we test and find out the results. There is a possibility of two things either the tumor is benign (Non-Cancerous) or malignant (Cancerous). If the lady has malignancy she under goes with further tests, chemotherapy and radioactive therapies as per clinical requirement. We are the largest Histopathology in the world. We test about 1000 biopsies in one day and we are the second largest kidney biopsy center in the world. We are the only laboratories in India which have their own electro-microscope for very high end testing. We have our centers in all the major cities of India.

Our next step would be to set up another comprehensive laboratory in Lucknow. We have such research center in Kolkata and next year we will make one in Lucknow. With this we will provide high end services for the people in the region for whom the services are not available.

Q3. With so many market players why people should opt for Dr. Lal? What additional value you bring to the table?

We have many reasons, first of all people know that we are not fly by night operators and also they have faith in us since last 70 years plus people come to us for their pathological tests because 70% of all the medical decisions are nbased upon the pathology test of a patient, hence if the pathological tests result aren’t in place 70% of the medical decision can’t be taken. Gone were the days when people used to visit the “vaids” and doctors and they felt the nerves and pulse gave medicines, now it is evidence based medication. If someone has fever the doctor would suggest the person to get a blood test because it could be malaria, chikungunya, dengue or it could be anything. And if the person is diagnosed with anything she or he will get the treatment for the same. Now the medicines are completely evidence based, there is no hit and trial. These are the reasons why people come to us.

Q4. With Dr. Lal Path labs entering into the international market with operations in countries like Middle East, Malaysia, Bangladesh, Nepal and many more, where do you see the potential for growth of your organization?

The first reason is, India is not having the kind of quality labs that it should have. There is a demand and supply problem. That is because there are no large laboratories. There are lots of facilities that claim to do testing, but they are not testing laboratories but testing shops. This is what is to be changed and people give the example of our establishment and say that “they should be like Dr. Lal’s laboratory.” All these countries you have mentioned, we are getting their samples for testing but only one lab is set up in Nepal and next would be in Bangladesh and then we will go to other countries. The reason we are slow on this is because our own country is huge. I usually say to people that if we will take out Uttar Pradesh and put it in the Indian Ocean, India would be the 5th largest country in the world. So this is the reason that we want to look at our country first and then look at the outside market.

Q5. What kind of environment does your organisation provide to patients?

Our organisation provides a very sterile kind of an environment, it doesn’t smell, and blood is not spilled around, there are no flies buzzing around the surroundings. This is a kind of a place where anyone would like to go to.

Q6. Now days there so many machines available in the market for test like sugar, BP etc, which we can be used by the patients themselves. How good is that? What are your views?

These are known as point of care testing and people can test a few things but in India people can only test blood sugar. For which we suggest the patient to check his or her blood sugar on a regular basis of 15 or 20 days, so these are called Point of Care Testing (POCT).

The POCT in India is not established because firstly, it is very expensive and secondly the Indian people aren’t savvy. There are seven types of care testing which is emanated by a lady. A lady can go to the bathroom and test her pregnancy by a UPT (urinal pregnancy test) in which she gets to know whether she is pregnant or not then in this case there is no need of a pathological test. When I was young we never had cats and dogs as pets but we had rabbits , so I never couldn’t understand why my father killed those rabbits and I got my answer when I was studying medicine. The reason why rabbits were killed during that time i.e, in early 1950s people used to check the pregnancy through it. A pregnant woman’s urine was injected into a female rabbit and after killing them they use to dissect the abdomen area to find ovulating ovaries. This is how pregnancy test were conducted.

Q7. Now a days Dr. Lal Path labs is focusing on inorganic growth; how beneficial it is to patients?

The growth in any sphere or in any business is either organic or inorganic, organic means when a person is creating his own set up, say if a person is doing well in Delhi so he decides to open a set up in Uttar Pradesh and then in Uttarakhand, and inorganic growth is when other person is ready to give up her or his lab to somebody else irrespective of any reason the former will give some certain amount of money to the latter in position of the lab this is called inorganic growth. We have done 10 inorganic growths till now and yes we will buy some more from south of India and west of India.

Q8. What innovations you think can bring down cost, keep quality and improve efficiency on which researchers and start-ups concentrate?

There is no start-up in my line, if one is a qualified pathologist either he can work in a pathology lab or can start his own lab. The start-up in Delhi is difficult because Delhi has become a saturated city. there are many people who are running many pathology labs and they shouldn’t run these pathology labs and the reason they are running the labs is because it is very lucrative, which is very unethical and should not be done.

So the government of India has also started the voice to our ways and they said that we are going to have a clinical establishment act which has been passed by the parliament in 2010. Since the healthcare is state subject so all the 29 states have not adopted it or implemented it. There are a chain of pathology labs which are not run by the pathologists they are run by the non-pathologists they are not even doctors they are quacks. So this brings out the quality and efficiency of the whole industry.

They are many diseases which affect the mankind these days and these diseases are called the non-communicable diseases. The non-communicable diseases can’t communicate with others, whereas malaria, chikungunya and dengue are communicable diseases because it happens through a mosquito bite. TB is a communicable disease too and if a person’s lungs are infected by TB people around them will get infected. In India we lose two patients of TB in every three minutes, India has a burden of communicable diseases which includes Hepatitis A.

But a bigger set of diseases have come out which are called NCDs (Non Communicable Diseases) and the NCDs are killing 65% of our people and if we will not control the NCDs it will also affect the two per cent of our GDP. The NCDs are headed by the high blood pressure, obesity, smoking, cardiac diseases, lung diseases, cancer, kidney diseases and stroke. Why it is becoming so important to us because it is also called the life style diseases, it changes the lifestyle of the person which has suddenly come up. India has large number of cancer patients and also large number of blood pressure patients. There is an element of genetic transfer of physical appearance of a person but some diseases are also transferred which only run in families.

The problem with Indian people is they only come in illness, but they should know that they should get their self-check on a regular basis to keep a check on their health, my main point is to make people aware of the annual healthcare which is very important for one’s health which is in between the doctor and a patient and also make them aware of the testing in wellness not in illness.

Introduction

The famous Silicon Valley investor Marc Andreessen says, “software is eating the world”. By, which he means that increasingly we are bringing software into systems to increase efficiency, lower down the cost or time involved in the process. Interestingly, humans also do software writing and humans are prone to make mistakes. It is estimated by various experts that 1000 lines of code (KLoC) has approximately 15-50 bugs present. Bugs here mean mistakes made by the software programmer while writing the software code. Bugs often result in some kind of malfunction or wrong output. Some of these bugs can lead to exploit by a third party making the larger system vulnerable or as we call hackable. As long as humans will write software, bugs will be there.

In a typical software company as bugs are discovered, new code is written to fix these bugs. The new code might further result into new bugs hence the cycle continues. At the consumer end, we keep receiving software updates over the air, as we use our phone / laptops or other devices, which are many times an attempt of the software company to overcome the past mistakes.

A lone computer hacker or an organized crime group looks at these software updates (sometimes called patches) very curiously as for them this could be a chance of hitting the jackpot! They reverse engineer it and try to understand the bug, that the patch is trying to cover. Very often systems are not updated with latest updates. Leading to most system having a known vulnerability, which the hacker can take advantage after understanding it well. Hackers further can create a simple script (programming code snippet) to some sophisticated software, which can then take advantage of the vulnerable system. We often call such a program as malware, as it is built with bad intention.

Today, as we talk it has become from a hobby crime to organized crime! Software companies regularly receive communication from bounty hunters about exposing their critical software bugs and in exchange not to do so, hackers want to charge them bounty money. Some software companies have gone further and engaged these bounty hunters to reduce security risks in their software.

In some cases the hacker is not interested in the bounty money (hence they do not inform the software maker) but rather interested in exploiting the bug. Sometimes, the bug is not known to the software maker or anyone else in the world and can be converted into a lethal attack. Such attacks are known as a zero day attack! As prior knowledge of such a vulnerability does not exist. Hence, most software security solutions, like anti virus software do not work on them. Further selling the knowledge of exploit as lethal software is now called as a cyber weapon. Nation states are now engaged in buying or building such software to infect systems of enemy states. Hence, we have come very far in the business of software bugs, where the enemy could be a lone developer, an organized crime group or a Nation state.

How is software eating the health sector and the threats linked to it?

In the above section we discussed in general, how the exploitation of software is increasingly becoming a serious business. While, we have seen many examples in last 30 years from a hobby software programmer to Nation states taking advantage of the software driven vulnerabilities. We would like to share some examples closer to the health sector.

1. Malware affecting data systems

Hospital information systems and similar information systems as part of the healthcare delivery have become very commonplace and one of the core component of the system. As pointed out in the introductory section, organized crime groups are now looking to exploit software bugs for commercial purposes. One of the ingenious way that they have developed is a malware known as ransomware . Ransomware is a malicious computer program which when executed on a system encrypts the data with very strong encryption making it unusable for hospitals or any other care provider to access patient records or other vital information. It then demands a ransom inform of bitcoins (a crypto currency) in order for the victim to have the key to decrypt the vital information. In recent incidents of ransomware infection, some hospitals in USA have even demanded millions of dollars as ransom and some have even paid.

The mitigation strategy for countering ransomware for any organization would be a strong backup of data. Also, creating awareness among the employees on sources of malware and reducing the chances of accidental infection of the workplace systems.

The long-term solution of tackling such organized crime is a better international legal framework, which allows international prosecution and cooperation among law enforcement agencies.

2. Denial of service attacks on ehealth services

In 2007 there was a distributed denial of service attack that took place in Estonia. A statue of the Russian soldier was removed from the Tallinn Square, capital of the country. Which sparked a response from sympathizers from Russia and it brought down the Estonian economy for three days. Estonia being one of the most advance countries when it comes to take up of e governance services, ehealth being one of them. The entire attack costed less than 50,000 US dollars. That was the first Denial of service attack the world saw at the level of a nation state.

The basic premise behind such an attack is that you have a service (e-service) to be provided to citizens over Internet like their own health records for example. The provider would have some finite amount of bandwidth and computing power at the backend of the service correlating to the average load on the service. In a distributed denial of service attack, the attacker uses compromised computing devices (commonly known as a bot) to access the Internet service. The botnet, which is a collection of such bots could be having thousands or millions of such devices that simultaneously access the service. The service provider is not able to distinguish the normal traffic from the bot traffic and often the server crashes under the heavy load. For a normal user trying to access the service, the service is unavailable because of the finite resources of the server being exhausted by the bot traffic. Hence, it is called a denial of service attack.

Hence, when a city, state or a nation is considering providing an eservice to citizens it could witness such attacks. One strategy to mitigate such attacks is to have tracking of the server traffic for any anomalies and having redundancy available in the system. This is achieved many times by putting the service on a cloud, which can tolerate such traffic fluctuations.

3. Data leak and breaches

Many health systems or systems require some kind of authentication mechanism to log in to the system in order to access the service. Many a times these are text password based systems behind which, important patient profile or health records information is stored. The largest of the companies like that of Google, Microsoft etc have seen attacks where the attacker is able to leak the passwords of millions of their customers. Such scenarios result in massive breach of data privacy and compromise for customers.

Good security practices, proper encryption of data and regular updates of the system are some of the key considerations for avoiding such instances. Nowadays, two-factor authentication has become a standard practice for making the authentication systems more robust. However, still some user awareness is needed to opt for better security practices whenever possible.

4. Hacking medical devices and health system

If we look at the building blocks of the health systems, where information technology is deeply integrated. We have already covered the health information systems, eservices and patient interface of authentication into the services. However, increasingly we hear about Internet of Things (IoT) devices in the health sector domain. Which means the integration of Internet services into traditional medical devices or new age devices, which have also connectivity. For example, a thermometer which can send the temperature data to your phone or a stethoscope which can record the patient breathing sound and upload in a server for finding patterns of lung diseases. These are powerful use cases and provide great opportunity to clinicians and care providers, where they have greater computation power available to them and they are able to do more with less. However, these IoT devices are prone to the same kind of attacks as any other communication device or a software program. They can be compromised to show wrong values and totally messing up the diagnosis. There are already such instances. One such instance not related to health sector but important is of the Stuxnet. Stuxnet was designed for the SCADA systems of Iranian nuclear program by USA and Israel in order to delay their nuclear program.

5. Stealing identity information

As mentioned in the point 3, about data leaks and breaches at the system level. One problem, which can arise from such an attack, is a further more damaging attack that is stealing of identity information. In India, mobile phones to receive an sms message containing one time password is increasingly becoming a standard practise because of being cost effective, simple and secure. Any such application, which you may install on your phone, can also get access to the sms and other features of your phone. Meaning the incoming sms or calls can also be stolen by this application to complete the transaction on your behalf. As increasingly we have to prove ourselves using biometrics or passwords to online systems. It is possible for the attackers to steal these credentials and access our records without our knowledge. Hence, any third party applications that we install on our devices (especially phone) , we need to be very careful about the type of access control they have on our devices.

6. Implantable medical devices with communication interfaces:

In 2007, the former US Vice President, Dick Cheney’s implanted pacemaker’s wireless communication was disabled fearing a terrorist attack. This sounds like science fiction to many but incident has already happened ten years back! Many of the medical devices are built with a communication interface and it is quite normal for a typical pacemaker or other such devices to have a Bluetooth or a similar communication technology based interface for remote diagnosis and other purposes. While, the communication ability of such a device was planned for looking at the state of the pacemaker it was not designed with keeping security in mind. Hence, it is possible that someone can connect to a critical device like pacemaker and shuts it down remotely.

One more reason that such exploits are possible increasingly as computing is becoming cheaper. What seems strong security today might not be strong tomorrow. However, an implantable device might stay in the patient’s body for tens of years. Hence, we need to have a long-term view on the communication interfaces and their capabilities on such devices. We need to make considerations on control and information capabilities of these interfaces. Misuse of control capabilities can lead to even death and misuse of information capabilities can lead to breach of patient privacy.

Way forward: why Internet is the new breeding ground for crime?

The law of the land governs the Internet in every country and hence the legal regime globally is very fragmented. However, a user of Internet does not see any borders or walls and so is the criminal. They build their criminal businesses where they do not fear strict government action and often for paltry sums the user or the national law enforcement agencies do not pursue the criminal cases cross border.

On top of it newer crypto currencies like Bitcoins, makes it easy to make such transaction in an anonymous manner. Dark net marketplaces provide a breeding ground for criminals to conduct illegal transactions of billions of dollars without getting caught. So, the three important components, weak legal enforcement, anonymous currency and secret marketplaces are enabling the cyber crime to flourish. If we want to slow it down, we will need greater international collaboration among lawmakers and user awareness at all levels.

Reference:
(i) https://www.wsj.com/articles/SB10001424053111903480904576512250915629460
(ii) http://labs.sogeti.com/how-many-defects-are-too-many/
(iii) https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net/transcript?language=en
(iv) https://hackerone.com
(v) https://en.wikipedia.org/wiki/Zero-day_(computing)
(vi) https://en.wikipedia.org/wiki/Cyberweapon
(vii) https://en.wikipedia.org/wiki/Ransomware
(viii) https://en.wikipedia.org/wiki/Bitcoin
(ix) http://www.csoonline.com/article/3033160/security/ransomware-takes-hollywood-hospital-offline-36m-demanded-by-attackers.html
(x) https://www.theguardian.com/technology/2016/feb/17/los-angeles-hospital-hacked-ransom-bitcoin-hollywood-presbyterian-medical-center
(xi) http://innovatiocuris.com/looming-danger-of-ransomware/
(xii) http://www.bbc.com/news/technology-24608435

Want to write for InnoHEALTH? send us your article at  magazine@innovatiocuris.com