Patient Generated Health Data (PGHD) - The "Killer App"

Technology often goes hunting for a problem to solve, this becoming more evident as technology funding is skyrocketing, producing an environment of technological acceleration.   Healthcare technology fueled by the ACA and the need to reduce cost is in the forefront of the movement.  PGHD, the human endpoint for data collection and the place where answers lie, has been mostly overlooked in medicine, drafting far behind clinically collected data.   PGHD holds the verifiable keys to individual and public health, filling the gaps of clinical data.  PGHD along with IoT devices will provide a  contiguous stream of patient data becoming the"The Killer App" of healthcare and clinical research.

Recently the ONC commissioned Accenture to develop a draft Whitepaper on PGHD,  "Conceptualizing a Data Infrastructure for the capture, use, and the sharing of Patient-Generated Health Data in Care Delivery and Research through 2024".  It is currently in draft and a good overview of the PGHD landscape.  

What I find lacking in the draft is the upcoming deluge of IoT information such as, home and workplace environmental data along with endpoints such as vehicle OBR (On Board Reporting), which impacts a person's health.  It is predicted that we will have thousands of sensors providing bio and environmental data in the very near future.  How and where are we going to store and provide access to this data? How will it be authenticated and secured? Will it become part of our medical record? Who will own and manage the data?

Much of this data will be near real-time streamed data which will need to be cleaned, compressed and analyzed.  EHRs, which focus on the collection of clinical data do not have the ability or architecture to manage this high volume of non-clinical data.  PGHD data is unstructured, it doesn't follow standards such as HL7 or LOINC to name a few, and is mostly stored in proprietary data sets.  The data doesn't fall under HIPAA protection unless it is stored in an EHR raising the liability of the providers and organizations. 

Technology is ahead of the ONC timeline, by 2024 the end date for ONC adoption, I predict the amount of PGHD generated will surpass the amount of clinical data collected, swinging the pendulum of value to the PGHD.  Why, because data is where the answers lie, the value.

The growth cycle will probably need to be brought in two to three years based the current rapid development of sensors and IoT technology.  This will future stress the EHR vendors to attempt to accommodate this data rather than focusing on their core business of providing an interface for providers to access patient data.

Security and privacy are a major concern with IoT sensors and devices.  It takes an architecture that is built from the ground up to support remote client devices. A secure architecture which supports authorization, authentication, data-provenance, non-repudiation and transparency.

A new PGHD data architecture is needed to provide an interface between the EHR and the Patient's devices.  A platform that can scrub, analyze and format results and findings for a provider to access via a portal or EHR.  Health Record Banking may be the solution, a patient controlled standalone distributed database that is secure,  accessible anywhere, anytime and anyplace,  

“Secure by Design”, IoT in health

Though my subject is Medical Security, this post  extends to devices within our home, auto and our pocket.  If the device is connected we need security to insure privacy.

The most important step to ensuring our privacy and protecting our data starts long before you purchase a device or a new connected devices is added to a hospital or doctors office network.

Security starts in the design of the device and is based on software best practice, many that are not known or enforced in to coder community today. The practice is called  Secure Software Development Life Cycle (S-SDLC) an is taught in the first semester of most Computer Science college curriculum.  This is where I normally lose the Agile designers, but wait, this will work for Agile as well  We just need to consider the sprints as smaller circles/life cycles, more about this later.

There is one large caveat to designing medical software, if it fall under the FDA definition of a medical device it must follow IEC 62304, which is waterfall design, at least for the documentation.  Not all software for medical use need FDA approved, e.g., EHR Electronic Health Records do not fall under FDA jurisdiction, why?  Good question, however we will leave this for another discussion.

One issue software faces today is the lack of Computer Scientists,  there are many great coders doing good work, however the oversight seems to be lax.  Oversight is the responsibility of the vendor that owns the software and the customer who purchases the software, e.g., a hospital purchase a solution to store PHI, something goes wrong and the data is compromised.  It is the hospital responsibility to report and most likely compensate the patient's that have been damaged by the breach.    

S-SDLC

Secure SDLC is based on SDLC, a best practice for designing and delivering robust software.

A series of steps starting at the top of the circle describing the life cycle of the development.
S-SDLC  takes into account security at every step of the cycle, e.g., Requirements phase, add Security requirements.

One of the most important parts of the cycle is testing,  it is the last chance to catch a problem before it gets to the customer.  Because of the emphasis placed on iterations and quick to deliver, many coder today do not agree.

There is a V-Model for SDLC that stresses the testing phase, by including 5 levels of testing.  Many in the Agile community feel that this model is to close to Waterfall design,  I do not wish to debate, however I did want to show the testing phases that must be implemented in-order to protect data.

• 
  

• Unit testing
• Integration testing
• System testing
• User acceptance testing
• 
  

User Acceptance Testing is one of the most important phases because it test in a way that the customer will use the system.  I suggest that organization perform this testing themselves to make sure they are getting the protection and operation that was sold to them.

As IoT solutions become more available in healthcare, we will need to be more diligent in protecting our privacy and the privacy of our patients.  We can no longer except that notion that a product, service or vendor is secure, we must follow through and be sure.

Security isn't something that you can buy as much as it is a way of thinking, designing testing and implementing.   Organization must train their people to think about security first, in everything they do.  We also must implement system that allow employees to report suspected security problem without repercussions, i.e., shooting the messaging .  Security is a team effort, both strategic and tactical.