Traditional RESTful APIs Will Not Solve Healthcare’s Biggest Interoperability Problems

Traditional RESTful APIs Will Not Solve Healthcare's Biggest Interoperability Problems
Brian Platz, Co-CEO and Co-Chairman of Fluree

Interoperability is a big discussion in health care, with
new regulations requiring interoperability for patient data. Most approaches
follow the typical RESTful API approach that has become the standard method for
data exchange. Yet Health Level Seven (HL7), with its new Fast Healthcare Interoperability
Resources (FHIR) standard for the electronic transfer of health data, is
leading to a rash of implementations that, to date, are not solving core interoperability
issues. 

Data is still insecure, users can’t govern their own health
records, and the need for multiple APIs for different participants with
different rights (human and machine) in the network is adding unneeded
expenditures to an already burdened healthcare system. The way out is not to
add more middleware, but to upgrade the basic tools of interoperability in a
way that finally brings healthcare
technology
into the 21st century.  

A Timely Policy 

Doctors, hospitals, pharmacists, insurance providers,
outpatient treatment centers, labs and billing companies are just a few of the
parties that comprise the overcomplicated U.S. healthcare system. 

In digitizing medical files, as required by the 2009 Health
Information Technology for Economic and Clinical Health (HITECH) Act, providers
have adopted whatever solution was most convenient. This has led to the mess of
interoperability
issues that HL7 seeks to remedy with FHIR. 

Existing Electronic Medical Records
(EMR)
systems do not easily share data. Best case, patients have to sign
off to share data with two incompatible systems. Worst case, information must
be turned into a physical CD or document to follow the patient between
providers. Data security is also notoriously poor. Hackers prioritized the healthcare sector as their main target in 2019; breach
costs exceeded $17.7 billion.

The New Infrastructure Rush

When common formats, by way of FHIR and HL7, provided
standards and solutions to empower global health data interoperability, the
industry erupted into a flurry of activity. Thousands of healthcare databases
are now being draped in virtual construction tarps and surrounded by digital
scaffolding. 

Building a new, interoperable data ontology for the entire
healthcare system is a massive undertaking. For one, 80% of hospital data is
managed using the cryptic, machine-language HL7 Version 2. Most of the rest
uses the inefficient, dated XML data format. HL7 FHIR promotes the use of more
modern data syntaxes, like JSON and RDF (Turtle). 

Secondly, databases have no notion of the new FHIR schema.
Armies of developers must build frameworks and middleware to facilitate interoperability.
This is why Big Tech incumbents including Google Cloud Healthcare, Amazon AWS
and Microsoft for Healthcare are jumping into the fray with their own
solutions. 

The outcome, once HL7’s 22 resources are fully normative, will
be seamless information sharing, electronic notifications, and collaboration
between every player in the giant web of patients, providers, labs, and
middlemen. But it will come at a steep cost in the current traditionally RESTful
API-based manner that is being broadly pursued. 

The Problem with APIs

The new scaffolding is expensive, takes data control away
from patients, and is not inherently secure. The number of unique APIs required
to support the access, rights and disparate user base in the healthcare network
are the reason. 

Interoperability requires a common syntax and “language” to
enable databases to talk to each other. The average traditional API costs up to
$30,000 to build, plus half that cost to manage annually. That is not to
mention the cost to integrate and secure each API. A small healthcare
organization with only 10 APIs faces costs of $450,000 annually for basic API
services. 

When you consider that most big healthcare organizations will
need to connect thousands of APIs, HL7’s interoperability schema really is the
best way forward. The traditional API tooling to manage the interoperability of
the well-framed data structures, however, is the problem. 

Moreover, the patient, the rightful owner of their own
health record, still doesn’t have the ability to govern their own data. Because
change only happens in the database itself, the manager of the database, not
the patient, controls the data within. 

In the best case, this puts an additional burden on patients
to give explicit permission every time health records move between providers.
In the worst case, a provider sees an entire medical history without a
patient’s consent–your podiatrist seeing your psychiatric records, for
example.

Finally, each API enables one data store to talk to the
next, opening opportunities for bad actors to make changes to databases from
the outside. The firewalls that protect databases and networks are penetrable,
and user profiles are sometimes created outside of the database itself, making
it possible to expose, steal and change data from outside the database. 

In that light, HL7 is paving the wrong road with good
intentions. But there is another way. 

Semantic Standards and Blockchain to the Rescue

If you eliminate data APIs, secure interoperability, with
data governance fully in the hands of the patient, becomes possible. Healthcare
data silos will be replaced with a dynamic, trusted and shared data network
with privacy and security directly baked in. The solution involves adding
semantic standards for full interoperability, blockchain for data governance
and data-centric security. 

Semantic standards, such as RDF formatting and SPARQL
queries, let users quickly and easily gain answers from multiple databases and
other data stores at once. Relational databases, the ones currently in use in healthcare,
are all formatted differently, and need API middleware to talk to one another.
Accurate answers are not guaranteed. Semantic standards, on the other hand,
create a common language between all databases. Instead of untangling the
mismatched definitions and formatting inevitable with relational databases,
doctors’ offices, for example, could easily pull in pertinent patient records,
insurance coverage, and the latest research on diseases.

Patients, for their part, would use blockchain to regain control
of their data. Patients would be able to turn on aspects of their data to
specific caregivers, instead of relinquishing control to database business
managers, as is currently the case. Your podiatrist, in other words, will not
be able to see your psychiatric records unless you choose to share them. 

The data ledger, which lives on the blockchain, will contain
instructions as to who can update (writer new records on) the ledger, who can
read it, and who can make changes. All changes are controlled by private-key
encryption that is in the hands of the patient; only those with authorization
can see select histories of health data (or, as in the case of an ER doctor,
entire histories, with permission). 

Data security is controlled in the data layer itself,
instead of through middleware such as a firewall. Data can be shared without
API, thanks to those semantic standards, and data are natively embedded with
security in the blockchain. Compliance, governance, security and data
management all become easier. Data cannot be stolen or manipulated by an
outside party, the way it commonly is by healthcare hackers today. 

The interoperability conundrum, in other words, is solved.
Fewer APIs means fewer security vulnerabilities; a common, semantic standard
eliminates confusion and minimizes mistakes. Blockchain puts patients in
control of who sees what parts of their health records. Eliminating the need
for API middleware also saves tens of thousands of dollars, at a minimum.


About Brian Platz 

Brian is the Co-CEO and Co-Chairman of Fluree, PBC, a decentralized app platform that aims to remodel how business applications are built. Before establishing Fluree, Brian was the co-founder of SilkRoad technology which expanded to over 2,000 customers and 500 employees in 12 international offices.


3 Telemedicine Security and Compliance Best Practices

3 Telemedicine Security and Compliance Best Practices
Gerry Miller, Founder & CEO at Cloudticity

The coronavirus pandemic accelerated telemedicine exponentially as patients and doctors switched from in-person visits to remote consultations. Health providers rapidly scaled virtual offerings in March and April and traffic volumes soared to unprecedented levels, with practices “seeing 50 to 175 times the number of patients by telehealth than before the outbreak,” according to McKinsey. By early August, the U.S. Department of Health and Human Services expanded the list of allowable telehealth services in Medicare and there was an executive order supporting permanent telehealth provisions for rural areas.

But the surge in telemedicine adoption comes with a host of cybersecurity risks and regulatory compliance requirements unique to the healthcare sector.

As telemedicine traffic increases, so does the volume of hacking attempts. Recent cybersecurity news indicates healthcare organizations are top targets for cyberattacks and “providers remain the most compromised segment of the healthcare sector, accounting for nearly 75 percent of reported breaches.” The consequences are chilling: “The average cost of a healthcare data breach is $7.13 million globally and $8.6 million in the United States.

Further, whenever patient information is involved, HIPAA compliance is required. While HHS temporarily suspended pursuing HIPAA penalties on providers for “good faith provision of telehealth during the COVID-19 nationwide public health emergency,” such permissiveness will not last.

Luckily, most telemedicine providers can utilize managed services and cloud infrastructure to keep pace. Here are some best practices to meet IT compliance and cybersecurity demands for telemedicine.

Telemedicine Compliance Best Practices

Compliance should be viewed as a real-time process that drives security. Telemedicine tools and technology should therefore reflect significant expertise with all healthcare regulations (HIPAA, HITRUST, HITECH), with compliance functions permeating processes. Recommended compliance best practices include:

1. Automate Remediation

Healthcare applications cannot offer high reliability if every potential compliance problem is remediated manually; there’s just too much that can go wrong and never enough staff to address it when needed. The solution is to automate everything that can be automated, and rely on people to handle exceptions or potential violations that don’t impact reliability. Cloud-based services can integrate AI and operational intelligence to automatically remediate anomalies when possible, present recommendations to operations staff for cases that cannot be resolved automatically, and present clear choices such as:

·         Do Nothing: Take no action, delete ticket after [x number of days]

·         Fix Now: Implement the recommended actions immediately

·         Schedule: Perform the recommended actions during the next maintenance window

This approach speeds resolution and decreases service disruptions, and improves the reliability of telemedicine delivery. The automated response also plays a critical role in security (which will be discussed shortly).

2. Perform Formal Risk Assessments

Understanding the risk level and specific risk issues are critical components for an effective compliance plan. Many providers of healthcare services underestimate their level of risk, in part because it is difficult to quantify. The HHS has published guidance in its Quantitative Risk Management for Healthcare Cybersecurity, which offers insight. There are also cloud solutions that can aid the process. Cloud services providers such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud offer automated security assessment services that help improve the security and compliance of applications deployed on their cloud hosting platforms. They can generally assess applications for exposure, vulnerabilities, and deviations from best practices. A good inspection service should highlight network configurations that allow for potentially malicious access, and produces a detailed list of findings prioritized by level of severity.

3. Reduce Attack Surface

To provide secure access to sensitive information, hybrid architectures supporting telemedicine applications need a virtual private network (VPN) gateway between on-premises and cloud resources. However, developers, test engineers, remote employees, and others who need access to cloud-based protected health information (PHI) may bypass a VPN gateway by either cracking open the cloud firewall to allow direct unencrypted internet traffic or using peering connections. To prevent such potential exposures, secure desktop-as-a-service (DaaS) solutions provide an elegant way to allow cloud-based access to PHI without exposing connections or records. A DaaS is generally deployed within a VPC providing each user with access to persistent, encrypted cloud storage volumes using an encryption key management service. No user data is stored on the local device, which reduces overall risk surface area without impeding development capability.

Telemedicine Security Best Practices

While the full scope of cybersecurity strategies is beyond the scope of this article, here are three best practices that telemedicine providers can use bolster their security profile:

1. Deploy Proactive Network Security

Modern cyber threats have become steadily more sophisticated in evading traditional security measures and more devastating once they penetrate network perimeters. For that reason, telemedicine providers need a highly proactive, multilayered approach to prevent malware-based outages, theft of intellectual property, and exfiltration of protected health information (PHI).

A combination of network anti-malware, application control, and intrusion prevention systems (IPS) is recommended. Such proactive solutions are generally bundled in managed cloud services that should automatically detect suspicious system changes in real-time, isolate and quarantine affected resources, and prevent the spread of exploits by locking down any server whose configuration differs from the installed settings.

2. Encrypt Data Storage

Data encryption is the last line of cyber-defense for PHI and other critical information. Even if an attacker can penetrate the perimeter and proactive network security and exfiltrate data from the provider, those data are useless to the hacker if encrypted. It’s good practice to encrypt all web and application servers running on cloud instances using a unique master key from a key management service when creating volumes.

Encryption operations generally occur on the servers that host cloud database (DB) instances, ensuring the security of both data-at-rest and data-in-transit between an instance and its block storage. For additional protection, you can also opt to encrypt DB instances at rest, underlying storage for DB instances, its automated backups, and read replicas.

3. Harden Operating Systems

Both Microsoft Windows Server and Linux are ubiquitous operating systems in telemedicine. They are also both attractive targets for cybercriminals because they provide complex capabilities, frequently remediate vulnerabilities, and are so common (increasing attackers’ chances of finding an unpatched system). Hackers use OS-based techniques such as remote code execution and elevation of privilege to take advantage of unpatched operating system vulnerabilities. Hardened images of Windows Server and Linux virtual machines (VMs) should be used, employing default configurations recommended by the Center for Internet Security (CIS). Such hardened images make gaining OS administrative extremely difficult, and coordinate well with proactive security bundles described earlier.

Additional resources for telemedicine compliance and security are available from the American Medical Association (AMA), the US Department of Homeland Security, the U.S. Department of Health and Human Services, and HITRUST.

 While these best practices are targeted primarily at telemedicine companies, they can also be applied to a wide range of healthcare providers and organizations delivering vital services in the face of 2020’s dramatic swings in demand.


About Gerry Miller

Gerry Miller is the founder and chief executive officer at Cloudticity. He is a successful serial entrepreneur and healthcare fanatic. From starting his first company in elementary school to selling his successful technology consulting firm in 1998, Gerry has always marched to his own drummer, producing a series of successes. Gerry’s first major company was The Clarity Group, a Boston-based Internet technology firm he founded in 1992. Gerry presided over seven years of 100% aggregate annual growth and sold the company in 1998 when it had reached $10MM in revenue.

He was recruited by Microsoft to become their Central US Chief Technology Officer, eventually taking over a global business unit and growing its revenue from $20MM to over $100MM in less than three years. Gerry then joined ePrize as Chief Operating Officer, where he grew sales 38% to nearly $70MM while improving operating efficiency, quality, and both client and employee satisfaction. Gerry founded Cloudticity in 2011 with a passion for helping healthcare organizations radically reshape the industry by unlocking the full potential of the cloud.

5 Critical Considerations for Patient Privacy in Telehealth

5 Critical Considerations for Patient Privacy in Telehealth
Sachin Nayyar, CEO at Securonix

The COVID-19 pandemic has had a tremendous ripple effect across all industries, with one of the most impacted being healthcare. Providers have had to quickly adapt to supporting patients ‘virtually’ in a secure manner, while simultaneously developing procedures to support accurate reporting to government organizations. These changes have placed added pressure on security and privacy professionals, as they struggle to keep up with urgent demand.

Mature healthcare organizations already have stringent policies and procedures in place to remain compliant with government regulatory requirements (i.e., HIPAA, HITECH Act, etc.) and protect patients’ privacy. However, with the new focus on telehealth, unprecedented patient growth, and strict regulations on reporting, the key threats healthcare security and privacy teams need to be able to detect are also evolving: 

  • Unauthorized access to patient data by employees
  • Patient data snooping (by employees, family members, co-workers, etc.)
  • Compromised records (unusual access patters – new locations, multi-location access, etc.)
  • Failed logins and download spikes 
  • Terminated or dormant user accounts being used to gain access
  • Accessing discharged patient records or deceased patient records

Identifying these threats and uncovering suspicious patterns or activities, however, is no easy feat. Most security monitoring solutions cannot integrate with and consume electronic medical records (EMR) in a usable format. As a result, these solutions have limited out of the box content, leaving a majority of threat detection engineering to the security operations teams, which are already overwhelmed. Legacy security tools are no longer cutting it, as they use rule-based security event monitoring methods that do not account for the need to protect patient data privacy required by regulations such as HIPAA, HITRUST, and GDPR. They also lack the ability to protect patient data from insider threats, advanced persistent threats, or targeted cyberattacks.

Successfully monitoring patient data privacy must focus on two key entities: the employees accessing records and the patients whose records are being accessed. Organizations need to be able to visualize and correlate events across these entities and throughout the IT infrastructure and EMR applications to detect suspicious patterns while adhering to reporting and compliance mandates.

Monitoring EMR applications is crucial to detect and prevent suspicious activity that may lead to data compromise. However, this can be a cumbersome process. Given that nearly all EMR records contain patient data information, organizations must maintain the confidentiality of this data while enabling security monitoring. Unfortunately, most traditional SIEMs do not provide solutions to this problem. As a result, organizations are forced to intermix sensitive patient data with other IT data, risking compliance violations.

To achieve these goals in the near term, there are five crucial areas where healthcare security and privacy teams need to focus attention:

1. Remote Access Protocol: Like all other industries, healthcare organizations must now grant remote access to a large percentage of their workforce. As they migrate workers to remote access these organizations must address logistical challenges such as ensuring IT support can keep up with requests and implementing multi-factor authentication. 

2. Security Training: Organizations must make sure that their employees are abreast of the unique challenges that accompany working remotely and associated security best practices (i.e., security hygiene, secure internet connections, strong vs. weak passwords, signs of phishing attacks, etc.)

3. Critical App Exposure: Typically, critical applications containing electronic health records are not exposed to the internet without very rigid security controls. However, with the need to share and access more information via apps, strict security is more critical than ever before. 

4. Use of Personal Devices: Many organizations do not issue corporate devices to all their employees. Therefore, there is a greater security risk as workers are being permitted to use their personal devices to access critical systems.

5. User Monitoring and Detection: Identity activity patterns are vastly different as employees adapt to the new normal. As a result, prospective attack vectors have changed drastically. Monitoring and detecting new patterns of human and non-human identities must happen quickly in order to adapt to the new reality and detect attacks.

With the entire world experiencing unprecedented changes, we must learn to adapt quickly and strategically. New threat patterns will emerge, but it is crucial to remain vigilant about all activity and access occurring across IT infrastructure. Stringent regulations and ethical codes of conduct also mean that organizations need to be more vigilant about protecting patient data privacy than ever before. 

The constantly evolving data landscape makes it hard to differentiate new and normal, from malicious and threatening. Healthcare organizations need to assess their security posture, ensuring that they have proper tools in place to accurately analyze and correlate events across the IT infrastructure and electronic records. Only with access to this full picture will they be able to detect any suspicious patterns and ultimately protect patient data.


About Sachin:

Sachin Nayyar is the CEO of Securonix, a company redefining Next-Gen SIEM using the power of big data and machine learning. drives the vision and overall business strategy for Securonix. Built on an open Hadoop platform, Securonix Next-Gen SIEM provides unlimited scalability and log management, behavior analytics-based advanced threat detection, and automated incident response on a single platform.

Prior to Securonix, Nayyar served as the founder & CEO of VAAU where he led the company from conception to acquisition by Sun Microsystems. Following the acquisition by Sun, Sachin served as the Chief Identity Strategist for Sun Microsystems where he led the vision and strategy for the Sun security portfolio. Sachin is a renowned thought leader in areas of risk, regulations, compliance, identity/access, and governance and speaks frequently at professional conferences and seminars.