Securing the Digital Hospital

Of late, IT giants seem to have woken up to the fact that the Indian healthcare sector, and hospitals in particular, is one of the last industries where IT tools have a relatively limited sway. Mostly restricted to billing and administration, IT traditionally rarely played a role in the actual practice of clinical care, no thanks to an ingrained mistrust of technology perceived to be too 'technical'. This mirrors the scenario when IT first started making forays into the US healthcare system. In 2002, when Cedars Sinai Medical Center, Los Angeles, first tried to implement a Centralised Physician Order Entry system, developed in-house, it had to be scrapped as senior doctors were embarrassed by the number of errors the system caught and reported. But eight years down the line, IT firms are lining up with customised solutions promising higher efficiency levels and streamlining of data. This coincides with the growing corporatisation of Indian hospitals, as opposed to the old model of publicly funded medical care. These corporate hospitals today have a fair crop of medics who have trained and worked abroad and are now returning to India as opportunities at home begin to match with those abroad. Catch the latest IT moves of India’s top hospitals in Express Healthcare’s IT Special Cover story section.

But as Indian hospitals go down the IT path, they would do well to learn from the experiences of other countries. Concerns are being raised on the security and privacy of EMRs (Electronic Medical Records). Ownership of the data is also a sticky issue as whoever owns the data has to take responsibility for securing the data. Can the system ensure confidentiality of patient clinical data and guarantee that the records are not misused and can be accessed solely by authorised personnel? As consumers become more aggressive and NGOs play the role of vigilantes, patients affected by failure of IT systems may file lawsuits against healthcare providers. Who bears the legal liability: the IT provider or the healthcare provider? And what happens if the IT provider closes shop and moves away? Regulation too is the missing link in India. The US has the HIPAA (Health Insurance Portability and Accountability Act) passed in 1996, the EU (European Union) has several parliamentary directives to protect the processing and free movement of personal data while Canada's PIPEDA (Personal Information Protection and Electronic Documents Act) does something along the same lines. Will self regulation be enough for India?

Also, IT systems cannot be the complete solution to more efficient healthcare delivery. It can be big a part of the plan and offers a lot of hope, especially in times of natural calamities. For example, in August 2005, when Hurricane Katrina wiped out life along the US Gulf Coast, it also took away the medical histories of patients. Hardest hit were chronic patients on complex combinations of medication, like psychiatric patients, who can only recollect that ‘I used to take a red pill.' New Orleans, the hardest hit by Katrina, started building up the city’s electronic health records of more than 500 LSU (Louisiana State University) physicians. The project was rolled out in 2007, along with a $100 million e-prescribing initiative, supported by a consortium of IT biggies like Dell, Google and Microsoft. The system allows patients to go online, download their active medications, medication history and allergies. Recognition for the project came in June this year, when LSU Healthcare Network was selected as a recipient of the Microsoft HealthVault Be Well Fund, to develop a model that cities across the US can use to help patients take their medical records, where ever they go, especially during natural disasters. This is already happening in India, with the Health Hiway initiative of Apollo Hospitals and IBM, which connects 250 users across 75 providers. The goal is a centralised database of patient records across the country. The VeriChip system, which is an RFID microchip, implanted under the skin, which when scanned by a doctor or nurse, confirms the patient's identity and pulls up the patient's entire medical records, could be too futuristic for now. We have a long way to go, but we are certainly on the right path and as you will read in the IT special, some of these solutions are uniquely Indian. We just need to ensure that the password to this 'digital fortress' is in the right hands.

Viveka Roychowdhury
viveka.r@expressindia.com