George Steptoe

home

authors

george-steptoe

The progress from research to practice can be notoriously sluggish. So that’s why researchers set out to develop a new rapid evidence review process for health system leaders to more quickly and efficiently identify and prioritize novel tech-based tools to use in clinical care. The pioneering results, published 

, could prove useful to doctors who want to take advantage of the proliferating technologies that can connect patients with clinical teams to improve care.

The research team looked at tools that can support patient self-management, (SM), patient decision aids, point-of-care clinical decision support and web-based platforms that keep healthcare teams and patients in touch outside of clinic visits — for instance, tools that collect patient-reported outcome (PROs).

Our Top 8 Health-Tech Research Stories of 2018

Despite a growing enthusiasm among health system leaders that PROs and SM tools can make care safer, more effective and patient-centered, they can also be difficult to implement — owing to their complexity, the difficulty posed in figuring out how they can be best put to use in local health systems, and the varying degrees to which they’ve been tested. What’s more, formal evaluation processes of new technologies before implementation can take years.

When speaking with clinical experts, clinicians, nurses and pharmacists, the researchers came across a lot of excitement for the promising efficacy of PROs and SMs, according to Tanner Caverly, M.D., MPH, lead author of the study and assistant professor at the department of health learning sciences at internal medicine at the University of Michigan Medical School.

“But they are seeing lots and lots of work to do before being able to actually put those into practice and carry them out,” Caverly said.

How to speed up the process while maintaining a rigorous evidence-based grounding? Enter the rapid evidence review process.

The researchers set out a five-step methodology: an “environmental scan” whereby symptom domains were identified by reviewing all guidelines that had been published by major professional health organizations; expert panel recruitment; a host evidence review panel; an analysis stage; and a local validation panel.

The process is meant to streamline the information provided to an expert panel, reducing the time needed to evaluate and prioritize options from an array of interventions. Panels would meet just twice and then again in a five-hour in-person meeting. They employed a modified “Delphi” process, a method engineered to obtain a quick expert consensus.

All in all, the study found that by employing a rapid evidence review process, the time from research to practice could be reduced from several years to just 4 months.

Implementing AI Is Simpler than You Think

Caverly said that the impetus for the study was rooted in his team’s interest in the patient-centered aspect of the pay-for-performance Oncology Care Model (OCM), through which clinicians routinely send surveys to patients at hundreds of cancer care centers across the U.S. to measure patient experience and incentivizing improvements.

For a patient, the treatment pursuant to a cancer diagnosis — such as powerful chemotherapy regimen and surgeries &mdash; can be challenging enough, let alone the substantial concerns of existential angst, cancer-related fatigue and severe depression, according to Caverly.

“And it turns out that in current medical practice, we’re not always as good at paying much attention to... what the patient is experiencing internally,” Caverly said. “We may not know how severe it is.”

“By tracking any side effects that occur and using these technologies [PROs and SMs] to allow patients to communicate more effectively with the clinical teams, they can act on that and manage that more aggressively. It can radically improve the patient’s experience.”

The findings, though, came with some reservations.

According to the study, “panelists had substantial concerns about implementing patient-reported outcome tracking tools, voicing concerns about liability, lack of familiarity with new technology, and additional time and workflow changes such tools would require.”

The tech-based tools can in some ways be 

effective in terms of patient feedback, Caverly said.

“Clinicians and nurses have a concern about data deluge — they feel that they don’t have a lot of time to take out a large extra task,” Caverly said. “And if all of the sudden they had a whole new stream of data coming in from patients, they don't know how they're going to be able to fit that in to their work day.”

Instead, clinicians favored technologies that did not require clinician involvement, the report concluded.

Get the best insights in healthcare analytics 

Taking a Data-Driven, Multidisciplinary Approach to Radiology Research

In the US, Healthcare Data Access Is a Scavenger Hunt

Medicare Substance Abuse Data Redacted for 4 Years, Fueling Flawed Research

Articles

Health tech is changing rapidly, but barriers to innovation remain. Can this process help health systems?

How to Go from Clinical Research to Practice in 4 Months

, a spate of high-profile attacks brought the healthcare industry’s need to strengthen its cybersecurity into sharp focus. Ransomware, like WannaCry and NotPetya, has wreaked havoc in small hospitals and biopharma giants alike, and the vulnerabilities appear widespread and acute, experts said.

The ECRI Institute, a nonprofit research organization, identified ransomware and other cybersecurity threats to healthcare—and the danger they pose to patients&mdash;as the top health technology hazard for 2018. A Department of Health and Human Services (HHS) Healthcare Industry Cybersecurity Task Force report to Congress in June found that digital security is in “critical condition.” According to the Protenus Breach

Barometer, at least 1 breach occurs in the healthcare sector every day.

Until now, healthcare has “benefited from relative obscurity while no one was paying attention,” said Joshua Corman, a member of the task force and chief security officer at the software company PTC. “WannaCry shattered that obscurity.”

The biggest problems facing healthcare are unique to the field, which also has the highest stakes. “In terms of flesh-and-blood consequences to ransomware and hacking, we are most exposed in hospitals,” Corman said. “It’s almost a miracle that we haven’t had more hospital outages.”

A 2016 Ponemon Institute report noted that data breaches cost the healthcare sector $6.2 billion annually, and attacks remain consistently high in terms of volume, frequency, impact, and price. “New cyber threats, such as ransomware, are exacerbating the problem,” said Larry Ponemon, PhD, the institute’s founder.

Data compiled by the HHS Office for Civil Rights show hundreds of incidents in the past 2 years, affecting tens of millions of individuals. And the problem might be even greater. Lee Kim, JD, director of privacy and security at the Healthcare Information and Management Systems Society, said many security breaches fly under the radar. “There have been a lot of incidents that have created a lot of buzz in the industry, but there’s also a hidden undercurrent of smaller organizations,” Kim said. Low-level security breaches often don’t meet the reporting threshold, and so health systems stay quiet for fear of scaring shareholders, Kim noted.

So what’s keeping healthcare from fortifying its defenses?     Security understaffing, a lack of appropriate resources, unnecessary overconnectivity between devices, few means to securely install updates, long-lasting equipment operating on outdated software, and little staff awareness, experts said. A review of the most prolific and largest security incidents of 2017—from WannaCry and NotPetya to targeted attacks and old-fashioned human error&mdash;reveals industry-wide trends.

In a massive, high-profile assault this spring, the WannaCry ransomware virus hit 81 British hospitals, leading to thousands of canceled appointments. The virus crippled the United Kingdom’s National Health Service (NHS), causing 19,500 canceled medical appointments; locking the computers of 600 general practitioners; and forcing 5 hospitals to divert ambulances elsewhere, according to a National Audit Office report. The attack “could have been prevented by the NHS following basic IT [information technology] security best practice,” the report said.

As part of a WannaCry wave that also disrupted organizations outside healthcare, 2 multistate hospitals systems in the United States faced significant challenges to operations, according to an HHS cyber notice. “The behaviors that have been reported are typical for environments where the WannaCry scanning virus persists, even though the encryption stage has been blocked by antivirus, or is not executing,” HHS wrote.

“If you were hit by WannaCry, you were really doing something very wrong,” said Justin Cappos, PhD, associate professor of systems and security at New York University’s Computer Science and Engineering Department.

In October, a new WannaCry strain caused additional network downtime at FirstHealth of the Carolinas, a hospital system that takes patients from 15 counties. FirstHealth’s information system team shut down the network when it identified the threat. As of last month, it remained down because of “an abundance of caution,” according to the group’s website.

A spokesperson for FirstHealth declined to comment on the network disruption. But the health system noted that the virus did not affect databases or patient or operational information.

“If we found out tonight that there was a new WannaCry strain, in most of those organizations, there would be no qualified person who would know what to do about that,” Corman said. The cybersecurity task force discovered a “severe” lack of security specialists, with 85% of medical organizations—particularly small, medium, and rural hospitals&mdash;lacking a single security staffer. “They have more janitors at these hospitals than they do security people,” he said.

The goal of Theresa Meadows, MS, cochair of the cybersecurity task force and senior vice president and chief information

officer at Cook Children’s Health Care System, is to add 6000 to 7000 new cybersecurity professionals to the ranks. “All the software won’t help. You need to have people who can spot it,” Meadows said, noting that they could reeducate victims.

But that would take resources. Meadows said the task force wants a federal “stark exemption” so large providers can provide security services and software at reduced costs to smaller provider partners. 

Although hospitals manage many competing priorities, experts said cybersecurity must top the list.

NotPetya spread in June, imitating a ransomware virus called Petya, which cropped up in 2016. But rather than extorting users by demanding Bitcoin to unlock data, NotPetya was designed to destroy.

Defense against NotPetya should have been easy, Cappos said. The virus was built “so, so, so poorly,” and “it was essentially just deleting the files on the system rather than really locking them up.” Cybersecurity leaders thought it was made to merely look like an attack.

NotPetya affected mainly Ukrainian businesses and appeared to have been launched by the Russian government, Cappos noted. It subsequently swept across the Atlantic and infected 4    companies: the pharmaceutical colossus Merck, Pennsylvania’s Heritage Valley Health System, Princeton Community Hospital in West Virginia, and Nuance, which sells dictation and transcription software.

A month later, Merck was still reeling from the virus, and Princeton Community Hospital was forced to replace all its hard drives and had yet to relaunch all its systems by late summer. The malware affected Merck’s production, delivery, manufacturing, research, and sales operations, according to a government filing.

NotPetya tapped the same vulnerability as WannaCry did but then spread through a software updater. WannaCry used a National Security Agency hacking tool called Eternal Blue, which NotPetya also exploited, Cappos said.

Not all security breaches require malicious hackers or software.

Human error caused the biggest security incident of 2017, according to HHS. About 655,000 patients of the Bon Secours Health System in Virginia were notified that their records might have been breached when a third-party contractor accidentally made files accessible online during a network settings adjustment.

Raising awareness is a low-tech solution. “It seems so simple and silly to mention, but educate your end users about what your security practices are, [and] raise their cybersecurity IQ by giving them simple, basic, easy-to-understand awareness tips,” Kim said. “Otherwise, you’ll be just chasing their tail.” Regularly changing passwords is an easy fix, Kim added.

Cybersecurity isn’t just an IT issue, said Juuso Leinonen, senior project engineer for health devices at the ECRI Institute. Protecting systems requires participation from the entire staff. Combating attacks “is something that each department within a healthcare facility can and should play a role in, from clinical engineering to information security, risk management, purchasing, and even the front-end clinicians,” Leinonen said.

Educating employees to identify risks is of utmost importance, Meadows agreed. Most attacks in 2017 occurred through phishing, she said. “The biggest recommendation that I have for hospitals specifically is to do ongoing education around phishing, ransomware, and malware, because you’re only as strong as your weakest link.”

Airway Oxygen, a home medical equipment provider in Michigan, suffered a ransomware attack in April that might have compromised the data of 500,000 individuals, making it the second-biggest security breach of the year. According to an official notification sent to HHS, a hacker infected the organization’s network with ransomware, which then shut employees out.

cybersecurity firm to investigate. “Clearly, there is a trend, not surprisingly, where many companies are devoting more money to the organization after an incident,” Andrew Liuzzi, a public relations crisis and risk management expert, later told one news outlet.

Shutting the stable door after the horse has bolted is not enough, and plans should be made before a strike. “You have to have your mitigation plan on the ready,” Meadows said. “Many people didn’t do the work before, so they’re caught off guard.”

Although viruses operate autonomously once unleashed, the healthcare industry is also susceptible to targeted hacking.

That occurred at Women’s Health Care Group of PA, when 300,000 patient records were exposed, making it the year’s third-largest breach. The organization informed patients of the breach in July, more than 2 months after it discovered the ransomware, noting that the company’s systems might have been compromised as early as January. “We have been unable to determine if any specific information was actually acquired or viewed in connection with this incident,” it said.

The incident highlighted the need to defend against individual hackers, who may enter through outdated software for expensive, legacy medical equipment whose life spans exceed those of the accompanying operating systems.

There’s a window of time for the medical device community to “really get their act together and fix things,” Cappos said. But when attackers start identifying vulnerabilities in specific devices, the healthcare industry will be in an “absolute world of hurt,” Cappos said. The diversity and complexity of the medical device market make it difficult to identify which supplier or manufacturer to contact and who is responsible to ensure security, Cappos added.

“Frankly, I’ve worked in hospitals where our ventilators were 18 years old and were working perfectly from the clinical perspective,” said Leinonen. “But it becomes very tricky when it comes to medical devices that are built to operate on software that might be obsolete.” 

Finding a workable solution for legacy medical devices has prompted a lot of discussion in the industry, according to Meadows. The task force has been working closely with the FDA to solve this problem. “Sometimes you build a building around that machine because of its size,” Meadows said. Hospitals can’t rip out and replace high-cost legacy equipment. “You have to come up with a plan so we can segment that device and not let any potential risk get past it.”

Without segmenting a network, an attack on a single part of the system can disrupt an entire hospital, Corman said. The cybersecurity task force report noted that a single flaw in a single device could cause entire network outages.

The gold rush from paper to electronic health records led to premature overconnectivity, Corman said.

Hospitals must seal the subsequent holes, though implementing security patches is often complex. An industry-wide consensus on how best to address the implementation of patches and updates must be reached. “Probably the most fundamental thing that manufacturers need to do is have a secure way to update,” Cappos said, explaining that systems with updated security patches were rarely vulnerable, as were companies with solid firewalls. “If you can securely update systems, you can fix problems, but if you can’t, you’re basically putting a device in a time capsule in the ground that hackers can get into and do whatever they want with.”

He added, “The actual security of many types of devices, if you wanted to hack into them, is embarrassingly bad. It’s frankly appalling.”  

In 2017, a spate of high-profile attacks brought the healthcare industry’s need to strengthen its cybersecurity into sharp focus.

The Worst Healthcare Cybersecurity Breaches of 2017

An ongoing network disruption to a hospital system caused by a new strain of the WannaCry virus has highlighted how vulnerable the healthcare industry 

In a massive, high-profile attack earlier this year, a prior strain of WannaCry ransomware hit 81 British hospitals, leading to thousands of canceled appointments. A new strain of the same virus was blamed for continued network downtime at FirstHealth of the Carolinas, a not-for-profit hospital system that serves as a referral center for 15 counties.

Until now, the healthcare industry in the United States has “benefited from relative obscurity while no one was paying attention,” said Joshua Corman, a member of the Department of Health and Human Services (HHS) Healthcare Industry Cybersecurity Task Force and chief security officer at the global software company PTC. “Ransomware and WannaCry shattered that obscurity.”

Like other ransomware, WannaCry is designed to infect a computer, block access to it, and then demand money in the encrypted currency Bitcoin to unlock it.

FirstHealth’s information system team shut down the network on Oct. 17 when it first identified the threat. The network remains down due to “an abundance of caution,” according to a notice posted to the hospital group’s website. Staffers are checking 4,000 devices and more than 100 physical locations connected to the network to ensure no virus risk.

Though it caused delays and cancelled appointments, “the virus did not reach any patient information, operational information or databases,” according to the notice. FirstHealth added that the network downtime didn’t affect critical or emergent needs.

In May, another strain of WannaCry swept across Europe. The virus 

 the United Kingdom’s National Health Service, causing 19,500 canceled medical appointments, locking the computers of 600 general practitioners, and forcing 5 hospitals to divert ambulances elsewhere, according to a 

 published last week. The attack “could have been prevented by the NHS following basic IT security best practice,” the report said.

In March, the HHS established the Healthcare Industry Cybersecurity Task Force, which released a report on their findings to Congress in June. The report found that healthcare cybersecurity in the US is in “critical condition.”

“If we found out tonight that there was a new WannaCry strain, in most of those organizations there would be no qualified person who would know what to do about that,” said Joshua Corman, a member of the cybersecurity task force and chief security officer at the global software company PTC.

The task force discovered a “severe” lack of security specialists, according to Corman, with 85% or more medical organizations—particularly small, medium, and rural hospitals&mdash;lacking a single qualified security person on staff.

“They have more janitors at these hospitals than they do security people,” he said.

The report also identified other risk factors for the healthcare industry, including a tendency to use outdated and unprotected software. “The equipment hospitals buy has a longer life than the operating system that it runs on,” Corman said. “They’re always going to be structurally more vulnerable until we factor that into the durable goods that hospitals invest in.”

In addition, the “gold rush” from paper to electronic health records led to premature and over-connectivity, according to Corman, who said that hospitals accepted the promise of going digital without preparing for the peril.

Without appropriately segmenting a network, over-connectivity can render a system particularly vulnerable so an attack on a single part can cause system disruption for an entire hospital, he said. The cybersecurity task force report also found that a single flaw in a single device can cause entire network outages.

“In terms of flesh and blood consequences to ransomware and hacking, we are most exposed in hospitals,” Corman said. “It’s almost a miracle that we haven’t had more hospital outages.”

A 2016 Ponemon Institute report found that the overall cost of data breaches to the healthcare industry is $6.2 billion and that attacks remain consistently high in terms of volume, frequency, impact, and cost. “New cyber threats, such as ransomware, are exacerbating the problem," 

 Larry Ponemon, PhD, chairman and founder of the Ponemon Institute.

“They have more janitors at these hospitals than they do security people.”

Latest WannaCry Virus Attack Stresses Healthcare's Need to Fortify Defenses

Some of the most popular mobile health apps have “critical” security flaws, which can lead to confidentiality issues for patients and medical professionals, as well as safety issues regarding data integrity, according 

Researchers from the University of Applied Sciences and Arts Dortmund in Germany assessed 53 apps taken from lists of the top 10 downloaded free apps in 3 countries. They found that 40% had pressing vulnerabilities.

mHealth apps have a “heightened need for protection,” the report said. Yet none of the 21 apps that had security issues guaranteed the integrity of user data, 18 apps leaked private data or compromised confidentiality between apps and their servers, 17 apps used unprotected connections, and 2 apps failed to validate certificates. Many apps employed ad providers, which undermine user privacy, according to the study.

The findings surprised Christoph Friedrich, PhD, lead author of the study. “The proper use of transport security should be mainstream today,” he said. “Most users and developers have no feeling for the potential risks and do not care about it.”

The term “transport security” refers to the means by which an app transmits data to a service provider. “As soon as data are sent through public infrastructure, data can potentially be observed, modified, or redirected. Without any protection, this endangers the integrity of data displayed, gives away potentially sensitive data, and enables malicious parties to impersonate the victim,” the report said.

After the study, researchers contacted developers to let them know about the security issues. Only 5 of 21 responded, Friedrich noted. They subsequently corrected the issues.

Some security risks could have “severe implications,” Friedrich said, including identify theft, password hijacking, and the loss of sensitive information.“The attacker can get full access to the smartphone, if the systems are not patched,” he said. “This is especially problematic, as some devices, after a short marketing time, do not get security fixes.”

Friedrich said that his team analyzed 1 app that had a vulnerability that would allow an attacker to send prescription information from the doctor to the pharmacy, enabling the procurement of drugs with manipulated or duplicated prescriptions.

A lack of awareness among both developers and users is a central issue, according to Friedrich. “We should train developers, [and] then the problem will disappear. The users, on the other hand, need to apply the security fixes distributed by the manufacturers in a timely manner,” Friedrich said.

Lackluster law enforcement was another obstacle that Friedrich identified. Despite strict European laws on protection for medical-related data, they are not always applied to mHealth apps. “When there is no demand for proper security implementations, it is economical to avoid them,” Friedrich said. What’s more, in the US, health apps often aren’t regulated like medical software, even though they often contain sensitive information.

Existing user concerns about information security in health apps may impede growth in the sector, Friedrich said. “If users fear misuse of their data, they might shy away from using mHealth apps,” he added. “This is a pity, as mHealth apps can be a very cost-effective instrument to improve healthcare through telemedicine or other applications.”

The report also noted the potential of using mHealth apps on inexpensive smartphones in developing countries to minimize discrepancies in healthcare worldwide.

A study found vulnerabilities in 21 top apps, including 18 that leaked private data.

George Steptoe

Articles

How to Go from Clinical Research to Practice in 4 Months

The Worst Healthcare Cybersecurity Breaches of 2017

Latest WannaCry Virus Attack Stresses Healthcare's Need to Fortify Defenses

mHealth Security Flaws Pose Risks to Users