Why the ‘gold standard’ of medical research is no longer enough

Why the ‘gold standard’ of medical research is no longer enough

Why the ‘gold standard’ of medical research is no longer enough

Randomized controlled trials have long been held up as the “gold standard” of clinical research. There’s no doubt that well-designed trials are effective tools for testing a new drug, device, or other intervention. Yet much of modern medical care — perhaps most of it — is not based on randomized controlled trials and likely never will be. In this “dark matter” of clinical medicine, past practices and anecdotes all too often rule. We need to look beyond trials to improve medical care in these areas.

Randomized controlled trials have long been held up as the “gold standard” of clinical research. There’s no doubt that well-designed trials are effective tools for testing a new drug, device, or other intervention. Yet much of modern medical care — perhaps most of it — is not based on randomized controlled trials and likely never will be. In this “dark matter” of clinical medicine, past practices and anecdotes all too often rule. We need to look beyond trials to improve medical care in these areas.

In a randomized controlled trial (RCT), participants are randomly assigned to receive either the treatment under investigation or, as a control, a placebo or the current standard treatment. The randomization process helps ensure that the various groups in the study are virtually identical in age, gender, socioeconomic status, and other variables. This minimizes the potential for bias and the influence of confounding factors.

Despite their strengths, RCTs have substantial limitations. They can be very expensive to run. They can take many years to complete, and even then may not last long enough to assess the long-term effect of an intervention such as vaccine immunity, or to detect rare or long-term adverse effects. Findings from RCTs may not be valid beyond the study population — a trial that included a high-risk population in order to maximize the possibility of detecting an effect, for example, may not be relevant to a low-risk population. RCTs may not be practical for population-wide interventions and often aren’t relevant for urgent health issues such as infectious disease outbreaks, for which public health decisions must be made quickly.

As I write this week in the New England Journal of Medicine, several other study types can generate data that are at least as effective as RCTs, or may be even more effective, at generating evidence for action, especially related to population-wide interventions.

Why has healthcare become such a target for cyber-attackers?

Why has healthcare become such a target for cyber-attackers?

Why has healthcare become such a target for cyber-attackers?

More than 16m patient records were stolen from healthcare organizations in the US and related parties in 2016. That year, healthcare was the fifth most targeted industry when it came to cyber-attacks. And earlier this year, Britain’s National Health Service was crippled by a ransomware attack that locked up the computers holding many of its records and booking systems.

But it’s not just health data and services that are at risk from cyber-attacks – it’s also human lives.

More than 16m patient records were stolen from healthcare organizations in the US and related parties in 2016. That year, healthcare was the fifth most targeted industry when it came to cyber-attacks. And earlier this year, Britain’s National Health Service was crippled by a ransomware attack that locked up the computers holding many of its records and booking systems.

But it’s not just health data and services that are at risk from cyber- – it’s also human lives. In 2007, the then US vice-president, Dick Cheney, had his implanted heart defibrillator modified in order to avoid “death by hacking”, a technology weakness that US officials warned of again just recently. Any medical device connected to a  is potentially at risk from being taken over and exploited by hackers, from MRI machines to electric wheelchairs.

As connected technology becomes even more embedded in , this cyber-threat is only likely to grow. But if we want to protect our health from cyber-attacks, we shouldn’t fear technology. Instead, we need to understand it better and realise that the threat becomes much worse when people make simple mistakes.

What is the risk to healthcare?

The most common cyber-threats to healthcare are data theft attacks. They typically start from something like a phishing attack. For example, if you are a doctor with access to patients’ records, an attacker may send you an e-mail and convince you to click a link or attachment that downloads a piece of software known as malware to your computer.

The attacker can then use this software to gain access to the organisation’s financial, administrative and clinical information systems. In the case of the recent “Wannacry” attack that affected the NHS, the malware (in this instance “ransomware”) locked users out of their computers and demanded money to release them.

These attacks can also develop into “advanced persistent threats” against healthcare networks. These occur when malware enters a health network and remains there unnoticed while keeping in contact with the attacker. From there it can spread throughout the network, even if the original download is detected and removed. Then it can steal data and direct network traffic to the attacker so they can see exactly what is happening in the  in real time.

Attackers can also use the health network to spread into connected  and equipment such as ventilators, X-ray machines and medical lasers. From here they can create a “back door” that will allow them to maintain access even if software is updated to improve security.

It’s also possible that attackers could one day use artificial intelligence to mount more complex attacks. For example, hackers could use an intelligent system to block algorithms in the healthcare network that manage prescriptions or drug libraries and replace them with fakes.

Why is healthcare such a target?

Yet any organisation with a computer is at risk from cyber-attacks and there are arguably far more obvious targets for those wanting to extort money. The recent attack on the NHS, for example, yielded very little ransom.

Part of the reason for the threat against the healthcare sector is that it is classed as national critical infrastructure, alongside water, electricity and transport networks. This makes it an attractive target for those hackers wanting to cause chaos, especially from a hostile foreign country. Attacking a healthcare organisation that is part of a wider network of infrastructure could also provide a way in to other critical facilities.

There are also a huge number of opportunities for attacks on healthcare systems simply due to the extent to which they rely on technology. Healthcare today makes massive use of expensive technology, not just in computer systems and hospital equipment but also devices attached to and even embedded in the human body, such as fitness monitors or digital pacemakers. There are also many ways in for a healthcare hacker, from data networks to mobile applications and even non-medical systems such as CCTV.

In particular, the spread of the Internet of Things, the connection of increasing numbers of devices and objects to the internet, is increasing the number of potential access points for hackers. Unlike many of the more trivial uses for the Internet of Things, connected medical devices have obvious benefits because they can instantly exchange useful data or instructions with medical staff. This is where some of the greatest dangers lie because the devices are often involved in critical procedures or treatments. Interference with the signals to a robotic surgical tool, for example, would be devastating.

How can we protect healthcare from attacks?

Most of the attacks against health systems fall under the category of missile attacks. They cannot spontaneously harm the attacker and leave limited traces, but can cause significant damage. This makes it very difficult to track down the attackers or predict future attacks.

But healthcare organisations have already become more aware of the danger they are in and started to take measures to protect themselves, for example by building cyber-security into their information technology strategies. At a delivery level, hospitals can establish new security standards and better ways to effectively integrate the new interconnected systems as they emerge.

But healthcare systems suffer from the same inherent problems as any technology. Even when a security team thinks is has a grip on a problem, another often appears. When one is solved, many more are often generated. What’s more, they are designed by humans for humans, and so it’s fair to assume they are vulnerable by default thanks to human error.

Although you can train staff as best you can, it only takes one person clicking on a rogue attachment to let in malware that can disrupt the whole system. What’s more, the fear of legal costs and responsibilities might lead some organisations to under-report incidents and take action that could increase the threat, for example by paying ransoms to hackers. In reality, the reputation and trust of healthcare organisations depends on them understanding the true extent of the threat and taking sufficient measures to guard against it.

This article was originally published on The Conversation. Read the original article.The Conversation

Forgetting Can Make You Smarter

Forgetting Can Make You Smarter

Forgetting Can Make You Smarter

For most people having a good memory means being able to remember more information clearly for long periods of time. For neuroscientists too, the inability to remember was long believed to represent a failure of the brain’s mechanisms for storing and retrieving information.

But according to a new review paper from Paul Frankland, a senior fellow in CIFAR’s Child & Brain Development program, and Blake Richards, an associate fellow in the Learning in Machines & Brains program, our brains are actively working to forget. In fact, the two University of Toronto researchers propose that the goal of is not to transmit the most accurate over time, but to guide and optimize intelligent by only holding on to valuable information.

Read more at: https://medicalxpress.com/news/2017-06-smarter.html#jCp

For most people having a good memory means being able to remember more information clearly for long periods of time. For neuroscientists too, the inability to remember was long believed to represent a failure of the brain’s mechanisms for storing and retrieving information.

But according to a new review paper from Paul Frankland, a senior fellow in CIFAR’s Child & Brain Development program, and Blake Richards, an associate fellow in the Learning in Machines & Brains program, our brains are actively working to forget. In fact, the two University of Toronto researchers propose that the goal of is not to transmit the most accurate over time, but to guide and optimize intelligent by only holding on to valuable information.

“It’s important that the forgets irrelevant details and instead focuses on the stuff that’s going to help make decisions in the real world,” says Richards.

The review paper, published this week in the journal Neuron, looks at the literature on remembering, known as persistence, and the newer body of research on forgetting, or transience. The recent increase in research into the brain mechanisms that promote forgetting is revealing that forgetting is just as important a component of our memory system as remembering.

“We find plenty of evidence from recent research that there are mechanisms that promote memory loss, and that these are distinct from those involved in storing information,” says Frankland.

One of these mechanisms is the weakening or elimination of synaptic connections between in which memories are encoded. Another mechanism, supported by evidence from Frankland’s own lab, is the generation of new neurons from stem cells. As new neurons integrate into the hippocampus, the new connections remodel hippocampal circuits and overwrite memories stored in those circuits, making them harder to access. This may explain why children, whose hippocampi are producing more new neurons, forget so much information.

It may seem counterintuitive that the brain would expend so much energy creating new neurons at the detriment of memory. Richards, whose research applies artificial intelligence (AI) theories to understanding the brain, looked to principles of learning from AI for answers. Using these principles, Frankland and Richards frame an argument that the interaction between remembering and forgetting in the human brain allows us to make more intelligent memory-based decisions.

It does so in two ways. First, forgetting allows us to adapt to new situations by letting go of outdated and potentially misleading information that can no longer help us maneuver changing environments.

“If you’re trying to navigate the world and your brain is constantly bringing up multiple conflicting memories, that makes it harder for you to make an informed ,” says Richards.

The second way forgetting facilitates decision making is by allowing us to generalize past events to new ones. In this principle is called regularization and it works by creating simple computer models that prioritize core information but eliminate specific details, allowing for wider application.

Memories in the brain work in a similar way. When we only remember the gist of an encounter as opposed to every detail, this controlled forgetting of insignificant details creates simple memories which are more effective at predicting new experiences.

Ultimately, these mechanisms are cued by the environment we are in. A constantly changing environment may require that we remember less. For example, a cashier who meets many new people every day will only remember the names of her customers for a short period of time, whereas a designer that meets with her clients regularly will retain that information longer.

“One of the things that distinguishes an environment where you’re going to want to remember stuff versus an environment where you want to forget stuff is this question of how consistent the is and how likely things are to come back into your life, ” says Richards.

Similarly, research shows that episodic memories of things that happen to us are forgotten more quickly than general knowledge that we access on a daily basis, supporting the old adage that if you don’t use it, you lose it. But in the context of making better memory-based decisions, you may be better off for it.

Apple Aiming to Make iPhone ‘One-Stop Shop’ for Medical Info

Apple Aiming to Make iPhone ‘One-Stop Shop’ for Medical Info

Apple Aiming to Make iPhone ‘One-Stop Shop’ for Medical Info

Apple is quietly working on turning your iPhone into the one-stop shop for all your medical info  

Imagine turning to your iPhone for all your health and medical information — every doctor’s visit, lab test result, prescription and other health information, all available in a snapshot on your phone and shared with your doctor on command.

No more logging into hospital websites or having to call your previous doctor to get them to forward all that information to your new one.

Apple is working on making that scenario a reality.

  • Apple wants the iPhone to become the central bank for health information.
  • It is looking to host clinical information, such as labs and allergy lists, and not just wellness data.
  • To that end, it is talking with hospitals, researching potential acquisitions and attending health IT industry meetings.
Apple is quietly working on turning your iPhone into the one-stop shop for all your medical info

Imagine turning to your iPhone for all your health and medical information — every doctor’s visit, lab test result, prescription and other health information, all available in a snapshot on your phone and shared with your doctor on command.

No more logging into hospital websites or having to call your previous doctor to get them to forward all that information to your new one.

Apple is working on making that scenario a reality.

CNBC has learned that a secretive team within Apple’s growing health unit has been in talks with developers, hospitals and other industry groups about bringing clinical data, such as detailed lab results and allergy lists, to the iPhone, according to a half-dozen people familiar with the team. And from there, users could choose to share it with third parties, like hospitals and health developers.

One of the people said Apple is looking at start-ups in the cloud hosting space about potential acquisitions that might fit into this plan.

Essentially, Apple would be trying to re-create what it did with music — replacing CDs and scattered MP3s with a centralized management system in iTunes and the iPod — in the similarly fragmented and complicated landscape for health data.

“If Apple is serious about this, it would be a big f—ing deal,” said Farzad Mostashari, former National Coordinator of Health IT for the Department of Health and Human Services and the founder of a start-up called Aledade.

Such a move would represent a deviation in strategy from Apple’s previous efforts in health care, the people said, which have focused on fitness and wellness. Apple’s HealthKit, for instance, is primarily used to store things like step counting and sleep. There’s also a feature called “health records,” which includes the option to import documents that include summaries of care, but that is a limited snapshot of medical information.

 

Apple Medical ID

With this move, Apple is trying to tackle a huge problem that the medical community has been grappling with for years.

Even in the digital age, patients find their info cannot be easily shared between doctors, especially among different hospitals or clinics. This information tends to still live in PDF files attached to emails or delivered by fax machine. Those who do have access through so-called “patient portals” sometimes find that the user experience is poor and the information is limited.

This problem is often referred to as the “interoperability crisis” — and it is hurting patients, health experts have said.

The lack of data-sharing between health providers leads to unnecessary mistakes and missed diagnoses, Aneesh Chopra told CNBC. “As health care goes digital, the promise has always been to give patients and the doctors they trust full access to their health information,” he said.

Apple in recent months has been involved with discussions with health IT industry groups that are looking for ways to make this goal a reality, two of the people said. These include “The Argonaut Project,” a private sector initiative that is promoting the adoption of open standards for health information, and “The Carin Alliance,” an organization that is looking to give patients a central role in controlling their own medical data.

Bud Tribble, Apple’s vice president of software technology, has been personally involved with the latter group, two of the people said. Tribble is a trained physician with a background in medical research. The Carin Alliance’s Ryan Howells declined to comment on Tribble’s participation.

The company has also hired some of the top developers involved with FHIR, an increasingly popular protocol for exchanging electronic health records. These people include Sean Moore, an Apple software engineer who previously worked at medical records giant Epic Systems, and Ricky Bloomfield, a physician from Duke University with a background in medical informatics.

Google and Microsoft have tried, but failed

Other technology giants have attempted to solve the problem through their own web-based patient health record services, but have failed. Google shut down its initial product, Google Health, in 2011 due to a lack of traction.

“At any given time, only about 10 to 15 percent of patients care about this stuff,” said Micky Tripathi, president and CEO of the Massachusetts eHealth Collaborative and a health IT expert. Managing health information tends to be top of mind only for those who are chronically ill or obsessed with their health.

“If any company can figure out engagement, it’s Apple,” added Tripathi, who said he didn’t have any knowledge of Apple’s strategy.

It might have also been too early for an effort like Google Health to succeed. Since then, Mostashari said, policymakers pushed for technical standards among electronic medical records to promote data-sharing.

Apple also has other edges. The majority of doctors use iOS, and Apple has more than 1 billion active devices around the globe, which hospitals and developers are looking for new ways to reach. And it has made data privacy and security a priority in recent years.

Apple’s other plans in health include a sensor to noninvasively track blood glucose, CNBC previously reported. It has also made some notable hires from the medical sector of late, including a rising star of Stanford University’s digital health efforts, Sumbul Desai, also reported by CNBC.

Apple declined to comment on this report.

 

MIT Has Developed Colour-Changing Tattoo Ink That Monitors Your Health in Real Time

MIT Has Developed Colour-Changing Tattoo Ink That Monitors Your Health in Real Time

MIT Has Developed Colour-Changing Tattoo Ink That Monitors Your Health in Real Time

Researchers have developed a new colour-changing tattoo ink that responds to changes in the body, such as blood sugar and sodium levels.

Using a liquid with biosensors instead of traditional ink, scientists want to turn the surface of the human skin into an “interactive display” – an idea that makes this proof-of-concept an exciting one to watch. Technology like this could become a revolutionary new way to monitor health.

Researchers have developed a new colour-changing tattoo ink that responds to changes in the body, such as blood sugar and sodium levels.

Using a liquid with biosensors instead of traditional ink, scientists want to turn the surface of the human skin into an “interactive display” – an idea that makes this proof-of-concept an exciting one to watch. Technology like this could become a revolutionary new way to monitor health.

The project, called DermalAbyss, is a collaboration between researchers from MIT and Harvard Medical School, combining efforts from Fluid Interfaces and biotechnology.

So far, the team has developed three different inks that shift colour in response to changes in interstitial fluid – the stuff that sloshes around between our cells, comprising some 16 percent of the human body weight.

Of the three sensor inks, the most intriguing is the one that can measure glucose levels. The sensor changes its colour from blue to brown as blood sugar rises.

Having a glucose-sensing tattoo could conceivably make life easier to people with diabetes, who have to rely on pin-prick blood tests throughout the day to monitor their glucose.

The team has also created an ink that shifts from pink to purple in relation to pH levels, and a third sensor that can detect sodium, shining a vibrant green hue under UV light in the presence of rising salt levels.

Colour-changing ink sensorsXin LIU, Katia Vega

“The Dermal Abyss creates a direct access to the compartments in the body and reflects inner metabolic processes in a shape of a tattoo,” the team writes on the project website.

“It could be used for applications in continuously monitoring such as medical diagnostics, quantified self, and data encoding in the body.”

For someone who has a health condition that requires careful dietary monitoring, or even if you’re just a data nerd and like the idea of tracking bodily changes with a cool-looking tattoo, it’s an alluring concept.

“People with diabetes email us and say, ‘I want to try it out,'” one of the team, Xin Liu from MIT told CBS News.

But if you’re ready to be signed up for one of these biosensing tattoos, unfortunately we have to disappoint you for now. So far, DermalAbyss is only in the proof-of-concept stage, and there’s no indication of when it might become a real product.

The researchers have tested the inks on patches of pig skin, using injections to change the levels of the fluids to be detected.

In the video below, you can see these test patches in action, as well as a digital rendering of what such a colour-changing tattoo might look like on a human arm:

Before this amazing tech can be approved in humans, it will need to go through several stages of rigorous tests, probably in animals first and then eventually in people. Things to look out for are adverse reactions to the ink and possible allergies.

There’s also the question of how to make sure the tattoo indicators are as accurate as possible. In a medical situation, you’d want that colour-changing ‘interface’ to be as reliable as a blood test, and we’re definitely not there yet.

“It will take a long time for anything practical to go to market, but it [the technology] evokes imaginations and opens up possibilities,” Liu told CBS News.

The team will be presenting their research at the 2017 International Symposium on Wearable Computers in September.

By:SIGNE DEAN

11 Things the Health Care Sector Must Do to Improve Cybersecurity

11 Things the Health Care Sector Must Do to Improve Cybersecurity

11 Things the Health Care Sector Must Do to Improve Cybersecurity

No industry or sector is immune to hacking. That reality was made painfully clear in mid-May, when a cyberattacker using WannaCry ransomware crippled health care institutions and many other kinds of organizations around the world. In 2015 over 113 million Americans health records were exposed, and in 2016 the number was over 16 million, according to reports submitted to the U.S. Department of Health and Human Service’s Office for Civil Rights.

No industry or sector is immune to hacking. That reality was made painfully clear in mid-May, when a cyberattacker using WannaCry ransomware crippled health care institutions and many other kinds of organizations around the world. In 2015 over 113 million Americans health records were exposed, and in 2016 the number was over 16 million, according to reports submitted to the U.S. Department of Health and Human Service’s Office for Civil Rights. At the beginning of 2017 Experian predicted that the health care sector would be the most heavily targeted vertical industry. A March 2017 report from the Identity Theft Resource Center indicated that more than 25% of all data breaches were related to health care. The estimated loss to the industry is $5.6 billion per year. These stats should be a wake-up call for the entire industry.

There are three reasons health care is the source of so much stolen data right now. First, health care data can be monetized. For instance, cybercriminals can use medical data to sell fake identities, construct synthetic identities, and enable someone to conduct medical identity theft. If that doesn’t work, they can use the stolen information for traditional identity theft, since medical information tends to include enough information to allow a criminal to open a credit card, bank account, or loan in the victim’s name. If neither of those works, cybercriminals can use ransomware to extort health care organizations to pay them money to regain access to compromised systems and data.

Second, health care organizations have been slow to adopt practices that have worked for other industries. Most health care portals, for example, don’t have strong multifactor authentication. Many medical personnel are unaware of the risks to data security (which is ironic given the strong emphasis on patient privacy). And health care organizations tend to have smaller security budgets and teams than financial services organizations.

Finally, as other industries have become more sophisticated in detecting and blocking cyberattacks, criminals have had to find new sources of data. Aside from the fact that health care institutions collectively hold information on the vast majority of the population, their IT systems also have links to financial services (e.g., flexible spending accounts with their own debit cards or health savings accounts that can have five-figure balances after two to three years).

Given that most transactions in the health care sector are conducted through vulnerable hardware and software, it’s critical for providers and payers to strengthen their cybersecurity. For an example of how to proceed, they can look to the financial services industry, where some of the most well-known examples of cyberattacks in the last decade have occurred. This turmoil led to huge operational shifts in the financial services sector, where there’s more focus than ever on consumer education, industry information sharing, and stronger forms of authentication, among other things.

Here are some specific recommendations, which are based on our collective expertise in care delivery, health systems, financial regulation, and risk management.

Update HIPAA. Like the PCI DSS rules for debit and credit card security, the HIPAA Security Rule and the HIPAA Privacy Rule are already well-known frameworks for defining how a health care organization should secure its people, systems, data, and equipment. These established methods of approaching health care security would merely need to be updated to cover new forms of cyberattacks and new tactics employed by cybercriminals.

Take stock of basic housekeeping. Care providers should apply strong encryption to all patient data and limit who has permission to access medical charts. In addition, organizations should monitor searches and downloads from their IT systems by tracking exfiltrated data such as large batch files of patient, research, financial, or other sensitive data.

Purchase insurance. Many financial services organizations have cyber insurance, and health care systems should get it, too. Since this is a relatively nascent kind of insurance, most leaders of health care organizations and boards of directors may not be aware that it exists. Significant open questions about it remain, including who should pay for such policies and whether it should protect the institution, the patient, or both. At the moment, the institutions themselves are paying, and this likely will not change in the foreseeable future.

Require training for personnel. Human error, including falling for phishing attacks,  is the leading cause of major security breaches today. Health care systems should regularly remind people of the importance of information security best practices through required training, strategic reminders, and other means.

Protect supply chains. Hospitals and health care systems have diversified supply chains and massive lists of vendors with whom they digitally interface. They are a tempting way for cybercriminals to gain access to health care organizations’ IT systems. Consequently, care providers must understand the many moving parts that are involved and protect their relationships and information exchanges with and among those groups. Third-party vendors can help assess such risks and recommend ways to minimize them.

Share industry best practices regarding cybersecurity. The FS-ISAC has made life easier and safer for the financial services sector by enabling peer financial institutions to share information rapidly and directly. Similar groups, such as the NH-ISAC, can serve as starting points for expanding similar types of discussions and planning.

Deploy strong authentication. Health care systems should use multifactor authentication or other types of consumer security that are already ubiquitous in the U.S. financial services arena. Most U.S. consumers are already familiar with this type of technology and won’t need to be significantly reeducated (a challenge the financial services sector had to deal with a decade ago).

Adopt “tokenization.” This approach, which involves substituting sensitive data with other unique but nonsensitive data, has been in vogue in the credit card world for the past few years. It is a suitable way to protect data in situations in which a consumer (i.e., a patient) is involved in some type of card-based transaction. This might involve using a flexible spending reimbursement card or paying a health care–related bill online.

Copy the chip card approach. The U.S. consumer first encountered chip cards in a significant way in early 2015, when card issuers began to widely distribute them. Much of this was done in the run-up to a shift in who was liable for fraud. U.S. consumers are now intimately familiar with how to use such cards. (The cards have been in use for many years in France, the UK, Canada, Australia, and elsewhere.) Public and private payers are discussing the merits of issuing chip cards to beneficiaries to expedite patient identification and eligibility verification.

Experiment with blockchain. The technology can record transactions between two parties efficiently and in a verifiable and permanent way. It is being used in financial services as well as other areas. For instance, after Estonia suffered a significant cyberbreach in 2007, the country became more aggressive about protecting its society and is now using blockchain to protect its citizens’ medical data. A number of blockchain-based identity-credentialing systems exist, including Guardtime, TruCred, Civic, and OneName.

Consider biometric-based security. Biometrics are increasingly being embraced as the ultimate “bio-identifier.” Start-ups such as Simprints and RightPatient are testing its value as a verification feature for electronic medical records. Perhaps the most ambitious application of biometrics is the Indian government’s Aadhaar project, which has created 12-digit unique identity numbers based on biometric and demographic information (e.g., iris scans, digital fingerprints, and a digital photo) for nearly all of the country’s 1.2 billion citizens. But underlining the sad reality that no system is totally safe, this new system has already faced difficulties: Last month, the Centre for Internet and Society reported that 130 million Aadhaar numbers and around 100 million bank numbers of beneficiaries have been leaked online.

The great boon of the digital era has been that patients’ medical data is becoming increasingly portable. This promises to make it vastly easier to collect and share data from all the players in health care in the years ahead. But, unfortunately, it also poses major cybersecurity risks.

In this new world, protecting patients’ health information in accordance with HIPAA will take a highly coordinated effort among care providers, insurers, and institutions, as well as significant investments in new tools and practices. It also will require health care institutions to look at the cyber risks across their business, not simply in one niche area (e.g., access to patient records). In the risk management world, that is known as taking a holistic approach.

The health care sector needs to adopt lessons from industries, such as financial services, that are much more advanced in their ability to thwart cyberattacks. Given how badly health care organizations are lagging others, they must make boosting cybersecurity a priority.


Rebecca Weintraub, MD, is an assistant professor at Harvard Medical School, managing director at the Draper Richards Kaplan Foundation, and an associate physician at Brigham and Women’s Hospital.


Joram Borenstein is vice president of marketing and partnerships at NICE Actimize and is an expert in financial crime, anti-fraud, consumer-identity and payments protection, risk management, IT audit, and compliance.