How far can you trust the institutions and organizations that hold your sensitive medical information?
Earlier this month, the Canadian government fined the manager of a pharmacy for using the provincial Drug Information System to snoop on the confidential medical history of friends, family, and coworkers. A few weeks earlier, the Orlando Orthopaedic Center reported that a misconfiguration in its servers resulted in the exposure of more than 19,000 patient records for about two months.
Health-related data breaches are among the most damaging security incidents, and they happen often and everywhere. But what makes the healthcare industry unique is the degree to which internal actors are responsible for threats. “Healthcare is the only industry in which internal actors are the biggest threat to an organization,” found a recent Verizon study.
Part of the challenges of securing health data has to do with how fragmented the industry is. Take medical research. Every study can possibly involve hundreds of institutions, thousands of researchers, and the health information of millions of people. When sensitive health data changes multiple hands in the process of medical research, there are many ways things can go wrong; data breaches and the illegal use and monetization of personal data being two of the most obvious.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
The fear of running into troubles like these seriously limits innovation and expansion of medical research activity. Researchers at Philips are exploring the use of blockchain in establishing trust and accountability across medical research ecosystems. This will hopefully help prevent security incidents and lay the ground for improving innovation and cooperation in ways that weren’t possible before.
Can hospitals trust researchers?
Researchers rely on data from hospitals, clinics, and other health institutions to do their work. The question is, can these organizations trust researchers with the data of their patients? “Quite often, what we see is that there is an implicit trust relationship between a researcher and a hospital,” says Mark Hennessy, lead researcher at Philips Research. “They will simply turn up at the hospital and ask for data. The data will be de-identified and put on a USB stick and handed to the researcher.”
This works in some cases because that trust already exists between researchers and hospitals. Often, these exchanges happen between individuals and without any logs or records made of the data that’s being handed over. “While the data is often de-identified, we know that if you pooled enough data and you don’t govern that data well enough, it’s possible to re-identify individuals,” Hennessy says.
That’s something hospitals would want to avoid, because it would put them in violation of privacy rules and subject them to penalties and fines, depending on the jurisdiction they’re in. They also have to make sure that they can track the information as it changes hands so that they can prevent data theft and other security incidents.
The most important way to avoid such problems is to keep a record of these exchanges. “What we’re trying to do is to strengthen the responsibility and the accountability between the institutions for the data that is exchanged,” Hennessy says.
As Hennessy explains, institutions that share health data usually trust each other. They don’t think anyone will intentionally make ill use of the data. But they also acknowledge that accidents can happen. “It’s at that level they want to establish trust, that something doesn’t fall between the cracks,” he says. “If facts can be established, they will not be left with any grey areas in relation to doing these exchanges.”
What is Philips doing?
Philips Research is working on an exciting project that Hennessy calls “verifiable data exchange.” “This is basically the ability for researchers in a network of hospitals and universities to request data that suit a need for research,” Hennessy says.
The process will revolve around three disciplines: anonymizing data, requesting data and fulfilling requests. The aim of the project is to record all those exchanges and the identity of the people in the institutions doing those exchanges. “This is what we call ‘verifiable data exchange’ because you’ve got the actual audit trail of the request and the fulfillment of the request for data recorded,” Hennessy says.
Blockchain will be the technology that supports the audit trail of data exchanges. Philips researchers believe that the transparent storage of data exchange between the involved parties will create a system of shared risk and responsibility.
Why blockchain?
Establishing a system of auditing data exchange between different parties sounds like something that could perfectly be achieved with the traditional centralized client/server model that governs most online services. Which begs the question, why did Hennessy’s teamdecide to use blockchain? This is especially important since in the past few years, the blockchain landscape has been marked with failures and scams, and the market is being viewed with no small amount of skepticism.
“A lot of it comes down to trust and transparency,” Hennessy says. “While you can trust a centralized server for storing the logs of each exchange, what we’re exploring is whether we can enhance that trust by decentralizing the storage of the logs between all the participants in a network.”
In case you don’t know, blockchain is a distributed ledger, a database that replicates information across a network of independent computers instead of storing it on a centralized server or cluster of servers (read TNW’s complete blockchain explainer here). No single gatekeeper controls the information stored on the blockchain and all the parties in a network can transparently verify its information.
Blockchain has also proven to be more resilient against cyberattacks that target centralized systems. “If you ever enter a situation where there might be a dispute, it’s possible for each of the stakeholders to have an independent-but-coordinated set of logs that will tell them what has happened in reality rather than trusting a third party or one of those stakeholders to store the logs in a tamper-resistant way,” Hennessy says.
A research project that will expand in the future
In this regard, Philips Research is currently exploring the use of a private or consortium blockchain, which will be available to a limited number of parties. In the research space, the blockchain will create a decentralized audit trail to enhance trust and accountability between the hospitals, clinics, universities, and researchers that already work together.
New participants will have to be vetted and confirmed before being admitted into the network. “We’re in the research phase and having a lot of interactions with potential customers,” Hennessy says. “We’re trying to see if such a proposition around verifiable data exchange could be adopted by them. [Our customers] see a lot of potential for improving trust in data and accountability for the data that’s exchanged.”
Down the road, the model can grow to become a reliable public network of health data sharing. “In the longer run, just like the internet itself developed from intranets to the full public internet, you would have potential to connect into a more public network,” Hennessy says. “But right now we’re trying to experiment and bring along institutions that are usually quite conservative given the regulations around how people’s data is handled.”
Strong leadership
Healthcare is one of the very active domains for blockchain, which means Philips isn’t the only company pioneering this innovative new market. On the one hand, they will be facing a slate of blockchain startups that are trying to disrupt different parts of the healthcare industry, while on the other, they’ll be going up against tech giants such as Google, which has both a blockchain project and an active presence in the health sector.
“We need to understand what we’re good at and where the genuine opportunities are,” Hennessy says. “We’re always looking at startups in general— not just in blockchain startups— to understand where they’re being successful, whether they’re disrupting a market or if they’re simply solving an existing problem using the technology.”
While startups often have interesting ideas, without a proven track record or any experience working with health institutions and organizations, they will have to face the challenge of earning the trust of entities that will be using their technology.
On large tech companies, Hennessy acknowledges that companies like Google have “a large war-chest of money” to try break into new areas. “I think they can have quite a large impact on the more personal health space,” he says. “But they will have certain challenges, especially in the clinical space.”
Google has only started working with health institutions in recent years and is still facing challenges. For instance, last year, DeepMind, a Google subsidiary, fell into legal trouble over acquiring health data from the UK’s National Health Service. One year later, experts are still concerned that giving the company leeway into the health space can have dire consequences for consumers.
Philips has a long history in developing software and innovations in the health tech industry. Its developers have long been working with health organizations and hospitals to develop better health management processes and enhance diagnosis and treatment of diseases. And the company is already testing the verifiable data exchange paradigm with a network of hospitals and universities.
“Where there’s deep clinical insight and understanding required, I think Philips will continue to outpace the likes of Google and Microsoft and others trying to do data science in the health space in general,” Hennessy concludes.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
