Patient privacy in electronic prescription transfer

Abstract

Changing from paper-based systems to digital mechanisms means that personal information becomes more easily accessible and more difficult to control and secure. When the paper-based practice is in a sector such as healthcare, concerns for patient privacy protection are great. In paper-based prescribing in the United Kingdom's National Health Service (NHS), patients are responsible for protecting the privacy of their prescription information while it is in transit from the prescriber to the dispenser. The UK government has introduced a plan for future NHS reform that includes a change from paper-based prescribing to a national electronic transfer of prescriptions (ETP) system. 1 This brings with it concerns for patient data privacy and questions about the burden of trust placed on professionals in the ETP system. As recently seen in the Emilio Calatayud case in the United States, 2 systems that contain an aggregation of identifiable personal information can be abused. A similar case could result from malpractice in an ETP system. We have developed and implemented an ETP system for the UK NHS. 3 We present our system for protecting the privacy of patient data, describe how we implemented it in Java, and discuss how others can use our system for other applications both inside and outside the healthcare sector.

Information security and privacy in healthcare: current state of research

“…Financial risk: Information security failures could also lead to financial losses to various stakeholders including patients, providers, and payers arising from fraudulent care and drug charges by organized criminals (Ball et al 2003), the sale of medical identities to illegal immigrants (Messmer 2008), and fraudulent billing for services never received leading to erroneous health records and potential harm to patients (Dixon 2006). Aside such anecdotal evidences, a systematic study of financial risk is in order to guide information security policy development and inform health maintenance organizations as they move toward wider adoption of electronic health records systems.…”

End-User Privacy in Human-Computer Interaction

“…Many case studies focus on a specific market or an organization's use or introduction of a specific technology with privacy implications. For example, case studies have been used to discuss widespread privacy policy violations by US airlines [20], the introduction of PKI-based systems in banks [92], and the introduction of electronic patient records in healthcare IT systems [29].…”

Data Hemorrhages in the Health-Care Sector

“…Like medical fraud, it involves fraudulent charges and like financial identity theft, it involves the theft of identity. It is unique in that it involves a medical identity (patient identification, insurance information, medical histories, prescriptions, test results…) that may be used to obtain medical services or prescription drugs (Ball et al 2003). Leaked insurance information can be used to fraudulently obtain service, but unlike a credit card the spending limits are much higher-charges can quickly reach tens of thousands or even millions of dollars.…”