How Strengthening Data Chains of Custody Mitigates Risk and Protects Patients
Medical devices have become increasingly complex as technology evolves, and the sheer number of these devices now being worn or implanted has grown exponentially over the past few years. There are currently over 500,000 different types of smart, connected medical devices in use that have the ability to collect, share, or store private patient data and protected health information (PHI)(1). Additionally, the number of devices and the vast amount of data they generate is set to skyrocket in the near future.
As the number of smart devices in the field increases and the data they produce grows in both volume and complexity, companies must ensure their data strategy and digital infrastructure allows them to manage their product and consumer data chains of custody more effectively. The rapid growth of the Internet of Medical Things (IoMT) devices, makes the case for manufacturers to strengthen data chains of custody across key imperatives including:
- Patient privacy – How manufacturers ensure data privacy, security, and governance across consumer and IoMT device data
- Product traceability –How manufacturers trace and identify product lineage and histories with respect to performance to design criteria (covered in detail here)
In this blog, we’ll examine some of the challenges facing medical device manufacturers in approaching data privacy, security, and governance in protecting patient privacy. We’ll also explore why manufacturers must be able to track, manage, securely store, and share patients’ protected health information (PHI) safely, responsibly, and securely. Finally, we’ll look at why having intelligent systems or platforms in place is critical for medical device manufacturers to protect patients in today’s data-rich environment.
Why Data Privacy And Compliance Are More Important Than Ever Before
As technology has evolved, regulations have moved to keep up with the growing complexity of the digital landscape as well as public demand for privacy. The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to ensure the integrity of patient health information is protected while still allowing for the flow of health information required to provide the highest possible quality of care (2); but as healthcare became increasingly digitized, legislation like the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 was needed to “address the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules”(3). Finally, General Data Protection Regulation (GDPR) was introduced by the European Union in 2016 and broadly governs the protections around personal data usage.
The regulatory framework set out by these three pieces of legislation means that compliance is the core operational consideration for all medical device businesses and the penalties for non-compliance can potentially total millions of dollars. How companies manage the internal handling of patient data, and the strength of the systems that they have in place for continual compliance, are critical to both operational efficiency and financial health.
Governing Protected Health Information Within A Complex, Data-Rich Landscape
The internal handling of data, as well as the controls around how data is used and stored, has become even more important as the number of medical devices grows and the use cases for the information they produce becomes more complex and nuanced. MedTech companies must now shift to strategies that allow for vast amounts of data from diverse devices to be ingested, secured, aggregated, and analyzed at scale. As any business in the sector knows, this must also be done in real-time to provide accurate insights into performance that can drive key, proactive decision making.
A compliant, safe way to protect PHI and allow for controlled sharing with stakeholders is a crucial driver to modernize health care more generally, and to support the digital transformation that fuels future business growth. Businesses in the space need a data platform with centralized governance and security compliance administration and management functionality at its core. Private patient data must be centrally governed for greater visibility while being securely stored.
Centrally controlled, intelligent data management solutions which have consistent standards around security, administration, access control, transmission authorization, and integrity help medical device manufacturers better navigate the growing complexity of the data rich world of IoMT. Those firms with the right digital infrastructure in place are ideally positioned to take advantage of the rapidly growing adoption of smart medical devices.
Data Security Is Paramount Within The MedTech Space And Risks Are Evolving Quickly
Recent research from IBM and the Ponemon Institute estimated the average data breach cost for healthcare companies in the United States was over $6.45 million while the average cost per individual record is as high as $150(4). The average number of records lost in a data breach is a staggering 25,575 and it can take as long as 279 days for a business to identify and contain a breach if they do not have sufficient, proactive security measures in place. (5)
The costs of large-scale data breaches have been trending upwards as cybersecurity threats evolve and adapt taking advantage of businesses that do not have secure networks and infrastructures. Fines and associated costs, not to mention long-term reputational damage, caused by significant data breaches can be a death-knell to companies within almost any industry, but this is especially true of firms within the medical sector.
With HITECH and HIPAA regulations mandating penalty violations for data misuse and security breaches of up to $50,000 per violation, the potential costs of failing to secure and safeguard private patient data is clear and firms must ensure compliance is a core business priority. System and network security is paramount to mitigate these risks and protect patients’ privacy.
How Cloudera Solutions Can Help Firms Forensically Map, Trace, And Securely Share Data
In order to meet the challenges of patient data, security, and responsible governance in a rapidly changing digital landscape, it is imperative that businesses invest in intelligent solutions that can classify and tag massive data sets to the privacy and security requirements. The Cloudera Data Platform (CDP) for cloud, hybrid or on-prem data provides full visibility on data lineage, which is critical in a sector that is incredibly data rich and where the potential penalties for non-compliance are increasingly harsh. By shifting towards an approach that leverages the security and flexibility of a centrally managed data platform, like CDP, medical device manufacturers can ensure that only specific parties have access to private data and can implement a secure data chain of custody strategy that can be validated on an ongoing basis.
CDP and Cloudera DataFlow (CDF) combined with the power of Cloudera Shared Data Experience (SDX) offer MedTech companies an easily manageable, centrally controlled and exceptionally secure platform to help ensure that data governance, security, and traceability are central to business operations. Data assets can be monitored in real-time and an advanced security framework underpins Cloudera Data Platform, ensuring the highest possible standards drive data administration, authentication and perimeter security, authorization, audit and data protection protocols.
With Cloudera Data Platform, authenticated users can create and view multiple dashboards, reports and multi-function analytics which means stakeholders get higher value insights from device data too. CDP also helps deliver more intelligent data into how devices are functioning, how patients are benefiting, the current status of any given device, and how and why excursions occur. Data classifications and notifications on group data based on different characteristics provide companies with a more holistic view of data lineage, allowing them to track and change issues at the most granular level possible, tracing faults and known issues to specific conditions or even manufacturing locations.
Cloudera DataFlow is a real-time streaming analytics platform to help providers easily capture, combine, enrich, secure, and drive analytics from real-time streaming data feeds from bedside sensors, bio-monitors and other connected healthcare IoT devices, at scale. These sensor data readings can be analyzed in real-time and predictive insights can be produced instantly. Data from IoT sensors can also be stored, analyzed, and used to build machine learning models to predict patient outcomes and the next best course of action. Additionally, with faster, higher performance SQL analytics and real-time stream processing and data management, businesses can more easily connect the dots between a failure in the field and how and where a device was made. They can mitigate the impact of product failures, differentiating more quickly between faulty devices and non-faulty ones, meaning less downtime, risk exposure, and fewer potential associated legal costs.
Finally, Cloudera’s Shared Data Experience ensures consistent data security and governance across the data lifecycle and across all clouds and data centers while mitigating risk and costs, including:
- Govern enterprise data platform as a single application and from a single pane of glass
- Migrate healthcare data easily whilst maintaining security and governance policies between on-premises and the public or private cloud
- Gain audited lineage trails with built-in healthcare provenance, even for transient workloads
- Maintain visibility and control via a management console for all data, including PII and PHI
- Automatically identify and tag PII and PHI data, and handle it consistently
- Enable an enterprise-grade, end-to-end experience that supports and promotes HIPAA compliance
Cloudera enables medical device manufacturers to close the loop and manage all data from a single platform. Discover more about how we can help implement a data chain of security strategy for your business that significantly increases data protection, maximizes the value of even large data sets and helps drive greater operational efficiency across your organization.
Click here to learn more about Cloudera Data Platform and how it can help you achieve Data Chain of Custody.
(1) Deloitte, ‘Medtech and the Internet of Medical Things,’ https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Life-Sciences-Health-Care/gx-lshc-medtech-iomt-brochure.pdf
(2) U.S. Department of Health & Human Services (HHS), Summary of the HIPAA Privacy Rule, https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
(3) U.S. Department of Health & Human Services (HHS), HITECH Act Enforcement Interim Final Rule, https://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html
(4) IBM Security, Cost Of A Data Breach Report 2019, https://www.ibm.com/downloads/cas/ZBZLY7KL
(5) Ibid
Editor's Choice
