By Dr. Ann Cavoukian
Nothing disappoints me more than news of yet another lost unencrypted USB key or laptop containing personal health information. Unequivocally, there have been far too many breaches of this kind, most of which could have easily been avoided by utilizing well-established privacy and security measures and building in Privacy by Design (‘PbD’)best practices.
The numbers are startling. In the U.S. over a 20-month period ending June 2011, there were 288 notable breaches impacting millions of Americans – with about a third involving mobile devices. Here in Ontario, there have been a number of high-profile breaches over the past two years impacting well over 100,000 people.
Some of these breaches have been in the health research area, as researchers have become increasingly reliant on laptop computers, memory sticks and other mobile computing storage devices, to collect and store personal information.
Concerns over the privacy and security of personal health information used for research purposes should not undermine the resounding fact that health research is extremely important, and high quality research depends on the availability of high quality information.
A bulletin by the World Health Organization concluded that health and biomedical research is an investment that can produce tangible benefits such as a healthier population, economic advantages through commercial development and direct cost savings to the health care system.
Some of the personal health information that is used for research purposes comes directly from individuals, but most of it is acquired indirectly from health care providers. However our personal health information is recorded and transported, whether on paper, a computer, or a USB key, sufficient safeguards must be in place to protect it from unauthorized collection, use and disclosure.
As highlighted in our new paper co-authored with the Children’s Hospital of Eastern Ontario: “Safeguarding Personal Health Information When Using Mobile Devices for Research Purposes,” many safeguards are quite simply common sense. First and foremost, whenever possible, the storage or transporting of personally-identifiable health information on mobile devices should be avoided altogether. If this is not possible, then the device should be protected with a strong password, ideally 14 characters combining letters, numbers and symbols.
As well, personal health information on mobile devices should always be encrypted — a process in which ordinary text or data is turned into an unintelligible stream of seemingly random symbols. Only authorized people should have access to the encrypted information, controlled by a digital key, such as a strong password (separate from the login password), or a separate hardware key such as a fingerprint key.
In Ontario, health information custodians, researchers and ethic boards all have legal obligations to ensure that safeguards are in place to protect personal health information that is collected, used or disclosed for research purposes.
This obligation should go a step further, by taking on a comprehensive and proactive approach to safeguarding our personal health information. Privacy by Design is the practice of embedding privacy directly into the design specifications of various technologies and business practices, to prevent privacy breaches before they occur, rather than prescribing remedial actions.
The research community should strive to ensure the principles of PbD are incorporated into the design and implementation of all research-related practices. Find out more on protecting personal health information on mobile devices at our Stop Think Protect resource centre.
The goal is to make privacy the default setting for our electronic health information systems — a win/win strategy which should help ensure that privacy breaches become a much rarer occurrence. I look forward to that day.
