Biometric security for health

Fingerprint scanning, palm scanning, and facial recognition are biometric technologies that help make computing easier and more secure.

By Frank Lenk

Security and privacy are more important in healthcare than in most any other field. But a security system that wastes doctors’ time, or distracts them with complex procedures, is as bad as none at all.

‘Biometric’ technology may be the answer. Instead of long, cryptic passwords that must be entered over and over, biometric systems rely on quick detection of a user’s unique physical characteristics. Just as humans recognize each other by their appearance, biometric security systems can recognize individual computer users.

A lot of early work in biometrics and healthcare has targeted large U.S. institutions, such as hospitals and HMOs. But biometric security is also emerging in packaged products and smaller systems that could make life easier for doctors in small clinics or even single-doctor practices.


Fingerprints

The best-known type of biometric security is the fingerprint, which has helped catch criminals for over a hundred years. Recently, fingerprint security has become a near-ubiquitous feature on business-oriented laptop computers.

“We’ve been leveraging that technology in our commercial notebooks for five years or more,” confirms Darren Leroux, product manager, Commercial Notebooks, Hewlett-Packard (Canada) Co.

Prints are scanned with just a quick ‘swipe’ of the finger over a tiny electronic sensor, usually located at the edge of the keyboard. You ‘enroll’ yourself on a new computer by storing a finger image using several practice swipes. After that you can log in by swiping the sensor again. The software finds a match with the saved image and allows entry to the computer.

HP’s software can recognize secure internet sites via the web browser, and allow automatic login as long as your fingerprint has been validated.

Early scanners used visible light, and could be confused by cuts, dirty skin and other random factors. HP’s current notebooks use radio-frequency scanners developed by AuthenTec. These read a sub-layer of the skin, providing a far more reliable image.

For desktop use in an office or clinic setting, mouse-sized fingerprint scanners can be purchased separately. For example, Microsoft has offered both mice and keyboards with fingerprint scanners built-in. There’s a choice of brands of fingerprint scanners on the market, some selling for under $50.

While fingerprint login can improve convenience for users in healthcare, Leroux does caution that other measures, such as encryption of data on the hard drive, can be equally important for complete security. Also, the sensor does require physical contact, and will require frequent cleaning. Studies have shown that the keyboard can be the most germ-infested area of an office.


Palm Scanning

Fujitsu has been selling fingerprint sensors for over five years, but is far more excited about a more advanced biometric technology, which has the potential to be both more reliable and easier to use.

The Fujitsu PalmSecure system uses an infrared sensor the size of an ice cube, without physical contact, to scan the pattern of veins in a person’s palm. Hal Tierney, practice director, Health Industry Solutions, explains that this pattern doesn’t deteriorate over time, and hence provides more reliable identification than the skin surface.

The Fujitsu palm scanner can be used even on an unconscious subject, opening up the possibility of ambulance use. On the other hand, it does require a pulse, making it difficult to fool using a non-living facsimile. Fingerprint sensors are far easier to dupe.

For both doctors and patients, palm scanning offers the immediate advantage of not requiring physical contact. The vein image is likely to offer better reliability than a fingerprint, being at an even deeper level in the body, and less susceptible to change.

PalmSecure has much to offer for both caregiver and patient, but it’s the latter that’s been Fujitsu’s early target. Springfield Clinic, in Springfield, Illinois, has been using the technology (via “a co-developer relationship” with Allscripts), to deploy a system of kiosks at which patients can check-in for a visit, update their personal information, check health records, view their schedule for any upcoming tests or procedures, and even pay using either credit or debit card.

The clinic’s CIO, James Hewitt, reported in May that the palm technology has been a huge success, and a hit with patients. Equipment has been ordered for a full-scale roll-out, ultimately to include forty units. Compared to fingerprint scanning in kiosks, palm scanning is more secure and easier to keep clean, since scanning is accomplished without the palm coming in contact with the scanner.

Fujitsu sees many other applications for palm scanning. For example, the inexpensive sensor, which attaches via USB to any PC, could be used by patients for wireless in-home authentication. “Where the patient goes, this device has the ability to follow,” says Tierney.

In Canada, Fujitsu is positioning itself as more of an integrator than simply a seller of products. “Our intention is to be that service provider of choice,” says Tierney. While there are no PalmSecure systems operating in Canada as yet, he noted that this could change soon, with a likely pilot implementation in Western Canada.

Fujitsu currently has no plans to sell palm scanners as add-ons for computers, especially since manufacturing costs are higher than for USB fingerprint sensors. Given the concerns about security and privacy, the interest in biometric security and the benefits of PalmSecure, such units are likely to become widely available in the future.


Face Recognition

Face recognition is arguably the most advanced form of biometric identification. It’s how humans distinguish each other, after all. But it has also been very difficult for a computer to get right, given the range and variability of human features.

According to George Brostoff, co-founder and CEO of Sensible Vision Inc., the company has been developing its FastAccess face-recognition system with healthcare specifically in mind as an early target market.

FastAccess uses a standard, inexpensive webcam to track from 100 to 1,000 points of facial detail, along with software that can reliably match this information against a stored database of users. With FastAccess, login requires no effort, and, according to Brostoff, typically takes under three seconds.

This approach not only saves effort for the user, it offers some interesting advantages in healthcare.

“One of the big problems is ‘tailgating,’” says Brostoff. Regardless of who enters the password, the computer is now open, and there’s no way of knowing who is using it 30 seconds later. The traditional response has been to require more-frequent password entry. Obviously, this is frustrating for the user.

FastAccess can tell when a user walks away. It immediately locks the system until a legitimate user logs in (by approaching the webcam and being recognized). If two legitimate users swap places at the keyboard, the system can instantly switch to the appropriate account.

If a physician is with a patient but has to turn away for a moment, FastAccess can immediately lock the system, then unlock it again when needed. Add a simple wireless sensor and the system can keep the doctor logged in while the examining room door is closed, lock itself if the door opens.

Beyond ensuring privacy of patient records, the Sensible Vision system can also create an accurate audit trail. “You need to know who updated that record, or who issued that prescription,” says Brostoff. Face recognition can continuously record who’s sitting in front of the computer at any given time.

Brostoff reports that various institutions throughout the U.S. are now using Sensible Vision technology, and the company is “very close to going over one million users.” In Canada, “things continue to move slowly,” but the company has been working with provincial groups.


Total Solutions

With any of these biometric authentication systems, theoretical error rates are very low – on the order of one in a million or even less. However, real-world factors are far more important – starting with details like dirty fingers or a beard that’s been shaved off.

Even more important is how security policies are implemented in an organization. “Most of the systems we work on in healthcare tend to be semi-public,” notes Brostoff. Typically, the terminal would be in a room that’s accessible to various people, including both caregivers and patients.

“Anyone who is in possession of your computer will eventually find a way in,” Brostoff cautions. “If you block the door, they’ll just come in through a window.” The trick, in all cases, is to find the right balance of security and convenience.

It’s possible, for example, to require ‘two-factor’ login at the start of the day, using both a strong (long and complex) password and a biometric technique such as a palm or facial scan. Once the system has been unlocked, a more relaxed protocol, possibly aided by biometrics, may be adequate.

Overall, the newest biometric technologies look like a very promising fit with the needs of healthcare. In fact, Brostoff reports that vendors of medical software are becoming increasingly interested in adding biometrics to their products. “It’s going to just be a feature that’s included with their software,” he predicts. •

BACK TO THE CONTENTS LISTING

Going digital

The Albany Medical Clinic goes digital, after years of waiting for funding.

By Rosie Lombardi

The Toronto-based Albany Medical Clinic, one of Canada’s oldest full-service clinics, is making big digital moves. Started up in 1947, the physician-owned clinic has 23 family doctors and 35 specialists on staff – and has accumulated over 100,000 charts for its walk-in and family practice patients over the years.

But except for billings, almost all the workings of its extensive practice were handled manually until recently. Recognizing this situation was unsustainable, the Albany’s technology committee began planning the steps needed to move from paper to digital back in 2003.

Large clinics offering multiple specialists and on-site diagnostics have business needs not typically covered in systems designed for smaller doctors’ offices. “We offer many ancillary services, not just GPs, and we wanted to be able to link them all into one EMR system,” says managing director James Higginson-Rollins. “And we needed to ensure there would be no impact on performance, whether two doctors were accessing the system or 30.”

Many years of planning came to fruition last year when the Albany started implementing its system, component by component. Last summer, the diagnostic imaging department converted to digital imaging. Then in the fall, an EMR system developed by Edmonton-based Jonoke Software Development Inc. was implemented, and went live in December 2008.

The clinic is currently integrating its imaging and EMR systems so they can communicate with each other and plans to build links to hospitals and other clinics later this year. Last, but not least, the clinic is moving into a new building designed specifically for its growing practice in Fall 2009.


In the beginning: Funding headaches

The most difficult aspect of the venture was finding the funding, says Higginson-Rollins. The clinic’s technology committee initially assumed the clinic would use its own funds. “You couldn’t get EMR funding from the province unless you agreed to a capitation model, which led to protests that it was unfair,” he explains.

In response to criticism, the Ontario Ministry of Health (through the OMA) extended the funding in 2006 to Family Health Groups (fee-for-service practices) as well. The funds offered were limited, so funding applications were effectively treated like lottery tickets, with draws made to determine the recipients. “We didn’t win the first three draws but we were going to press on anyway. Then we got a call in 2008 to let us know we’d won some funds that other clinics hadn’t used,” he says.

IT funding for fee-for-service practices has been closed off again in Ontario, and is currently in limbo, says Dr. Douglas Mark, president of the Coalition of Family Physicians (COFP). “This on-off funding situation is a disincentive to investing in information technology,” he says, pointing out Ontario has a low rate of EMR adoption. “Some doctors may just go ahead anyway, but others will sit back and wait for the government to start offering money again.”

In the Albany’s instance, the funding was fortuitous, says Higginson-Rollins. “Waiting for it delayed our move, but it helps cover the hard costs for the equipment, software and training. I’m not sure it would cover the same volumes in smaller practices of one or two doctors, because they won’t get the economies of scale we do as a large clinic. And the funding doesn’t cover reductions in doctors’ billings when you first convert – it takes time to get back to previous levels.”


Zeroing in on the right vendor

The Albany’s technology committee went through an exhaustive process to find the right system. “We discussed the capabilities we wanted internally with our physicians, and then put together a 70-page request for proposal (RFP). It’s important to do your homework, as you will have to live with the system you pick for the next 20 years,” says Higginson-Rollins.

From the responses, the technology committee pared the list to seven promising vendors and met with them for discussions. “We made it clear we weren’t interested in being a test case,” he says.

As a result, one of their favourite vendors backed out early in the process. “They recognized their systems weren’t scalable to our level. Even though we were very interested in their product, they acknowledged they hadn’t done a clinic of our size, and didn’t want to put their reputation on the line.”

Then the real footwork began, with on-site visits to the short-listed vendors’ existing customers in Toronto, northern Ontario and New York.

“It’s very important that you speak with their clients,” says Dr. Brian Adno, head of the Albany’s technology committee. “And not just one or two people who are using the system, but as many as possible in different practices to get a true reflection of the company.”

These in-depth discussions eliminated another vendor from the list, says Adno. “Some clients of one vendor said they weren’t as happy as they were a year ago when they first implemented the system. The support vendors provide has to be consistently good – it’s not enough to be good at the outset or at certain times.”

The final selection from the last five vendors was difficult. “The conformance testing done by OntarioMD has helped to ensure most products can do an adequate job,” says Higginson-Rollins. “The differentials aren’t the features, as they all have the same sort. You aren’t comparing cars with two wheels versus three – they all have four.”

In the end, the decision came down to the look-and-feel of the system, its friendliness to new users, and positive feedback from other clinics, says Adno. “All were reasonably good – there wasn’t a really terrible system in the five, although some do certain things a bit better.

Physician feedback and consensus also played a big role in the decision, he says. “Some of our doctors absolutely didn’t like the interfaces of some of the other systems.”


Big-bang implementation

After years of careful planning, the actual implementation of the EMR system last fall proceeded with lightning-like speed. “The whole rollout from training to going live was about four weeks, not including the installation of the hardware, which took another two weeks,” says Higginson-Rollins.

The original plan was to phase in the system scheduling, billing and other components to administrative staff first, then to doctors one at a time. “The whole thing was so foreign to us – we weren’t even doing scheduling with computers before,” says Dr. Adno.

But the vendor’s project leaders persuaded them to rollout the entire system to all staff in one fell swoop instead. “They explained that there are so many interactions between different system modules – billing is linked to scheduling, for example, so doctors wouldn’t be able to see schedules unless they went live at the same time as administrative staff – that the sooner we did everything, the sooner things could be linked,” says Dr. Adno.

Vendor staff worked round the clock during this period, assembling the hardware and tweaking the software during the evenings and weekends. “It was a very intensive period for us, but it turned out fine as the rollout was compressed and didn’t drag on for months.”

Training began once the hardware was in place, and was conducted during the implementation period. “We did it in groups of three to five doctors at a time. We were seeing maybe 80 percent of our usual number of patients during those first few weeks.”

In retrospect, more training would have been beneficial, says Higginson-Rollins. “We thought we’d build in a lot of training – we built in more than the vendor recommended in our plan, but we still could have used more.” But Adno points out many doctors lacked fundamental computer skills. “We encouraged doctors to get familiar with using computers ahead of time, but not all of them took it up.”

This is a key issue, says IT administrator Spencer Kopra. “Some of our doctors are very close to billing what they were last year this time, but some aren’t,” he says. “It ultimately depends on how quickly they can adapt to using computers. It’s not necessarily issues with the system – just typing or getting used to a mouse slows things down.”

Like many family practices, the Albany’s physicians are converting paper-based files into digital cumulative patient profiles (CPP). “We’re inputting them directly into the EMR, and only scanning in documentation relating to complex care conditions,” says Dr. Adno.

To assist in this endeavour, additional support staff were hired, says Higginson-Rollins. “In the short term, we don’t expect to save money in staffing costs – in fact, we hired more to ensure we didn’t get bogged down in the initial stages,” he says. “We have staff both on the dictation and scanning side to receive materials from doctors. They have the option of inputting the CPPs themselves, or dictating them and sending them to staff to input and scan backup documents.”

Doctors who don’t have advanced skills can still go about their business, as the basic functions in the software are exactly the same as a regular chart, says Adno. “Writing encounter notes and prescriptions, ordering lab tests and so on are all the same, except you’re typing.”

More advanced templates and features are available that take time to learn but can be real timesavers later, he says. “Previous problems, current medications, allergies: you can build templates that bring all that into the notes automatically. The system can bring a lot to the art of note taking.”

Although doctors can function without understanding the intricacies of the system, it’s nevertheless important they understand the reasons for certain directives, he says. “For example, doctors need to use consistent terminology in their notes. Many have their own terms for illnesses, and they need to be trained out of those bad habits.”

Not all use the standard International Classification of Diseases (ICD) terminology, he explains. “The same illness may be called diabetes, pre-diabetes or type II. But if we try to search the database for that information later on, it can become very cumbersome if they don’t use clear, consistent terminology.”


Present and future directions

The next major step is integrating the various components of the system. “Over the next three months, we’ll be connecting the EMR to the PACS system so we can order and receive radiology reports electronically, and beyond that, we plan to connect to hospitals and other external agencies,” says Higginson-Rollins.

The Albany’s physicians are already logging in remotely from home offices or other clinics to review charts and lab reports, but the system is not accessible by patients yet. “Long-term, we plan to allow patients to schedule appointments and access their charts,” he says. “But there are workflow and access issues we need to define first. Patient access features exist in the system, but we need to have rules in place before we open it up.”

Doctors have been equipped with desktop computers rather than laptops or smaller devices such as PDAs or BlackBerries, says Dr. Adno. “At the moment, we want all our doctors on the same standard equipment. Some of them say they’d like to look at touchscreen monitors in the future. We may introduce more variations in equipment later.”

Another project in the works for next year is introducing speech-to-text capabilities to boost efficiency, says Higginson-Rollins. “We want to set up a dictation server that will allow doctors to dictate direct into the EMR. We’ll be able to send the speech file to the dictation pool where staff will review it to ensure the speech recognition software translated their words properly – their jobs will change from transcribing to editing files.”

But at present, the Albany’s physicians have their hands full learning about new features and creating CPPs, says Adno. “We’re leaving it to the doctors to decide if they want to get into some of the advanced features or just operate as basic users. If you put in the time, you do get better results, but most of us are so busy.”

An example of a time-saving feature offered by the system is the “stickie” function, he says. These are little diagrams that portray diseases; for example, blood pressure and hypertension are represented by the image of a blood pressure cuff. “You can put the stickie on the front page of the patient’s chart, and it automatically alerts you to the fact that the patient is hypertensive and puts it into a problem list,” says Adno. “With one or two clicks, you can get the readings and other underlying information. You can still do all that with pure text, but it’s simpler once you learn how to use the feature.”

“Only five months after the system went live, doctors are already getting comfortable enough with the system to ask about new, useful capabilities. “Some of our doctors are asking, ‘If only it could pick up on drug interactions.’ That feature exists in JonokeMed, but we haven’t switched it on yet. Drug interactions vary from minor issues which are really just for information purposes, to the more serious variety. If you are writing a script for 6-7 drugs, and for each drug you get 2-3 different messages about potential interactions, which often are not necessarily going to change the doc’s decision to prescribe, each one has to be dealt with before you can actually print the script. Serious interactions will still be flagged by the pharmacist as they always have been. As our doctors grow more confident, we’ll slowly switch on more of these features.”

Templates that can save time or accommodate specialist areas can be created. “ENT specialists take notes in a totally different way from GPs, so they’ll want to use their own templates to tick and bop,” says Higginson-Rollins. But this requires an investment in time designing them, he adds. “Our technology team looks at what doctors want and then figures out how to do it, either by assigning it to our internal IT staff or a request to Jonoke to custom-build templates.”

Dr. Adno believes all these teething pains will be gone by the end of 2009, and the Albany Clinic will start reaping the benefits. “I predict we’ll be back up to speed by then.” •

BACK TO THE CONTENTS LISTING

HOME - SUBSCRIBE - ADVERTISE - ARCHIVES - CONTACT US