WHAT’S INSIDE
NEWS, REVIEWS, CLINICAL DATA, mHEALTH APPLICATIONS
The
Journal of mHealth The Global Voice of mHealth
June 2015 | Volume 2 Issue 3
mHealth Security
Securing Information on Mobile & Digital Health Platforms INSIGHT Cyber5security
Steps for mHealth Developers
ARTICLES
REGULATION
mHealth Technology Security
European Cybersecurity Requirements for mHealth Apps
mHealth Technology Security: Securing Information
mHealth Technology Security: Securing Information on a Digital Health Platform By Peter Ohnemus Health data is particularly sensitive personal data. As an industry, we must be focused on providing top privacy and security for the global mHealth market. Users trust us with their health data for the benefits of the digital healthcare solutions that we provide to them, in order to drive consumerization of healthcare forward. The outcome of digital health will only be trusted, if, the highest possible security and privacy is provided. The problem is that every time there is a breach in security, this trust is eroded. dacadoo is a global provider of digital Health Scoring and Lifestyle Navigation. We have been developing our Health Score Platform, since 2010, where we today have users in both, corporate healthcare, digital health providers and digital life and health insurance companies. They all trust the Health Score as the future digital health outcome supporting any device, anytime, anywhere. For dacadoo, security has always been at the forefront of our thinking, and never a mere afterthought. In this article, we outline key principles which we have developed and applied over the course of our history. The Law First and foremost, the law must be observed. dacadoo is a Swiss company. In Switzerland, the Datenschutzgesetz (Data Protection Law; DSG) applies. In this law, health data is classified as particularly sensitive data. This classification implies, among others, that users have to explicitly opt-in to any processing of their data, and that the database operated by dacadoo is registered publicly with the Federal Data Protection and Information Commissioner. In addition, the DSG mandates that dacadoo take adequate measures to protect the data. dacadoo has, since day one, decided not to license or resell any data. This is our clear advantage in the market, as people seeing their healthcare data being treated very seriously by dacadoo. In order to earn and maintain the trust of our users and partners, we have adopted a holistic approach to data security that touches on everything we do. Applicable laws vary on a countryby-country basis. Our holistic approach to data security has focal points on the right level of transparency, secure technology and best quality processes in the market. Transparency We are transparent and clear about what we do, and do not do, with user health data. As previously mentioned, dacadoo does not license or sell any end-user data – we also do not provide any advertising on the platform. As a consequence, our services
cost money. This money is paid by our users, or by third parties such as their employers, insurance companies or healthcare operators. They all have key interest in providing the best possible mHealth service and digital outcome to their clients in order to keep health conditions at the best possible level and costs as low as possible. In cases where a third party is the payer, we only provide anonymous statistics to the third party and of course inform the end user about this (opt-in). The personally identifiable data remains in the exclusive control domain of the end user/dacadoo client at all times. We give transparent control to the users. Users determine how their health data is shared. For example, we enable users to share their health data with health professionals if they desire to do so. For less sensitive data, such as workouts and the aggregate Health Score, we let users decide whether they want to keep that data private, or share it with their friends, or their groups. Or even share it publicly, on platforms such as Facebook and Twitter. This is exclusively decided by the end-user of dacadoo’s Health Score and Lifestyle Navigation Platform. Technology On the technology level, IT security starts with a secure infrastructure. Rule number one is obviously to use the most trusted Continued on page 22
The Journal of mHealth
21
Connections that Could Transform the Future of Healthcare Continued from page 21
data centers that provide adequate physical access control and privacy protection. The physical access requirement is extended by the use of VPN technology for accessing backend systems, and by requiring physical access tokens for remote access. On the network level, we use state of the art firewall technology to segregate our infrastructure into multiple zones. On the application level, we additionally apply state of the art Web Application Firewall (WAF) technology to protect our applications and services against attacks aimed at software errors, such as injection attacks. In developing our solutions, we apply best practices of software engineering, such as continuous integration and code reviews. In the software architecture of our solutions, we aim at concentrating security logic, for example in a segregated security or account server that receives special protection within a highly secured environment. Another key consideration in IT security is sourcing. No solution of relevant complexity is built entirely in-house these days. When selecting solution components, we carefully evaluate their providers with regard to their approach to security. We clearly make sure we stay on top of things in case there is a development relevant to security and privacy of our global user community. Process dacadoo has since its early beginning worked with key clients in the global healthcare industry in order to provide the best possible and professional processes in the industry. This is obviously including but not limited to background checks, policies regarding access, change control, 3rd party processes, such as media management. Regulatory Developments Regulation is at a tipping point from where it can go in two directions. In the direction we favour, regulation specifies responsibilities with regard to the protection of health data, and provides for
penalties in cases where a company fails to comply. In the adverse direction, regulation specifies what a company is allowed to do with health data and what it is not allowed to do. We do not support such regulation as it inhibits innovation and keeps the health industry in the analog age. An analogy to this would be outlawing hammers as they have occasionally been used to kill people. Luckily, our law does not outlaw hammers; it simply states one is not allowed to kill people. This is sensible. It is a statement of trust towards human beings. It is now up to all of us in the global mobile health industry to prove that we are worthy of trust, when it comes to processing healthcare data. The digital and mobile healthcare industry is forecasted to grow very rapidly over the coming years and it is up to the industry to find the right level of law, transparency, technology and processes that both, the regulatory authorities and the end-users of mHealth and digital healthcare infrastructures will fully trust. dacadoo is taking an active lead in this important movement and industry. About the author Peter Ohnemus is Founder, Chairman, President and CEO of dacadoo ag and dacadoo americas, inc. Peter has been involved in high-tech and bio-tech investments over the last 25 years. Peter Ohnemus/Network Capital Holding, his private investment firm, is currently invested in high-tech, bio-tech and sustainable energy/infrastructure startups. Peter co-founded ASSET4, the world’s leading provider of extra-financial information, in 2004, which was sold to Thomson Reuters in November of 2009. The dacadoo mobile health engagement solution enables individuals to track, manage and benchmark their health and wellbeing in an easy and fun way on their smartphones. For more information see Peter describe the dacadoo solution at https:// www.youtube.com/watch?v=krcUtW-Cx_E n
Connections that Could Transform the Future of Healthcare How the Internet of Things can empower care-givers and patients in a new, data-rich system By Jeroen Tas, CEO, Healthcare Informatics Solutions and Services, Philips In Britain, they called it a ‘major incident’. Hospitals across the country have been so inundated with patients that there was a ‘threat to the health of the community’ because proper care could not be administered by an overstretched staff. In one January week this year, more than 105,000 people were admitted into
22
June 2015
hospitals in England, one of the highest figures on record. That’s 20,000 more than the same week last year. The healthcare system in the UK is not the only one under scrutiny – there have been protests this month in France over reform plans and the Dutch government was criticised at the end of last year over a new healthcare bill. These are certainly the results of com-
plex situations and technology is by no means a panacea on its own, but it can and it should play a major role in helping to resolve these issues in the longer term. The Internet of Things (IoT) offers the potential for a more connected healthcare world, in which new technologies allow organisations to ensure the patient experience is not so fragmented and reliant on face-to-face care. There is a need for a stronger and more meaning-
Crowdsourced Tool for Depression
Crowdsourced Tool for Depression Peer-to-peer application outperforms conventional self-help technique for easing depression, anxiety.
“Could people get clinical benefits from it? That’s hypothesis one,” he says.
Researchers at MIT and Northwestern University have developed a new peerto-peer networking tool that enables sufferers of anxiety and depression to build online support communities and practice therapeutic techniques.
“Hypothesis two is, ‘Will people be engaged and use this regularly?’” Morris adds. “There’s a lot of great work in building web apps and mobile apps to provide psychotherapy without a therapist in the loop— as self-guided programs. There’s almost a decade of research showing that these things can produce really profound improvements for people. The problem is that, once you release them out into the wild, people just don’t use them. The way we designed our platform was to really mimic some of the interaction paradigms that underlie very engaging social programs.”
In a study involving 166 subjects who had exhibited symptoms of depression, the researchers compared their tool with an established technique known as expressive writing. The new tool yielded better outcomes across the board, but it had particular advantages in two areas: One was in training subjects to use a therapeutic technique called cognitive reappraisal, and the other was in improving the mood of subjects with more severe symptoms. “We really wanted to see two things,” says Rob Morris, who led the work as a PhD student in media arts and sciences at MIT. After graduating in February, Morris is now commercialising the technology through a New York-based company he co-founded, called Koko.
On that score, too, the results of the study were encouraging. The average subject in the control group used the expressive-writing tool 10 times over the three weeks of the study, with each session lasting about three minutes. The average subject using the new tool logged in 21 times, with each session lasting about nine minutes. Morris; his thesis advisor, Rosalind
Picard, an MIT professor of media arts and sciences; and Stephen Schueller, a clinical psychologist at Northwestern, describe the study in a paper appearing in the Journal of Medical Internet Research. Morris, who had majored in psychology as an undergrad at Princeton University, initially enrolled in a PhD program in psychology in California. But he concluded that a traditional psychology program wouldn’t grant him enough latitude in researching the therapeutic potential of information technology, a topic that quickly captured his interest. So he applied instead to do graduate work in Picard’s Affective Computing Group, which specifically investigates the intersection of computing technologies and human emotions. “I was at MIT without an engineering degree and really trying to race to learn computer programming,” Morris recalls. He found himself spending a lot of time on a programmers’ question-and-answer site called Stack Overflow. “Whenever I had a bug or was stuck on something, I would go on there, and almost miracuContinued on page 29