AMA Journal of Ethics^®

Hall JL, McGraw D. For telehealth to succeed, privacy and security risks must be identified and addressed. Health Aff (Millwood). 2014;33(2):216-221.

Innovative connected health technologies offer a promising solution to many of the challenges facing health care delivery in the United States. Connected health refers to a wide range of care delivery models that utilize communications technologies (sometimes referred to as telehealth and telemedicine) to help patients manage their conditions through improved self-care and to extend clinical care outside of traditional settings [1]. Health care systems that combine patient-reported information and objective data from telehealth devices and sensors can be used to create patient-centered, personalized health interventions. Although these new technologies promise to improve the quality of care, reduce costs, and increase patient satisfaction, they raise a number of ethical issues.

Hall and McGraw argue that there are significant privacy and security risks in telehealth systems that can adversely affect patients’ and clinicians’ level of trust and willingness to adopt and use the system [2]. Noting that current regulations do not provide sufficient guidance for developers or protection for users, the authors recommend that a single federal agency, the Federal Trade Commission (FTC), coordinate the creation and enforcement of comprehensive privacy and security standards. In what follows, we summarize Hall and McGraw’s key points and then discuss their implications based on our experience in creating, evaluating, and implementing telehealth systems.

Hall and McGraw begin by describing the risks that telehealth systems pose to the privacy and security of patients’ health information. Privacy risks involve a lack of control over the collection, use, and sharing of data. For example, home telehealth devices and sensors designed to detect falls may collect and transmit information on activities in the household that a patient wishes to keep private, such as substance abuse or that the house is unoccupied at particular time. Smartphone apps may share sensitive data—such as sensor data on location—with advertisers and other third parties in ways not anticipated by users. The primary security risk is that of unauthorized access to data during collection, transmission, or storage. Any transfer offers the potential for a security breach. The authors argue that, despite efforts to create secure devices and apps, many contain serious flaws, and hackers and malware pose an increasing threat to the security of telehealth systems.

Hall and McGraw explain that existing regulations are insufficient to provide strong privacy and risk protections for users. Currently, the Health Insurance Portability and Accounting Act (HIPAA) contains the primary set of regulations that guide the privacy and security of health information. HIPAA requires that identifiable health information be encrypted so that only those authorized to read it can do so. HIPAA, however, applies only to “covered entities”—health care providers and insurers—not to patients. The Food and Drug Administration (FDA) regulates medical devices but not consumer-facing devices and apps, focusing on technical issues related to the security and integrity of information. In this way, the FDA ensures patient safety but not patient privacy; hence, Hall and McGraw propose that Congress authorize a single federal agency, the Federal Trade Commission (FTC), to create and enforce telehealth privacy and security regulations.

The FTC has expertise in privacy and technical issues related to security, in creating and enforcing consumer protection laws, and in supporting innovation. The authors recommend that the FTC enlist stakeholders and manufacturers in creating voluntary codes of conduct for protecting privacy and security and provide a “safe harbor” or protection from legal action to entities that operate under these codes. If no agreement were reached on voluntary standards, the FTC would exercise its authority to create and enforce federal regulations. Hall and McGraw conclude that giving the FTC this two-part authority is the best option for creating comprehensive privacy and security standards that will ensure telehealth systems are trusted and adopted [2].

Discussion

Hall and McGraw provide a useful description of and suggested resolution for the privacy and security challenges facing the development of successful telehealth systems, but there are several caveats to accepting the authors’ recommendation for an FTC solution.

First, there is the possibility that establishing voluntary standards or new federal regulations aimed at telehealth systems may not significantly improve users’ level of trust, even if such steps improve privacy and security protections. Increased reporting of security breaches, which are almost a daily occurrence, may have contributed to a general sense of distrust in electronic transmission and storage of personal information that may not diminish with regulations directed solely at telehealth. For example, as this paper was being written, a cyber-attack was launched with the “Backoff” malware—first used in a widely publicized 2013 theft of information from Target—to steal consumers’ payment card information from as many as 1,000 businesses [3]. What may be needed is a comprehensive set of privacy and security standards and regulations not exclusively for health data but for all consumer data that is collected, stored, and shared electronically [4].

Second, many people remain interested in using telehealth systems despite their concerns about the privacy and security of their health information [5]. A California Health Care Foundation survey in 2010 found that, although 66 percent of adults thought that there was a need to address concerns about the privacy of their personal medical information [6], they agreed with the statement that “we should not let privacy concerns stop us from learning how technology can improve our health care” [7]. In addition, more than half of the adults surveyed were interested in using technology to monitor their health and almost half were interested in using telehealth devices to send health information to their doctors [6].

In fact, people may be more willing to accept privacy risks when they perceive that the health benefits of using telehealth systems outweigh the risks involved in sharing their information. For example, a study of focus groups on technology’s future role in improving health care management found that healthy participants were more concerned about privacy than participants with chronic conditions [8]. In general, for most people, the convenience of rapid access to information and communication with clinicians outweighed privacy concerns. Another example of a privacy trade-off comes from a study we are conducting at the Center for Connected Health involving asthmatic teens’ use of Facebook to share their experiences living with asthma and to improve self-management and medication adherence. To ensure some level of privacy in sharing identifiable health information, we are using a private Facebook group accessible only to study participants. Despite the potential privacy risks, legal guardians give permission for teens to participate, and teens are active in the group (unpublished data, study in progress).

A third caveat is that, despite the potential for telehealth systems to automate some tasks and deliver care outside of the clinic, patients’ trust in their clinicians will play an important role in their adoption of telehealth technologies. Such trust is built on good patient-physician communication [9] and contributes to improved treatment adherence and continuity of care [10]. Physicians should discuss the benefits and risks of using telehealth and other technologies as part of a patient-centered care plan [11]. Due to the rapid pace of innovation it is unlikely that voluntary codes and regulatory agencies can provide guidance on all situations and new technologies [12]. Therefore, physicians will need to stay informed of their institutions’ privacy and security policies and discuss these with patients as part of their ethical obligation to ensure patient-physician confidentiality.

Finally, to encourage patients to adopt and use telehealth systems, clinicians must do so first. At the Center for Connected Health, we have seen that clinicians’ use of telehealth is a key factor in telehealth systems’ success in improving clinical outcomes. For example, among diabetic patients who were using a text messaging program that delivered personalized coaching to promote physical activity and blood glucose control, those patients whose physicians did not log in to view their results were more likely to stop using the program than patients whose doctors did log in to view the results [13]. Therefore, the integration of telehealth systems into clinicians’ workflows and standard of care will be essential to patient adoption and sustained use of telehealth systems and, ultimately, to their success.

Conclusion

Concerns about the privacy and security of telehealth systems may adversely affect people’s trust in telehealth and threaten the ability of these systems to improve the accessibility, quality, and effectiveness of health care. More comprehensive standards and regulations may be needed to ensure strong privacy and security protections not only for telehealth but also for all electronic consumer information. But many people, especially the chronically ill, believe the benefits of using telehealth systems outweigh the risks. Physicians can contribute to the success of telehealth by creating patient-centered care plans that effectively use telehealth tools and make sure patients are aware of potential privacy and security risks.