Mr. Patient, May I See Your ID?

Patients must be clearly identified in all stages of care. The identity stakes have never been higher: The Institute of Medicine of the National Academies has reported that medication errors—including administering the wrong medicine to the wrong patient—harm at least 1.5 million people each year and the extra medical costs of treating drug-related injuries occurring in hospitals alone amount to $3.5 billion a year. This figure doesn’t include lost wages, productivity or additional healthcare costs.

Identity theft also is a growing problem, especially in larger healthcare facilities. According to the 2010 HIMSS Analytics Report: Security of Patient Data commissioned by Kroll’s Fraud Solutions, the number of healthcare facilities that reported a security breach that requires notification increased from 13 percent in 2008 to 19 percent in 2010.

Leading-edge multimodal biometric scanners aim to secure patient data based on unique traits of patients as well as caregivers including fingerprints, iris, voice, hands and faces. New authentication software can even analyze caregivers’  typing habits as well as their preferred devices and location. These measures can help ensure the right patients get the right care—and prevent fraud. 
 

A show of hands

To quickly register patients while protecting against identify theft, El Camino Hospital in Mountain View, Calif., last November deployed a biometric reader, Fujitsu’s PalmSecure. The hospital oversees two campuses spanning 54 acres, so it’s important to admit patients quickly, while making sure that the person being admitted is who he or she claims to be, says Greg Walton, CIO at the 542-bed facility.

“Fraud is frightening for us as caregivers, but if someone is trying to impersonate a patient, PalmSecure prevents that,” says Walton. The PalmSecure reader is a noninvasive device slightly larger than a coffee cup that uses ultrasound to scan the veinous structure of a patient’s palm (typically the hand the patient uses to write), making a “key” from the scan and storing the image for future admittance. The palm key is stored in an encrypted SQL database and integrated into El Camino’s registration system. This system ensures patient security because it’s extremely accurate—according to Walton, it correctly identifies patients more than 99.99 percent of the time.

Patients also are asked their birthday while being admitted to add another layer of identity protection at El Camino. “We like to assess what a patient has—his or her palm—and what a patient knows—his or her birthday—to ensure that the patient is who he or she says he or she is,” says Walton.

In instances when a patient is unconscious or not alert enough to answer the birthday question, the patient’s hand is scanned and the record is reviewed to determine who he or she is, according to Walton.

After this secure admittance, the patient goes through his or her visit with the assurance that practitioners won’t spend precious time repeatedly asking who he or she is, or looking up identity. This improves both the quality care and the patient’s experience, says Walton.
 

Same name, but all eyes are different

Federally qualified health provider Urban Health Plan, based in New York City’s South Bronx area, also uses biometrics for registration and to make sure providers are logging details in the correct medical record for each patient.

“Before an invasive exam, it’s imperative to know that the chart you’re entering information into matches the person you’re doing a test on,” says Samuel De Leon, CMO for Urban Health Plan. The group logs more than 200,000 visits annually from 37,000 patients over one large outpatient clinic and three satellite clinics, and the potential for different patients to share the same or similar name is great, De Leon says.

An iris recognition system, Eye Controls’ SafeMatch, is used to ensure patient identity and accurate charting among De Leon and his colleagues. The iris scans are integrated into an eClinicalWorks EMR, and matched to a patient’s chart.

“I had three areas in mind with SafeMatch [and] its integration into the EMR: Improve workflow, lower the risk of writing in the wrong medical record and cut down issues of potential fraud,” says De Leon. Deployed more than a year ago, iris scanning has reduced time in the outpatient clinic’s workflow: “On average, it reduces registration time by about 10 seconds,” says De Leon. “That doesn’t sound awfully helpful at first, but if you add up that we see 600 patients a day, that [10 seconds’ additional registration] time could slow you down.”
 
SafeMatch is a handheld device that uses a web camera-type imager with a low-energy light to illuminate a patient’s iris. Iris scans are stored separately from EMR data, but individual patients’ scans are integrated with their EMR and pushed out to any clinician who is trying to identify the patient to retrieve the correct record. The scan appears with a patient photo in the EMR as another security measure.

“In areas where you are asking a patient to draw blood or about to take an x-ray, you want to make sure you don’t make a mistake,” says De Leon. Because the iris is unique and the scan is attached to the medical record, when the patient’s record is accessed, only his or her medical record will pop up. This cuts down on fraud and errors caused by entering information into the wrong chart, De Leon explains.
 

Adding another layer

Positively identifying patients is often a one-step process that lends itself to biometric devices. However, using device-based options to authenticate caregivers has its drawbacks. For 10 years, physicians at Hackensack University Medical Center, in New Jersey carried RFID-equipped key fobs for positive identity and authorized access to patient information. However, physicians didn’t like to carry the fobs around, “as they seemed archaic” and some 1,100 to 1,200 lost fobs had to be replaced every year, says Ben Bordonaro, director of IT and CTO for the 775-bed teaching and research hospital.

To keep patient records secure and boost physician satisfaction, Hackensack University Medical Center in February migrated to risk-based authentication, RSA Adaptive Authentication technology, to safeguard secure remote access for the 1,500 on-staff and consulting physicians, says Bordonaro. Implementing risk-based authentication, the facility was able to save the $25,000 in annual replacement fees it had been spending on key fobs, he says.

RSA Adaptive Authentication provides another layer of authentication in addition to the facility’s user name/password security measures. When clinicians join the Hackensack system, they choose to answer three out of 15 security questions. The answers are entered into an encrypted RSA database.
  
“RSA Adaptive Authentication only replaces the [key fob-based] authentication piece of the process, not the remote access piece,” says Bordonaro. It authenticates users based on risk indicators such as device identification, geolocation, behavioral profiling and fraud data from the RSA eFraudNetwork community. Hackensack employs firewalls and Microsoft’s Intelligent Application Gateway appliance to secure remote access, interfaced with the RSA system’s encrypted storage, he says.

The software takes about three to six months to learn users’ login and computer usage patterns, Bordonaro says. “If we see a person trying to log in on 10 different machines, it’s going to prompt him or her or we can set different security levels based on that clinician’s login behavior.”

Hackensack expects to roll out Epic’s EpicCare EMR this month with RSA Adaptive Authentication fully integrated into the remote access experience. Bordonaro hopes to incorporate the system for use in a patient portal in the future.

Hospitals traditionally might be a little slow on technology uptake, but these next-generation security approaches are verifying and safeguarding patient and provider information in a growing number of facilities.