A new system for transferring personal health information files has not only enhanced data security, but it's taken the Ontario Ministry of Health out of the 1960's and into the 21st century, according to the Ministry's security architect, David Wilkins.
"There wasn't a system before this, this is entirely new," said Wilkins.
Wilkins said that prior to the implementation of California-based Tumbleweed's Secure Transport system, the Ministry was using couriers and a paper-based system to transfer health information.
"We've gone from the 60's and 70's into the early 2000's in one jump," he added.
The Ministry of Health transfers personal health information typically for financial, billing and claims transactions between doctors and hospitals. These transactions often contain billing information along with personal health information that must be secure and protected, said Wilkins.
In its current file transfer process, the Ministry establishes an out-of-bend security arrangement with either an internal or external partnerB to transfer digital certificates depending on the data classification (low, medium or high), Wilkins said.
The Tumbleweed system enabled the Ministry to put in security controls to manage the data transfer. A user would then have to log on to the DMZ server, provide a user name and password. Once credentials have been established the user is brought to a data store, explained Wilkins.
"There can either be a file waiting for them that they can pick up and take to their machines or their end client securely, they can drop the file off and someone else can pick it up, or it can be processed to go to someone else at that point," he said.
In addition to modernizing the process, security is also a top-of-mind concern when implementing a system responsible for handling the transfer of personal health information.
"We help companies ensure that they're compliant or meeting compliance and industry standards as well as protecting the interest of their own organization as well as that of their end points or their customers and constituents," said Tumbleweed's director of product marketing Kathryn Hughes.
One of those privacy mandates that the Ministry has to ensure compliance with is the Personal Health Information Protection Act (PHIPA).
"The security controls that are in place are relatively prescriptive from a PHIPA point of view," said Wilkins.
"Through a combination of exhaustive security controls both at the hardware and application levels, we've ensured that the personal health information of Ontario citizens is protected both during transmission and in persistence throughout all of the channels using the attendant security controls and Tumbleweed," he said.
Wilkins noted that they were able to reuse their Government of Ontario public key infrastructure digital security credentials, and imported them into Tumbleweed. They are now using them as one of the factors of authentication for protecting personal health information.
The Ontario Ministry of Health will be presenting the Ontario Information and Privacy Commissioner's (IPC) office with a security posture next month, as a result of its Secure Transport implementation.
"There's a review by IPC for every major system that goes through the government that results in PIPEDA or PHIPA exposure; so they analyze threat risk assessments and personal privacy impact assessments for the project," said Wilkins.
Currently, there is no requirement for Ontario hospitals to use the Secure Transport system, according to Wilkins.
"The Ontario hospitals generally use the Smart Systems for Health network for their file transfers, and that's under different governance than the transfers directly with the Ministry of Health and its partners."
He added there is a similar entity over at Smart Systems for Health, and the Ontario Ministry of Health is in the process of planning a secure digital pipeline with them using Tumbleweed to transfer all of the data required to go out of the Ministry of Health through Smart Systems for Health.
The Secure Transport system has been in place for about a year, said Wilkins, and since the implementation, ease of use has been one of the major benefits.
"Our operational people grabbed onto the tools quite fast," said Wilkins. "We've actually made this an infrastructure strategy for us, and it's now a Ministry standard."
However, there is still a lot of work that remains to be done on the migration end of the implementation, said Wilkins.
"Currently we have about 40 projects waiting in the wings and we have all of our legacy file transfer methods, that no longer meet the legislative requirements, that are going to be migrated into the secure file transfer service," he said.
Related content:
No excuses for SickKids, says Ontario privacy chief
Privacy complaints reach record highs, says Ontario czar
The paradox of dual power
Question and Answer with Sarah Kramer of Cancer Care Ontario
icon.
