Electronic Patient Data Confidentiality Practices Among Surgical Trainees: Questionnaire Study

All basic and higher surgical trainees attending a Northern Ireland Association of Surgeons-in-Training meeting were invited to complete a structured questionnaire designed to evaluate the confidentiality protection measures taken when handling electronic patient data.

Chi-squared testing (Fisher's exact test when expected cell values < 5), and Mantel-Haenzsel common odds ratio analysis were used to analyse confounding factors including differences related to grade and time elapsed since qualifying from medical school using the Statistical Package for Social Sciences (SPSS) v.12.0 for Windows.

We observed that nearly all surgical trainees stored non-anonymised personal data relating to patients on computers, but that only one was registered with the Data Protection Act, 1988. Under UK law, it is likely that any doctor or health-related practitioner who has input into the analysis, presentation and publication of a piece of research or audit, should be registered with the Information Commissioner.2 Further details regarding notification or registration may be accessed at <www.informationcommissioner.gov.uk>. Under European Parliament and Council Directive 95/46/EC of November 1995 (Protection of Personal Data), data controllers must, by law, implement appropriate measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access.3

Four key areas of data protection were addressed by this study, namely user authentication, the securing of data by encryption, electronic data shredding and internet security.

Of particular concern in this survey was the failure to implement simple password logon requirements. In our study, portable devices (hand-helds and laptops) were less well protected than desktops at home or work, yet these devices are most likely to be mislaid, stolen, or left unattended in the operating department changing room, or at a patient's bedside.4 The requirement of communal desktops at work to force a password logon in 60% of cases is probably a reflection of a centralised IT administration policy. Even so, this proportion should be 100%. Where used routinely, passwords were too short, and frequently did not contain both letters and figures.

One solution is to adopt biometric logon technology such as a fingerprint. Fingerprint sensors can be embedded in the mouse or keyboard of the computers, and are available as USB plug-in devices. Biometric logon systems are not fail-safe, however, and we have experimented with techniques that can be used to fool fingerprint sensors. In the NICR, we were able to ‘resuscitate’ fingerprint images, left on the sensor's surface as fat deposits, by breathing on them. Wiping the sensor clean after every use is recommended.

In our study, only one respondent routinely encrypted sensitive files, and the majority of trainees did not know how to. If unauthorised people by-pass the username, password and biometric logon to gain access to encrypted file, it can not be deciphered without first obtaining the primary user's private key. If a different user needs to access the data for business continuity, a recovery agent can decipher the file to make it readable by the new user, with appropriate authorisation.

Electronic data shredding is crucial for the preservation of data confidentiality. Confidential data stored on a disk disappear only when the disk is physically destroyed or new information is written over the file. Overwritten files can still be read by specialised techniques, such as those used by data recovery agencies, companies and researchers. True electronic data shredding must be achieved by more complex overwriting procedures. In the NICR, we have designed and developed a simple piece of software that achieves that target, in accordance with guidelines developed by the University of Auckland, New Zealand.5 The software specifies the number of deletion ‘passes’ they wish to perform to ‘clean’ a disk. Removable disks may be then reclassified as ‘safe in the internal environment’ or ‘safe to be re-deployed’.

Alarmingly, in this study, we observed that a substantial proportion of trainees sent sensitive, non-anonymised, personal data over the internet, through non-secure servers. Nearly all machines storing sensitive data were connected to the internet for extended periods of time without activation of simple electronic defences. This highlights the erroneous perceptions of the public and the practitioner regarding security in medical IT and in the internet in general. The wide-spread belief that computerised records are more secure,6 or at least as secure as paper records, results in overconfidence.7 In a survey presented in makingITwork,1 potential patients felt equally comfortable booking an out-patient appointment by e-mail (which is highly insecure), compared to using a secure internet site, similar to those implemented by online banking providers. Wireless networking, including BlueTooth™ technology poses even greater potential problems, as remote access of unencrypted confidential data is possible without physical proximity.

The inadequate IT security practised by this group is disturbing enough to warrant remedial action through education and training. We have already begun to implement medical IT security training through the postgraduate education programme, and will re-assess data protection practice after this training.