[{"innerBlocks":[],"name":"core\/freeform","postId":125987,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Mark Zuckerberg recently wrote a blog post detailing Facebook\u2019s future plans around privacy and product direction. In his post<\/a>, Zuckerberg drops some keywords that also show up in healthcare, especially in the new ONC and CMS rules\u2014interoperability<\/a>, security, and safety.

I previously used Facebook as an example of what we should not do in healthcare<\/a>. I thought Zuckerberg\u2019s post was a good opportunity to contrast social media and healthcare, since we aspire to the same principles.

Zuckerberg lays out six principles from which the future of Facebook, Instagram and Whatsapp will be driven. Three of these principles don\u2019t really apply to healthcare\u2014secure data storage is already highly regulated in healthcare; reducing permanence doesn\u2019t really apply (you don\u2019t want your lab results to disappear); and private interactions are typically the default (but I\u2019m sure we could dig into that more). Right now, I want to focus on encryption, interoperability and safety.

Encryption<\/b>
End-to-end encryption (E2EE) is not as widely deployed in healthcare as it should be. The idea is at the core of the Direct Project. Essentially, each person who can share or consume healthcare information should have a set of keys that allows them to either read messages only intended for them or send messages only intended for others.

Direct was included as part of Meaningful Use, and with the time restrictions and distributed nature of healthcare in America, organizations called HISPs moved in to help providers meet regulatory requirements. HISPs are not necessarily good or bad, but it does mean that we are falling short of true E2EE. At best, we can describe it is a HISP-to-HISP encryption. What would a future look like that enables E2EE?

Social networks and healthcare have some key infrastructure differences that make E2EE in healthcare a challenging prospect. Whatsapp already has E2EE. What makes this possible is that Whatsapp has control over the application used to send data on both sides. This isn\u2019t strictly necessary, but it makes the user experience so much better.

Many Redox developers use GPG to sign our Github commits. It\u2019s fun and cool for developers to do cryptography, but asking doctors and patients to go through the same rigmarole is impractical. The simplicity of downloading Whatsapp (or just using iMessage) is what we\u2019re missing. This is all theoretically possible if enough people buy in. One way to think about this buy-in is interoperability.

Interoperability<\/b>
Interoperability to Zuckerberg is different from the healthcare interoperability we talk about frequently. For one thing, there are varying definitions of interoperability in healthcare\u2014see the recent HIMSS definition<\/a>. Zuckerberg is talking about intra-Facebook interoperability\u2014in other words, the ability to do E2EE from Whatsapp to Instagram. There are two key differences in healthcare\u2014the fragmentation of the market (there are way more than three messaging apps), and the nature of data being exchanged.

Fragmentation is a huge problem that is unlikely to go away soon. In the Facebook case, all three systems are controlled by Facebook and can, in all likelihood, use the existing Whatsapp infrastructure. In healthcare, we have rival vendors trying to connect through multiple middlemen. The equivalent for Facebook would be trying to join a \u201cnetwork\u201d where Twitter, iMessage, Line, for example, could all do E2EE with the Facebook products.

The scale is much different in healthcare as well\u2013instead of 10 messaging platforms, we have hundreds of diverse products. Getting them all on board, even with the current government carrots and sticks, naturally takes more time.

Data is another dimension in which healthcare is vastly different from the problem that Facebook has to solve. Pictures and text are primary what is exchanged on social media networks. These are well-defined standards that are primarily human readable. Healthcare has the opposite type of content\u2014flexible standards like HL7 FHIR\u00ae which are expected to be machine-readable. In my opinion, this inversion has led us down a path where we\u2019re intensely focused on making the data interoperable when we don\u2019t really have the infrastructure in place to move it.

Safety<\/b>
Safety is the final principle, and it offers perhaps the starkest contrast with healthcare. To Zuckerberg, safety is about the misuse of the platform for \u201ctruly terrible things.\u201d

In healthcare, we need to worry about misuse, but we also need to worry about patient safety. For example, if a patient shows up to an emergency department unconscious, we need ways to get potentially life-saving data about them into the hands of caregivers.

At some point, we may be able to learn from Facebook. Keeping bad actors off messaging platforms is not dissimilar to the problem of allowing good actors access to data they normally wouldn\u2019t have access to. As Zuckerberg points out, Facebook has a lot to figure out as they roll out E2EE across their platform.

Encryption, interoperability and safety are issues that healthcare must think about differently than Facebook. There are many more players in our ecosystem, and we fundamentally deal with different kinds of data. There are also modes of communication (such as queries) we need to support to enhance patient care. Despite those differences, however, we aspire to the same goals, and we should look to learn from Facebook as they go about working towards these principles.","saveContent":"Mark Zuckerberg recently wrote a blog post detailing Facebook\u2019s future plans around privacy and product direction. In his post<\/a>, Zuckerberg drops some keywords that also show up in healthcare, especially in the new ONC and CMS rules\u2014interoperability<\/a>, security, and safety.

I previously used Facebook as an example of what we should not do in healthcare<\/a>. I thought Zuckerberg\u2019s post was a good opportunity to contrast social media and healthcare, since we aspire to the same principles.

Zuckerberg lays out six principles from which the future of Facebook, Instagram and Whatsapp will be driven. Three of these principles don\u2019t really apply to healthcare\u2014secure data storage is already highly regulated in healthcare; reducing permanence doesn\u2019t really apply (you don\u2019t want your lab results to disappear); and private interactions are typically the default (but I\u2019m sure we could dig into that more). Right now, I want to focus on encryption, interoperability and safety.

Encryption<\/b>
End-to-end encryption (E2EE) is not as widely deployed in healthcare as it should be. The idea is at the core of the Direct Project. Essentially, each person who can share or consume healthcare information should have a set of keys that allows them to either read messages only intended for them or send messages only intended for others.

Direct was included as part of Meaningful Use, and with the time restrictions and distributed nature of healthcare in America, organizations called HISPs moved in to help providers meet regulatory requirements. HISPs are not necessarily good or bad, but it does mean that we are falling short of true E2EE. At best, we can describe it is a HISP-to-HISP encryption. What would a future look like that enables E2EE?

Social networks and healthcare have some key infrastructure differences that make E2EE in healthcare a challenging prospect. Whatsapp already has E2EE. What makes this possible is that Whatsapp has control over the application used to send data on both sides. This isn\u2019t strictly necessary, but it makes the user experience so much better.

Many Redox developers use GPG to sign our Github commits. It\u2019s fun and cool for developers to do cryptography, but asking doctors and patients to go through the same rigmarole is impractical. The simplicity of downloading Whatsapp (or just using iMessage) is what we\u2019re missing. This is all theoretically possible if enough people buy in. One way to think about this buy-in is interoperability.

Interoperability<\/b>
Interoperability to Zuckerberg is different from the healthcare interoperability we talk about frequently. For one thing, there are varying definitions of interoperability in healthcare\u2014see the recent HIMSS definition<\/a>. Zuckerberg is talking about intra-Facebook interoperability\u2014in other words, the ability to do E2EE from Whatsapp to Instagram. There are two key differences in healthcare\u2014the fragmentation of the market (there are way more than three messaging apps), and the nature of data being exchanged.

Fragmentation is a huge problem that is unlikely to go away soon. In the Facebook case, all three systems are controlled by Facebook and can, in all likelihood, use the existing Whatsapp infrastructure. In healthcare, we have rival vendors trying to connect through multiple middlemen. The equivalent for Facebook would be trying to join a \u201cnetwork\u201d where Twitter, iMessage, Line, for example, could all do E2EE with the Facebook products.

The scale is much different in healthcare as well\u2013instead of 10 messaging platforms, we have hundreds of diverse products. Getting them all on board, even with the current government carrots and sticks, naturally takes more time.

Data is another dimension in which healthcare is vastly different from the problem that Facebook has to solve. Pictures and text are primary what is exchanged on social media networks. These are well-defined standards that are primarily human readable. Healthcare has the opposite type of content\u2014flexible standards like HL7 FHIR\u00ae which are expected to be machine-readable. In my opinion, this inversion has led us down a path where we\u2019re intensely focused on making the data interoperable when we don\u2019t really have the infrastructure in place to move it.

Safety<\/b>
Safety is the final principle, and it offers perhaps the starkest contrast with healthcare. To Zuckerberg, safety is about the misuse of the platform for \u201ctruly terrible things.\u201d

In healthcare, we need to worry about misuse, but we also need to worry about patient safety. For example, if a patient shows up to an emergency department unconscious, we need ways to get potentially life-saving data about them into the hands of caregivers.

At some point, we may be able to learn from Facebook. Keeping bad actors off messaging platforms is not dissimilar to the problem of allowing good actors access to data they normally wouldn\u2019t have access to. As Zuckerberg points out, Facebook has a lot to figure out as they roll out E2EE across their platform.

Encryption, interoperability and safety are issues that healthcare must think about differently than Facebook. There are many more players in our ecosystem, and we fundamentally deal with different kinds of data. There are also modes of communication (such as queries) we need to support to enhance patient care. Despite those differences, however, we aspire to the same goals, and we should look to learn from Facebook as they go about working towards these principles.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

What healthcare can learn from Facebook’s privacy-focused vision

More for you