Cybersecurity, HIPAA, and Blockchain: Microsoft’s David Houlding Talks Health Data in the Digital Age

David Houlding

[Music]

Female : Welcome to C onversations on H ealth C are with Mark Masselli and
Margaret F linter. It's a show where we speak to the top thought
leaders in health innovation , health policy , care delivery and the great
minds who are shaping the health care of the future. This week Mark
and Margaret speak with David Houlding, P rincipal H ealthcare L ead at
Microsoft responsible for health care initiatives within the Microsoft
Azure Industry Experiences Team . He's Chair of the Health
Information and Management Sys tem Society, B lockchain Health Care
Taskforce , t alks about the growing cyber security challenges in health
care and what needs to be done to protect people's health data .

Lori Robertson also checks in , the Managing Editor of F act C heck.org
looks at misstate ments spoken about health policy in the public
domain separating the fake from the facts . W e end with a bright idea ,
that’s improving health and well being in everyday lives. If you have
comments, email us at ch c radio @ ch c1 .com or find us on Facebook,
Twitt er, iTunes, or wherever you listen to podcasts. You can also h ere
us by asking Alexa to play the program C onversations on H ealth C are.
Now stay tuned for our interview with David Houlding, P rincipal
Healthcare Lead at Microsoft on C onversations on Health C are.

Mark Masselli: W e're speaking today with David Houlding, P rincipal Healthcare Lead
at Microsoft responsible for health care initiatives at the Microsoft
Azure Industry Experiences Team . He is chair of the HIMSS B lockchain
in H ealthcare Task f orce , he’s also an advisor to the British B lockchain
Association. Previously , Mr. Ho ulding served as D irector of Health c are
Privacy and Security at Intel Corporation, where he established the
Intel Healthcare Security Readiness Program . He holds several patents
in i nformation technology, architecture and security. He earned his
master's of a pplied s cience at Simon Fraser University in Vancouver.
David, welcome to C onversations on H ealth C are.

David Houlding: It's great to be here. Thanks for the opportunity.

Mark Mas selli: Yeah, you know you've been at the forefront and really been thinking
a lot about data security for a q uarter of century. And I think it's fair
to say that the industry has gone through this incredible revolution
over the last decade or so of moving from paper to electronic and
digital data. Given your background in data and health security , I'm
wondering, do you think the industry is ready for the cyber security
side of having this much data in a digital format?

David Houlding: Yeah, you're right. So digitizing paper and sort of moving to electronic
health records was the first step and we've come a long way. But once
that data is digitized, if it's locked away in silos like centralized
databases, that's only have limited use , right ? I f it's not share d when
necessary for health information exchange and other things then it's

David Houlding

limited use in terms of improving health care. I think the opportunity
beyond just digiti zing health records is to facilitate secure targeted
sharing and unlock the potential of th e data. I think cloud computing
can play a key role in that .

T he reality is also th at a lot of health care organizations lack the
resources, the cyber security resources to adequately secure on
premise infrastructure. T hey can get a lot of that with secure
platforms, tools and partnership from and focus more on the higher
levels of the stack , t he applications , the business , the innovation and
not have to have the capital costs the same degree of on premise
cyber security resources.

W e're really focused on f our key business goal s of health care, right ?
R educing health care costs is the first one and really using the cloud
can free up a lot of health care organizations from the capital
expenditure associated with on premise infrastructure versus in the
cloud, but also improving patient outcomes right ? T hrough the
improved accessibility and secure information sharing that you can
get with cloud based data . T hat gives us an opportunity to improve
patient outcomes through better care collaboration, and so forth.
I mproving patient engagement and experiences is another third key
goal of health care.

Y ou have things like patient portals that can run in the cloud, can also
have intelligent health care agents , think Chatbots but health care
agents to be much broader tha n that . R unning all the time in multiple
languages, very cost effective and it can really boost patient
engagement to that next level. But the fourth sort of key goal we're
really focused on is also improving the experience of health care
professionals, ri ght ? Th at's all about intelligent health. It's all about, AI
machine learning for clinical decision support. R ather than give those
clinicians the raw data and drown them in raw data , use the AI
machine learning .

I n many cases running from the cloud to get actionable insights near
real time so they can be acted upon if there's a dangerous sort of
condition evidence in the in the raw data from the patient, then they
can intercept that really quickly and intervene and hope fully avoid an
episode, right, which can really impact the quality of care for the
patient . I'm thinking heart attack or something like that, if you can
intercept and avoid that , t hat's a major quality of life improvement
for the patient and definitely a cost reduction improvement for the
hea lth care organization as well.

Getting back to the cyber security side, I think of it as privacy, security
and compliance. On the privacy side, it's really about transparency,
right? N otice to the data subject and we often just focus on patients
as a data subject, but any kind of person nel identifiable information

David Houlding

could also be the healthcare professionals, right ? W e need to be
concerned about privacy of that information and being transparent
about how it's being used, how is it collected, how is it stored, and
how is it disposed of. We o ften don't think about at the end of life of
data, disposing of it, disposing of it, security is a good thing to do,
right ? P rivacy to me is really about empowering the data subjects
including the patients to access , review , amend their data and so
forth. There’s some really interesting opportunities around n ew
technologies like B lockchains really have that up to the next level .

As a security professional, we're tr ained to break it down into CIA
confidentiality, integrity and availability. P rotecting confidentiality of
data, we got to make sure it's adequately secured against
unauthorized access. On the integrity side, we really got to make sure
the data is kept accurate, complete and up - to - date and isn't tampered
with . P rotec ting data integrity can be done with things like hash codes
and digital signatures and there's some super interesting capabilities
with B lockchain and the immutability side which can really take
protecting integrity of data up to the next level. Even thing s like AI
machine learning models, right , as we learn to depend on those we
got to protect them and make sure they aren't tampered with.

L astly, the availability , t his is one that I don't think we paid enough
attention to in health care . A vailability is al l about ensu ring timely and
reliable access, the systems and data . Prior to R ansomware, I think
most people equated security with protecting confidentiality and
avoiding breaches a nd that's certainly a big part of it. But it actually
turns out, especially for health care providers, protecting availability
can actually be far more important . I f you have a R ansomware event
and your data is not available, because somebody's trying to extort
money out of you for a ransom . T hat can be an immediate disruption
and it can really impact the quality of patient care and safety, frankly,
as well.

Now, we also got to think about new types of attacks that aren’t new
conceptually, but they're relatively new in health care, like distributed
denial of service attacks. As we move more and more infrastructure to
the cloud , there’s fantastic benefits again in freeing up health care
from the burden of on premise sort of legacy infrastructure
maintenance and enabling them to focus on the health care and
innovating . B ut we got to t hink about ensuring , h ow do we ensure the
availability of those systems in the cloud ? S o we can do that with
things like redundant connectivity to the cloud. Y ou can have a c loud
mitigation provider that helps you filter out, good, legitimate requests
from bad requests a nd basically ensure that you're not being drowned
by a DD oS sort of blast.

Margaret Flinter: I was particularly struck by some of the work that you're doing and

David Houlding

developing these new care delivery clinical support systems, including
remote pa tient monitoring, which has been around for a long time,
but we're seeing it taken to a whole new levels . Mark we had Noelle
LaCharite from Microsoft here with us not too long ago, she was
talking about the work that she's doing in voice technology in heal th
care which is also seeing significant growth. I wonder if I could ask you
to talk a little more about programs like the recently launched
Microsoft Healthcare Bot Service , which I think you might have
referred to in your comments as one example of healt h care agents
and other new t ech and voice enabled interfaces maybe just expand
on that a little bit.

David Houlding: Microsoft's approaches platforms, tools and partnerships , so w e don't
generally create like health care and solutions. Think of the
Health care Bots Service as a tool that can be used to build out
healthcare bo t capabilities into a myriad of different partner health
care solutions. T his is super exciting because technology can be
exciting , b ut what's most interesting to me is how its applied for the
health care benefits and the bot service and those kinds of
capabilities. It's all around patient engagement and experiences as
well as reducing costs .

O n the engagement side, the gist of it is really all hours of the day,
never sick, multiple lang uages concurrently, engagement options for
patients, whether it's a text interface, whether it's a voice interface .
It 's reaching patients in ways just not possible before, right . I t's not
that the only interface available to patients going forward will be
these automated agents . But think of the 80 - 20 rule , I think 80% of
the request c ould be handled by these agents, a nd it really reduces
the repetitive noise type requests to the human operators, the nurse
on call, for example . If the intelligent agents ca n help patients with
the basic types of requests and that also improves the experience of
the health care professional, because I think some of them get the
same question hundreds of times a day , a nd that's not a good use of
their time.

Just the continuous availability of intelligent health care agents is
going to really improve the experiences of patients . P icture of your
mom and you have a sick child and you need help now , a nd so if it
happens to be after hours on the weekend, or you speak a different
lan guage . T hese kinds of agents could really improve the experience
of the patient and enable their self - help, right . T he patients motivated
to help themselves so this could also help health care professionals
right . T hink if they're being credentialed or if there's other services
they need to get updates on or processes . T hese kind of intelligent
agents could really help expedite and empower health care
professionals with the actionable insights and information they need.
H opefully avoid or at least alleviate some of the clinician burnout

David Houlding

we're seeing .

O n the cost reduction side, of course, handling all of these different
types of languages concurrently 24 by 7 by 365 can really help
improve the cost picture, whether it's a health care provider, whether
it's t he payer on eligibility request , could even be a pharmaceutical or
l ife s ciences . L et's say if they're doing a clinical trial and patients have
questions and there’s wonderful opportunities there as well for cost
reduction across all those segments of heal th care.

Mark Masselli: David, your dramatic innovation and it doesn't seem that the
regulatory landscape is keeping up . B ut I didn't know that the Centers
for Medicare and Medicaid Services announced a new r u le that by
next year, all patients should be ab le to have access to their health
data delivered to their smart phones within 24 hours. W onder if you
could tell us whether or not it's doable given where we are in terms of
our technology and our ability to transfer that information safely and
securely to patients?

David Houlding: Ye s, I definitely think it's a good thing, right? F orever w e've been
talking about the need for patients to own their data, a nd it's all part
of empowering patients and take control of their health care, right ?
They got to have a ccess to their data. I think as an industry w e’ ll figure
out how to do that efficiently and cost effectively. C loud can play a
key role in that, right, it can enable, again, health care to free
themselves from those low level infrastructure on premise type costs,
and focus more on business innovation and applications with cloud
based deployment. O ne can really break it down into privacy and
security.

I think a lot more could be done to empower patients in any data
subjects, including health care professiona ls with their privacy . More
could be done around data sovereignty and transporter data flow. If
your data is collected, how is it shipped around the world? I don't
think HIPAA does as much in that area, as well as patients control over
their data, even the right to be forgotten, right. If a patient goes to a
provider and for some reason they opt not to go to that provider
anymore, and they request for their data to be deleted. I don't think
that's something that most health care providers do today. But, it is a
reasonable request.

I think there's new capabilities available that could really help us amp
privacy up to the next level. For example, B lockchain offers ways to
empower patients with privacy in ways not possible before . T hink of a
patient being able to see on B lockchain what data is being used, be
able to consent or opt in, or even opt outs and control their data in
ways not possible before. Th ere's new technologies like B lockchain
that can pave the way for new policy requirements.

David Houlding

W e've seen the deva station of breaches in health care and
R ansomware and definitely more could be done on the HIPAA s ecurity
r ule to keep track of what's going on since the last revisions to ensure
that health care organizations are adequately protected. T he risk is
never fu lly eliminated , b ut I think from the policy side we've got to
make sure that health care organizations at least have adequate levels
of security . I think more could be done on confidentiality and avoiding
breaches for sure . W e need to continue with the acc ess control the
encryption , the key management to track new vulnerabilities threats
and really approach security as a team, not each organization alone,
wh ich is just not reasonable.

But, there's a lot more that could be done on protecting the integrity
si de of data. I don't think we've paid nearly enough attention there
and there's wonderful new opportunities with capabilities like
B lockchain to bolster the integrity protections of all kinds of data a nd
then the need to protect availability of systems and data.
R ansomware has taught us that if data is not available, or systems are
not available and those are mission critical, that can be severely
disrupted to he alth care and on the health care provider side, that's a
degradation of quality of service for th e patient. It could be a patient
safety risk , right .

I think we need to really approach security from a three prong
standpoint. One is prevent, so do what we can to anticipate threats
and vulnerabilities and mitigate those . E ven though you teach people
not to click on links and unsolicited emails, they're going to c lick at
some point s a nd what you need to be able to do is detect new
intrusions , new security incidents very quickly. T here's wonderful new
opportunities with technologies like artificial intelli gence and machine
learning to collect all this telemetry. T hink of log data going into a
bank of AIs that are looking continuously around the clock for any
kinds of new threats and vulnerabilities . As soon as those are
detected, detected quickly and use AI machine learning for that and
respond quickly to stop loss and remediate. I think we need to really
get in the mindset of do what we can to prevent, but really bolster the
detect and respon d side of security.

Margaret Flinter: David, I want to take it to the level of the individual. Clearly personal
genomic, self generated health data are increasingly going to be part
of the health record. W e here in our organization are participating in
the All o f Us Project contributing their genetic data as well as thei r
personal health data, family data. When we think of how most people
sign off on that data, they sign that I've read my HIPAA notice and I
agree, right. What should consumers be looking at here? N ow we're
talking about the electronic health record having data not just on you,
but your antecedents your ancestors . W hat do you say to the person
in the street about what should they look for in order to have

David Houlding

reasonable assurance that they're well protected ?

David Houlding: I t's from a privacy standpoint, it's a bout risk reward, right? T hink
about i f you get a request for your data, what's the potential benefit
in opting in or consenting to the use of your data ? T his fantastic
capabilities and potential for precision and personalized health care .
R eally to get th e benefits of those, you have to consent and opt into
sharing your data , w hy? Because your data is used to actually tailor
the precision medicine to the personalized health care for you.
Sometimes there's rewards in terms of if you're participating in
clin ical trials, you can get updates on the findings directly if you opt
into participation and sharing your data.

Sometimes this compensation involve , that could be another part of
reward that patients could get for participation. But think about the
risk, I think of it in terms of the full lifecycle like what data are you
consenting to the use of ? H ow will it be collected? How will it be
used? Will it be shared with a ny other third parties? T hen what is
done with the data at the end of the life cycle? Is it g oing to be
disposed off or is somebody just keeping it in d efinitely ? O bviously the
risk of breaches and things is vastly increased if there's no disposal of
the data. I think we need to get past just thinking that there's these
huge nebulous privacy risks , because frankly that will shoot patients in
the foot in terms of their ability to participate in precision medicine
and personalized health care. We've got to opt in but we've got to do
it with our eyes wide open in terms of what are the risks and what ar e
the rewards in terms of benefits to health care .

Mark Masselli: W e've been speaking today with David Houlding, P rincipal Healthcare
Lead at Microsoft. You can learn more about their work by going to
Azure . M icrosoft.com or you can follow him on twitter @ D avid
Houlding and that's H - O - U - L - D - I - N - G . David, thank you for your
groundbreaking work as a leader in health data security and for
sharing your expertise and wisdom with us on C onversations on
H ealth C are.

David Houlding: Thanks very much for the opportun ity. Great to speak with you bo th.

[Music]

Mark Masselli: At C onversations on Health Care we want our audience to be truly in
the know when it comes to the facts about health care reform and
policy . Lori Robertson is an award - winning journalist and Managin g
Editor of FactCheck . o rg a nonpartisan nonprofit consumer advocate
for voters that aim to reduce the level of deception in US politics . Lori
what have you got for us this week?

Lori Robertson: A false cla im about Medicare eligibility and cost has been sha red
nearly 500,000 times o n Facebook. The false claim says, “W hy do

David Houlding

seniors on s ocial s ecurity have to pay for Medicare and a
supplemental insurance and the illegals get it all for free ?” Medicare
isn't available for people living in the US illegally. It i s available only to
citizens and lawful permanent residents who have lived in the US
continuously for at least five years and meet other criteria such as
being at least 65 years old and having p aid Medicare payroll tax es .

Also, most seniors don't have to p ay for the basic Medicare coverage.
There are four parts to Medicare . Medicar e Part A covers inpatient
stays at hospitals and nursing facility. It is funded largely through
payroll taxes, and those who paid into the system for at least 10 years
or are marr ied to someone who paid into the system d on't pay
premiums. Medicare beneficiaries can purchase additional coverage
for doctor's visits and outpatient care through Medicare Part B or
through a private insurance provider with Medicare a dvantage. Most
people who receive s ocial s ecurity benefits and use Medicare Part B
pay $130 per month.

Those living in the US illegally may actually provide a net contribution
to the Medicare Part A Trust Fund through taxes. From 2000 to 2011,
such immigrants contributed an es timated net total of $35.1 billion to
the trust fund. That's according to a study led by a Harvard Medical
School professor a nd published in the Journal of G eneral Internal
Medicine , and that's my fact check for this week. I'm Lori Robertson,
Managing Edit or of F act C heck.org .

Margaret Flinter: F act C heck.org is committed to factual accuracy from the country's
major political players, and is a project of the Annenberg Public Policy
Center at the University of Pennsylvania. If you have a fact that you'd
like c heck ed, email us at chc radio.com w e'll have FactCheck.org’s Lori
Robertson check it out for you here on C onversations on Health Care.

[Music]

Margaret Flinter: E ach week C onversations highlights a bright idea about how to make
wellness a part of our commun ities and everyday lives. Childhood
o besity is a national epidemic, but in the south i t’s far more prevalent .
In Louisiana f or example, over half of the children are either obese or
overweight, with many experiencing symptoms such as high blood
pressure, h igh cholesterol and prediabetes. Louisiana State Uni versity
researcher Dr. Amanda Staiano has been studying protocols t o tackle
childhood obesity, tapping into readily available resources that make
it easier for kids to adopt better exercise and activity h abits. S ince
video games are ubiquitous in children's lives, she thought that would
be a great place to start.

Dr. Amanda Staiano: I was trying to think of a way to meet children where they are so they
can be more physically active . C hildren now are spendi ng seven to
eight hours every day using screen technology. Video games are still

David Houlding

very popular. W ith these new active video games that require physical
activity to play. I thought this might be an innovative way to make
physical activity and exercise fun, b ut also to help these children to
lose weight and get a healthier heart.

Margaret Flinter: Her team at the Pennington Biomedical Research Center a t LS U
developed an intervention called G ame S quad giving prescriptions for
playing movement video games for a full hour three times a week .

Dr. Amanda Staiano: I n addition to giving the kids these extra games to play with , we gave
them a fitness coach that they would talk to over their video game ,
a nd the coach would check in with the parent and child once a week.
W e also gave the kids a step tracker so that they could objectively
keep track of their physical activity throughout the six months .

Margaret Flinter: A nd kids were encouraged to have other family members join them in
the movement video games, which added yet another level of
engagement like this young 12 year old boy who enjoyed gaining a
competitive edge over his mom who was often dancing right
alongside of.

Boy: M y mom want to race me, I have to say like 60% of the time I beat
her. I love to do this wit h my mom. It really does build up your cardio
and stamina for football and for different other sports.

Margaret Flinter: Dr. Sta iano says during the six month G ame S quad trial, over 90% of
the kids who are given video game prescriptions and the fitness coa ch
intervention stayed active throughout the study . T he gaming group
reduce d their BMI by about 3%, while the control group saw an
increase in theirs. Sta iano says the added bonus was th at kids gained
confidence and improve self - esteem w ith their newfound activity .
Game Squad an effective intervention to increase exercise in
sedentary and overweight kids , improving health and fitness for kids
and a fun engaging and sustainable way .

Boy: Well, w hen this is all over, I'll still do it . We’ll keep on continuing doing
the game s.

Margaret Flinter: N ow that's a bright idea.

[Music]

Mark Masselli: You've been listening C onversations on H ealth C are , I'm Mark
Masselli.

Margaret Flinter: And I’m Margaret Flinter.

Mark Masselli: Peace and health.

Female: Conversations o n Health Care is recorded at W ESU at Wesleyan
University streaming live at ch c radio.com , iTunes or wherever you

David Houlding

listen to podcasts. If you have comments, please email us at
ch c radio @ ch c1.com or find us on Facebook or Twitter. We love
hearing from you. The show is brought to you by the Community
Health Center .