Back to Home

Internet-Based Software System Allows Increased Security

By Charles A. Lewis

With the worldwide movement toward the use of electronic health records, the security of the data in those patient records is of critical importance. In addition to the confidential health information, most patient records also include Social Security Account Numbers, credit card numbers and other info that, if exposed, have the potential to cause great damage. Healthcare providers are growing increasingly anxious about protecting this vital data entrusted to their care and their concern is fully justified.

When Advanced Ortho first began offering orthodontic management software via Internet Program Delivery (‘IPD’) four years ago, some orthodontists would comment that “I would feel uncomfortable having my patient records stored in any location other than my own office.” “After all,” they would say, “I have a responsibility to protect those records.” And to a certain extent, both viewpoints were correct. Up until IPD was offered, orthodontic patient records were traditionally stored only in the doctor’s office, so having them in a different location could cause apprehension for some people. As to the doctor’s accountability for protecting the records, that remark was entirely accurate.

As we all know, drastic change often causes anxiety for humans, regardless of what form the change involves. When the concept of using electronic records was first introduced, many doctors were equally uneasy about using them. However, as the acceptance of electronic records and other paperless operations grew, orthodontists began seeing the overwhelming advantages and their fears subsided. Paperless (or near-paperless) operation is now commonplace and that trend is rapidly taking place with regard to using Internet-based systems. When you have finished reading this explanation, I believe you will understand why.

 

The purpose of this article is to point out the contrasts of what can be accomplished with Internet-based systems versus the local area networks still in use by most orthodontists.  My use of the word security herein will include two meanings: (1) protection of the patient records; and (2) having confidence that the office computer network will be available for operation at nearly all times (except in the case of a power failure). To keep the comparison as succinct as possible, both systems will be assumed to be operating a paperless practice. That means that all the patient information and treatment records are computerized and all the images, x-rays, and teeth models are digital.
 

Local Area Network (‘LAN’)

I’ll begin by talking about the traditional local area network, since most readers are probably using one. For those of you who are unfamiliar with the meaning of this terminology, here is a very basic explanation: A LAN is a set of wired (or wireless) connections wherein two or more workstations (usually PCs) are connected to enable information sharing. All the patient data is stored on a PC that is called a file server because it ‘serves’ the stored information to the various workstations as requested. All data processing is done at the workstation and when changes are made and saved, they are sent back to the server to be available to other users on the network. With a LAN, the entire network, including the server and all patient data, are located in the orthodontic office.

Here are some key concerns with LANs:

• Loss of data from theft. The typical office with a LAN might, or might not, have a security alarm connected to a central dispatch system and/or to the police department. Even if the office does have this safeguard, the response/reaction times of the alarm company’s dispatch system and the police department are critical. Once inside, the theft of a file server containing all the patient records could take 2-3 minutes or less. If the patient data has not been regularly backed up at the end of each business day and then removed from the premises to a safe location (and the backup is actually usable), the practice could have a potential disaster on its hands.

• Loss of data from fire. The typical office may, or may not, have the aforementioned security alarm along with a sprinkler system for fire protection. Again, the response/reaction times of the alarm company’s dispatch system and the fire department are critical. In the event of fire, the server and its data could be destroyed within minutes. Again, if the patient data has not been regularly backed up at the end of each business day and then removed from the premises to a safe location, the practice could have a potential disaster on its hands.

• Data accessibility. If the server is stolen, the patient information can be ‘mined’ for Social Security Account Numbers, credit card numbers, etc. because the data is not encrypted.

• System redundancy. Most offices do not have the redundant equipment necessary to keep the computer network in operation in the event that key hardware components fail. This would include a RAID-5 server (minimum of 3 mirroring hard drives), a fail-over server, network switch/hub, etc.

• Protection from natural disaster. Most orthodontic offices are located in buildings that meet only local construction standards and codes; no extraordinary safety measures have been taken.

Internet-Based System (‘IPD’)

In the Internet-based system, the server containing the orthodontic patient records is in a remotely-located datacenter. The orthodontic office accesses their patient data securely via the Internet using workstations connected to broadband systems such as DSL or Cable Modem. Because the company of which I am CEO is the only software vendor, worldwide, providing orthodontic clinical / information / management software over the Internet from its own datacenter, it will be necessary to refer to the safeguards provided by our Los Angeles-based facility.

Here are some key reasons for using this type of system:

• Loss of data from theft.  Onsite personnel provide around the clock security; security cameras are located throughout the datacenter and monitored 24x7. Entry requires a pass with photo and visitors are escorted by authorized personnel. In addition, all the data in the datacenter is regularly backed up to storage devices in other remote locations. As a result, theft of data is not an issue.

• Loss of data from fire. The datacenter's multi-zoned, dry-pipe fire suppression system is activated via under-floor and overhead smoke detectors and is monitored 24x7 by onsite personnel. If two or more zones have been activated, the pipes fill with water. As mentioned above, the data is also regularly backed up to storage devices in other remote locations, so data loss is not an issue.

• Data accessibility. The data used via IPD is fully encrypted using the current version of 128-bit encryption; an encryption level that hackers have yet to break. Experts say a128-bit system gives approximately 340,282,266,900,000,000,000,000,000,000,000,000,000 possible keys with which to encrypt the data. Because of this, the movement of encrypted data across the Internet is safe; it is when it gets to the server hosting the data that it is the most vulnerable to hackers. So besides the encryption, our datacenter takes special precautions by using the latest technologies at the router and firewall levels making the data as secure as current technologies allow.

• System redundancy.

1. The datacenter has two separate wiring systems that use fiber-optic cable.
2. The datacenter uses multiple Xeon-processor equipped RAID-5 servers. Data is constantly backed up to other servers, storage devices, and media both onsite and in remote locations.
3. Firewalls and routers have identical duplicate devices available for backup and the switchover is automatic in the event of hardware failure.
4. In regard to power, the datacenter is on a preferred service grid of the Los Angeles DWP that only supplies one other building; a second power grid offers redundancy. In the event of a DWP power outage, the first emergency backup consists of five battery-powered 560 KVA, 2 MW Uninterrupted Power Systems (UPS). Three modules are on line; two sit idle as backups. The UPS system supplies uninterrupted power until the second emergency backup made up of 5 diesel generators automatically kicks in. The 90,000 gallons of onsite fuel for the generators enables them to provide power for up to 30 days.
5. When it comes to redundant broadband connectivity, the company's servers are connected, concurrently, to three of the world’s largest, most reliable bandwidth providers (Level 3, UUNET & Global Crossing) with on-demand speeds up to 40GBPS available.

• Protection from natural disaster. The building containing the datacenter is seismically designed to withstand an 8.3 magnitude earthquake. A building constructed to that protection level inevitably provides additional fortification against the dangers of wind and fire.

Summary

Clearly, no orthodontic office can economically afford to provide all the security procedures offered by the datacenter described above. Yet these are the security measures that can eliminate an orthodontist’s anxieties about safeguarding his/her patients’ records.

And what is really remarkable is that compared to using a similar sized LAN, the total savings from using IPD over a period of 5-7 years can be as much as 50-60%! Enjoying all the protections described herein, while simultaneously reducing the costs and hassles of operating a LAN, is rapidly causing IPD to become the primary method of operating leading-edge clinical / information / management systems. I believe you will have to agree that Internet-based software delivery is a technique worth considering for your practice.

Back to Home