Patient Centric Cybersecurity - Excerpt

By Aaron F. Brantly and Nataliya D. Brantly

Over the last several decades there has been a shift in standard models of healthcare both in the United States and globally. Patient centric approaches in health care reorient the power relationships of physicians and patients. This shift elevates the needs and challenges of the patients and builds a more robust and communicative relationship to foster improved health outcomes. Recently, Nataliya Brantly, VT STS PhD Student and Dr. Aaron Brantly, Department of Political Science, Tech4Humanity Lab Director, took up the issue of patient centric care and focused on expanding it to encompass cybersecurity concerns. Their article is available – open access at: https://www.tandfonline.com/doi/pdf/10.1080/23738871.2020.1856902?needAccess=true

Below is a subsection from their paper as well as a case study on the impact of patient centric approaches applicable to the care of patients with Type 1 Diabetes that was shortened in final publication. Technology in health care is becoming increasingly pervasive and important to the sustainment of life, the quality and provision of care, and the security of private information. There are dozens of examples of the increasing intermediation of technology in patient-physician-care relationships. Technology is having a profound impact on the human condition in places we often least expect it. It is pervasive and impacts relationships, power structures, and services. When examining the impact of technology on the human condition it is important to look for those often-overlooked areas and those areas where existing models or practices can provide guidance, spur discussion, and spark inspiration.  

The Patient Centric Approach (PCA) is a health care ecosystem that builds and fosters partnerships between practitioners, patients, and families. The approach seeks to synchronize patient needs, wants, and preferences with high-quality care. It is rooted in bi-directional communication and interaction. At its most basic it empowers patients and their families in health care settings. PCAs have been shown to result in better health outcomes. PCAs reorient power structures of medicine away from top-down care structures. This reorientation alters the policy and regulatory structure of health care systems. Despite a shift towards PCAs as “best practice” their implementation is not universal and is complicated by overlapping health care needs, wants, ecosystems, and structures. Understanding the tension of PCAs in a technology-enabled health care environment is difficult and often obscured by complexity. To elucidate this challenge, we examine a case example arising out of the management of Type 1 Diabetes. We trace the power relationship of the patient through their care, the need for the inversion of the top-down process of national and international regulation becomes more apparent.  

Type 1 Diabetes (T1D) is a chronic disease that requires life-long care for which modern care solutions heavily rely on technology. T1D patients also have substantial involvement in their own self-care including decision processes that influence the sustainment and quality of life. T1D patients supplant endocrine function through self-administered doses of insulin, a hormone necessary to avoid keto acidosis as well as long-term negative externalities of the disease including blindness, cardiovascular disease, kidney damage, nerve damage and other complications. The administration of insulin is increasingly mediated through implantable medical devices (IMDs) many of which are connected to other devices via body area networks (BANs) and by extension to the Internet. Additionally, diabetics must engage in self-monitoring of blood glucose, an act historically performed by technicians in laboratories or other trained medical personnel. Based on self-monitoring, diabetics adjust insulin dosage amounts to avoid both diabetic ketoacidosis and hypoglycemia. Glycemic monitoring is always conducted with digital devices, and in many instances these devices are also becoming IMDs. The data these devices provide to patients is critical to insulin administration. In contrast to T1D care, in most instances medication and care adjustment are managed directly by physicians. T1D highlights the importance of including patients in the management of their health. Moreover, because patients are increasingly reliant on technology in the management and provision of care, the segmentation of technology beyond a PCA framework exposes individuals to vulnerabilities not previously considered in PCAs. Data in patient records, resident on devices, or input into the dosing of medications among a variety of other associated devices and data repositories are critical in managing patient health. 

Further complicating the top-down approach to law and regulation, patients are increasingly “hacking” their own care solutions. This behavior is becoming prevalent within the T1D community particularly following the development by Nate Racklyeft, of the OpenSource LoopKit, an artificial pancreas solution that enables T1D patients to leverage FDA approved wireless medical devices (WMD) and IMDs in combination with non-FDA approved artificial intelligence and applications to improve glycemic control. Racklyeft’s LoopKit built upon existing OpenSource software in the OpenAPS designed to empower T1Ds and caregivers. LoopKit demonstrates the intersection of regulatory, legal, and PCA practices in the provision and management of care. Multiple studies have indicated that the use of LoopKit in both pediatric and adult T1D populations results in substantially tighter glycemic control, increased patient WMD-IMD interaction and improved general health outcomes. The OpenSource community for T1D is defined by the “#WeAreNotWaiting” mantra and has sought to advance therapies often slowed by law and regulation. The projects have been extremely successful and have resulted in patient driven change of industry actors including the inclusion of the OpenSource applications in the production and verification pipelines of major T1D insulin pump manufacturers. The first Do-It-Yourself (DIY) algorithm is currently included in Medtronic and Insulet systems pending FDA approvals.

T1D care illustrates the increased transition of responsibility from physician intermediated to patient self-care enabled by technology. This transition involves a delegation of roles previously conducted by health care professionals to the patient. Patients are empowered to make decisions about their health as well as speak up regarding the vulnerabilities of technologies they use. Patients use a variety of channels to communicate their needs and values related to such technologies. Focus on communication within PCAs can improve care outcomes. However, it is important to note that not every patient is equally empowered or able to communicate and engage effectively with health care providers

Beyond issues of access and capacity to engage with health care providers, patients are also subject to the endemic vulnerabilities of both health technology used for patient records and management as well as the medical devices that have become increasingly pervasive. Successful PCAs require trust, and as the data in the above highlights, there are increasing challenges to the confidentiality, integrity and at times availability of data necessary for the provision of care. Fostering trust in health care environments once constituted the storage of paper records and the immediate and proximate patient-physician relationship. This relationship is presently being intermediated by a range of technologies that impact the interaction between parties and influences the potential outcomes of care. 

Continuing with the case of T1D care management, when popular continuous glucose monitoring (CGM) system provider DEXCOM suffered a server failure in fall 2019, it accidentally placed the safety of hundreds of thousands of patients at risk. During the roughly 72-hour outage, caregivers were unable to receive remote alerts about T1D glycemic states. Moreover, in the first 24-hour period, many caregivers, who were sleeping were unaware of the outage and therefore not prepared to render care to individuals within their charge. While there were no reported fatalities, there were numerous reports of near misses in which patients, particularly children, experienced hypoglycemic episodes and their caregivers were unaware, only to find out by chance that a child was entering into a potentially fatally low glycemic state. DEXCOM, the CGM manufacturer and service provider adhered to all US legal and regulatory requirements, but because of a failure to include patients into discussions of security and maintenance of digital devices, it was wholly unprepared for the medical crisis it caused. It was only after numerous calls, emails, social media posts to DEXCOM, physicians, congressional representatives, and news agencies that communication attribute of the PCA was able to re-establish the patients and caregivers concerns at the center of the crisis. This contrasts with Open-Source model and two applications NightScout and xDrip both of which provided data and connection failure notifications when CGM-server communications were disrupted. The DEXCOM application, created in a top-down manner, failed because it did not fully assess the needs present at the patient level. 

The T1D case example, is not unique, instead it is replicated across patient care interactions in health care. The T1D community does, however, provide an example of a patient population that engages in bottom-up development, focused at the patient level. This patient driven approach to care empowers patients and their caregivers by not only providing novel care solutions at the lowest level, but also by informing the creation of future laws and regulations. By involving patients, the Open-Source community addressed a potentially fatal flaw years before industry, laws and regulations. The T1D community has demonstrated itself to be capable of productively contributing to the improvement of patient care thereby demonstrating that patient centric approach can not only shift the power dynamic in healthcare but also foster real change for better health outcomes.