French reforms bring privacy concerns

-----------
netizen 1.07. 22 nov 1995. © e-Med news. Published in the Issue 6, December 5 1995.
-----------

The French government has ordered official bodies to develop and agree an encryption method to protect medical data when transmitted through the country's growing national health networks. The body which regulates security and encryption, the SCSSI (Service Central pour la Sécurité des Systèmes d'Informations), is to cooperate with the computers and privacy commission CNIL, the national health insurance body CNAM, and the professional association of French doctors, the Conseil de l'Ordre des Médecins.

At a conference in Paris in late November, organized by the business newspaper Les Echos, healthcare experts stressed that the huge development of medical computer networks between healthcare professionals and health insurance agencies (caisses) in France could put users' medical privacy at risk. Encryption was agreed to be the best solution for keeping the transmitted data confidential.

The CNAM itself is building a computer network linking local and regional caisses, and will thus handle and transmit very sensitive personal data, such as records of AIDS cases. Jean-Paul Verdaguet, the CNAM's director of computer security matters, told e-Med News he would insist on using "strong encryption to keep medical secrets out of the hands of anybody but selected people at the CNAM". He added: "Protecting medical privacy is a fundamental right for every citizen. Even government officials would not be allowed to have direct access to it". Mr Verdaguet warned that France would not accept any moves similar to GCHQ's attempts to prevent encryption in the new British National Health Service network (see e-Med News no.3, p.6. And EPIC Alert Newsletter, 2.13, oct 30 95.). "This is my own conviction (and) I will try to convince official authorities (e.g. the SCSSI)", he said.

Currently, however, encryption is rigorously restricted because the French government wants to be able to intercept all existing communications for law enforcement purposes. Healthcare officials hope that special dispensations could be made to protect medical privacy. For example, the smartcard project Sesam-Vitale will be used by both patients and healthcare professionals to record all medical acts and transmit them automatically to the caisses. But the same card will also be used as the carnet médical, or treatment record, thus keeping track of the patient's therapeutic profile. Smartcard manufacturers like Gemplus maintain that modern chip technologies can be used in smartcards to provide reliable encryption methods. This could encompass the digital signature, which would protect data integrity by ensuring both that the original message has been sent by the right person and that the data has not been modified during transmission. The chip could also be used to scramble data to protect the message's confidentiality. Healthcare officials have not given any assurance, however, that high security scrambling methods will be used to protect medical secrets.

Prime Minister Alain Juppé's recent call for a comprehensive shake-up of the French social security system to reduce its FF110 billion deficit and control healthcare expenditure will also lead to significant technological changes in healthcare management. As part of the plan he officially relaunched the automated coding of medical acts, originally scheduled in a 1993 law. The reform will replace all paper-based transactions with bar codes for drugs prescription, and computer-based digital transmissions for recording medical acts.

Automated payment is already under way as a means of controlling costs. Conference figures suggested that between 25% and 50% of pharmacists are already transmitting their reimbursement claims through computer networks. But only a tiny portion of this data is really securely protected. Sophie Vuillet-Tavernier of the CNIL, told e-Med News: "This causes real privacy concerns". It could also be a source of computer-based fraud, said security experts at the conference.

Medical coding itself is scheduled to begin with laboratory and pharmacy procedures, and will end with pathology and disease classification (see e-Med News, October 24th, no.3, p.9). The French government says the coding reform must be well advanced by the end of next year; more pessimistic experts say that no real progress will be made before 1998.

Gérard Rameix, director-general of the CNAM, said the first 'symbolic' decision would be to impose a tax of FF1 for every paper-based treatment form generated by physicians. The tax will be used to pay for the computerization of doctors' practices and should generate FF900 million next year and a further FF800 million in 1997. The implementation of information systems should enable the introduction of medical coding and encourage doctors to use computers and digital treatment forms. Currently only 15% of physicians have reliable computer systems installed in their practices, compared with around 80% of pharmacists.


Retour vers la page d'acceuil de netizen.