Wireless networks in healthcare: critical information at the point of care. (Storage Networking).

Dr. John Halamka enables doctors, nurses, and other healthcare professionals to have immediate access to what's happening with their patients. As associate dean of Harvard Medical School and CIO of CareGroup Healthcare Systems, Halamka has armed thousands of healthcare professionals at the six CareGroup hospitals with wireless laptops, tablets, and PDA's. In fact, a key part of CareGroup's IT infrastructure includes a wireless network used by healthcare professionals to access diagnostic, drug interaction and patient history wherever a patient receives care.

Halamka said the mobility that wireless networks provide is crucial in the modern hospital. "Many places in the hospital are hubs of activity--the ER, ICU, the surgical recovery room--where there are nurses running around getting orders and needing test results."

"Every day there's more medical knowledge published than a doctor could read in a lifetime," said Halamka. The flood of information extends beyond that generated by universities and research centers, though, he adds.

Jon Bogen, managing principal of HealthCIO said, "A lot of clinicians in the field want to do point-of-care charting and ordering." He explains that immediacy and accuracy are each improved by immediate record keeping. "Wherever they're delivering the care, they want to record the information and have it stored centrally. You tend to get more accurate information recorded, and if you can look up a central database to check on a patient's condition you improve quality of care because you don't have to rely on human memory."

Caregivers are pushing for wireless networking technologies that allow for quick access to patient information. The relationship between patient and caregiver shapes the nature of the technology chosen to implement the information service. "Using a small handheld computer looks much more personal than when you're sitting behind a big computer monitor that sits between you and the patient," said Bogen.

The list of advantages is long enough that you would expect every hospital and clinic to rush towards implementing a wireless network. Serious concerns on two fronts have slowed that rush, however, and, in some cases, prevented institutions from seriously considering a wireless infrastructure.

Dangerous Energy?

The first concern is, in the eyes of most physicians and nurses, the most important: Will wireless network devices harm a patient? There is some concern, based on research and observation, that radio-frequency (RF) devices such as cell phones, public service radios, and wireless networking devices may interfere with critical medical items such as ventilators, infusion pumps, apnea monitors, and EEG machines. However there is more fiction than fact to this.

"Rumors of wireless handhelds causing pacemakers to arrest are grossly exaggerated to the point of silliness," said Halamka.

Many medical centers have responded by limiting the operation of wireless devices in areas where patients and medical electronic devices are in use. Others restrict wireless devices to ranges outside of certain limits depending on the transmitted power of the device. Wireless network access points lend themselves well to this approach since ideal placement is near the ceiling of rooms.

When laptop computers and other user devices are kept several feet from patients and medical electronics, risks are minimized on the client side of the technology. As with the use of computers on commercial airline flights, experience with wireless networks in hospitals and clinics is leading many institutions to approve their use with fewer and fewer restrictions.

Hyper About HIPAA 

Hospital administrators share the physician's concern for patients' well-being, but have additional worries, as well. The most serious administration concerns lie with the requirements of HIPAA, the Health Insurance Portability and Accounting Act, concerning patient privacy and confidentiality. HIPAA requires healthcare institutions to take precautions safeguarding patient information from unauthorized access. The requirements of HIPAA vary in their impact on various phases of information operations, but they all have teeth; failing to protect patient information can results in fines of up to $25,000 per incident.

Administrators frightened by the prospect of massive fines have sometimes responded by declaring that wireless networks are incompatible with the demands of HIPAA. Network managers facing the demands of information-hungry users, counter administration prohibitions on wireless networks by exploring architectural solutions to the perceived weaknesses of 802.11b networks.

One architectural solution involves carefully segmenting the network into segments that can access (and be accessed by) users on the Internet, and those that cannot. HealthCIO's Brogan said that HIPAA makes a clear distinction between private networks that are separate from the Internet, and those that 'are accessible from outside the organization. Private networks have an assumption of security, even if a "war driving" hacker manages to find a wireless access point. Once there is a point of contact between the local area network and the Internet, the situation changes.

Access control, authentication and encryption are key to responsible wireless network deployment in a HIPAA-aware environment.

HIPAA rules are divided into three broad categories covering insurance transaction regulation, patient privacy, and record security. The rules for record security have yet to be formalized, but Dr. John Halamka said that his organizations have decided on the "Boston Globe Test" for security implementation: "If you published your security policy in the Boston Globe, would the average reader think they're sufficient?"

Virtually all 802.11b access points are shipped with the capability to protect connections through WEP (wired equivalence protocol). The problem with WEP is that it's easily broken with tools available to any hacker. Not only that, but WEP is seldom turned on.

Most network administrators would agree that relying on WEP alone fails the Boston Globe test. Some vendors, such as Cisco, are beginning to include more advanced security features in wireless routers and access points, but most administrators turn to standalone solutions to increase the security of wireless networks.

Halamka, for example, has chosen a product from Bluesocket that adds user access control, user authentication and encryption more robust than that delivered by WEP to wireless networks. He says that adding the Bluesocket services to wireless network implementation lets him meet the requirements of HIPPA: "Bluesocket doesn't allow the average person to try to get into the network, and it passes the 'Boston Globe Test' without doubt."

Passing security muster is important because both Halamka and Bogen agree that medical facilities are targets of particular interest to hackers. "I don't think WEP is sufficient security, because people have managed to hack the protocol and hackers are out there trying to embarrass the medical community," said Bogen.

Halamka is even more explicit in his assessment. "We get attacked about 15 times a day," he said, explaining, "We get everything from denial-of-service attacks to Microsoft security exploitation attacks, but so far we have had no penetration."

Treat the Problem

Wireless networks are growing at a fast clip because they solve problems for both administrators and caregivers. According to Gartner Group, organizations have embraced the technology because of the benefits of roaming as well as the widespread use of mobile PCs. Over 15 million laptops with wireless support will be shipped in 2005, up from 2.9 million in 2001.

"I don't think it's hard to demonstrate the business case for installing wireless," said Bogen, "It pays for itself quickly, improves patient care, increases information capture efficiency and more." The necessary mobility of healthcare professionals makes building a wired infrastructure with a stationary computer at every location where it's needed too daunting a task. Halamka feels that the sheer volume of information generated and used by healthcare institutions makes its availability at the point of care crucial: "I move 40TB of data a day."

The most important benefit of wireless networks in hospitals and clinics, a benefit seen by both administrators and caregivers, is that information at the point of care makes a qualitative difference in the quality of care provided to patients. When the improved quality of care is supported by a system that increases the efficiency of administration with faster billing and better patient tracking, the result is a system too valuable to be left undeployed. As CIOs and managers refine solutions to their issues of safety and security, wireless networks will show up in the hands of more doctors and nurses.

Curtis Franklin is president of CF2 Group, a technology consulting and communications firm in Gainesville, Fla. ([e-mail])