#patient data

Canadians' electronic health records need more protections to prevent foreign entities from accessing patient data, according to commentary in the Canadian Medical Association Journal. "Canadian privacy law is badly outdated," said Michael Geist, law professor and Canada Research Chair in internet and e-commerce law at the University of Ottawa and co-author of the commentary. "We're now talking about decades since the last major change." Geist says electronic medical records systems from clinics and hospitals — containing patients' personal health information — are often controlled by U.S. companies. The data is encrypted and primarily stored on cloud servers in Canada, but because those are owned by American companies, they are subject to American laws.

Continue reading

This spring brings a wave of new technology designed to confirm that patients are who they claim to be when accessing medical records or joining virtual visits. Healthcare IT company Verato launched a shared network that lets hospitals and insurers tap into a central identity database rather than building their own separate systems. As more organizations join, the network becomes more accurate, creating a standard way to match patient records across different providers. Meanwhile, electronic health record giant Epic added identity verification tools from 1Kosmos and Vouched to its MyChart patient portal. These features let patients prove their identity using government-issued IDs and selfies, meeting federal security standards without complicating the login process. Video platform Zoom also entered the space by partnering with Tools for Humanity to add real-time face verification to video meetings. The move targets the rising threat of deepfakes and fraud in telehealth and business calls, with losses projected to hit $40 billion by 2027.

Many patients assume federal privacy laws keep their health information safe, but that protection has strict limits. HIPAA, the main health privacy law, only covers doctors, hospitals, and their specific business partners. Most consumer health apps and fitness trackers operate outside this framework, meaning their privacy policies determine how your data gets shared or sold. Simple steps can sharply reduce exposure. Enabling two-factor authentication and using unique passwords for every patient portal and health app adds crucial protection. Regularly checking which permissions apps have on your phone also limits unnecessary data collection. Screenshots and email attachments pose another hidden risk. These files spread easily, cannot be tracked, and often live on devices with weaker security than official medical records. Sensitive health details shared this way can travel far beyond their intended recipient, creating privacy breaches that laws cannot easily fix.

NHS England has granted Palantir, a US data analytics company, unlimited access to patient health records as part of a national digitisation scheme. The firm, which already supplies software to UK police forces, the Ministry of Defence, and local councils, uses technology that aggregates vast amounts of information to identify patterns. The deal has sparked protests over privacy risks and ethical concerns regarding Palantir's relationship with the Israeli military, which uses its technology to identify targets. Critics worry that giving a private contractor such broad access to sensitive medical information sets a concerning precedent for data protection in the UK's public health system.

Cybersecurity Best Practices for Healthcare Providers