Home

Cover Story

Table of Contents

E-Newsletter

Article Archive

Editorial Calendar

Datebook

Writers' Guidelines

Orgs/Links

Opinion Polls

Reprints

Forum

For other articles and previous issues click here.

July 11, 2005

Not in the Cards — Biometrics Offers Better Security for Patients and Systems
By Robbi Hess
Radiology Today
Vol. 6 No. 14 P. 18

Whether for patients or system users, individual identifiers such as fingerprints can speed and protect healthcare.

On the myriad medical forms you have completed, your name may be listed as John M. Smith, J.M. Smith, or J. Michael Smith. You know exactly who you are, but what happens if there is another J.M. Smith who lives in your town, has a similar address, and frequents the same local hospital? What happens if you are incapacitated and unable to speak for yourself? Are you certain the caregiver will pull the correct medical records or are you running the risk of being misidentified when entering a multifacility hospital system?

If the hospital you frequent utilizes biometric technology, a simple fingerprint virtually eliminates the possibility of mistaken identity and ensures that the caregiver has access to medical records that are uniquely yours.

“A fingerprint is a universal translator when you can’t speak for yourself or if there are other language barriers,” says John K. Schneider, PhD, Ultra-Scan founder, president, and chief technology officer (CTO). “A patient can be immediately identified and if an ambulance is equipped with a portable biometric unit, care can begin before the patient reaches the acute care facility.”

Why Biometric Technology?
Biometrics is the science of identifying individuals based on unique biological characteristics, such as fingerprints. Much more secure than presenting a health insurance card—which could be lost, copied, or stolen—a fingerprint could be the ultimate personal “key” to unlocking doors and keeping your individual data—medical and otherwise—secure.

“Biometrics has a great fit in improving safety and quality of care for patients through accurate identification,” Schneider explains. “A fingerprint scan can accurately identify the Marys, Johns, and Joes of the world both on admission to the hospital and throughout their care. Biometrics can eliminate the ambiguity associated with patient identification.”

HIPAA also specifies security standards for patient health information. The idea that entering a password into a desktop terminal is secure is considered by some to be an outdated fallacy.

“What sort of compliance is it when a piece of paper hangs on the computer to remind the user of the password?” DigitalPersona Cofounder/CTO Vance Bjorn asks. “Fingerprint log-ins improve compliance, make it easier for the user because they don’t have to remember a slew of passwords, and lowers operating costs.”

“By implementing a strong authentication scheme into their environment, healthcare organizations can guarantee that access to patient health information is limited to authorized clinicians only,” says Ali Ersheid, director of product management at BNX Systems. “Problems such as password sharing and delegated access can be completely eliminated to ensure patient privacy.”

When used to register and identify patients, biometric technology ensures that patients cannot impersonate other patients during hospital visits, which reduces the risk of fraud and worse, including the risk of identifying a patient incorrectly and associating him or her with another person’s medical records.

In addition to correctly identifying a patient, Ersheid says biometrics could be used to enhance a healthcare facility’s physical security.

“Biometrics can also be used to restrict access to physical areas in the hospital,” he explains. “For example, maternity ward doors can be fitted with fingerprint readers that would allow access to authorized personnel and registered parents or family members. Such security would ensure the safety of newborns.”

William Spooner, chief information officer and senior vice president at Sharp HealthCare, says biometrics is one component of their new clinical desktop that’s intended to ensure patient safety by providing the caregiver the necessary tools in a convenient and safe manner.

In 2003, Sharp reengineered its entire clinical system in an effort to simplify caregiver access to electronic medical records (EMRs) and implement greater security and patient privacy. As in many industries, enforcing the best practice systems security while ensuring ease of access to the system can be competing goals.

“We had to have a product that was as seamless as possible, allowing users to go from one system to another,” Spooner explains. “One component of biometrics is its convenience factor for sign-in [using] fingerprint ID. The caregiver can use his or her fingerprint instead of a password.”

Spooner says there is 85% compliance in staff usage. The fingerprint readers are connected to a variety of systems, including PCs, shared workstations, and mobile carts, both traditional and wireless.

Enrollment Procedures
Following a process that takes less than two minutes, a patient can be enrolled in the Ultra-Scan system. The patient would have both index fingers scanned, a digital photo taken as a way to prove visual confirmation, and the healthcare worker will identify and scan a couple of identifiers such as a health insurance card and driver’s license. With the Ultra-Scan technology, all information and scanning is processed at a biometric identity enrollment station that has built-in scanners and digital equipment.

“After the initial enrollment, the patient simply places a finger down on the scanner and in a couple of seconds the database is accessed and the medical records are brought up,” Schneider says.

Biometrics identifies someone based on a personal characteristic of that individual either by face, voice, or fingerprint, the most popular biometric. “You no longer have to ask Mary Smith to bring her license for identification,” Schneider says. “All you have to ask her to do now is place her finger on the scanner and in a couple of seconds she is accurately identified and her records are pulled.”

Making the Technology Work
In the past, optical fingerprint scanners were utilized but the optics caused false readings because they weren’t able to measure against the ridges and valleys in a fingerprint without regard for dirt, moisture, or other substances found on an individual’s finger.

“The biggest technology limitation facing healthcare is the limitation surrounding how fingerprint devices would work,” Schneider says. “Traditionally, optical devices—basically a digital camera—were used. If your finger was clean, it worked well. In healthcare, you have all types of demographic groups, white- and blue-collar workers, and if you get a greasy, grimy fingerprint, the digital camera would take a picture of all the dirt, grease, and grime and not get accurate results. Many hospitals that tried optical scanners were disappointed with the technology’s limitations.”

Ultrasonic technology in the field of biometrics uses high-frequency sound waves to penetrate foreign substances on a finger and obtain accurate measures of the ridges, grooves, and swirls regardless of grime.

Sharp utilizes either fingerprint identification or passwords. Why still depend on passwords? “We’ve found that some people’s fingerprints are not easily read or the readers have a hard time interpreting it. For example, if the caregiver is frequently gloved, the reader doesn’t read the fingerprint through the glove,” Spooner says.

Ultra-Scan utilizes LUIS (Livescan Ultrasonic Identification System), which can take an image through the contamination brought about by daily activities. “The quality of the image isn’t distorted by the dirt of everyday life,” Schneider says. “We get an accurate result better than any other vendor because with LUIS, we get an accurate reading.”

Ersheid agrees that LUIS technology is more accurate than optical or semiconductor-based sensors. “Although it’s more expensive, ultrasound-based fingerprint readers tend to be more rugged and practically fraud-free,” he says.

System User Log-in
From a user interface point of view, log-in is as simple as placing a finger on a scanner and waiting for two seconds.

“We’ve rolled this out and both patient and healthcare worker acceptance is close to 100%,” Schneider says. “The use of the system is entirely optional, though, and if a patient isn’t comfortable with the technology, they don’t have to use it. A healthcare worker can explain the system, its conveniences, what safety issues it addresses, and that it costs nothing to the patient to participate. When you present it to them that way, it [has] a very high acceptance rate by patients. It’s a nonobtrusive technology.”

Gaining healthcare professional acceptance was challenging when Ultra-Scan was rolling out its technology, Schneider says. “We put a lot of time and effort into the human interface system and realize that registration clerks have a wide variety of computer skill levels,” he explains. “The system is a simple point-and-click process and it is automatically process-driven to take the user through the steps—once one is completed, it goes effortlessly to the next.”

Most customers have used it for several months, have validated how well the LUIS technology works, and are applying it in other areas, such as physical access control to medical cabinets and other secured areas.

Spooner says getting the doctors and nurses to accept the technology was one of the first steps in implementing the process.

Ersheid agrees that staff compliance is paramount to successful implementation of a biometric technology.

“For patients, it’s a little more complicated,” he says. “Some people are wary of giving their fingerprints to a hospital, but this will come with time as biometrics become more commonplace in the workplace and at home. In the meantime, the user of biometrics can be positioned as a measure to increase patient safety and to lower fraud—thus lowering the cost of medicine for the patient.”

Selecting a Biometric
Schneider says a healthcare facility needs to find a biometric technology that will work under various applications and not until LUIS came along was that possible.

“One of the things I caution is to find a biometric vendor that has direct experience in the application you are looking for,” Schneider explains. “Biometrics has grown up in the law enforcement field and the FBI’s use of fingerprints. People think if a vendor is good enough for the FBI, then they’re good enough for us. My argument is that the application requirements for the FBI are so vastly different than the applications for a hospital that I caution healthcare decision makers to find a biometric vendor that has been involved in the healthcare industry.”

Costs range from $10 million to $30 million for the implementation of a traditional, demographic-based master patient index system. Ultra-Scan can enter a facility and have biometric technology up and running within two months of deployment for roughly $500,000 without destroying any of the present systems. It keeps prices low by not replacing the existing EMR.

“We’re much more accurate than a demographic-based system, but we don’t spend a tremendous amount of time and money [on] resolving duplicate database errors that exist in the legacy database system,” Schneider says. “We stop problems from this day forward and it is the healthcare facility’s task to find and change database errors. Many hospital administrators say errors will take care of themselves over time through patient attrition.”

Schneider says if the implementation of a biometric system helps a healthcare organization avoid just one malpractice lawsuit—which he says cost hospitals $650,000 on average in 2004—it would in essence pay for itself.

Different biometric technologies have different applications, Ersheid says. “Out of all currently available biometric technologies, fingerprint scanners tend to be the most accurate, intuitive, and cost-effective,” he says. “Choosing among the available fingerprint scanner technologies comes down to accuracy and cost.”

The lower-cost semiconductor-based scanners can cost as little as $40 while ultrasound scanners are priced in the thousands.

“Cost-effective fingerprint scanners that utilize semiconductors or optical technology are ideal for ‘one-to-one’ or ‘one-to-few’ applications such as employee authentication or door access where the scanned fingerprint needs to be matched to a limited number of potential previously scanned templates,” Ersheid explains. “But ultrasound technologies might be more ideal for patient identification where the number of potential records can be in the tens of thousands or higher.”

When choosing a biometric package, hospitals need to look for solutions that can support a variety of devices and applications.

Making a Point
Biometrics support HIPAA compliance, but they are only one piece of the puzzle to securing access to networks and applications and ensuring that access is more secure than with a password or key cards.

At Sharp, biometrics and its authentication solution provide greater security for 10,000 users and, as a result, will protect the information of countless numbers of patients.

Spooner says patients benefit because nurses and doctors can dedicate more time to care because they are spending less time entering passwords or sign-on scripts. Also, by having all relevant patient information online, the caregiver has access to the data he or she needs at the time of treatment.

DigitalPersona Cofounder Bjorn says, “Basically, for HIPAA compliance reasons, the notion of being able to know who did what transaction, when, and who entered it using fingerprint recognition is a straightforward, simple way to accommodate those regulations.”

Passwords just aren’t enough to authenticate the individual who is entering your private medical records.

“Customers need to trust who is accessing their private data, and how do you authenticate the people who authenticate the data?” Bjorn asks. “Passwords are not enough—they don’t say who the person is who is entering that data. But with a fingerprint sign-in, there is no doubt about the data.”

— Robbi Hess, a journalist for more than 20 years, is a writer/editor for a weekly newspaper and a monthly business magazine in western New York.

Subscribe to Radiology Today Magazine!