Image Retention in the PACS Era

Transcription

1 Image Retention in the PACS Era Susan D. John, M.D. Professor and Chair, Dept. of Diagnostic and Interventional Imaging SCARD Fall 2015

2 Objectives At the end of this presentation, the attendee will be able to: Define the rationale for developing an institutional policy to guide retention and deletion of medical images from the PACS archive. Develop a policy for deletion of PACS images using the experiences of institutions with active programs. Acknowledge concerns of referring physicians and radiologists about PACS image deletion Consider strategies to gain physician acceptance of such programs

3 I have no financial conflicts to disclose.

4 Deletion of PACS Images A Relatively New Concept MHHS Dec Announcement that PACS images older than 5 years would be deleted. Alarms sounded!!!! No rationale was given Program scheduled to start in 30 days Flurry of activity Sought local physician responses Queried a sample of academic institutions

5 Cost Health System Rationales Increasing size and number of imaging exams is stressing capacity of archive Security risk Described as the major hospital concern Maintaining digital information of patients once no longer needed magnifies risk of data breach Medicolegal risk Retained images that are no longer needed for patient care may expose hospital to unnecessary risk of lawsuits

6 Medicare Legal Requirements No federal requirements States Medicare can audit for up to 5 yrs to ensure billing compliance Vary from state to state Policies often not updated for digital images Different policies for mammography, children, cases related to toxic exposure

7 Physician Response Not Happy Why do this? Digital storage is inexpensive Negative impact on patient care Many patients followed for more than 10 years. Oncology Physical Medicine and Rehabilitation Cardiovascular surgery

8 Physician Response Research Retrospective protocols for uncommon diseases may need to access cases that go back more than 10 years May not be able to predict what patients will be studied in the future Education Time is needed to plan separate archive for educational materials

9 Informal SCARD Survey Jan responses Store PACS images indefinitely 26 Autodelete images after a period of time 3 Ranged from 7 years to 26 years Planning an image deletion policy 3 Similar SCORCH survey Most maintain indefinitely or for at least yrs

10 What is the security risk? Scott Erven, Mark Collao Security researchers at DerbyCon 5.0 (2015) Shodan search engine for devices connected to public Internet Honeypot research Are devices being attacked? What are the motivations? Targeted attack or random noise?

11 Conclusions Device Security Research Many devices accessible through Internet Tens of thousands of hospital computer systems and medical devices One very large U.S. healthcare system 97 MRI devices 323 PACS devices Hundreds of other devices (CT, Nuclear Medicine, etc) 3 vulnerabilities Weak default administrative credentials Known software vulnerabilities Transmission of unencrypted data bigguy

12 What is the risk for images? Compromised easily Most attacks not after imaging data per se Usually after financial gain (credit card data, PPI) Many devices do have good protection from patient safety perspective If software controls not adequate, attacker can get administrative controls just like technologists Not just attackers: Patients hacked into an infusion pump to increase dose of pain meds

13 All software has flaws Bottom Line As connectivity increases, more data entered into a hostile environment A software driven, connected medical device is a vulnerable and exposed device

14 Compromise Policy at MHHS Auto-delete will occur: Adults 10 years after last imaging study Children 18 years, plus 10 years after last study System will consider exceptions for: Certain patients at the request of the physician

15 Summary Administrators are eager to implement image retention/deletion policies Security risks Cost Physicians are concerned about impact on patient care, research, and education Policies will almost certainly become necessary as imaging archives grow