Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
Some hospitals are pioneers in ditching plastic, turning green
This is part 2 of a three part series on a new generation of doctors leading the charge to make the health care industry more sustainable - for the benefit of their patients and the planet. Read part 1 here and part 3 here.
After graduating from her studies as an engineer, Nora Stroetzel ticked off the top item on her bucket list and traveled the world for a year. She loved remote places like the Indonesian rain forest she reached only by hiking for several days on foot, mountain villages in the Himalayas, and diving at reefs that were only accessible by local fishing boats.
“But no matter how far from civilization I ventured, one thing was already there: plastic,” Stroetzel says. “Plastic that would stay there for centuries, on 12,000 foot peaks and on beaches several hundred miles from the nearest city.” She saw “wild orangutans that could be lured by rustling plastic and hermit crabs that used plastic lids as dwellings instead of shells.”
While traveling she started volunteering for beach cleanups and helped build a recycling station in Indonesia. But the pivotal moment for her came after she returned to her hometown Kiel in Germany. “At the dentist, they gave me a plastic cup to rinse my mouth. I used it for maybe ten seconds before it was tossed out,” Stroetzel says. “That made me really angry.”
She decided to research alternatives for plastic in the medical sector and learned that cups could be reused and easily disinfected. All dentists routinely disinfect their tools anyway and, Stroetzel reasoned, it wouldn’t be too hard to extend that practice to cups.
It's a good example for how often plastic is used unnecessarily in medical practice, she says. The health care sector is the fifth biggest source of pollution and trash in industrialized countries. In the U.S., hospitals generate an estimated 6,000 tons of waste per day, including an average of 400 grams of plastic per patient per day, and this sector produces 8.5 percent of greenhouse gas emissions nationwide.
“Sustainable alternatives exist,” Stroetzel says, “but you have to painstakingly look for them; they are often not offered by the big manufacturers, and all of this takes way too much time [that] medical staff simply does not have during their hectic days.”
When Stroetzel spoke with medical staff in Germany, she found they were often frustrated by all of this waste, especially as they took care to avoid single-use plastic at home. Doctors in other countries share this frustration. In a recent poll, nine out of ten doctors in Germany said they’re aware of the urgency to find sustainable solutions in the health industry but don’t know how to achieve this goal.
After a year of researching more sustainable alternatives, Stroetzel founded a social enterprise startup called POP, short for Practice Without Plastic, together with IT expert Nicolai Niethe, to offer well-researched solutions. “Sustainable alternatives exist,” she says, “but you have to painstakingly look for them; they are often not offered by the big manufacturers, and all of this takes way too much time [that] medical staff simply does not have during their hectic days.”
In addition to reusable dentist cups, other good options for the heath care sector include washable N95 face masks and gloves made from nitrile, which waste less water and energy in their production. But Stroetzel admits that truly making a medical facility more sustainable is a complex task. “This includes negotiating with manufacturers who often package medical materials in double and triple layers of extra plastic.”
While initiatives such as Stroetzel’s provide much needed information, other experts reason that a wholesale rethinking of healthcare is needed. Voluntary action won’t be enough, and government should set the right example. Kari Nadeau, a Stanford physician who has spent 30 years researching the effects of environmental pollution on the immune system, and Kenneth Kizer, the former undersecretary for health in the U.S. Department of Veterans Affairs, wrote in JAMA last year that the medical industry and federal agencies that provide health care should be required to measure and make public their carbon footprints. “Government health systems do not disclose these data (and very rarely do private health care organizations), unlike more than 90% of the Standard & Poor’s top 500 companies and many nongovernment entities," they explained. "This could constitute a substantial step toward better equipping health professionals to confront climate change and other planetary health problems.”
Compared to the U.K., the U.S. healthcare industry lags behind in terms of measuring and managing its carbon footprint, and hospitals are the second highest energy user of any sector in the U.S.
Kizer and Nadeau look to the U.K. National Health Service (NHS), which created a Sustainable Development Unit in 2008 and began that year to conduct assessments of the NHS’s carbon footprint. The NHS also identified its biggest culprits: Of the 2019 footprint, with emissions totaling 25 megatons of carbon dioxide equivalent, 62 percent came from the supply chain, 24 percent from the direct delivery of care, 10 percent from staff commute and patient and visitor travel, and 4 percent from private health and care services commissioned by the NHS. From 1990 to 2019, the NHS has reduced its emission of carbon dioxide equivalents by 26 percent, mostly due to the switch to renewable energy for heat and power. Meanwhile, the NHS has encouraged health clinics in the U.K. to install wind generators or photovoltaics that convert light to electricity -- relatively quick ways to decarbonize buildings in the health sector.
Compared to the U.K., the U.S. healthcare industry lags behind in terms of measuring and managing its carbon footprint, and hospitals are the second highest energy user of any sector in the U.S. “We are already seeing patients with symptoms from climate change, such as worsened respiratory symptoms from increased wildfires and poor air quality in California,” write Thomas B. Newman, a pediatrist at the University of California, San Francisco, and UCSF clinical research coordinator Daisy Valdivieso. “Because of the enormous health threat posed by climate change, health professionals should mobilize support for climate mitigation and adaptation efforts.” They believe “the most direct place to start is to approach the low-lying fruit: reducing healthcare waste and overuse.”
In addition to resulting in waste, the plastic in hospitals ultimately harms patients, who may be even more vulnerable to the effects due to their health conditions. Microplastics have been detected in most humans, and on average, a human ingests five grams of microplastic per week. Newman and Valdivieso refer to the American Board of Internal Medicine's Choosing Wisely program as one of many initiatives that identify and publicize options for “safely doing less” as a strategy to reduce unnecessary healthcare practices, and in turn, reduce cost, resource use, and ultimately reduce medical harm.
A few U.S. clinics are pioneers in transitioning to clean energy sources. In Wisconsin, the nonprofit Gundersen Health network became the first hospital to cut its reliance on petroleum by switching to locally produced green energy in 2015, and it saved $1.2 million per year in the process. Kaiser Permanente eliminated its 800,000 ton carbon footprint through energy efficiency and purchasing carbon offsets, reaching a balance between carbon emissions and removing carbon from the atmosphere in 2020, the first U.S. health system to do so.
Cleveland Clinic has pledged to join Kaiser in becoming carbon neutral by 2027. Realizing that 80 percent of its 2008 carbon emissions came from electricity consumption, the Clinic started switching to renewable energy and installing solar panels, and it has invested in researching recyclable products and packaging. The Clinic’s sustainability report outlines several strategies for producing less waste, such as reusing cases for sterilizing instruments, cutting back on materials that can’t be recycled, and putting pressure on vendors to reduce product packaging.
The Charité Berlin, Europe’s biggest university hospital, has also announced its goal to become carbon neutral. Its sustainability managers have begun to identify the biggest carbon culprits in its operations. “We’ve already reduced CO2 emissions by 21 percent since 2016,” says Simon Batt-Nauerz, the director of infrastructure and sustainability.
The hospital still emits 100,000 tons of CO2 every year, as much as a city with 10,000 residents, but it’s making progress through ride share and bicycle programs for its staff of 20,000 employees, who can get their bikes repaired for free in one of the Charité-operated bike workshops. Another program targets doctors’ and nurses’ scrubs, which cause more than 200 tons of CO2 during manufacturing and cleaning. The staff is currently testing lighter, more sustainable scrubs made from recycled cellulose that is grown regionally and requires 80 percent less land use and 30 percent less water.
The Charité hospital in Berlin still emits 100,000 tons of CO2 every year, but it’s making progress through ride share and bicycle programs for its staff of 20,000 employees.
Wiebke Peitz | Specific to Charité
Anesthesiologist Susanne Koch spearheads sustainability efforts in anesthesiology at the Charité. She says that up to a third of hospital waste comes from surgery rooms. To reduce medical waste, she recommends what she calls the 5 Rs: Reduce, Reuse, Recycle, Rethink, Research. “In medicine, people don’t question the use of plastic because of safety concerns,” she says. “Nobody wants to be sued because something is reused. However, it is possible to reduce plastic and other materials safely.”
For instance, she says, typical surgery kits are single-use and contain more supplies than are actually needed, and the entire kit is routinely thrown out after the surgery. “Up to 20 percent of materials in a surgery room aren’t used but will be discarded,” Koch says. One solution could be smaller kits, she explains, and another would be to recycle the plastic. Another example is breathing tubes. “When they became scarce during the pandemic, studies showed that they can be used seven days instead of 24 hours without increased bacteria load when we change the filters regularly,” Koch says, and wonders, “What else can we reuse?”
In the Netherlands, TU Delft researchers Tim Horeman and Bart van Straten designed a method to melt down the blue polypropylene wrapping paper that keeps medical instruments sterile, so that the material can be turned it into new medical devices. Currently, more than a million kilos of the blue paper are used in Dutch hospitals every year. A growing number of Dutch hospitals are adopting this approach.
Another common practice that’s ripe for improvement is the use of a certain plastic, called PVC, in hospital equipment such as blood bags, tubes and masks. Because of its toxic components, PVC is almost never recycled in the U.S., but University of Michigan researchers Danielle Fagnani and Anne McNeil have discovered a chemical process that can break it down into material that could be incorporated back into production. This could be a step toward a circular economy “that accounts for resource inputs and emissions throughout a product’s life cycle, including extraction of raw materials, manufacturing, transport, use and reuse, and disposal,” as medical experts have proposed. “It’s a failure of humanity to have created these amazing materials which have improved our lives in many ways, but at the same time to be so shortsighted that we didn’t think about what to do with the waste,” McNeil said in a press release.
Susanne Koch puts it more succinctly: “What’s the point if we save patients while killing the planet?”
The Friday Five: A surprising health benefit for people who have kids
The Friday Five covers five stories in research that you may have missed this week. There are plenty of controversies and troubling ethical issues in science – and we get into many of them in our online magazine – but this news roundup focuses on scientific creativity and progress to give you a therapeutic dose of inspiration headed into the weekend.
Listen on Apple | Listen on Spotify | Listen on Stitcher | Listen on Amazon | Listen on Google
Here are the promising studies covered in this week's Friday Five:
- Kids stressing you out? They could be protecting your health.
- A new device unlocks the heart's secrets
- Super-ager gene transplants
- Surgeons could 3D print your organs before operations
- A skull cap looks into the brain like an fMRI