How to verify new accounts against a known persons database?

Question

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her against her medical chart.

Let's assume that most patients will not have an email address listed among the data that I already have. If I want to allow a prospective patient to submit a bunch of demographics information, and then if it matches, receive an activation code, is there an alternative to sending that code to whatever email address the prospective patient provides? Because I might know all of the info for another person (i.e. an estranged spouse or a neighbor who doesn't shred their garbage) and then give my own email address (which can't be verified).

Short of having the prospective patient come into the doctor, or receive snail mail, to verify her identity (the problem I'm trying to solve) is there any way these types of verifications can be done?

(I am posting this here as suggested in a comment when I posted it to webmasters.stackexchange)

Is there something that prevents them from creating an account in the office during their next visit? — Jeff Ferland, Aug 08 '11 at 19:16
As clarification, what percent of the records have phone numbers assigned to them? — blunders, Aug 08 '11 at 20:45
It's good to hear that Germany is not the only country where the health care system is designed by...well, its actually not designed at all but more of a big accident with potentially high profit margin. — pepe, Aug 08 '11 at 21:16
@Jeff Ferland - No that still works but the business wants an online only option. — Don Zacharias, Aug 08 '11 at 22:04
@blunders we might have way more phone #s than email, and I'm having a report generated. Patients don't need to give us an email unless they sign up for the portal, so I'm guessing something like 1% of inactive pts will have one listed. — Don Zacharias, Aug 08 '11 at 22:07

score 9 · Answer 1 · answered Aug 08 '11 at 20:13

9

This is what I'm hearing you say: You have a medical facility with computerized records for the full set of patients. You want to allow web users to try and set up accounts with a one-to-one mapping between actual patient and their own records. Your goal is to allow this to be done online without resorting to out-of-band methods such as snail mailing account information or requiring an office visit.

There's two questions here:

Can you one-to-one match a user against their patient record based on what they know?
Can you trust verification based purely on what they know?

The answer to both tends to be "not really." Because patients may use different names or variations (I've got paper trails as both 'Greg' and 'Gregory'), there may be name mismatches. Adding in things like birthdate helps, but is still not collision-proof. And you probably have multiple patients with the same name - I've worked with so many Jennifer Chens over the years it isn't funny.

...which is why your set of patient records all have some form of unique patient ID, hopefully unique to your facility or umbrella medical group. If the user knows that, they can just type that in. But in many cases they won't know it or have it handy. At best, it may show up on paperwork they receive in the mail... but that goes back to what you wanted to avoid.

Finally, nothing a user knows can be trusted to be private. I'm not legally allowed access to my wife's medical data, but I know everything you could possibly ask to identify her. And in this day and age it isn't impossible to find out that level of detail about strangers.

I think you'll find that the standard in this area is to send snail mail out with an initial password. I've signed up for some medical (insurance) related sites where that was how it worked. The snail mail to the address of record is treated as a trusted second form of authentication, although of course, it isn't really. As you pointed out, it's easy enough for a family member or even stranger to intercept that mail.

Given that you're talking about medical records, you need to be careful to avoid the more culpable forms of improper access ("I know John's birthday, so I can get into his medical records"). That may mean resorting to snail mail, which reduces culpability if not exposure.

answered Aug 08 '11 at 20:13

gowenfawr

71,975
17
161
198

If I'm reading your answer correctly, you're saying there's not a solution based on the requirements presented, and pretty much restated options that the original poster of the question stated were not good options. Right? – blunders Aug 08 '11 at 21:11
1

@blunders, Right. With the requirements that the original poster put forth there is no reliable way to do it other than the way the original poster came up with in his post. Some times there is no clever solution. I guess this answer could be shortened to "No." but I think the long explanation is better. – Scott Chamberlain Aug 08 '11 at 21:17
@Scott Chamberlain: I disagree, but waiting for clarification from the poster, since it's not clear how access to a mailbox is more secure than access to a phone. And I'd be very surprised if large percent of medical records do not have a phone number tied to them. – blunders Aug 08 '11 at 21:28
Thank you. I think I can accept this even though you didn't technically give me anything short of snail mail. This is what I was thinking, and I guess I was really looking for gratification on that if I couldn't get an actual alternate solution. – Don Zacharias Aug 08 '11 at 22:11
@blunders The mailbox would be the one in the chart, whereas the email would (in my hypothetical) be the one supplied by the web applicant, which may or may not be appropriate. Maybe some sort of hierarchy of email if in the chart, or text message, or snail mail if nothing else. Thanks! – Don Zacharias Aug 08 '11 at 22:13
3

@blunders, you're right. Should I instead have said "Can't do" without explaining why? As for phones, medical offices will generally not use phones for anything more specific than "please call us back" without requesting and receiving explicit approval to leave personal information in a voice mailbox. At least that's the case with the 2 or 3 of my family's doctors where the question has come up. And when you're at the point of clarifying phone permissions, you're at the point (physical, live voice) of giving them the login info that user3916 wants to pass anyway. – gowenfawr Aug 08 '11 at 22:34
@user3916: Are you saying it's uncommon for charts to have phone numbers? Realize you commented below the question that you were working on generating a report, but I'm not concerned about the mailbox because you said that wasn't good option. – blunders Aug 08 '11 at 22:39
@gowenfawr: Who said anything about voice mail or person-to-person verification. I waiting on an answer if phone numbers are common on records. If they are I'll post my own answer, otherwise I agree there's on easy answer. – blunders Aug 08 '11 at 22:42
1

@blunders, I invite you to end our bated suspense and post your answer in the form of "*IF* phone numbers are common on records..." I assume your answer will deal with the issues of text-capable (cell/SMS) versus no-text (POTS) numbers and shared versus dedicated voice mail boxes. Personally, I think it's completely valid assumption that each record will have a phone number. I've filled out an awful lot of forms over the years, and they all asked for it. – gowenfawr Aug 08 '11 at 22:54
@blunders No, I believe a good deal of patients would have a phone number in the chart. Home number more likely than cell/text number. – Don Zacharias Aug 08 '11 at 22:59
@user3916: Ok, based on phone numbers being very common I'll outline a my solution later tonight. Out at a bar right now. – blunders Aug 08 '11 at 23:51
1

@blunders: Enjoy the bar. First things first! – gowenfawr Aug 08 '11 at 23:55
+4 @gowenfawr: Thanks, funny thing is I would have posted an answer while I was out, but typing on a phone is a $%&@... :-) ...so, I've posted an attempt at an answer, but still like your answer too. As for the "call us back"... when you call back, how do they even know it's you. My guess is they just do that as a professional form, than a level of authentication. – blunders Aug 09 '11 at 05:26
I accepted the other because it had another option but you have been extremely helpful. – Don Zacharias Aug 09 '11 at 16:15
1

@blunders "it's not clear how access to a mailbox is more secure than access to a phone." A postal mailbox is in one physical location and can be locked with a physical lock. In the case of a Post Office Box it can be in a facility with video monitoring. A phone number, even a land line can be forwarded to nearly any physical location. Hacking phone communications is easy (see News International phone hacking scandal). – this.josh Aug 10 '11 at 01:03

blunders · Accepted Answer · 2011-08-09T16:18:31.423

Based on the feedback you provided via comments, those being so far:

@blunders we might have way more phone #s than email, and I'm having a report generated.

and

@blunders No, I believe a good deal of patients would have a phone number in the chart. Home number more likely than cell/text number.

So, let me see if I'm able to dig myself out of the hole I made... :-)

First let me say, I know ZERO about HIPAA, though I did a quick Google for "HIPAA authentication" and while there appear to be general standards, there also appear to be no implementation specifications; or at least that I was able to find.

My take is that a patient is giving an address and phone number knowing that these channels of communication maybe used to pass medical information to them.

In real life if a nurse calls a number on chart, and the person answering says they're that person, the nurse will tell the person answering the phone the information they intended to only give the authorized person per HIPPA. On the same note, if the nurse discovers an issue with the phone number in the chart and is unable to reach the person by phone, they'll send out a notice to the address on file; opening up the chance that an unauthorized person will break postal laws, and open the information sent via mail to the address on file.

So, going on that, but again not knowing anything about HIPPA laws, case law, etc. related to authentication requirements my suggestion would be to use the number on record as the/an authentication layer done real-time knowing an end user just requested a code be given to that number that's on record in the database, either by SMS or an automated voice system.

A rough flow off the top of my head for a phone-to-web authentication system would be:

The end user attempts to create an account.
They enter the phone number(s) they believe are already tied to their records.
The system checks to see if those numbers are in the database.
If the numbers are not in the system, the user is told the other options; mail, in person, etc.
If the numbers are in the system, the user is asked if they'd like a call or a text message sent to the number already in the system.
The system excutes the request and the user gets the code via an inbound call/SMS to the phone they requested.
Then the end user enters the code into a form on site site that's expecting the code from that IP/cookie session, and is validated as having access to the number on file.

A number of sites use phone verification and have FAQs on it. For example: Google and Craigslist ; though after a quick search was unable to find company that would have HIPAA oversight that uses phone verification to release records.

Also, guessing to start it'd be faster to outsource it to a service phone verification with an API, which again not knowing anything about HIPAA I'd think was fine as long as all they're doing is getting a number, passing the code back to you, and making the call.

Again, this is just me attempting to find a solution instead of just saying there is none. I'd welcome any and all feedback.

UPDATES BASED ON COMMENTS:

@blunders [...] As for phones, medical offices will generally not use phones for anything more specific than "please call us back" without requesting and receiving explicit approval to leave personal information in a voice mailbox. At least that's the case with the 2 or 3 of my family's doctors where the question has come up. And when you're at the point of clarifying phone permissions, you're at the point (physical, live voice) of giving them the login info that user3916 wants to pass anyway. – gowenfawr

My Reply:

@gowenfawr: [...] As for the "call us back"... when you call back, how do they even know it's you. My guess is they just do that as a professional form, than a level of authentication. – blunders

Good solution. User first auths by submitting number that matches records; callback to preset number implies proper call targeting, and you can get back-coverage (but not true authentication) when the user presses '1' as prompted to verify they're So-and-so Jones. (That's what my pharmacy does; they'll call about a prescription refill but first the recording will ask me to press '1' if it's me). So this is a reasonable solution avoiding snail mail. I don't know how trivial or inexpensive the call infrastructure would be to set up, though, and I would fear that "expensive" is the answer. — gowenfawr, Aug 09 '11 at 12:27
+1 @gowenfawr: I agree, it's not an "cheap" solution, though in the right context it might make sense. My thought on the "I'm who I say I am" would be to have that take place on the website, not via the phone; since the code must be entered on the site, and it'd be a lot easier to manage that via the web transaction than the phone dialog. Thanks for the feedback, since I really wasn't sure if I'd was way, way off. — blunders, Aug 09 '11 at 13:14
As far as I can tell you're right about HIPAA implementation laws. This is a great idea! — Don Zacharias, Aug 09 '11 at 15:22
+1 @Don Zacharias: Super, glad you're going to look into it... :-) ...and thank you for selecting my post as the answer!! If run into any issues going forward, let me know. Cheers! — blunders, Aug 09 '11 at 16:06

score 4 · Answer 3 · answered Aug 09 '11 at 14:48

You could work on a Single Sign On protocol to initiate the account creation.

You record a card number into your system (this card shall have a secret password on it, potential with those "to scracth" areas on it to hide the password)
You send the card through the best authentication mode you can find (standard mail, face-to-face meeting, eventually you can communicate them their login by over the phone/email)
Client set-up her account using the provided credentials and is ask to change the password. If the card has been altered, the client must contact you to reject any account created/creation with that number. After any use of the password, it must be revoked to avoid a duplicate account to be created.

If that protocol can't be set up, you still have the possibility to let the client set up and account, trying to match her identity, but requesting confirmation to activate. Then she could ask for activation. At this point, you would call her from your in memory phone number to confirm her identity.

At last, the authentication relies on the strength of the link you can establish with your client for the first time. The weakest it is, the more probable usurpation can be.

Interesting idea! One of our competitors in this space does that. I think the other thing I left out is they want it yesterday and they want it cheap. :) So adding any business tier stuff that doesn't exist is basically out. — Don Zacharias, Aug 09 '11 at 15:19
@Don Hum. I can understand. Pick any two http://en.wikipedia.org/wiki/Project_triangle — M'vy, Aug 09 '11 at 15:32
Exactly! We'll see how it goes. Thank you so much for the answer. — Don Zacharias, Aug 09 '11 at 16:14

score 2 · Answer 4 · answered Aug 09 '11 at 02:21

This is an authentication problem. Though I need to brush up on my EHR, this is a hard problem to solve without a trusted party. The only possible solution I can think of, which would be really easy to do wrong, would be to do challenge/response on the information you already have.

For instance, someone wants to register with their user name/social security number and some other information. Based on information you already have about the person, they need to correctly answer a series of questions about themselves. Like if you've ever got your annual credit report, at the 3 bureau sites you have to select previous addresses and other PII information.

Once registered you would want to still send out snail mail to let them know their online account was activated to hopefully help mitigate the 'crazy-ex' situation. Though, I have to believe that situation is going to be low risk.

Anyway, what you know is still a factor of authentication and I would have to think it would be a lot more hassle than it's worth to set this up rather than something more traditional. Hopefully it gave you an option of how it can work. I'm sure someone can come up with a better one.

I would change doctors if they implemented electronic records that included security theatre with "What was your mother's maiden name" style questions. — DanBeale, Aug 09 '11 at 12:28
Thank you! This is an idea we have talked about. I think we have the ID challenging part down (they plan to authenticate via credit card) but I'm looking at the "one to one" account to chart problem. — Don Zacharias, Aug 09 '11 at 15:20

D.W. · Answer 5 · 2011-08-11T03:03:14.143

You are thinking about it wrong. You should not be granting electronic access to a medical file without patient consent. This is not just a question of a technical mechanism for authentication; there is a much more fundamental issue of patient consent. You are trying to solve a social problem with technology, which is often a mistake. You are trying to solve this through technical methods, but this is not primarily a technical problem. This is a social and legal problem, and it should be solved primarily through policy and procedural methods.

So, there are two steps. First, you need to get patient consent to activate electronic access to the patient's record. Then, you need to collect information sufficient to authenticate the patient.

The first step probably means that when the patient comes into your office for a visit, they will need to sign a form indicating consent to make the information accessible electronically. This should not be a burden for you; your patients probably already have to sign a bunch of forms when they come into your doctor's office, so why not just have them do this at the same time? Alternatively, if you never interact with your patient in person, probably you're having them mail you some signed forms, so why not add this to the form the patient signs and mails you?

Given that collecting consent requires an in-person interaction, or requires the patient to sign some form, collecting authentication information ought to be simple. Why not just add another field to the form asking them to provide their email address? Alternatively, if you do have their phone number but not their email address, it may be possible to bootstrap from the phone number through a call-back system: they get an email, they log into a website to request electronic access, they get an automated callback to their registered phone number, the automated phone call communicates to them a one-time-use time-limited personalized PIN that they type into the web page to authenticate themselves, and then they register a password to create their account on the website. However this may be trying too hard, and it may be simplest to just ask users to provide their email address on the form.

In short, I'm concerned that the way you have framed the question suggests that your approach does not adequately protect patient privacy and does not comply with accepted norms and standards in the medical industry regarding protection of personally identifiable medical information.

How to verify new accounts against a known persons database?

5 Answers5