By Russell Craig, National Technology Officer, Microsoft NZ
In late September, the Office of the Privacy Commissioner (OPC) released a report entitled Electronic Shared Care Records Review: Elements of Trust. The OPC summarised the report as having “reviewed three regional health agency projects and found the projects met their clinical objectives and complied with their obligations under the Health Information Privacy Code (HIPC).” While this is significant in its own right, it caught my eye due to media coverage which seemed to suggest that the Privacy Commissioner had a very negative view of the sharing of health information.
For those that understand the role and pay attention to the work and views of the Privacy Commissioner and his team, this slant on the report did not ring true. Subsequent reading confirmed that the report had been misrepresented. In fact, the report presents a characteristically balanced assessment of the potential benefits and risks of sharing health information, usefully grounded in a discussion of trust.
As the new National Technology Officer for Microsoft New Zealand, and having previously held privacy responsibilities for the national health information collections maintained by the Ministry of Health, I hope the following comments will be a useful contribution to the public discourse on this subject.
First, I completely agree with the Privacy Commissioner in regard to trust being the cornerstone of effective and sustainable sharing of health information. I also believe the same should apply to any personal information, whether it be held in the public or private sector, either on or off-shore.
This is not just a personal view: Microsoft cares about this matter deeply. We are engaged in enabling health systems around the world to achieve the benefits of shared health information, both in regard to enabling better individual and population health outcomes and in improving the cost-effectiveness of health service delivery. Our enterprise software and services have been widely used in the health sector for decades, and we are now seeing our global public cloud services being adopted in health in many locations.
Perhaps the most well used cloud service is Office 365 – Microsoft’s suite of online office tools. There are some great examples of how health organisations are using this around the world to enable their staff to work more effectively and collaborate more easily. One is the Queensland Health Service in Australia, which is moving to Office 365 as part of the Queensland state government’s adoption of that service. Another is in the USA, where Office 365 has been adopted by New York’s Community Health Network in the wake of Hurricane Sandy. Here in New Zealand, St John Ambulance has also been effectively using Office 365 for some time. These and other health sector organisations are continuing to develop innovative and exciting uses of Microsoft’s cloud services for the ultimate purpose of improving health outcomes.
Trust is vital for cloud and health
Like the Privacy Commissioner, we understand that trust is of fundamental importance. Customers will not use products and services if they cannot trust them. Trust has been part of Microsoft’s DNA for many years – especially since we initiated our Trustworthy Computing initiative in 2002.
Now that Microsoft is a global industry leader in cloud services, we are hearing a consistent set of questions arise when people consider using our cloud services. These questions are:
- “How do I know your cloud services are secure?”
- “What is your approach to privacy, and will you use my data for advertising?”
- “How can you enable me to meet my compliance obligations?”
- “How do you respond to government requests for access to my data?”
- “How do I know you are keeping your promises to me?”
We have responded to these and other government, commercial and public concerns about such matters by developing what we call our ‘Trusted Cloud Initiative’. As we see it, trust in our services is based on four pillars, representing areas in which we are continually investing with a focus on leading the cloud services industry. These pillars are:
- Security: we deliver best-in-class security, drawing on our decades of experience in building enterprise software and delivering online services.
- Privacy: we follow a privacy-by-design approach, and contractually commit to only use our customers’ data for the purposes for which they entrust it to us, and no others.
- Compliance: we are committed to leading our industry in complying with appropriate international standards.
- Transparency: we provide an appropriate level of transparency into our security, privacy and compliance practices, the location of our customers’ information and our actions to protect that information to the highest possible degree.
In New Zealand, Microsoft is working to assure customers about the ways in which our cloud services comply with all relevant security and privacy requirements, including those specific to the health sector.
We start from a very strong global position of compliance with relevant international standards and requirements. For example, Microsoft was recently recognized by the EU’s Article 29 Data protection Working Party as meeting the requirements of the “EU Model Clauses” in relation to the contractual arrangements we make for protection of customer data. Microsoft is the first, and so far only, global cloud services provider to have achieved this recognition.
Big data = better health
So how is this relevant to the Privacy Commissioner’s report? Simply, Microsoft is confident that our cloud platforms and services will come to play a very significant role in the health of New Zealanders. This will occur both through adoption of our technology in the health sector, and directly by consumers who are seeking out exciting cloud-enabled services such as those provided by the new Microsoft Band and its underlying platform, known as Microsoft Health.
Microsoft Health includes a cloud service for both consumers and the health industry to store and analyse health and fitness data to create powerful insights. Microsoft Health will be available to consumers through the new Microsoft Health app which is available on Android, iOS and Windows Phone.
The implications of these initiatives are significant. For Microsoft, it means that as we become custodians of ever increasing quantities of personal health information, our cloud services will also provide health sector organisations and consumers with incredibly exciting new analytics and data re-use capabilities that will underpin dramatic changes and improvements in health outcomes.
This phenomenon of cloud-enabled big data analytics is an area where the Privacy Commissioner has been an active and positive contributor in recent times. We find ourselves very much in line with his thinking, as set out in the New Zealand Data Futures Forum paper entitled Harnessing the Economic and Social Power of Data, where he observes that “wider use and re-use of data is inevitable…and in the public sector the re-use of data is in some sense as much a responsibility as an opportunity”.
This is especially true in the health sector, and public cloud services will be an essential factor in releasing the opportunities on offer. Again, the responsibility of any companies involved in this endeavour – including Microsoft – will be to operate in ways that engender and maintain necessary levels of trust in the underpinning systems and processes.
There really has never been a more exciting time in health informatics, and Microsoft is mindful of how important it is build and maintain trust so that benefits can be realised as quickly and confidently as possible. We welcome and agree with the Privacy Commissioner’s views in this regard, and will be active contributors to the evolving understanding of how this trust can best be achieved, and assured.
It’s what the public should expect from organisations such as Microsoft, and is an area in which I believe we can provide the benchmark for what is possible.
Russell Craig
National Technology Officer, Microsoft NZ