There is no shortage of enthusiasts promoting blockchain technology's potential to disrupt conventional industry practices, generate cost savings and reveal operational efficiencies.
Blockchain replicates and distributes information in the form of a digital ledger across a decentralized network of computers, or "nodes." As each transaction is completed and verified, the information in each node is updated so that the data across the entire ledger system is complete and accurate. Blockchain is still in its infancy but has been successfully deployed in the finance, real estate and insurance industries. As with any new disruptive technology, it is important to differentiate between technology facts and fiction.
Fiction: Blockchain is the same as cryptocurrencies like Bitcoin. Blockchain is often thought to be identical with Bitcoin. However, while Bitcoin uses blockchain, blockchain is much more than simply Bitcoin. Bitcoin is a specific use case of blockchain that permits electronic code to function as a digital currency for its users and willing merchants. Blockchain manages the records and transactions conducted using Bitcoin and, due to the transparent and immutable characteristics of blockchain, ensures that no Bitcoin can be spent twice. Blockchain is used by multiple types of cryptocurrencies other than Bitcoin. The growth of various cryptocurrencies is raising a number of business opportunities with new initial coin offerings, or "ICOs," now marketed as an alternative to initial public offerings for startups and companies looking for less traditional substitutions to venture capital; however, it is important to note that regulation of cryptocurrency transactions and ICOs is increasing.
Fact: Health care should prepare for cryptocurrencies. While blockchain and cryptocurrencies have not yet arrived in the health care space, health care executives should be considering possible impacts of both cryptocurrencies and blockchain. Government regulators are taking an increasing interest in developing an appropriate regulatory framework for cryptocurrencies. While cryptocurrency values are currently too volatile to be entertained as a payment tool for patients, some health care executives have considered purchasing cryptocurrencies in the event there is a ransomware attack. Increasingly, cryptocurrencies are the bounty of choice, and having a cryptocurrency wallet may save precious time when making difficult real-time decisions in a ransomware attack. Caution should be exercised, however. As noted above, there are a number of different cryptocurrencies, and holding a Bitcoin wallet will not benefit the organization if the ransom demand seeks payment in Ethereum or Ripple. As cryptocurrencies gain mainstream status, health care organizations should consider whether and how acceptance of payment in the form of cryptocurrency should be accommodated.
Fiction: All blockchain is all the same. While all blockchain technology is based on similar cryptography principles and a distributed ledger, not all blockchains are the same. Blockchains can be public or private and can require different "permissions" from the nodes. A permission-less blockchain does not require a single authority approving information to be added on the blockchain, meaning anyone and everyone can contribute new entries to the digital ledger based upon the blockchain rules. Alternatively, blockchain can also use permission-based methods that control who and when information can be added to the ledger. Permissioned blockchains are able to authenticate each of the participants on the blockchain and can use consensus-based algorithms to confirm transactions.
Fact: Permissioned Blockchain can work for healthcare. Because permissioned blockchains can authenticate the participants on the blockchain, this technology can meet the security needs of health care organizations. These networks can be set up so that even though only some individuals are authorized to add information, other nodes can still view the information. For example, consider a use case in which a permissioned blockchain manages a pharmaceutical supply chain. The materials provider, manufacturer and distributor nodes could all add information to the ledger showing the pharmaceutical product manufacturing, storage and transportation history, while the health care customers could have "view-only" access to the ledger to ensure product quality, supply volume and costs. There remain some challenges: this use case will require scaling to accommodate data volumes that may be relatively demanding. Health care stakeholders should have confidence that a blockchain can not only meet immediate needs but accommodate the demands for interoperability needed for efficient health care operations.
Fiction: Blockchain is immune from cyberattacks. Blockchain presents promising approaches to information management, but it is not immune to all cyber threats. The fact that the ledger is distributed may, at some point, prove to be a vulnerability. For example, there is a proof of concept referred to as the "51% attack," in which an individual or a group that controls at least 51% of the nodes could control the entire blockchain. The one guarantee is that, as with any other form of computer-based activity, new attack vectors will be developed that will require attention and intelligent security to defend against.
Fact: Blockchain is still worth exploring. Possible exploitation of blockchain should not unduly discourage health care organizations from considering the use of blockchain as it becomes a more mature technology. Blockchain may be useful in supply chain and may even have a role in managing cybersecurity risks in day-to-day operations.
Fiction: Blockchain data is inherently trustworthy and accurate. Blockchain is built around impressive cryptography and emphasizes transparent data management and storage. However, users should not confuse the integrity and security of the blockchain with the trustworthiness or accuracy of the managed data. For example, an electronic health record system build on blockchain could ensure that patient data is kept up to date across each computer terminal, clinical providers' smart phones and the billing office. However, this only ensures that each node has up-to-date data because providers, even in a blockchain infrastructure, must independently rely upon the trustworthiness of the data source (i.e., the patient, the lab and the previous records). Clinical providers should be increasingly conscious that the availability of data through a blockchain does not ensure that the data is inherently trustworthy or accurate. Blockchain provides decentralized methods to manage data, but it does not remove the importance of the right individual interpreting and making appropriate clinical decisions with the data.
Fact: Blockchain will require revisiting traditional data governance plans. Health care providers should have robust policies for record retention and data governance. These practices and policies are designed around pre-blockchain technologies that rely upon centralized data storage. Blockchain rejects a traditional centralized data storage, which requires new approaches to how data is managed and governed. Health care executives teams should work with their management and clinical teams to develop new policies and procedures that appropriately assign rights for permission to add information, view information and ensure that the right individual is making decisions based upon the data. Privacy and security professionals will have to carefully consider how to address regulatory issues such as the right of rectification and the right of erasure under the General Data Protection Regulation in the blockchain world, given the immutability and transparency of the technology. Further, consideration of the scope of the nodes in a given blockchain will be a factor when considering cross-border transfers.
As blockchain's role in health care and promise to improve operations evolves, health care stakeholders can be certain that there will be successes and failures. Like any new technology, short-term failures should not dissuade adoption, but understanding what is fact and what is fiction and carefully considering the impact of decisions can empower health care executives in selecting the best technical tool to minimize unforeseen consequences and prepare for implementation and deployment.
This article is educational in nature and is not intended as legal advice. Always consult your legal counsel with specific legal matters. If you have any questions or would like additional information about this topic, please contact:
• Melissa Markey at (248) 740-7505 or mmarkey@hallrender.com;
• Ammon Fillmore at (317) 977-1492 or afillmore@hallrender.com; or
• Your regular Hall Render attorney.
Melissa Markey and Ammon Fillmore are attorneys with Hall, Render, Killian, Heath & Lyman, P.C., the largest health care-focused law firm in the country. Please visit the Hall Render Blog at http://blogs.hallrender.com/ for more information on topics related to health care law.