S1-Episode 5: Putting patient trust at the centre of virtual health

Patricia Kosseim: Hello, I'm Patricia Kosseim, Ontario's information and privacy commissioner, and you're listening to Info Matters, a podcast about people, privacy and access to information. We dive into conversations with people from all walks of life and hear real stories about the access and privacy issues that matter most to them. Hello listeners, thanks for tuning into another episode of Info Matters. Today, we're talking about healthcare. Virtual healthcare that is, and why trust in your healthcare provider matters. It really matters. Now we all know staying healthy is partly about eating well, getting regular exercise and living a healthy lifestyle, but it's also about seeking out regular health care either when we need it, or at least once a year for that annual checkup. Now in the good old days prior to COVID-19, this meant booking an appointment with your healthcare provider and going to see them face to face at their office. But of course, the pandemic changed all that. For over a year now, many healthcare providers have turned to electronic messaging platforms, video conferencing, and other ways to provide care to patients virtually. Now we're very fortunate to be living in a time when these kinds of technologies are available to us, but we know they also come with unique privacy and security concerns. There's a whole new dimension to managing a virtual healthcare practice now. Choosing among all the different new apps and platforms out there, guarding against downstream commercial uses, selecting the right privacy settings, getting informed consent from patients online, and protecting sensitive personal health information from cyber threats. All of these are new challenges of protecting personal health information online. Our guest today is on the front lines of the virtual healthcare revolution. Dr. Duncan Rozario is the chief of surgery at Oakville Trafalgar Memorial Hospital here in Ontario. He also runs a busy outpatient practice at the North Oakville Medical Center where he uses sophisticated digital tools to provide virtual care to his patients. And as I've recently learned, he's also a real technology aficionado. Dr. Rosario, welcome to the show. Dr. Duncan Rozario: Thank you very much, Commissioner Kosseim. It's an honour to be invited. PK: So Dr. Rozario or Duncan, to begin can you tell us a little bit about the nature of your medical practice and really I'd like to know more about your direct relationship with patients. How does that work in your day-to-day office? DR: A typical general surgery practice involves seeing patients in the office. So, I have a private office outside the hospital, but about half of my time is spent in the hospital, as well. So, a general surgeon typically sees patients to deal with surgical problems inside the abdomen. So, we do gallbladder surgery, hernia operations, resections of the large intestine for cancer. We manage breast cancer. And so my role in the hospital involves working in the operating room, covering the emergency department for patients who need urgent surgery, and working in the outpatient's department, doing colonoscopy. I have a role in administration as the chief of surgery, helping to manage the department in our hospital. PK: So just to level set for everybody, you're not just the surgeon in the operating room with the gown and the mask and the gloves that somebody will see just once in their lifetime, or maybe not even see if they're unconscious. But you actually deal with patients who you see them in the lead up to the surgery. You see them after the surgery, I imagine, as any patient-physician relationship would unfold. DR: Absolutely, Patricia. Certainly, a key part of the development of the physician-patient relationship is communication and trust. And no surgeon would operate on a patient without seeing that patient first, taking an appropriate history, doing a physical examination as needed, and getting appropriate consent for surgical or non-surgical management. So, as with most surgeons, I see patients multiple times before surgery. If they need surgical management, we perform the surgery. And then, of course, we manage them after surgery to ensure they're healing well to go over pathology reports and arrange the necessary follow-up. So even for a surgeon, surgery involves a small fraction of what we do. As with most healthcare practitioners, it's communication. Healthcare is about communication and 80% of what we do in healthcare is really communication. PK: And we're going to talk about communication. And, in particular, your interest in virtual communication with your patients. You seem to be quite the avant-garde physician in terms of your technology know-how. Has technology always been of interest to you? DR: It has Patricia. I have to say, I firmly believe that the problems of the future will not be solved by the solutions of the past. And when I finished high school, I had, there was a fork in the road, go into the technology side and computer science or go into healthcare. My family made it clear that I could be a physician with an interest in technology, but it would be very difficult to be an IT specialist who does surgery on the side. So, I opted for a career in healthcare and I have to say, I have had no regrets. The tremendous opportunity to serve people in healthcare provides endless rewards. It's tremendously satisfying and it allows you to really bring your own interests to the field as well. And so I've had a long, deep interest in technology. And so I brought that along in my healthcare journey. PK: I wouldn't imagine this is very typical of all physicians. How would you describe the rate of technology adoption among physicians generally in Ontario? DR: So I would say physicians are very much like average citizens, and I think the adoption of technology to a large extent follows the traditional Gaussian distribution or Bell-curve. You've got most physicians in the middle and you have a small number, 2 or 3% at the leading edge who are early adopters, are willing to try the latest, greatest thing that comes out. It really depends upon one's interests and one's ability. We need all types. We need individuals who are skeptics. We need individuals who point out the challenges associated with implementing new technology in healthcare, but we also need these early adopters to try and fail and try and fail again until they succeed. And I hope I'm one of those who succeeds on occasion and doesn't fail too often. PK: And what prompted you to offer virtual health services to your patients? Was all of this spurred on by COVID-19? Or did it predate the pandemic? DR: Patricia, this started many years ago. I've been involved in the quality improvement programs in our department for many years and I had the honor to represent our hospital at the Ontario National Surgical Quality Improvement program. And many years ago, the importance of patient experience, again, to be very clearly understood. There was a time back in the olden days – and that's when I trained back in the olden days where patient care was paramount – where we were taught and patients were told, doesn't matter how pleasant your physician is, whether her or his disposition is positive or negative. Whether they're polite or not, you simply want the best care. And that's how medical care was many years ago. But over the past decades, it's become very clear that that's actually incorrect. It's become very clear that patient experience, which is not only the care, but how patients perceive their experience with healthcare, how it's delivered, the demeanor and courtesy of the women and men delivering healthcare, that experience affects outcomes. Many years ago, that made me reflect, "Are we offering the best experience to our patients? Or are we being driven by archaic processes and payment models that require patients to attend their physician if they need a prescription renewal? Or if they simply have a quick question, or if they have an interaction that really doesn't require an in-person visit, why do we mandate it? Is it because it's convenient for the physician? Is it because that's the nature of the payment model? Is it because the technology is not there?” And that's how I really became very interested in virtual care because I have to say when my daughter went away to University, far more impactful for my wife and I would be a video chat as opposed to a telephone call. As anyone who's a parent knows, if you can see your children's face, you get a pretty good idea of how they're feeling, whether they're actually happy or not. And I have to say over many years, I began to understand the importance of body language, the importance of the additional information that comes from video interactions and audio interactions compared to an in-person visit. And don't get me wrong, Patricia, I think patients need choice. And I think we need to provide the right modality of care for the right patient at the right time. But if everything is a nail, then of course you go at it with your hammer. But what if we actually had options? What if we could provide telephone interactions, video interactions, secure messaging interactions and in-person interactions. And physicians had a choice. Patients had a choice and you could provide the right modality at the right time. PK: Fascinating to hear your perspective on these issues. And particularly to hear you talk about it from the vantage point of your patients and their needs as the primary driver for the future of healthcare. Let me just ask you a little bit about messaging, just a start with the basics. Of course, email is still the easiest mode of communication these days, particularly I would imagine among older Ontarians. So what do you tell patients who may get frustrated that they can't just use their email? And how do you explain to them why it's generally a bad idea? DR: The challenge is that email is a fundamentally un-secure way of sending information. If you had a confidential document that you wanted to send to your family member in Victoria, British Columbia. And you took that document and you handed it to a woman or man on the street and said, "Pass it on” until it arrived in front of your family member in British Columbia, that's essentially how email works. Email involves sending what's called plain text, which is exactly what you type is transmitted in a legible fashion, across multiple computers until it gets to your destination. And anyone at any of those computers can simply look at your email. So if you're sending a message to your friend to meet up for coffee on Thursday at 5:00, unless you have security considerations of meeting in public, then that should be fine. But if you were sending banking information, if you're sending medical information, anything personal or confidential or private, I believe it's completely inappropriate to do so over an open means of communication. So that's whether you're handing that sheet of paper to the man in front of your house and asking him to pass it on, or whether you're emailing that information. It's simply a reflection of the technology. So email is not a secure way to send information, but we have lots of secure ways of sending information. And one of those ways is secure messaging. And if you look at the large integrated health systems in the United States, Kaiser Permanente is a large health management organization in the United States that has tremendous experience with virtual care. In 2018, 50% of their patient interactions were done virtually and 80% of those interactions were done with secure messaging. So if you look at large integrated health systems, virtual care can easily provide half of their required care and secure messaging seems to be the most popular way to communicate when it comes to our virtual healthcare communication. PK: Is it complicated from the patient's perspective? DR: It's surprisingly easy because secure messaging typically involves using what's called a patient portal. So often it looks and feels very much like email, but the message actually doesn't travel anywhere other than on the same computer. And there are even more secure ways of communicating with secure messaging. So there's a concept called end-to-end secure messaging, which means that when you send your message, it travels encrypted to a computer server in a Canadian location. Your message stays encrypted on that computer server and travels encrypted to the destination. So end-to-end encryption means that no one, not even the service provider, not even the police, no one can actually read the message other than the intended recipient. So we have encryption technology that is extremely secure. We use it for banking every day. We use it for a wide variety of the business and legal interactions that we do. So we have the technology, but sometimes the solution isn't enough. Sometimes we need to have the processes. We need to have workflow. We need to have the right incentives. We need to be taught what is the right way to communicate, what's the wrong way to communicate. And fortunately the office of the IPC, your office is doing a very good job of communicating why privacy and security is important when it comes to communication. PK: So you mentioned earlier that sometimes that visual is really important, additional dimension. So apart from secure email messaging, what do you use? Or what do you recommend to physicians or providers who need that visual dimension by way of video conferencing or otherwise? First of all, what types of situations would you say that you need that video dimension? And what do you recommend are some of the ways of adding that visual to your communications with your patients? DR: The visual aspect can be done in one of two ways. It can be done by sending an image or a picture with a secure message, or it can be done with a video interaction. And we have secure video interactions just as we have secure messaging available. And so if one uses Skype or a typical consumer video solution, those solutions would generally not be compliant with the privacy and security regulations of the province of Ontario or Canada. But there are medical video systems. We have many made in Canada as well. And these medical video systems provide encrypted video interactions from provider to patient. And that video interaction is surprisingly useful in a number of situations. I've used it to look at incisions to assess for healing after surgery. I've used video interactions to look at masses or skin changes before surgery. And sometimes whether it's communication before or after surgery or communication in specific specialties, such as pediatrics or psychiatry, sometimes the communication with words and with voice doesn't provide the full story. Sometimes when patient sees provider and provider sees patient, it really helps with communication. It helps by using our humanity. It allows us to use the subtle cues that we use every time we meet people to communicate with more compassion and to communicate more effectively. It depends upon the situation and it depends upon the clinical need, but it also should fundamentally be a matter of choice. It should be a matter of choice for the provider and for the patient, because we are really trying to find the right channel to communicate with the right patient at the right time. And sometimes it's a combination of all three, Patricia. For instance, before I operate on patients, I always insist on seeing them in-person once so that they can make a determination of their trust in the physician and patient relationship. So that I can assess them, clearly examine them before surgery, assess their frailty, assess their understanding of the medical concepts and their ability to provide consent. But after one in-person interaction, often that's enough, often after that telephone calls, video interactions or secure messaging are enough for the other interactions before surgery or after surgery. But it is a matter of choice and it is a matter of clinical need. PK: What have been your patients' reactions to this offering so far? Are they adapting? Or are they adjusting to the new forms of communication? Or are they hesitant? What's been their response or uptake of these technologies? DR: I have experienced the whole gamut. Very much like that Bell curve, I would say most people are actually very happy with the virtual options, whether it's secure messaging or telephone or video, and most people have adopted it without any challenge. I've had a few early adopters who use virtual interactions for virtually every interaction that they have with me because they're early adopters. There's a stereotype that older patients may not be as comfortable with technology. And I have to say, I believe that to be incorrect. I believe that in the modern world of high-speed broadband and iPads and smartphones, I've had superb patient experiences in all age groups, but everyone is different. Some people are not comfortable with the use of virtual technology. Some people want to see physicians in person, the more complicated the technology. So as you might imagine, telephone interactions involve very simple workflow and very simple technology. Secure messaging adds a bit of complexity to the interaction and video adds even more complexity. So the more complex the interaction, the more comfortable one needs to be with technology. PK: Do you make it easy for your patients? Let's say not the early adopters. Do you have like a, how to manual, do you explain, walk through the steps with them in terms of how they can deploy these applications or use these platforms? How do you sort of hold their hand and make it easy for them until they become comfortable with the technology? DR: Adoption requires comfort with the technology and everyone needs a different amount of teaching to get comfortable with the technology. I'd have to say 90% of the credit goes to my wonderful office staff. We also have a section on our office website that describes how to use the virtual tools that we have available. We have how to manuals and step-by-step guides to make it as easy as possible. At the end of the day, we have an office telephone and many days I'm here as opposed to in the hospital. So we believe in providing choice and providing all the possible channels that patients could require so that we can optimize their care and experience. PK: So when you use some of these third-party service providers or platforms, are there certain conditions that your patients have to accept in order to be able to use these platforms? Do you worry, in other words about some of the downstream commercial uses of personal health information, that some of these providers may want to introduce somewhere down the chain? DR: So I actually am not worried about that. If I was using Skype or a commercial video systems, or if I was using email, absolutely Patricia, I would be concerned. As you know, we are in a bit of a surveillance industrial age now where large technology companies have access to so much of the information that we move around on the Internet. If we're using technology in healthcare, we need to use the right technology and we need to use it safely. And most of us are not IT professionals. Fortunately, the government of Ontario really does the work for us and Ontario Health has evaluated solutions. And Ontario Health will certify solutions to ensure that they provide appropriate security and privacy measures. So providers and patients do not need to do that work. And my suggestion to the healthcare providers of Ontario is the government has done the pre-authorization or the certification and has done the heavy lifting. And my suggestion is go to the otn.ca website, review the options that the government has certified as compliant with modern privacy and security regulations, and then do your own due diligence. Evaluate the solutions, see what works for you and your office and your patients, and then proceed. So I would not suggest providers use solutions that have not been verified by Ontario Health. PK: Yes, I understand there's quite a few verified solutions. I think getting close to 10 or so, so far, and a growing list. Of course, verified solution doesn't guarantee compliance with the law or regulations. Health information custodian still have to do some of the hard work and make sure that they are complying, but I take your point is verified solutions, at least from a technical perspective have been vetted. And it's certainly a good place to start. So far we've been talking a lot about communications between healthcare providers and patients, so physician patients. But, of course, a lot of communication happens between healthcare providers and as part of delivery of care. And how do these messaging or other platforms help with the inter provider communications or are there interoperability issues that arise? Or are they quite at ease in terms of using these messaging or video conferencing between providers? DR: I'm embarrassed to admit that most provider to provider or office to office communication is done via fax machine? The fax machine is something that should have been pitched out the window a long time ago, because there's really very little way of ensuring that the fax was sent, that it was sent correctly, that it was sent to the correct number. The fax machine had its time in the 1970s and 1980s, but it's really time that the fax machine be replaced. And you're quite correct just as we have secure messaging to allow providers to communicate with patients, the same system can be used to allow providers to communicate with other providers. Because unfortunately not only the fax machine, but insecure email, SMS, there are a variety of non-secure methods being used for providers to communicate with other providers, but we have solutions available now. So the same solutions that allow us to communicate with patients, allow offices to communicate with offices. As you know, our family physicians often send referrals to specialists, specialists often send consultation notes back to family physicians. There are often questions sent back and forth. We move requisitions for X-rays, for ultrasounds. We move lab work. We move pathology test results. There's a tremendous amount of personal health information that moves around Ontario much of it via the fax machine. And all of that – and when I say all of it, I'm not kidding, I don't mean 10%, 20% - all of that office-office, provider-provider communication can be done very successfully with secure messaging as we have seen demonstrated very clearly by integrated health systems in the United States. PK: As I'm sure you know faxes represented the large majority of the root causes of privacy breaches of personal health information last year. And as my annual report will show in just a couple of weeks from now, it's the same story, sadly this year, again, with faxes being the number one cause of privacy breaches of personal health information in Ontario. So you and I both would like to see fax machines retired from the profession. Now our office, as you know, recently issued privacy and security advice in our virtual health care guidance that I know you've had a chance to look at. And I'd love to ask you, not to put you on the spot, but I love to ask you how helpful do you think this guidance could be for, or is for health care providers who are considering using virtual methods of communicating with patients or with other providers. How practical and usable do you think it can be in the day-to-day operations of a physician? DR: I found it very well-written and very helpful. Physicians really don't have the time or capacity to go through government regulations, to go through the details when it comes to how to communicate securely and privately. And fortunately, your office has done that. The document goes through the rules of custodian. It goes through the responsibilities that we have as physicians very well and outlines the risks and benefits associated with virtual care very well. My only suggestion would be to start with next steps, meaning how do we as a healthcare system, how do we as a province move towards an integrated, modern, secure messaging system to knock the fax machine out and yet put patients at the center of their care safely and securely. A discussion involving all the stakeholders. So Ontario Medical Association, Ontario Health, the patients and the citizens of Ontario, the nursing staff. So basically all healthcare providers, the citizens of Ontario, everyone who will be impacted by this needs to be involved in the development of an integrated system. And ideally, Patricia, I would have to say the province of Ontario should have one system that allows everyone to communicate with everyone else securely to provide healthcare. That would be a dream of mine if the entire province would actually have that capacity to securely and safely communicate for the purposes of healthcare to allow this information to be safely moved into electronic medical records and to put care in our patient's hands. I believe patients should have all of the information that they need. And so whether it's my consultation note, whether it's a pathology report after surgery, whether it's the result of an X-ray, I believe patients should have access to all of their own personal health information in a safe and secure fashion. And the healthcare providers that look after these patients should have, with the patient's consent, access to that information as well. Imagine if we had that for the entire province of Ontario, imagine the efficiency data moves, where it needs to go virtually instantaneously. And this era where we have such a huge clinical backlog of care, both surgical and nonsurgical related to COVID-19 and even predating COVID-19. Imagine if we could boost the health care system with efficiency and compassion with an integrated communication system, that would be my dream Patricia. PK: Lots of work to do ahead. I think, you know that one of our office priorities or priority areas is trust in digital healthcare and the vision you just put out there, Duncan is certainly predicated on trust. If there isn't trust, then it's hard to imagine how that data will flow least of which from the patient to the provider in the first place. So let me just close with a few questions if I may, to pick your brain on what do you see as some of the key challenges in really enhancing trust in the delivery of digital healthcare in Ontario. What's it going to take to remedy this trust deficit and to get people comfortable with the vision you just laid out? DR: The trust is actually a great question because you're so correct. When we become physicians, as part of the oath of Hippocrates, we take an oath of confidentiality. And that is why patients, when we meet them in the office, that's why they're willing to tell us their deepest secrets. Because for us to treat patients effectively and safely, we need to know about their health conditions. We need to know about their health practices and medications and behaviors and successful medical care arises from a trust relationship between provider and patient. And, by the same token, if we're communicating with patients via secure messaging or other virtual methods, if we expect the trust to be there, we need to demonstrate to our patients that there is complete privacy and security to the best available technology that's available. So ensuring that we are communicating with privacy and security is a key way to gain that trust, because if that trust relationship is present, then our patients will be comfortable messaging us confidential, personal health information. And they'll be comfortable receiving it from us as well. But you're so correct that trust is really the key to an effective relationship between provider and patient. And that's really what we need to be seeking. And that involves all stakeholders being involved in the discussion as we develop these solutions, because it really is about collaborative discussion. It's about respectfully understanding everyone's viewpoint, the needs of patients, the needs of providers, the needs of our single payer, the government of Ontario, or the other provincial or territorial health ministries in Canada. It's the need to understand the power of collaboration. And when you collaborate with compassion and when you collaborate with trust, that's when the magic happens. PK: Thank you so much, Dr. Rozario. It sounds like what we do every day and trying to enhance privacy and security in communications involving personal health information is pretty vital to what you do in terms of establishing that trust with your patients and providing them with the best healthcare possible. So nice to know we're connected and we'll be working closely together with you and many other healthcare stakeholders in the years to come as we advance trust in digital healthcare in Ontario. And we've been honored to have you on our podcast today. And thank you again, you've provided a great overview of some of the benefits and pitfalls of virtual healthcare and all things that healthcare providers and patients alike should be aware of when engaging in this new digital frontier. But most importantly, you've reminded us of the critical role of trust in the successful provision of healthcare and ultimately the maintenance of good health. For listeners out there who want to learn more about virtual healthcare access and protecting personal information, you can visit our website at ipc.on.ca. You can also contact our office for assistance and general information about Ontario's access and privacy laws. Well, that's it for this episode folks, be well everyone and stay healthy. Until next time. I'm Patricia Kosseim, Ontario's Information and Privacy Commissioner, and this has been Info Matters. If you enjoy the podcast, leave us a rating or review. If there's an access or privacy topic, you'd like us to explore on a future episode we'd love to hear from you. Send us a tweet @IPCinfoprivacy or email us at [email protected]. Thanks for listening and please join us again for more conversations about people, privacy and access to information. If it matters to you, it matters to me.