Page 85 - MC14326 all pages

The South African Insurance Industry Survey 2016 | 81
Another emerging phenomenon regarding the theft of
health information is medical identity theft, which is the
use of stolen medical details to obtain medical care, buy
drugs or submit fraudulent billing to medical aid schemes.8
Medical records are worth up to US$50 per record on
the black market9, which when compared to US$1 per
stolen credit card record, indicates why medical identity
theft is so lucrative.10 While data coming from your fitness
band or glucose meter may not be as valuable as your
electronic health record on the black market, users of
wearables and their related applications need to be aware
of the pervasive nature of the health information being
collected and stored about them, and what a breach of
that information might mean.
With health-related information fetching such a high
price on the black market, and cybercrime already a
problem, it probably will not be long before medical
identity theft and other health data-related crime
becomes prevalent in South Africa. While South Africa has
enacted legislation to protect the privacy of individuals
and electronic transactions through legislation, such as
the Electronic Communications and Transactions Act
(ECT) and Protection of Personal Information Act (POPI),
cybercrime is often difficult to detect, and identifying and
apprehending the culprit even more so.
What does this mean in the South African context?
South Africans have also been swept up in the wearable
fever. Fitness bands, for example, are common features
in public and in the workplace. Large insurers and medical
aid schemes offer incentives to members who buy and
use wearables and share the related health information
with the organisation. In turn, this information is utilised
in profiling, and incentivising policy holders and scheme
members. The benefits of the technological integration
are multi-faceted and present opportunities for both
8 http://oig.hhs.gov/fraud/medical-id-theft/
9 http://www.medscape.com/viewarticle/824192
10 http://www.secureworks.com/assets/pdf-store/other/infographic.healthcare.pdf
consumers, insurers and medical aid schemes.
Imagine an insurer or medical aid scheme being able to
calculate, in real-time, the risk profile of its policy holders not end with the policy holder or member; insurers and
and members and provide competitive premiums based
on the health profile of each of its policy holders or
members uniquely. This not only incentivises members to
lead healthy lifestyles but enables the insurer and medical
aid scheme to accurately quantify and underwrite its risk
exposure. From a consumer perspective the benefits are
numerous and range from customised premiums, as well
as health-related savings and promotions, to early warning
of possible health risks enabling more relevant, just-in-time
treatment.
Privacy awareness in South Africa is still in its infancy.
However, there are currently several pieces of legislation
that provide a framework to understand the rights and
obligations of the user, service provider and other parties,
where personal information is concerned. Policy holders
and scheme members will need to become more astute
as to the purposes for which their personal information,
health-related data, and other data collected through
wearables provided or utilised by insurers and medical aid
schemes is processed to ensure that their privacy is not
unreasonably infringed.
Discerning policy holders and members may protect
their data and themselves by carefully reading terms and
conditions, and available privacy policies on the wearables
and applications they wish to use, as well as knowing their
rights under their local privacy legislation. Furthermore,
they can defend their data by taking cognisance of
the threat of cybercrime and following good security
practices such as taking precautions to secure their
devices through strong passwords, encryption and dual
authentication, as well as being aware of who they are
allowing to access their data and devices. However, the
responsibility for processing information in a responsible
manner and ensuring the protection of information does
medical aid schemes play a pivotal role and should be
held accountable for ensuring that information obtained
through wearables is processed in a fair manner that does
not infringe on the rights of its policyholders or members.
In most instances, insurers and medical aid schemes
will need to balance the right of its consumers to privacy
against their own business interests. Insurers and medical
aid schemes should ensure that they are transparent in
the type of data collected through wearables, the purpose
for which this is processed, how it is used and secured,
and who it is shared with to ensure transparency.
All organisations integrating new technologies into their
day-to-day interactions with consumers, like insurers and
medical aid schemes, will need to start considering the
privacy impact of adopting these technologies and the
consequent business, consumer, and compliance risks.
Organisations should consider the privacy impact in light
of the following:
–– nature of information processed (i.e. health information);
–– how the information is collected, used and why the
organisation requires it;
–– where the information is located and volume of
information retained;
–– who has access to the information and whether it is
shared with third parties; and
–– the legal obligations in respect of the information.
Based on this assessment, the organisation will be
able to accurately determine what the privacy impact
of technology adoption, such as wearables, is and most
importantly where to “draw a line in the sand.”