This is not a typo. Rather, it is a central dimension of well-functioning digital health. In the field of health, infostructure¹, ² refers to developing and adopting information and communication technology (ICT) systems and components so patients, healthcare personnel, and other members of the health ecosystem can effectively communicate with each other and make informed decisions. While the infostructure is multifaceted, key components are interoperability,³ health standards,⁴ and cybersecurity.

Interoperability makes it possible to share and understand a national health system’s information. It involves two dimensions: the syntactical, which facilitates the information exchange itself; and the semantic, which allows the recipient of the information to correctly understand and process it and use it effectively.

Interoperability can tell you, for example, that the Pedro Pérez who visited a hospital in Bogotá today is the same person who went to an outpatient center in Cauca a year ago. It also allows users to differentiate this Pedro Pérez from any other person, even if they have the same name, surname, or even date of birth.

Interoperability also ensures that the diagnosis, treatment, and prescription that Pedro Perez received today is recorded in a way that any other physician and information system at any other place or time can understand. This is especially relevant in the field of medicine, where diagnoses, equipment, medications, and treatments are often given different names in different environments and by different actors.

Furthermore, a completely inter-operable national health system can yield major economic benefits, with net savings that can amount to 5% of all health spending, without counting indirect savings as a result of providing better medical care and the savings from the lawsuits that would be prevented.⁵

The European Telecommunication Standards Institute (ETSI)⁶ proposes a system to classify the different levels of interoperability:

• Technical interoperability. This level generally refers to hardware or software components, with systems and platforms that allow systems to communicate with each other to exchange data but not its meaning.
• Syntactic interoperability.The messages, documents, and services consumed need to have well-defined syntax and coding to be interpreted by the software that receives them.
• Semantic interoperability. Additionally, the content can be written in different languages, like Japanese or English, and to understand the message’s content, there has to be a vocabulary that both the sender and receiver know how to interpret.
• Organizational interoperability. Finally, there needs to be the option to generate actions through the exchanged content.

The IDB note Interoperability for Beginners: the Foundation of Digital Health gives detailed definitions, examples, and references for each aspect of interoperability and explores the steps to achieving it, which are summed up below.

Five steps to achieving effective interoperability

• Establish an interoperability framework. This framework is a set of policies, guidelines, standards, rules, and recommendations designed by a network of stakeholders to attain the highest level of interoperability.
• Promote the development and integration of information systems. Adopt open solutions and provide tools or services to make implementation easier.
• Empower the patient. Put patients in charge of their own information with tools that allow them to decide how their data is used.
• Address legal and regulatory issues. Amend or pass laws on medical records.
• Develop human capital. Properly train all system users on the technology and processes and inform them about their challenges and changes to them.

Interoperability⁷,⁸ and health standards⁹

It might seem utopian to envision a single national information system used by the operational and business units of all health establishments in the country. However, interoperability standards make this possible by ensuring that all information shared can be understood by everyone involved, regardless of the device or program used to access it. Using standards is important for interoperability, for scaling up systems, and, especially, for the quality of the information.

A traffic analogy helps illustrate the usefulness of standards: when a car’s red lights come on, people all over the world know the car is braking, and when its white lights come on, they know it is going to back up. Whatever the car’s brand or year, and wherever it is being driven, there is an agreement that applies to all manufacturers and drivers for communication and safety. That is a standard.

In the same way, the information systems that support healthcare processes also need standards¹⁰, ¹¹ for each level of interoperability

While standards have been classified in multiple ways, some of the most important are:¹², ¹³

• Messaging standards: how do I structure a message so another system understands it?
• Terminological standards: how do I codify the terms I use so others understand them?
• Documentation standards: how do I structure a clinical document?

Semantic interoperability requires ordinary dictionaries or master tables. The following diagram of a care process shows which data needs to be standardized.

From a care perspective, interoperability increases a patient’s safety, enhances the quality of care, and contributes to the continuity of care since it makes the patient’s clinical data available during care.

Cybersecurity

The health sector was among the most frequently targeted by hackers in 2019. It is also the industry that has experienced the most damaging attacks in recent years. The average cost of a cyber-attack on the health sector in terms of lost business and money spent on preventing, detecting, and recovering from the attacks is $7.13 million. Meanwhile, the average cost of a cyber-attack for all other industries is $3.86 million.¹⁵

How do we start protecting health information?

There are four groups of tools that help improve systems’ cybersecurity: frameworks, controls, guides, and the regulatory framework.

Frameworks equip organizations to carry out different information security activities in a systematized and controlled way. Controls are technical security or management measures taken to meet different information security objectives. Account management is one example. The regulatory framework includes compulsory regulations and optional standards that govern behavior and establish how organizations must act. Lastly, guides are practical tools for addressing specific problems. For example, the guide NIST SP 1800- 8¹⁶ lays out how to administer assets, protect against threats, and mitigate vulnerabilities in wireless infusion pumps.

7 key steps for cybersecurity:

• Include cybersecurity as one of the organization’s strategic management priorities. An example is setting the goal of achieving ISO/IEC 27001 certification for critical processes.
• Define the organizational structure for cybersecurity. The organization needs to designate at least one information security officer and an information security committee.
• Define the cybersecurity objectives and goals.
• Assess the situation by performing a GAP analysis. The IDB has developed different tools to facilitate that assessment, including an industry best practice self-assessment tool for the health sector, based on the NIST cybersecurity framework.
• Create a cybersecurity master plan. This plan should include the information security objectives, specific goals, and a portfolio of products/services
• Execute the master plan. The information security officer should monitor the plan’s implementation, analyzing the management indicators and associated risks.
• Evaluate the results and remaining risk. The results of implementing the plan should be evaluated periodically by analyzing their impact.

Those creating a national infostructure platform have to work collaboratively with the ecosystem, define a national interoperability framework, jointly design the core components for exchanging healthcare information, and establish a national framework of standards to be used, among other actions. This synergy, and spaces for sharing knowledge for a common objective, help the health system itself grow and are part of the effort to improve the quality of people’s health care.