MSc MBIT Thesis Presentation

1. The Economics, Practical Applications and Constraints in Enterprise-Wide
RFID adoption in the Healthcare Industry
Emmanouil Theocharopoulos
Supervisor
Professor Gregory Yovanof
MSc in Management of Business, Innovation and Technology
18/10/2012

2. Presentation Outline
• Introduction to RFID
• Basic Building Blocks of RFID
• Types of RFID Tags
• RFID Classes
• RFID Frequencies and their Characteristics
• Barcodes vs. RFID Comparison
• EPCglobal and ISO RFID Standards
• Electronic Product Code and EPCglobal RFID Approach
• The Internet of Things
• Implications of IoT to RFID Implementation in Healthcare
• Major non-Healthcare RFID Applications
• Non-Healthcare related RFID Applications per Sector
• EMC / EMI and RFID in Healthcare
• RFID Privacy and Security Concerns
• FDA Guidance Policy on RFID and Pharmaceuticals
• RFID Deployments in Healthcare and their Privacy Impact
• Greek Privacy Laws and Data Protection Authority
• RFID Privacy Enhancing Technologies
• Use Cases in a Smart Hospital
• Drivers & Obstacles for RFID Application in Healthcare
• SWOT Analysis and Strategies for RFID Deployment in a Greek Public Hospital
• The case for University Hospital of Heraklion
• Results and Conclusions

3. Introduction to RFID
• RFID is the reading of physical tags on single products, cases, pallets, or re-usable containers that emit radio
signals to be picked up by reader devices
• Not a new technology. Its history traces back to WWII
• During the 1960s RFID was first considered as a solution for the commercial world
• The first commercial applications involving RFID followed during the 70s and 80s. These commercial
applications were concerned with identifying some asset inside a single location
• In 1998, researchers at the Massachusetts Institute of Technology (MIT) Auto-ID Center began to research new
ways to track and identify objects as they moved between physical locations

4. Basic Building Blocks of RFID
Passive
Active

5. Types of RFID Tags
• Passive tags do not have an on-board power source so they have to ‘scavenge’ power from the reader in order
to run the digital logic on the chip and issue a response to the reader. They can therefore only operate in the
presence of a reader. The communication range is limited by the need for the reader to generate very strong
signals to power the tag, which therefore limits the reader-to-tag range
• Semi-passive tags require the tag to use battery power for the digital logic on the chip, but still use harvested
power for communication. Semipassive tags are far more reliable and have greater read ranges than purely
passive tags, but they also have shorter lives due to their reliance on battery power are more fragile, and are
significantly more expensive
• Active Tags have an active radio frequency (RF) transmitter (i.e. they are capable of peer-to-peer
communication) and the tags use batteries to power the logic chip and to communicate with the reader (i.e. they
do not use harvested power). Read range increases and reliability improves. Active tags can be read while
moving at up to 100 miles an hour

6. RFID Classes

7. RFID Frequencies and their Characteristics
Band LF HF UHF Microwave
Low High frequency Ultra high
frequency frequency
Frequency 30–300kHz 3–30MHz 300 MHz–3GHz 2–30 GHz
Typical RFID 125–134 kHz 13.56 MHz 433 MHz or 2.45 GHz
Frequencies 865 – 956MHz
2.45 GHz
Approximate less than 0.5 Up to 1.5 meters 433 MHz = up to 100 Up to 10m
read range meter meters
865-956 MHz = 0.5
to 5 meters
Typical data less than 1 Approximately 433–956 = 30 Kbit/s Up to 100 Kbit/s
transfer rate kilobit per 25 Kbit/s 2.45 =100 Kbit/s
second (Kbit/s)
Characteristics Short-range, low data Higher ranges, Long ranges, high Long range,
transfer rate, reasonable data data transfer rate, high data
penetrates water but rate (similar to concurrent read of transfer rate,
not metal. GSM phone), <100 items, cannot cannot
penetrates water but penetrate water or penetrate
not metal. metals water or
metal
Typical use Animal ID Smart Labels Specialist animal Moving
Car Contact-less tracking vehicle toll
immobilizer travel cards Logistics
Access &
Security

8. Barcodes vs. RFID Comparison
Barcode RFID RFID Benefit Example
Line of sight Required Not Required No need to orientate scanned
Requirement (some exceptions in case of items
water or metal)
Number of items that can One Multiple Very fast inventory scan
be scanned
Automation & Accuracy Manual read errors and prone Fully automated and highly Error free inventory count
to miscanning accurate
Identification Only series or type Unique item level Targeted recall
Data storage Limited codes Up to several kB of data Real time data access in any
location
Distance Less than 3m Up to 100m Very fast inventory scan with
minimal human participation
Interference May be subject to obstruction Metal and liquid can interfere No need to orientate scanned
from dirt or damage with some frequencies items / Very fast inventory
scan
Human Labour Required / High Moderate for handheld readers Low / no labour costs.
only. Non required for fixed
readers
Protection against fraud Low High Protection against fraudulent
misuse

9. EPCglobal and ISO RFID Standards

10. Electronic Product Code and EPCglobal RFID Approach

11. The Internet of Things
The EPC was developed with goals both mundane and magnificent; from tagging cases of milk to the vision of
an "Internet of Things."The Internet of Things refers to uniquely identifiable objects (things) and their virtual
representations in an Internet-like structure. It is foreseeable that any object will have a unique way of
identification in the coming future, what is commonly known in the networking field of computer sciences as
"Unique Address1", creating an addressable continuum of computers, sensors, actuators, mobile phones; i.e. a
thing or object around us. Having the capacity of addressing each other and verifying their identities, all these
objects will be able to exchange information and, if necessary, actively process information according to
predefined schemes, which may or may not be deterministic

12. Implications of IoT to RFID Implementation in Healthcare
• Requires constant and reliable internet connections
• Highly sensitive information about products, involved companies, individuals and patients can be
compromised
• Data or Services can be faked for criminal reasons
• More complex system which can fail at different levels
• Requires redundancies and additional security

13. Major non-Healthcare RFID Applications
• In 2003, Wal-Mart issued a mandate that its top 100 suppliers will be using RFID tagged pallets on delivery
• By April 2007, 600 Wal-Mart suppliers were using RFID
• In 2008, Wal-Mart announces its first real compliances ‘penalties’ for failure to tag products
• In 2004, the FDA published a compliance policy guide for industry on implementing RFID studies and pilot
programs
• In 2005, Pfizer announced its plans to place RFID tags on all bottles of Viagra intended for sale in the United
States
• In 2009, Airbus distributed RFID requirements to suppliers of parts for its A350 aircraft, and will use EPC RFID
tags to manage the configuration of A330 and A340 planes, as well as to track tools
• In 2010, Boeing announced a partnership with Fujitsu to develop a full turnkey RFID solution known as the
Automated Identification Technology (AIT) Retrofit Package, designed for managing aircraft parts through repair,
maintenance and inspection processes. The system is expected to be made commercially available in 2012,
following a year of testing by the two partner companies

14. Non-Healthcare related RFID Applications per Sector

15. EMC / EMI and RFID in Healthcare
• EMI (electromagnetic interference) is the disruption of operation of an electronic device when it is in the vicinity
of an electromagnetic field (EM field) in the radio frequency (RF) spectrum that is caused by another electronic
device
• Any radio frequency transmitting device has the potential to electronically interfere with the operation of another
electromagnetic device
• In healthcare facilities, EMI occurs when electromagnetic devices interfere with medical equipment, potentially
causing equipment malfunction
• Electromagnetic compatibility (EMC) is the opposite of EMI. No interference caused by its Electromagnetic (EM)
environment and it does not emit levels of EM energy that cause EMI in other devices in the vicinity
• Some studies have demonstrated that RFID tags and readers could interferer with some medical equipment and
pacemakers in very close proximity
• ANSI/HIBC 4.0 recommends that the 13.56 MHz High Frequency (HF) be adopted for
healthcare item level tagging specifically because its smaller read range is less likely to
result in EMI with medical devices

16. RFID Privacy and Security Concerns
• Surreptitious identification of individuals by known/unknown parties, without their prior knowledge or consent
• Systemic tracking and surveillance of individuals by known/unknown parties, without prior knowledge or consent
• The construction of histories and profiles about individuals and their interactions,without the individual’s prior knowledge or
consent
• Correlation of acquired data with contextual and other information obtained elsewhere
• Unwanted or incorrect inferences about the individual derived from the data
• Unauthorized revelation of personal and private facts and disclosure to others
• The inherent imbalance of power and potential for undesirable social engineering,control and discrimination on the basis of RFID-
generated data
• Unauthorized access, theft, and loss of RFID-based personal data held by custodians
• Unauthorized interception and access to protected information stores by unknown parties, due to poor information security
practices
• The cloning of RFID identification data and possibility of unauthorized access to physical and logical resources, and of identity theft
•The negative consequences upon the individual of all the above activities
• The inability of individuals to find out about the collection and misuse of their data, and to remedy any errors or abuses
• The lack of confidence and trust by individuals in the information management practices of organizations

17. FDA Guidance Policy on RFID and Pharmaceuticals
• A manufacturer, re-packager, re-labeler, distributor, retailer, or others acting at their direction will attach RFID
tags (chips and antennae) to only immediate containers, secondary packaging, shipping containers, and/or pallets
of drugs that are being placed into commerce
• The drugs involved will be limited to prescription or over-the-counter finished products
•
• RFID will be used only for inventory control, tracking and tracing of products, verification of shipment and
receipt of such products, or finished product authentication
•
• The tags will not contain or transmit information for the healthcare practitioner
• The tags will not contain or transmit information for the consumer
• The tags will not contain or transmit advertisements or information about product indications or off-label
product uses

18. RFID Deployments in Healthcare and their Privacy Impact
Technology Examples Privacy Impart
Deployment
Tagging things  Bulk pharmaceuticals In general, identifying and tracking inventory and
 Inventory and assets objects does not involve collection, use or retention of
 Medical equipment and instruments personally identifiable information.As such, tagging
 Electronic IT devices things has little or no impact on privacy.
 Surgical parts
 Books, documents, dossiers and files
 Waste and bio-hazards management
Tagging things linked  Medical equipment being used by patients, visitors or staff If the RFID-tagged item travels with an individual,
to people  Readers, tablets, mobile and other IT devices assigned to then extensive tracking and monitoring of the item is
staff in effect the same as tracking and surveillance that
 Smart cabinets individual.
 Devices, garments, or rooms assigned to patients Unauthorized identification, tracking, surveillance, and
 Blood samples and other patient specimens profiling of individuals are very serious privacy issues.
 Patient files and dossiers In addition, security issues related to RFID tags,
 Individual prescription vials including skimming, eavesdropping, interception,
interference, tampering, cloning and misuse, can also
impact individual privacy.
Tagging people  Access cards assigned to staff or visitors The privacy impact of tagging people is extremely
 Health-care employee identification cards high and elicit strong views among the privacy
 Patient health care identification cards community, medical practitioners, ethicists, consumer
 Ankle and wrist identification bracelets and civil rights groups, technologists, and public
 Implantable RFID chips policy. Protests are not uncommon.

19. Greek Privacy Laws and Data Protection Authority
In Greece, data and privacy issues are regulated by applicable laws 2472/1997, 3471/2006 and 3418/2005 , the
EU Data Protection Directive 95/46/EC and monitored by the Hellenic Data Protection Authority. The general rules
and guidelines for data controllers, as lay out by the DPA and the applicable laws are :
• They must process only the data which are necessary for one or more specified purposes, they must make sure
that they keep data accurate and up to date and they must retain data only for as long as is deemed necessary
for the purpose of the collection and process thereof
• In order to carry out the data processing, the Controller must choose employees with relevant professional
qualifications providing sufficient guarantees in terms of technical expertise and personal integrity to ensure such
confidentiality
• The Controller must implement appropriate organizational and technical measures to secure data and protect
them against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access as
well as any other form of unlawful processing
• If the data processing is carried out on behalf of the Controller, by a person not dependent upon him, the
relevant assignment must necessarily be in writing.
• The Controller must respect the data subject's rights to information, access and objection.
• They must meet their obligations vis-à-vis the DPA (notification, granting of permit)
• They must be kept informed on any Decisions, Directives or Recommendations issued by the DPA that may be
important to them

20. RFID Privacy Enhancing Technologies

21. Use Cases in a Smart Hospital
Patient Identification
A patient identification error may lead to improper dosage of medication to patient, as well as having invasive
procedure done. Other related patient identification errors could lead to inaccurate lab work and results
reported for the wrong person, having effects such as misdiagnoses and serious medication errors.

22. Use Cases in a Smart Hospital
Blood Tracking
A UK survey of 27 hospitals found that 1 in 1,501 blood transfusion samples were taken from the wrong
patient or labelled with the wrong patient’s identification details prior to transfusion. Blood is often given
under circumstances of extreme urgency and distraction. Patients are unconscious during the transfusion and
cannot state their name, and caregivers in the operating rooms may not "know" the patient as well as nurses
on non-surgical floors.

23. Use Cases in a Smart Hospital
Smart Operating Theaters
The aim of the system is to make sure surgeons carry out the right procedures on the right patients every
time. The Hospital will also use the system to ensure patients are given the right prescriptions and to identify
patients with infections to help stop the infection spreading. Patients are tagged on arrival. Photographs are
taken of them and digitised into an electronic record. A wireless network tracks each patient and brings up
his/her record at key points within the hospital, such as the operating theatre.

24. Use Cases in a Smart Hospital
Anti-Counterfeiting
Drug counterfeiting is an increasing problem as counterfeit drugs reduce patient safety, as they can contain
dangerous substances; and pharmaceutical companies lose tens of millions of dollars to the counterfeit drug
trade each year. This problem is being taken seriously and in February 2004 the U.S. Food and Drug
Administration (FDA) published a report encouraging the use of RFID to combat it and urging the drug
industry to adopt the technology.

25. Use Cases in a Smart Hospital
Tracking Equipment, Patients, Staff and Documents
Amongst all the imaginable use cases, RFID is certainly best suited for tracking applications. The technology
enables an automated and fast tracking of assets, equipment or people. Efficient tracking in a hospital offers
plenty of interesting perspectives. Allows for better equipment utilization, improved efficiency and allows
medical staff to spend more time in patient care, rather than on locating equipment and other menial duties.

26. Use Cases in a Smart Hospital
Smart Cabinets
RFID enabled solutions to manage supply chains are also useful after products enter inventory at a hospital.
RFID smart cabinets create real-time visibility of the tagged items within them, which enables hospitals to
track their inventories of medical devices and other assets. Many cabinets have built-in or optional access
controls, such as locks, that are designed to secure high-value items or restricted assets (narcotics, for
instance). Refrigerated cabinets are available for storage of pharmaceuticals and other heat-sensitive items.
Key features in smart cabinets software include screens, creation of reports, alarms and Web-integration.

27. Use Cases in a Smart Hospital
Neonatal Care
An RFID system works by having an active, tamper-proof RFID tag attached as an ankle bracelet on the
baby’s leg. The tag constantly checks in with readers, reporting every ten seconds that it is present and
functioning. The system is tied into the hospital’s security system, set to activate security cameras, trip
electronic door locks, and shutdown elevators for a lockdown of the facility in the event of an alarm. The
bracelet is also designed to set-off an alarm if it is loosened or cut-off from the newborn’s ankle. The system
also includes a mother-to-baby electronic matching feature. If the baby and mother tags do not match the
system will generate an auditable alarm and sends a message to the system.

28. Use Cases in a Smart Hospital
Access Control and Theft Prevention
The most widely use of RFID is found in access control. RFID cards and readers are used to allow access to
rooms and buildings to authorized members of staff and visitors. Additionally, RFID tags can be used for
access to PC workstations using integrated card readers. RFID tagging and tracing can also prevent and notify
on the event of Hospital assets theft or unauthorized removal from Hospital premises.

29. Use Cases in a Smart Hospital
Patient Monitoring
The RFID patient monitoring solution enables nurses to record, save and browse the results of patient
measurements, such as blood pressure and oxygen saturation, at bedside, using a lightweight PDA or laptop
computer equipped with an RFID reader. As part of the process, a nurse first identifies herself or himself
using the employee smart card, thereby gaining access to the system.Next, the nurse identifies the patient by
reading an RFID tag on that individual's wristband. Then, the nurse identifies the specialized monitoring
device to be used, such as a blood pressure cuff, which is equipped with an RFID tag.

30. Drivers for RFID Application in Healthcare
Response options 7, 8 or 9 indicate an important factor
Response options 4, 5 or 6 indicate a factor with unclear importance
Response options 1, 2 or 3 indicate an unimportant factor
Source : European Commission - DG INFSO - 2009

31. Obstacles for RFID Application in Healthcare
Response options 7, 8 or 9 indicate an important factor
Response options 4, 5 or 6 indicate a factor with unclear importance
Response options 1, 2 or 3 indicate an unimportant factor
Source : European Commission - DG INFSO - 2009

32. SWOT Analysis for RFID Deployment in a Greek Public Hospital

33. SWOT Strategic Options Matrix
OPPORTUNITIES THREATS
 Growing need and focus on reducing costs and improve  Concerns over privacy
utilization  Threat of non-compliance/insubordination from Greek
 Greek Government focus on IT and e-government health workers, as other recent examples have
 Large potential for improved patient care, reduce demonstrated
paperwork and mandate tasks  Care must be taken to adhere to all applicable laws and
 Large potential to reduce medical errors guidelines on data protection
 Potential for collaboration with other European Hospitals  RFID implementation requires a supporting IT system
for exchange of know-how and share costs and business processes changes in an environment and
culture notorious for its bureaucracy
 Cash-strapped Greek state might be unable to fund the
initial investment required
STRENGTHS STRATEGIES STRATEGIES
 Ease of use, small size and advanced features
→ Implement RFID in phases with emphasizing the → Involve and inform the public and healthcare staff
 Automation has led to more efficient healthcare systems
 Allows staff to concentrate on patient care rather than initial stages to improved patient care, safety and on benefits and motivations
mundane tasks (tracking paperwork, assets) reduced workforce paperwork → Implement RFID in phases with emphasizing the
 Allows for automated monitoring of patients → Seek partnerships and collaborations with other initial stages to improved patient care, safety and
 Provides an automated and secure method for access
European Hospitals reduced workforce paperwork
and IT control
→ Involve and inform the public and healthcare staff → Re-engineer redundant and bureaucratic
 Provides a first level of control against theft and
misplacement of hospital assets on benefits and motivations processes
 Has proven capabilities for providing additional security to → Seek EU funds, partnerships and collaborations
newborns
 Proven capabilities against counterfeiting
with other European Hospitals to reduce costs
 A number of well publicized successful RFID deployments → Adhere to EU and Greek privacy laws and
 Numerous EU RFID initiatives guidelines
WEAKNESSES STRATEGIES STRATEGIES
 No common/consolidated RFID standards → Seek partnerships and collaborations with other → Implement proven solutions (don’t re-invent the
 Poor interoperability between different RFID solution
European Hospitals and in particular with Hospitals wheel)
providers
 Most RFID/ICT solution providers use incompatible
that have already experience in RFID deployment → Involve and inform the public and healthcare staff
proprietary technologies
→ Implement proven solutions (don’t re-invent the on benefits and motivations
 Electromagnetic Interference can be an issue/concern wheel) → Implement RFID in phases with emphasizing the
 Metal and liquid can interfere with some frequencies, initial stages to improved patient care, safety and
unless specialized tags are used
 Some RFID industry standards and visions can be seen as
reduced workforce paperwork
over engineered/complex
 Cost and ROI is still a concern

34. The case for University Hospital of Heraklion
• The University Hospital of Heraklion (UHH) is one of the largest regional hospitals in Greece. It was
inaugurated in 1989 and it serves not only the population of Heraklion, but the whole of Crete
• The University Hospital of Crete is closely connected to the Faculty of Medicine of the University of Crete
where the university clinics and the laboratories operate. The Hospital offers a complete range of health care
services and departments such as pathology, cardiology, hematology, oncology, rheumatology, clinical
immunology etc
• UHH has approximately 750 patient beds and has over 179.000 outpatients and emergency admissions
every year
• The Hospital also performed approximately 7.000 emergency and scheduled surgeries in 2011
• The total number of patients per year is approximately 250.000
• The Hospital covers a built area of 60.837 square meters and it has approximately 2.000 members of staff

35. Recommended Phased Approach for RFID Implementation at UHH

36. RFID Coverage of UHH with 2.4 GHz Readers
12 Readers x 4 Floors for the Clinics Buildings
4 Readers x 3 Floors for the Administration Building
15 Readers x 2 Floors for the Main Corridor Building
Total of 90 Readers + 20% Tolerance
Grand Total of 108 2.4 GHz RFID Readers

37. Cost Estimation for Phase 1 Implementation
Estimated number of tags required for Phase 1
2.000 reusable wrist tags for patients
2.000 for the UHH employees
1.000 for tagging assets
ITEM QUANTITY PRICE TOTAL
2.4 GHz MOUNTED RFID READERS 108 300 € 32.400 €
2.4 GHz ACTIVE RFID TAGS 5000 15 € 75.000 €
INTSTALLATION/INFASTRUCTURE 1 50.000 € 50.000 €
RFID PRINTERS/WRITERS &
SOFTWARE 1 75.000 € 75.000 €
TOTAL 232.400 €
ANNUAL MAINTENANCE COSTS 25,000 €

38. Return on Investment for Phase 1
• Estimating and calculating the financial Return on Investment (ROI) for the RFID implementation in a public non-profit
Hospital is a challenge due to the nature of public Hospitals. For example, the efficiency improvements on staff workload will
not lead to reduced numbers of staff or salary expenditures, at least in the short term. However based on reported results, ROI
is expected within a year
• Efficiency gain is important to a Greek Public Hospital, as the Greek NHS is faced with increased patient traffic due to the
financial crisis in the country. Patients that in previous years would seek medical assistance in private clinics are now visiting the
public Hospitals in order to reduce the costs of healthcare
• Wayne Memorial Hospital in Goldsboro, in the U.S. which is a 316-bed facility, reported a realized capital expense reductions of
$327.147 in the first year of implementing an RFID tracking system which a cost of just over $300.000
• The Massachusetts General Hospital, reported a 400% ROI in just six months after implementing an RFID system for tracking
assets and Hospital supplies
• The Hospital also reported an 8% increase in patient safety, a 20% increase in charge capture, 30% increase in clinician full
time equivalent time, and a 70% reduction in stock outs
• Pantai Hospital Ipoh, in Malaysia, an understaffed Hospital tasks, due to chronic scarcity of skilled caregivers has reported that
with the use of RFID they have managed to automate routine giving nurses time to provide quality patient care, savings of
approximately 10.000 hours annually in nursing care
• Birmingham Heartlands Hospital in the UK, which implemented an RFID-based system called "Safe Surgery System" in two of
its surgical wards, reported that due to the patient through-put improvements the system paid for itself in six months
• All Hospitals reported medical staff satisfaction for the new systems

39. Results and Conclusions
• Based on the results and the findings, RFID deployment on a large Greek Public Hospital such as the
University Hospital of Heraklion is a worthwhile investment
• Privacy and security concerns need to be addressed and the project needs to involve all members of staff
• The public needs to be informed and educated
• Attention must also be paid to the Greek and European legal framework due to the sensitivity of the data
involved
• The patient benefits need to communicated clearly and the big-brother myths must be addressed.
• As the reduction of costs, resources wastage and misuse of funds is currently high in Greek Government
agenda, the strategic objectives targeting cost effectiveness can be as well be derived from such
implementation thanks to a potential reduction of overbuying and or replacement, unnecessary rentals, and
underutilization of hospital assets as the results have shown that benefits are derived from RFID
implementation
• The new RFID enabled processes provide information on assets availability rate, utilization rate, and real-
time localization
•Finally, RFID deployment will reduce manual intervention, the opportunities for human error or negligence
which ultimately improve the accuracy of patient identification, the patient identification for medication safety
and the critical information concerning the patient, which ultimately improve patient care, save lives and avoid
unnecessary suffering

40. Thank You For Listening