Joy Xu is a student at McMaster University in the health sciences program. With great passion towards healthcare, she’s an avid researcher who has worked on health policy at the McMaster Health Forum, computer simulations at the University of Toronto, and explores the department of anesthesiology and rheumatology.

“I’ve always held an intrinsic curiosity towards science. Born near the start of a new millennium, I witnessed the monumental progress in digital innovations. Growing up, my interests peaked within healthcare and I began learning about technological miracles helping institutions deliver compassionate support to the community. Wherever I volunteered, privacy and confidentiality was always held in high-regard and even became embedded as one of my personal core values. However, I often observed the lack of attention directed towards data sharing on the internet. As I scrolled through social media, I felt countless twinges of concern as I saw potential realms for privacy breaching. This year, misinformation and cyber attacks throughout COVID-19 has truly shown the detrimental effects of inadequate attention towards cyber security and digital transformation. The future can only prevail in optimism by learning from the surreal events of 2020. More than ever, these issues must be addressed now.”

In 2018, Canada strived closer towards attaining universal pharmacare with the Ontario Drug Benefit (ODB) program which provided over 4,400 prescription drug products to vulnerable demographics [1,2]. However, substantial economic losses have resulted from the lack of vigilance towards digital transformation of the pharmaceutical industries, including measures to improve cyber security and digital systems [3,4]. Pharmaceutical fraudulence accounts for an estimated 2 – 10% loss out of the $5.9 billion cost of the ODB program [5], [6]. With a conservative estimate, a mere 2% loss adds up to $118 million lost annually [5]. Yet only $5 million is recovered from pharmacy inspections every year [7]. The system of fraud prevention relies on outdated technology, including lack of adequate encryption, cyber security, and automated processes [4, [6].

For example, one of the most reported methods of “accidental fraud” involves the ministry of health’s computer system which has a seven-day window to reverse charges [7]. Billing cannot be reverted after this period, which often results in accidental charging when long-term care institutions don’t inform pharmacies of a resident’s death in time [7], [8].

The ministry also lacks consistency with implementing inspections. For example, the ministry did not report any fraud cases for two years to the Ontario Provincial Police’s Anti-Rackets Health Fraud Investigation Unit in 2013 and 2014, and only reported two cases in 2015 [8]. When the Ontario Provincial police asked for files, the ministry provided 13 cases where 8 cases were deemed too old for investigation (which included false prescriptions made against physician orders, false billing, and even billing when there were no customer visits) [5], [8], [9]. Without digital transformation, the archive system did not provide adequate integration between different units within the justice system for proficient fraudulent inspections [4].

In 2019, an investigation showed that fake transfers were easily made to falsely charge for drugs that were never in the inventory in the first place [8], [10]. With this method, over 100 of Ontario pharmacies have been involved with fraudulence within five years [8]. Additionally, auditors often provided early notice for inspection, which enabled pharmacies to replicate official documents within a few hours [11].

Though most pharmaceutical institutions have incorporated digital systems, additional defensive mechanisms must be instilled to tighten fraud regulations and also protect patient confidentiality [4], [12]. Cyber attacks have been detrimental to the healthcare system, often rendering millions of patient data lost to illegal sources such as the WannaCry ransomware cryptoworm demanding payment from hospitals in cryptocurrency [13], [14]. Even Express Scripts, one of the largest processors of pharmacy prescriptions, reported extortionists demanding for personal medical information on millions of patients [15].

Particularly within 2020, digital transformation must be prioritized with the unprecedented incidence of COVID-19 [16]. The continuous malperformance of fraud prevention is a culmination of an entire decade’s lack of sufficient attention to digital transformation in the pharmaceutical industries [12], [17].

Beyond pharmacare, cyber security must prevail against cyber attacks targeting health care information intended for the public [16]. Network penetration rates have tripled with attempts to steal intellectual property while taking advantage of the epidemic to extract ransom payments [18]. In 2019, ransom demands reached over $84 to $338 million (which is $570 million to $2.3 billion after factoring downtime costs) [18].

Canada remains as the only country with universal healthcare, but not pharmacare [19]. The ODB program has advanced us closer, but in addition to innovation, proactive maintenance needs to operate simultaneously to create sustainable systems for both medicare and pharmacare [20]. As a leading country, we must recognize the outdated elements and risks associated with this model during a digital era. By implementing the following feasible recommendations, the pharmaceutical industry can uphold precedence in digitally transforming systems for preventative measures against fraudulence, cyber attacks, and other technological risks.

1. Bolster the internal connectivity of pharmaceutical governance with enhanced digital systems

Most members involved within pharmaceutical fraudulence prevention should co-work rather than codepend in a serial process of inspection like the Ontario Ministry of Health, OPPs and College of Pharmacists [8]. For example, the health fraud investigation unit only inspects pharmacies based on ministry referrals (which resulted in no crime investigation between 2013 – 2015) [8], [9]. Hence, the allocation of specialized pro-active sectors within each group can alleviate the stagnancy and duration of the process. Unlike previous decades, digital records and online communication platforms can increase visibility between the moderating groups to adopt efficient methods within the serial approval process [7], [11]. The pro-active sectors within each department may require increased staffing which can be costly. However,the investment returns prove to save more than expended– in 2017, 10 inspectors recovered $10.3 million alone [8]. Within 4,200 pharmacies, only 6% are audited every year [8]. Therefore, increasing inspections can be a feasible and lucrative investment to sustaining pharmacare in the long-term. Additionally, e-health cloud computing can allow controlled data sharing to certain groups to streamline pharmaceutical processes at an enterprise level [21]. The cloud computing technology may present additional security risks– however, security architecture can establish privacy domains in the e-health infrastructure to uphold patient confidentiality [21]. Additional measures could include the implementation of cryptographic techniques which serve multifunctional purposes: (1) Stored data can be encrypted over the network available to users (2) Authentication mechanisms can be employed with decryption keys and digital signature verification [21], [22]. Through these processes, further investment and research could yield potential solutions to reducing inefficient operations [17].

2. Integrate technological solutions to improve pharmaceutical systems and enhance cyber security

Many fraudulent cases encompass counterfeited documents to pass inspections [8]. Official prescription and drug transfer documents should incorporate unique identifiers which can only be recognized through authorized personnel and government representatives [23]. Even with early notice of inspections, these identifiers prevent external manipulations while allowing auditors to access the unique identifier for the document validity [23], [24]. This may be in the form of number codes that match government registry, guilloches background printing, rainbow printing, invisible fluorescent printing, intaglio printing, micro-printing, etc [24]. The detection process can also be automated for efficiency through hand-held recognition machines or equipment for authorized government officials use only [21], [25]. Alternative options include classification systems to analyze the printing technique (where counterfeit documents often yield inkjet due to PC printouts) [25], [26]. Pharmacies should increase vigilance in implementing cybersecurity measures within technical management [27]. All pharmacies can significantly reduce cyber attack risks through implementing the encryption of data, secured hardware, and updated antivirus and malware protection software [28]. Particularly within smaller to medium pharmacies, cyber security can easily neglect the insurance of highquality systems administration and maintenance which is essential to configuring digital systems [29]. Social awareness among staff must proceed simultaneously [27]. Besides technical breaching, common cyber security risks often pose in the form of fake websites exploiting visitors (called watering holes) and emails requiring sensitive information (called phishing) [28]. During training orientations, cyber security must be contextualized beyond technical terms to warn staff of its appearance through common means such as unsolicited emails [27], [29]. Additionally, reporting cyber attack incidents should be a priority as well. In 2017, only 10% of Canadian businesses reported incidents to the police, which allow cyber criminals to continue victimizing other entities with data breaching and economic losses [30].