Soon, it might become the norm to verify your identity at the hospital or clinic by scanning your fingerprint.

One California clinic, the Kern County Medical Center in Bakersfield, recently started experimenting with a biometric fingerprint reader, called SafeChx, to avoid mixing up patients with similar names, and potentially even crack down on fraud. It’s the first hospital in California to use the SafeChx system.

The SafeChx system, which is available for free, is now used by 178 hospitals around the country. Patients are asked to scan their finger so hospital administrators can view their personal information, including their history of hospital visits and medical record.

New technologies for patient identification are spreading quickly in health systems in the U.S. as an alternative to a national patient identifier, which is used in other countries to accurately match patients to their medical record. Health systems today rely on demographic data, like name, address and phone number, which are likely to change over time.

“We serve a large Latino population, and they often use both their maiden name and their married name,” says Edward Din, director of patient access at Kern County’s Medical Center. “Sometimes those names are reversed. This resulted in a lot of confusion.”

But some health and privacy experts say finger-scanning technologies are not the magic solution. Once a fingerprint has been compromised, they say, it’s impossible for a patient to get a replacement. And it could open small hospitals to being hacked if the data is stored in one place.

New Technologies to Identify Patients

SafeChx was developed by Sean Lane, a former fellow at the National Security Agency, better known as the NSA, and Brad Mascho, an executive at a health insurance association. It is the flagship product of a company called CrossChx.

Lane and Mascho initially became interested in patient identifiers after a health system in their hometown in Southeastern Ohio asked them for advice on cutting down on prescription drug abuse, a consequence of identity theft.

“Many hospitals were using first name and date of birth to identity patients,” says Lane. “That simply wasn’t good enough.”

The founders viewed biometric identification techniques, like fingerprints, as the next step for hospitals. They say the fingerprint doesn’t need to be tied to any other sort of identifying information, like state status, so it can even be used by patients who are undocumented.

CrossChx is targeting small to medium-sized hospitals first, before reaching out to large academic teaching hospitals. It makes money by selling health care applications through its app store, which hospitals can use in addition to SafeChx.

Kern Medical Center’s employees say their patients don’t seem to have major reservations about scanning their finger. Since June of this year, more than 6,000 patients were asked to register to the system, according to Din, and 93 percent agreed to participate. Kern’s registrars were trained to inform patients how the process would work.

Many of Kern’s patients come from low-income households. Scott Thygerson, the hospital’s chief strategy officer, describes it as a “safety net hospital” that is responsible for nearly half of the population in the county — those who are enrolled in Medicare or have no insurance. “It’s nice to be on the leading edge of this,” Thygerson says.

CrossChx’s founders say they are not surprised that patients have been open to scanning their index finger. They claim that those who have opted out tend to be uninformed or have something to hide.

“It’s not worth our time to educate that sliver of the population,” Lane says.

Privacy Concerns

But some health experts say finger-scanning may not be an approach that’s in the patient’s best interests.

“It’s the opposite of a delightful customer service,” says Bob Kocher, a clinician and an investor in health technology at Venrock.

In Kocher’s view, most problems that patients face do not require extensive knowledge about their medical and visit history. And most patients are not out to commit fraud.

Privacy advocates harbor a different set of concerns about finger-scanning technology.

“I’m not sure that this protects against medical identity theft,” said Lee Tien, a senior staff attorney at the Electronic Frontier Foundation (EFF), a San Francisco-based group that specializes in Internet privacy. In order for that to work, even in theory, he argues, the entire U.S. health system would need to adopt it.

Tien says a biometric like a fingerscan is no better than a password or any other secret information. Moreover, when a biometric is compromised, it’s compromised for good. “I can’t change my fingerprints. Or iris. Or anything else,” he says.

Tien’s biggest concern is that the finger scan will spread outside of health providers and into the hands of insurers, or that it will become a de facto national patient identifier.

Currently, a debate is raging in Washington D.C. about the drawbacks and potential benefits of using biometrics to identify patients. Many privacy groups, including Patient Privacy Rights and EFF, have spoken out against patient IDs that can match individual patients to all sorts of medical information, referring to them as “the health care cousin of NSA surveillance.” These groups also argue that putting this information in one system would actually increase the likelihood that it will get hacked.

Hospitals that are not using the technology are experimenting with other approaches. John Mattison, chief medical information officer at Kaiser Permamente, says administrators are not using fingerprints. But they are increasingly taking photos of patients and storing them in the medical record.

Mattison says it’s not easy to crack down on fraud and keep patients safe, while maintaining privacy and security.

“The key is identity management that is flexible and appropriate to the level of privilege you get,” he says, “while being unlikely to get abused for criminal purposes. That’s the ideal.”