Search the KHIT Blog

Sunday, January 1, 2012

2012: ruminating on the year ahead in HIT


It will be a busy and contentious year, no doubt. I have a ton to reflect upon and write about. Per my prior post, it looks like Boehner blinked on the tax relief / unemployment extension / Medicare SGR "Doc Fix" bill. For now, that is. We're now getting government in recursive partisan election year two-month brinksmanship dramas, and we're right on the cusp of the next irritating episode.
___

MY HOLIDAY READING LIST

Cheryl and I went to her Mom's in northern Alabama on the family farm for the Christmas holiday.
Seems like all I did was eat, sleep, watch football, and read for nine days. I read and finished two books, and have three more well on the way to completion (click the images below for links).

ECONNED is depressingly astute and thorough. Perversely nice to know I got a lot of things right in my earlier policy blog posts on the topic, here, here and here.
Among my long treasured hardcopy books are the Kahneman / Tversky / Slovic works "Judgment under uncertainty: Heuristics and biases" and "Choices, Values, and Frames." "Thinking, Fast and Slow" comprises a wonderful, general-reader accessible recap of an esteemed career work to date. For a nice summary by noted writer Michael Lewis ("Moneyball" of late), see "The King of Human Error" in Vanity Fair (I have all of his books).

Apropos of the latest work by Dr. Kahneman is "Medicine in Denial," which I cited in an earlier REC blog post.

"Medicine in Denial" is a serious, serious throw-down to the profession (not that I buy it all uncritically; more on that as I go along). I am almost all the way through my gratis pre-pub copy. 267 pages of thoroughly, intelligently reasoned and exhaustively documented argument. My copy is now freighted with sticky notes, red pen margin notes, and yellow highlighter markups.


...We began by asserting the need for a secure foundation for care. With buildings, the value of a secure foundation is obvious, even though it gives no assurance that the rest of the building is well designed, constructed or maintained. That lack of assurance does not make the foundation any less important. On the contrary, if the foundation is not secure, then the rest of the building, no matter how well designed, constructed or maintained, is untrustworthy. And in medicine, the complex processes of patient care are untrustworthy if relevant, available information is not taken into account at the outset of care.

E. Objections to the combinatorial approach

Physicians naturally view the judgmental approach, and the elaborate training needed for the unaided mind to apply it, as inherent in scientifically advanced medical care. By comparison, a tool-driven, combinatorial approach seems to impose both crude standardization and excessive detail—”cookbook medicine” taken to a compulsive extreme...
Enter Dr. Kahneman:

...Not surprisingly, then, the idea that a mechanical combination of a few variables could outperform the subtle complexity of human judgment strikes experienced clinicians as obviously wrong. The debate about the virtues of clinical and statistical prediction has always had a moral dimension. The statistical method, Meehl wrote, was criticized by experienced clinicians as “mechanical, atomistic, additive, cut and dried, artificial, unreal, arbitrary, incomplete, dead, pedantic, fractionated, trivial, forced, static, superficial, rigid, sterile, academic, pseudoscientific and blind.” The clinical method, on the other hand, was lauded by its proponents as “dynamic, global, meaningful, holistic, subtle, sympathetic, configural, patterned, organized, rich, deep, genuine, sensitive, sophisticated, real, living, concrete, natural, true to life, and understanding...

This stuff is all fabulous. Bracing yet inspiring. I triangulate the foregoing with the observations found in Sperber and Mercier's "Why Do Humans Reason?" (PDF, another epistemological kick in the pants).

This quote from "Medicine in Denial" stings:
Policymakers recognize that transformation requires more than technology. Accordingly, certification and “meaningful use” of electronic health records (EHRs) are required to receive subsidies to purchase EHRs under the 2009 economic stimulus legislation. But the requirements for certification and meaningful use as currently conceived are primitive...

...Failures of quality in medical records, paper and electronic, are a root cause of the health care system’s failures of economy. The HITECH Act reforms effectively acknowledge this reality, but fail to remedy it...

...Health information technology has only recently become prominent in health care reform debates. The traditional focus of health care reform has instead been economic incentives. Yet, incentives are not the central problem. No arrangement of economic incentives is perfectly aligned with patient interests, especially within an out-of-control system [pp 37-38].
Hard to disagree with that, my current HIT evangelist job notwithstanding.

But wait! There's more!
Abstracting knowledge from the problem-solving activities to which it should relate has damaging effects at many levels. One effect is that formal education becomes focused unduly on personal intellect. Cultivating a narrow range of intellectual skills and temperaments that foster academic success, the culture of education takes interpersonal skills for granted, and devalues manual skills. And it fails to instill the intellectual behaviors and perspectives that foster effective problem-solving (see part V).

In particular, traditional schooling fails to instill high standards of achievement. In most schooling, time is the constant and achievement the variable—precisely the opposite of what true education demands. Students are allotted a fixed amount of time to learn and then permitted to pass exams and courses with a B or C or worse. Inevitably, given the widely varying abilities and inclinations of individual students, not many will have the experience of passing courses at a high level of achievement. This tolerance of lesser achievement is especially harmful when learning is cumulative, that is, when success at one level requires understanding of the material from an earlier level.

Failure to enforce high standards of quality arises from the premise that schooling should instill a fixed core of knowledge, as distinguished from a core of behavior. Teaching high standards of intellectual behavior and teaching a fixed core of knowledge are mutually exclusive when a fixed time is allotted to achieving these goals. One of the three variables (time spent, amount covered and degree of mastery) has to be held constant at a high level, and that constant should be the degree of mastery. Students would differ in the amount they master and the speed with which they do so, but not in the degree of mastery they attain.

Mastery of a core of knowledge should not be the goal of education — especially in an era when knowledge is constantly becoming obsolete and when information technology confers rapid access to more knowledge than anyone can learn and more processing power than anyone’s mind possesses. The goal should be mastering the behaviors involved in applying knowledge to solve problems effectively and efficiently.

Because these principles are ignored, many students pass through 12 or more years of schooling without ever experiencing mastery, while constantly undergoing invidious comparisons to the best students. This system is harmful even for those best students, for they may acquire elitist attitudes, superficial understanding and misplaced confidence that their academic proficiency will translate into effective problem solving. For less successful students, schooling is too often experienced as a caste system rather than a vehicle for personal development. Many students emerge from their schooling with their natural abilities undeveloped and their natural optimism defeated. To fight back, some adopt an attitude of disdain towards education and intellect. These reactions to formal education are like the reaction of dying canaries in a coal mine—highly sensitive indicators of toxic conditions. In varying degrees, many students are left without the capacities and confidence that only achievement can confer and without the expanded horizons that only education can provide. [pp 229-230]

Love it. Let's summarize, shall we? "
when information technology confers rapid access to more knowledge than anyone can learn and more processing power than anyone’s mind possesses. The goal should be mastering the behaviors involved in applying knowledge to solve problems effectively and efficiently."

Yes.
___
Other works in progress at this writing:


___

JAN 2nd UPDATES

Lots of cool new stuff over on The Health Care Blog this morning. Below, from the comments, a common refrain voiced by HIT skeptics.

"Widespread iatrogentic EHR diseases?" Really? Any data, sir? When I see phrases like "directly proportional," I reflexively react "data?"

Not that I disagree with the notion regarding continual evaluation and improvement of any medical technology.

Moreover, you have to give informed naysayers their due, e.g., "IT Malpractice? Yet Another "Glitch" Affecting Thousands of Patients. Of Course, As Always, Patient Care Was 'Not Compromised'."
__

I commented in this post (below). Fits with what I'm working on at the moment.

The Crash of Air France 447: Lessons for Patient Safety
By BOB WACHTER, MD

BobbyG says:
January 2, 2012 at 11:34 am

”We need to ensure that our personnel have the skills to manage crises caused by the malfunction of technologies that they’ve come to rely on. We should continue to push crew resource management training and work on strategies to bolster situational awareness (I haven’t found anything better than the old House of God rule: “In a Code Blue, the first procedure is to take your own pulse.”) We need to redouble our efforts to promote realistic simulation training, and to build systems that allow us to learn from our mistakes and near misses so we don’t repeat them.”
__

This is precisely a core takeaway point from Drs. Weed & Weeds’ excellent book “Medicine in Denial.” (now available on Amazon. They sent me a pre-pub proof, which is now loaded down with yellow marker, red pen margin notes and stickies; it’s excellent. Highly recommended)

to wit:

“The minds of physicians do not have command of all the medical knowledge involved. Nor do physicians have the time to carry out the intricate matching of hundreds of findings on the patient with all the medical knowledge relevant to interpreting those findings. External tools are thus essential. But the tools are trustworthy only when their design and use conform to rigorous standards of care for managing clinical information.

Without the necessary standards and tools, the matching process is fatally compromised. Physicians resort to a shortcut process of highly educated guesswork…

…We use the term “guesses” because these key initial judgments are made on the fly, during the patient encounter, based on whatever enters the physician’s mind at the time. That mind may be highly informed and intelligent, but inevitably its judgments reflect limited personal knowledge and experience, and limited time for thought. Euphemistically termed “clinical judgment,” physician thought processes cause a fatal voltage drop in transmitting complex knowledge and applying it to patient data. The outcome is that the entire health care enterprise lacks a secure foundation.

Equally insecure are the complex processes built on that foundation: decision making, execution, feedback and corrective action over time. Responsibility for all these processes falls on the mind of the physician. Here again the mind lacks external tools and accounting standards for managing clinical information.” [pp 2-3]
_

I’m now triangulating all this stuff with Kahneman’s “Thinking, Fast and Slow,” Groopman’s “How Doctors Think,” Sperber & Mercier’s “Why Do Humans Reason?” etc. Fascinating.

I’ll be citing your article on my REC blog. Fits right in with my latest topics.

There's so much to learn. One more Weed & Weed money quote for now:
Unlike scientific practitioners, medical practitioners do not operate in an objective realm, where the contents of thought and knowledge exist independently of the individual mind, a realm where knowledge can be reliably transmitted and applied, where new knowledge can be rapidly translated into practice, where all knowledge can be tested against patient realities. Isolated from this objective realm, the mind becomes a negative force, a cause of confusion and disorder. Physicians are not equipped to fulfill their immense responsibility safely and effectively. Other practitioners are not equipped to share that responsibility with physicians. Patients are not equipped to work effectively with multiple practitioners, nor to assume the ultimate burden of decision making over their own bodies and minds. Third parties are not equipped to create order out of this chaos. Practitioners and patients are not accountable for their own behaviors, while third parties are left free to manipulate disorder for their own advantage.

In short, essential standards of care, information tools and feedback mechanisms are missing from the marketplace. These missing elements are in large part already developed (see parts IV and VI below). Yet, the underlying medical culture does not even recognize their absence. This does not prevent some practitioners from becoming virtuoso performers in narrow specialties or skills. But their virtuosity is personal, not systemic, and limited, not comprehensive. Missing is a total system for enforcing high quality care by all practitioners for all patients. [pg 3]

"
[I]nformation tools and feedback mechanisms are missing from the marketplace"? Well, "third parties are left free to manipulate disorder for their own advantage."

Medical economist J.D. Kleinke would find that totally unsurprising.

___

ERRATUM: This is interesting.

Judge orders UPMC deposition in Presby death lawsuit

Monday, November 14, 2011
By Sean D. Hamill, Pittsburgh Post-Gazette


An Allegheny County judge today ordered UPMC to allow an official to be deposed in a medical malpractice case about whether he altered the electronic health record of a man who died while in UPMC Presbyterian Hospital.

UPMC's attorney, John Conti, had attempted to shield Richard Simmons, UPMC Presbyterian's head of quality assurance, from being deposed during a hearing before Judge Ronald W. Folino.

Mr. Conti argued that Dr. Simmons was performing "peer review" work -- which would protect him from being deposed -- when he entered the electronic health record of Samuel Sweet three days after the 62-year-old Cheswick man died at the hospital in 2009...

That certainly bears following.
___

Ahhh... The state of health care politics...
Really? Well, you learn something every day.

Back to the real world.

Dr. Kahneman on "Defending the status quo"

Animals, including people, fight harder to prevent losses than to achieve gains. In the world of territorial animals, this principle explains the success of defenders. A biologist observed that “when a territory holder is challenged by a rival, the owner almost always wins the contest—usually within a matter of seconds.” In human affairs, the same simple rule explains much of what happens when institutions attempt to reform themselves, in “reorganizations” and “restructuring” of companies, and in efforts to rationalize a bureaucracy, simplify the tax code, or reduce medical costs. As initially conceived, plans for reform almost always produce many winners and some losers while achieving an overall improvement. If the affected parties have any political influence, however, potential losers will be more active and determined than potential winners; the outcome will be biased in their favor and inevitably more expensive and less effective than initially planned. Reforms commonly include grandfather clauses that protect current stake-holders—for example, when the existing workforce is reduced by attrition rather than by dismissals, or when cuts in salaries and benefits apply only to future workers. Loss aversion is a powerful conservative force that favors minimal changes from the status quo in the lives of both institutions and individuals. This conservatism helps keep us stable in our neighborhood, our marriage, and our job; it is the gravitational force that holds our life together near the reference point. [pg 305, Thinking, Fast and Slow]
___

ON "PERSONALIZED MEDICINE"

I put up some linked excerpts and thoughts regarding "personalized medicine" in my November 16th post. So, I found this interesting today (click the graphic for the link).


As I contemplated what I’d like to write about for the first post of 2012, I happened to come across a post by former regular and now occasional SBM contributor Peter Lipson entitled Another crack at medical cranks. In it, Dr. Lipson discusses one characteristic that allows medical cranks and quacks to attract patients, namely the ability to make patients feel wanted, cared for, and, often, happy. As I (and several of us at SBM) have said before, it’s not necessary to invoke magic, quackery, or pseudoscience in order to show empathy to patients and provide them with the “human touch” that forges a strong therapeutic relationship between physician and patient and maximizes placebo effects without deception. In the old days, this used to be called “bedside manner,” but in these days of capitation and crappy third party payor reimbursement it’s very difficult for physicians to take the time necessary to listen to patients and thereby build the bonds of trust and mutual respect that can augment the treatments that are prescribed. Unfortunately, because of this the quacks have been all too eager to leap into the breach.

One aspect of this tendency of medical cranks is to claim that they somehow “individualize” their treatment to the patient, as Peter points out:

There are a number of so-called holistic doctors in town who claim to practice “individualized” medicine. What this really means isn’t clear. My colleagues and I certainly individualize the treatment plans for all of our patients, using data gleaned from decades of scientific studies of large groups of patients. What “individualized” care seems to mean in this other context is “stuff I made up to make that patient feel more unique and special.”
Yeah. Note doubt the hucksters will always be quick out of the chute to misappropriate scientific mantle keywords and phrases.

As usual, the comments are as good as the posts at SBM.


ConspicuousCarlon 02 Jan 2012 at 2:39 pm
...Except for insanely expensive tailoring, nobody measures a customer’s foot and then creates a custom shoe just for them. The seller measures the customer’s foot, and then gets one of only a handful of different sizes available. Far from being so personalized as to evade scientific study, each given shoe size is actually sold to millions of different people.

And what sort of scientific study might we want to do, if the concept of a shoe had just been invented? Well, we might want to do Phase I trials to find out if shoes are safe to wear, and how big of a shoe can be worn safely. Is the wearer going to experience discomfort or injury if the shoes are too big? How big can the shoe get before the wearer risks twisted ankles and tripping? Does the shoe remain on the foot all day without falling off?

Then we might want to do Phase II trials to find out how much benefit the wearer gains from wearing a shoe within the safe range of shoe size for their foot. If shoes in any size are harmless, but still beneficial, we can sell a nice big shoe which fits everyone. If having oversized shoes produces a risk which outweighs the benefit of going barefoot (and in fact, this is the case in real life), then we would have to sell shoes in multiple sizes so that a person can get a shoe within the safe size range for their foot, just as drugs with potential side effects and overdosing are available in different amounts. The foot’s tolerance for slightly imperfect shoe size will determine how many different shoe doses we have to manufacture for a Phase III trial and mass marketing.

And then we can argue about whether or not commercial shoe production has produced enough size variety for everyone, and weigh the ups and downs of possibly having the government mandate more varied shoe sizes.
LOL. On the other hand, I bet the folks at the "Personalized Medicine Coalition" would take exception to the conflation of alt.med stuff with
initiatives involving pharmacogenomics and epigenetics research, etc.
"My colleagues and I certainly individualize the treatment plans for all of our patients, using data gleaned from decades of scientific studies of large groups of patients."
Yeah, but I think Lawrence and Lincoln Weed would give you some pushback on that.
Medical knowledge is itself an element of the health care system. Like other elements, medical knowledge is distorted by failure to migrate from the realm of subjective, personal knowledge to the realm of objective knowledge, from knowledge as it exists in the mind to its independent existence in external information tools.209 The distortion occurs in the content of medical knowledge, in its organization, and in its capacity for growth.

First, the content of medical knowledge is oriented towards resemblances, not differences, among individuals. Yet, the differences must be taken into account for sound decision making, especially with chronic disease. Thus, individual heterogeneity and uniqueness, no less than patterns of resemblance across populations, must become the subject matter of medical knowledge.

Second, the health care system fails to organize medical knowledge for solving the problems of unique patients, just as the system fails to organize health care providers for delivering patient-centered care. Care is thus fragmented intellectually as well as institutionally. Rather than being oriented towards patient needs, knowledge is organized for comprehension by the unaided minds of physicians. Medical specialties, for example, are defined by body system. That narrow focus reduces the burden of comprehension, but it fails to cope with the reality that patient problems normally implicate multiple body systems. Similarly, the population-based content of medical knowledge is easier for the mind to comprehend than detailed data about individual variation.

Third, the health care system fails to enforce the scientific standards and tools essential to the growth of reliable medical knowledge. Existing “knowledge” is not just incomplete but in part is simply wrong. As with other areas of science, medical knowledge is only a provisional approximation of reality. Practitioners, patients and researchers must constantly test medical knowledge against reality. In caregiving, that testing process demands taking into account all potentially relevant knowledge and patient-specific data at the outset of care, and then carefully monitoring and adjusting whatever course of action is chosen. In clinical research, that testing process demands continuously harvesting feedback on knowledge by examining meticulous records of what happens when knowledge is applied. [Medicine in Denial, VII. The Gap Between Medical Knowledge and Individual Patients, pg 178]
All very interesting.
___

CODA: A MASTER'S IN "LAW"?
I'm too old to now go to law school (I'll be 66 in five weeks). But, I recently clicked on Facebook ad (which I nearly never do). It was for the Champlain College (VT) MSL program. Interesting. Enticing.

We believe that in a world dependent on the rule of law, the law is too important to have only a few specialists understand it. As such, we've created our Master of Science in Law to help professionals who are not lawyers think and act confidently in the legal dimensions of their work, prevent needless litigation, and work productively with legal counsel when counsel is necessary.
Dunno. Would that get me any traction with our HIE Counsel who keep politely blowing me off with respect to our Privacy and Security stuff? (See my prior posts. I rather doubt it.) Beyond that short-term utilitarian concern, would there be substantive net academic value? I am always up for more learning, particularly with respect to law, but, what's the likely appreciable margin here?

So, I made contact, but came away from it with disconcerting wafts of a pro forma "admissions counselor" (read call center sales rep) persistently fishing for a credit card number. Among other considerations, I was a bit red-flagged by the relatively low admission requirements.

Dubious.

They have competition, too, so it emerges. Google "Master's in Legal Studies."

Notwithstanding that it remains intriguing, I will have to search a bit longer.
___

More to come...

Sunday, December 18, 2011

The twisty politics of HIT

..."Shortly before the passage of the 2009 federal economic stimulus package, Gingrich criticized the legislation as a "big politician, big bureaucracy, pork-laden bill." However, at the same time, Gingrich praised a provision of the stimulus package that allocated $19 billion to promote the use of health IT. He said, "I am delighted that President Obama has picked this as a key part of the stimulus package."

Under the stimulus package, health care providers who demonstrate meaningful use of certified electronic health records can qualify for Medicaid and Medicare incentive payments...
"I am delighted that President Obama has picked this as a key part of the stimulus package."

Right, Mr. Gingrich. Insofar as it was then politically convenient, 'eh? (Click here or the image above for the link.)

Apropos of the forgoing. Monday morning news:


...Regulatory pressure is building on the industry to achieve the goals of Presidents George W. Bush and Barack Obama to provide most Americans with access to an electronic medical record by 2014. An early fissure as a result of that pressure comes as Dr. Farzad Mostashari, head of the Office of the National Coordinator for Health Information Technology, supports a federal advisory committee's recommendation in June that the CMS extend by one year the compliance deadline for Stage 2 meaningful use for some early adopters of health information technology...

Once we get the total head count and subsequent relative proportions of "early adopters" (those who attested in 2011), we'll have a better picture of how this all might shake out going forward. Pushing back Stage 2 was a good and necessary idea, IMO.

Also noteworthy in the Modern Healthcare article:
Breaches and privacy lapses make headlines again in 2011 as healthcare organizations suffer record data losses during the year. In September, in its report to Congress, the Office for Civil Rights at HHS says there have been more than 30,500 breaches, most with fewer than 500 records, since it began counting them in late 2009. By year's end, the office's public “wall of shame” lists 372 major breaches (involving 500 or more records each) totaling nearly 18 million records. Military healthcare payer Tricare Management Activity and its data backup services vendor, Science Application International Corp., tops the wall with the largest breach of the year at 4.9 million records.

I guess as the penetration of HIT increases, we should expect an increase in PHI breach incidents. Which brings to mind the following (click to enlarge):

HIPAA Security Rule Toolkit

The NIST HIPAA Security Toolkit Application is intended to help organizations better understand the requirements of the HIPAA Security Rule, implement those requirements, and assess those implementations in their operational environment. Target users include, but are not limited to, HIPAA covered entities, business associates, and other organizations such as those providing HIPAA Security Rule implementation, assessment, and compliance services. Target user organizations can range in size from large nationwide health plans with vast information technology (IT) resources to small health care providers with limited access to IT expertise...
I've installed it and have been kicking the tires. 492 questions (some of them conjunctive clause compound questions) spanning the gamut of 45 CFR 164.3. More on this shortly.
___

DEC 19th P.M. UPDATE

The NIST HIPAA toolkit is a bear. Lots of compound questions, e.g., the first 13 questions:
164.308(a)(1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.
  1. Has your organization developed, disseminated, reviewed/updated, and trained on your Risk Assessment policies and procedures?
  2. Does your organization's risk assessment policy address: purpose, scope, roles and responsibilities management commitment, coordination among organizational entities, training and compliance?
  3. Has your organization disseminated your Risk Assessment policies and procedures?
  4. Has your organization disseminated its Risk Assessment procedures to the work staff/offices with the associated roles and responsibilities?
  5. Has your organization defined the frequency of your Risk Assessment policy and procedures reviews and updates?
  6. Has your organization reviewed and updated your Risk Assessment policy and procedures in accordance with your defined frequency?
  7. Has your organization identified the types of information and uses of that information and the sensitivity of each type of information been evaluated (also link to FIPS 199 and SP 800-60 for more on categorization of sensitivity levels)?
  8. Has your organization identified all information systems that house ePHI?
  9. Does your organization inventory include all hardware and software that are used to collect, store, process, or transmit ePHI, including excel spreadsheets, word tables, and other like data storage?
  10. Are all the hardware and software for which your organization is responsible periodically inventoried, including excel spreadsheets, word tables, and other like data storage?
  11. Has your organization identified all hardware and software that maintains or transmits ePHI, including excel spreadsheets, word tables, and other similar data storage and included it in your inventory?
  12. Does your organization's inventory include removable media, remote access devices, and mobile devices?
  13. Is the current information system configuration documented, including connections to other systems, both inside and outside your firewall?
OK, and then the last section, first subsection:
164.316 POLICES AND PROCEDURES AND DOCUMENTATION REQUIREMENTS

164.316(a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in subsection

164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart
  1. Does your organization have policies and procedures for administrative safeguards, physical safeguards, and technical safeguards?
  2. Does your organization have in place reasonable and appropriate policies and procedures that comply with the standards and implementation specifications of the HIPAA Security Rule?
  3. Does your organizations security policies and procedures take into consideration: 1) your organization's size, complexity and the services you provide. 2) your organization's technical infrastructure, hardware and software capabilities, 3) the cost of your organization's security measures, 4) the potential risks to day-to-day operation including which functions, and tools are critical to operations?
  4. Does your organization have procedures for periodic revaluation of your security policies and procedures, and update them when necessary?
  5. Does your organization change security policies and procedures at any appropriate time, and document the changes and implementation?
My take on this is that it would take a provider/organization 2-5 days to get thoroughly and forthrightly through it. And, really, this is just about the ePHI "Security" piece. "Privacy" is a different -- and potentially much more difficult -- issue. I wrote about the Security stuff back in June, and I continue to work on the privacy issues more recently for our HIE.
___

MEANINGFUL USE CORE 15:
WHAT ARE YOU PEOPLE THINKING?


So, my wife and I are devoted Mac snobs at home. Consequently, I was thrilled to recently see an iPad app get certified for meaningful use.

The product looks great, and I'll bet it's quite functional.


HOWEVER...

I was not happy to see this regarding the Meaningful Use Core 15 criterion ("Protect Electronic Health Information"):
We've taken care of this one for you!

All of the items below are done automatically through drchrono.com (web) drchrono EHR (iPad)

Access Control: Each user must have a unique identifier. Assign a unique name and/or number for identifying and tracking user identity and establish controls that permit only authorized users to access electronic health information. §170.302(o)

Emergency access: Plan for emergency access for authorized users. Emergency access. Permit authorized users (who are authorized for emergency situations) to access electronic health information during an emergency. §170.302(p)

Automatic log-off: Turn on session timeouts.

Automatic log-off: Terminate an electronic session after a pre-determined time of inactivity. §170.302(q)

Audit log: Maintain audit logs.
(1) Record actions. Record actions related to electronic health information in accordance with the standard specified in §170.210(b).
(2) Generate audit log. Enable a user to generate an audit log for a specific time period and to sort entries in the audit log according to any of the elements specified in the standard at 170.210(b).

Integrity - Provide integrity check for recipient of electronically transmitted information. §170.302(s)
(1) Create a message digest in accordance with the standard specified in 170.210(c).
(2) Verify in accordance with the standard specified in 170.210(c) upon receipt of electronically exchanged health information that such information has not been altered.
(3) Detection. Detect the alteration of audit logs.

Authentication - Verify user identities and access privileges. Verify that a person or entity seeking access to electronic health information is the one claimed and is authorized to access such information. §170.302(t)

Encryption - Use encryption where preferred. §170.302(u) General encryption. Encrypt and decrypt electronic health information in accordance with the standard specified in §170.210(a)(1), unless the Secretary determines that the use of such algorithm would pose a significant security risk for Certified EHR Technology. §170.302(v) Encryption when exchanging electronic health information. Encrypt and decrypt electronic health information when exchanged in accordance with the standard specified in §170.210(a)(2).

Accounting of disclosures - Record PHI disclosures. §170.302(v) Record disclosures made for treatment, payment, and health care operations in accordance with the standard specified in §170.210(e).

Conduct a security risk analysis and implement security updates.

Gotta love the last little orphan sentence. OK, everything associated with
§170.nn has to do with the NIST EHR Certification specs, and nothing to do with complying with MU Core Measure 15:
Conduct or review a security risk analysis per 45 CFR 164.308(a)(1) of the certified EHR technology, and implement security updates and correct identified security deficiencies as part of its risk management process.
Beyond having a CHPL blessed system, it's the last item that counts for MU.

I emailed them regarding this and gave them more than a week. Silencio. Nada. Zip. Zilch.

This is not the first time I've encountered this precise misinformation from an EHR vendor.

So, what if you got audited? "Well, they told us we were automatically in compliance..."

"Conduct or review a security risk analysis per 45 CFR 164.308(a)(1) of the certified EHR technology, and implement security updates and correct identified security deficiencies."

So, who cares?
Digital Data on Patients Raises Risk of Breaches
By NICOLE PERLROTH
NY Times. Published: December 18, 2011


One afternoon last spring, Micky Tripathi received a panicked call from an employee. Someone had broken into his car and stolen his briefcase and company laptop along with it.

So began a nightmare that cost Mr. Tripathi’s small nonprofit health consultancy nearly $300,000 in legal, private investigation, credit monitoring and media consultancy fees. Not to mention 600 hours dealing with the fallout and the intangible cost of repairing the reputational damage that followed...

Shall we tally up an estimate of the entire cost of not having corrected "identified security deficiencies" per HIPAA 45.CFR.164.3 et seq?
___

ERRATA: HEDIS 2011 THOUGHTS


I blogged a bit about the 2010 HEDIS measures last year. I've been reading the 2011 report lately. Notwithstanding the new stratification of HMOs vs PPOs (and vs Medicaid as well), I can't really see that a whole lot has changed with respect to the major chronic indices. e.g.,

Overall, we still see the aggregate nil Pearson-R "quality vs cost" proxies' scatter. And, even where there are enticing (wish-fulfillment?) wafts of quadrant differentials, the small composite "N's" ought give one pause.

Maybe we'll make tangible progress on these fronts in the next few years (we must if we are not to go BK as a society). IMO there are two concomitant (and intertwined) "fronts" -- care delivery process improvements (X-axis) and clinical outcomes improvement (Y-axis). The latter of which is to a significant extent moreso a moving target.

"Value," my friends: Outcomes Quality / Cost. Hope it doesn't become this decade's Powerpoint / Seminar / Consulting / Book Sales cliche. (But, then, They Had Me at Deming.)
___

12/11 "PIONEER ACO" announcement

Interesting. Healthcare Partners of Nevada is one of the 32 announced today. We already work with them via our new HIE.

CMS MEANINGFUL USE PAYMENTS UPDATE

I played around a bit today with an app free trial that converts PDF tables to Excel files. CMS has updated its payments-to-date data (it says "November 2011" but it's not clear whether it's begin or end of month), so I downloaded the new PDF and converted it (click to enlarge).


I added the 4 "pct" columns on the right, and sorted the data down by aggregate payment rank. The top 12 states account for 2/3 of the money. Texas, with ~8% of U.S. population, is now at 16.4% of the cash -- and nearly 3/4 of theirs is Medicaid.

Be fun to also drop in the Census data to do comparative "per capita."

We'll see how all of the Medicaid Year One "A/I/U" free money crowd does in 2012 when they have to actually meet the MU criteria, for an entire calendar year attestation.

They have other tables that break things out by EPs vs Hospitals (Medicare, Medicaid, and aggregate), which would tell us where the bulk of the money is going vis a vis those strata (like we don't already know).

I may buy that utility -- if they have a Mac version.
___

MORE TWISTY POLITICS:
THE LOOMING MEDICARE REIMBURSEMENT CUTS

27.4% reduction ensues on January first absent Congress passing the "Doc Fix" in the tax cut renewal bill. The health press is fairly abuzz.


Another quick little Excel screen-scrap cut & paste. The 2012 estimate is mine for these two CPT codes, btw. Just an estimate. The whole Medicare SGR formulation is inscrutably complex (and uniformly hated by primary care docs).


Who will blink first, Boehner or Obama?
___

HOLIDAY CODA

I'm off 'til the 30th. To all of my awesome REC colleagues (both within our office walls and across the RECs), I wish you a joyful and safe Holiday season.


My dear friend, the breathtakingly talented Lenny Lopez on vocal.

Monday, December 12, 2011

Facts © ™ ®

...So on the one hand, we have the push from the government and insurers to have electronic medical records and health outcomes research (HITECH Act), the Sentinel Initiative for postmarketing surveillance of electronic medical records for adverse events, and Medicare reimbursements linked to “meaningful use” (i.e., providing data) of the EMR. On the other hand, we have the specter of HIPAA and more draconian penalties for breaches of personal privacy...

- Judy Stone, MD, Molecules to Medicine: Pharma Trumps HIPAA?

Which "facts" about you can be "owned" by you or others (or no one at all)? i.e., what data/information can be legitimately considered "property," the "title" to and controlling use of which will be defended and enforced by the society at large?
According to traditional copyright principles, the only copyrightable elements of a factual work are the author’s presentation, selection, and arrangement of facts. The underlying facts themselves cannot be copyrighted. In the past, this approach was sufficient to protect factual works against the most opportunistic forms of copying by competitors. Because facts were usually displayed narratively or in tables, authors generally made enough decisions concerning presentation, selection, and arrangement to protect their factual works against wholesale appropriation.

But the rise of electronic and on-line databases has cast doubt upon the validity of the traditional approach. These databases collect and display facts in a pure form, allowing the user to extract them as she sees fit. By dispensing with conventional modes of presentation, selection, and arrangement, they can easily fail to satisfy traditional standards for copyrightability, leaving them with virtually no legal protection against copying. [Michael Steven Green, PhD, Copyrighting Facts (pdf), Indiana Law Journal Vol 78]

Well, more broadly, it goes to the "value" of the facts to various parties. I have blue eyes. Who cares? I am 5'10" and weigh 173 lbs. With those two metrics you can quickly calculate my BMI (Body Mass Index -- mine is 24.8), which is of some economic interest to health insurors and others. I am typing this post in my study located at geocoordinates N36º 2.4018' W115º 8.5265'. Who might want to know that?

What about my blood pressure, my lipids panel results, my PSA? My DNA?
Data ownership refers to both the possession of and responsibility for information. Ownership implies power as well as control. The control of information includes not just the ability to access, create, modify, package, derive benefit from, sell or remove data, but also the right to assign these access privileges to others (Loshin, 2002).

...Scofield (1998) suggest replacing the term ‘ownership’ with ‘stewardship’, “because it implies a broader responsibility where the user must consider the consequences of making changes over ‘his’ data”.

According to Garner (1999), individuals having intellectual property have rights to control intangible objects that are products of human intellect. The range of these products encompasses the fields of art, industry, and science. Research data is recognized as a form of intellectual property and subject to protection by U.S. law.

Importance of data ownership:

According to Loshin (2002), data has [sic] intrinsic value as well as having added value as a byproduct of information processing, “at the core, the degree of ownership (and by corollary, the degree of responsibility) is driven by the value that each interested party derives from the use of that information”...

Considerations/issues in data ownership

Researchers should have a full understanding of various issues related to data ownership to be able to make better decisions regarding data ownership. These issues include paradigm of ownership, data hoarding, data ownership policies, balance of obligations, and technology. Each of these issues gives rise to a number of considerations that impact decisions concerning data ownership

Paradigm of Ownership – Loshin (2002) alludes to the complexity of ownership issues by identifying the range of possible paradigms used to claim data ownership. These claims are based on the type and degree of contribution involved in the research endeavor. Loshin (2002) identifies a list of parties laying a potential claim to data:
  • Creator – The party that creates or generate data
  • Consumer – The party that uses the data owns the data
  • Compiler - This is the entity that selects and compiles information from different information sources
  • Enterprise - All data that enters the enterprise or is created within the enterprise is completely owned by the enterprise
  • Funder - the user that commissions the data creation claims ownership
  • Decoder - In environments where information is “locked” inside particular encoded formats, the party that can unlock the information becomes an owner of that information
  • Packager - the party that collects information for a particular use and adds value through formatting the information for a particular market or set of consumers
  • Reader as owner - the value of any data that can be read is subsumed by the reader and, therefore, the reader gains value through adding that information to an information repository
  • Subject as owner - the subject of the data claims ownership of that data, mostly in reaction to another party claiming ownership of the same data
  • Purchaser/Licenser as Owner – the individual or organization that buys or licenses data may stake a claim to ownership [Data Ownership, Responsible Conduct in Data Management]

It all gets rather complex rather quickly. And, nowhere as complex as with respect to personal health information.

Some recent thoughts on this:
...While banks tend to keep information internally, health care data is handled by many more organizations, said Tom Srail, Cleveland-based senior vp with Willis North America Inc. “The nature of the health care business requires the sharing of that same information,” he said.

Patrick Moylan, New York-based senior associate with Dubraski & Associates Insurance Services L.L.C., said health care institutions are increasing their Internet activity with partners that include physicians, health plans and pharmacies.

Having “more people in the line of that chain that have the potential to handle sensitive data simply increases the risk that data will be accessed by accident, or by a third party,” with the potential that it could be used fraudulently, he said.

The sheer breadth of personal information that health care institutions hold complicates the issue.

“More than any other industry, the health care industry really has all of a complete set of information security and privacy exposures to contend with,” said Mr. Economidis.

Mr. Srail said retailers may have credit card numbers and financial institutions may have Social Security numbers, but health care entities “have all that as well as protected health care information,” so “it really can be problematic for those organizations when that data is lost and troublesome to its customers.”

“There's so many ways that the information gets compromised” and “just when you think you've got it figured out, you've got a twist in it,” said Lynn Sessions, counsel at law firm Baker & Hostetler L.L.P. and a former risk manager at Texas Children's Hospital, both in Houston.

Robert Parisi, senior vp at Marsh Inc.'s FINPRO practice in New York, said, “hospitals tend to be less secure than banks, and you've got a situation that obviously can be fairly risky and financially troubling to any medical center.”

Meanwhile, a black market for stolen medical identities has developed among people who are underinsured or have no insurance, observers say.

By some estimates, medical information is twice as valuable as more traditional identity information, said Mr. Silvestri. “That becomes a motivation for the criminal element to actually target that so they can sell it to the black market,” he said...

"Twice as valuable"? I'd never thought of it that way. Makes sense upon reflection, though. No one can really profit from the fact that I have blue eyes. But, other information about me can indeed have commercial value to others (particularly if they are of the sort not directly observable but instead only explicable via intermediary measurement/assay -- ranging from the simple arithmetic of BMI to the complex methods of DNA analytics).

Continuing:
...Federal law pulls health care institutions in opposite directions, said Mr. Srail. On one hand, it “wants health care to be open and portable and interactive” and to facilitate the process so the patient has choices in his health care with accessible medical information. On the other hand, however, “everything has to be kept secret” with no privacy breaches.

In addition, state laws, while similar, also differ from each other and federal law. HIPAA, for example, requires notification of data breaches within 60 days, while several states have a 45-day notification period, said Ms. Sessions.

Another complication is that hospitals must abide by the laws of the jurisdiction where their patient is a resident, even if it is in another state. Because the patients' resident state is the determining factor, Texas Children's Hospital, for instance, which has patients from all 50 states and foreign countries, must comply with all these jurisdictions' statutes, said Ms. Sessions...

My Nevada HIE Privacy and Security Task Force attorneys are gonna love that last paragraph.

Yeah, they'll probably love this too. On Dec 7th 2011 the California Office of Health Information Integrity (CalOHII) issued a patient consent/privacy report entitled "Research and Background For Patient Consent Policy Recommendation White Paper," (large PDF) wherein across pp 154-157 is a table of various states' PHI/HIE privacy policies to date. On page 156 is the reference to Nevada:


Click to enlarge. In the "Education" cell on the right is a link to my July 12th, 2011 blog post,
in which I voiced concerns regarding some of our facile assumptions made regarding Nevada HIE privacy policy.

Interesting. Nice to know that someone is reading my stuff.

___

Dec 15th O/T UPDATE

Yet another interesting blog to read.

Dear friends and colleagues,

This is a watershed moment for the U.S. healthcare system. Costs continue to climb, tens of millions of Americans lack insurance, and there is unacceptable variation in quality. Politicians from across the ideological spectrum are proposing potentially far reaching policy changes. Some of the proposals are promising; too many others seem fraught with danger. After 25 years as a researcher, teacher, and policy analyst, I continue to be disappointed by the lack of basic understanding of health economics among those who are most vocal about effecting change. No one has done more to shape my thinking about the links between economics and policy than my friend and colleague, William White, who is the director of the Sloan Program in Health Administration at Cornell University’s School of Human Ecology. Over the past two decades, we have had long conversations about virtually every aspect of our healthcare system, from the rise of HMOs in the 1980s to current trends in consumer driven healthcare.

Will and I have decided to put our conversations into a blog and share them with our friends at Kellogg and Human Ecology. We have even asked some of the nation’s top economists to take a look. We will respond to the best of your comments as time allows. We promise not to grade them!

There is a lot at stake in the upcoming years. We hope that this free exchange of ideas can help bring about positive change in our healthcare system.

Sincerely,

David Dranove
Walter McNerney Distinguished Professor of Health Industry Management
Kellogg School of Management

I've read Dr. Dranove's stuff for a while now (mostly at The Health Care Blog), but had never seen this blog. Lots of great new material to read, I would guess.
___

More to come...


Sunday, December 4, 2011

Meaningful Use Reimbursements Update


CMS just released the most recent data (PDF) on Meaningful Use reimbursements to date (actually to Nov 7th).

Notice the dark green Lone Star splotch. Texas EPs and hospitals have thus far gotten 20% of the $1.24 billion thus far paid out nationally ($247.5 million in TX). Of that, 83% went to the Medicaid side ($205.6 million).

Texas comprises ~8% of U.S. population.

On the Medicaid side all you have to do for Year One Stage One is attest to “A/I/U” — Adopt / Implement / or Upgrade to a CHPL Certified system. You don’t have to report on any MU measures, which is why vendors such as Practice Fusion are touting the “free money” aspect of it.

Maddeningly to me, CMS has yet to report on the relative proportions of EHR vendors whose clients have attested to date. We ran that all the way up the internal ONC/CMS flagpole and got blown off — they’ll release those tabulations in “Q2 or Q3 or 2012.”

No HHS-vendor opacity politics there, ‘eh? I'd like to see relative percentages of successful attestations to date by vendor, broken out by Medicare vs Medicaid (and further stratified by MU "registrations" to date).

Just sayin'.

DEC 15th UPDATE

CMS is now happily touting that they are going to exceed $2 billion in MU incentive payments in 2011. As reported by GovernmentHealthIT.com
  • Almost 30 percent of eligible providers and 60 percent of hospitals have now registered for the incentive programs.
  • Total incentive payouts under Medicare and Medicaid are now over $900 million each through November,
  • Thus, total payouts for 2011 will easily exceed $2 billion – of which close to a third of total incentive payouts for 2011 occurred in November alone.
This was to be expected. After all, a huge year-end bubble of 2011 MU attestors will complete their 90-day attestation period by 12/31 and file for the year one money.

(More broadly, I'm hearing that HHS is frantically shoveling money out the door for a breadth of initiatives, probably to get funding "obligated" to help immunize the money from looming deficit-hawk budget cuts.)

The article continues:
Still there are cautionary signs.

As we noted earlier, year 1 requirements under Medicare and under Medicaid are substantially less burdensome than subsequent years. While eligible providers have registered for one or other of the programs, only 4 percent have actually qualified for incentives. Also, interoperability-related criteria were among the least popular menu objectives. In addition, 2012, not 2011, is likely to be the pivotal year.

The pace must pick-up and be sustained if meaningful use is to reach its full potential, particularly for interoperability to coordinate care among providers. We expect the proposed rules for Meaningful Use Stage 2 by the end of January, if not sooner. Now that HHS has announced that providers will not have to meet Stage 2 criteria until January 2014, providers have an extra year under Stage 1 criteria without new interoperability requirements.

One observation for now. Pushing back stage 2 means that early adopters (2011 MU attestors) will spend 3 years in stage 1, during which they will have collected the bulk of the reimbursement money (~86% for Medicare EPs -- e.g., $18k, $12k, and $8k respectively, or $38k of the total $44k five year potential).

Draw your own conclusions as to the risk this might pose to the program's subsequent stages.

PROVIDER CONCERNS: "WILL THEY CUT OFF THE MONEY IN 2012?"

Some of our staff have fielded this question. My $0.02 response to the REC team:
Chief amid the most plausible speculation is the Obama veto hole card should some HIT incentives clawback legislation even get through the Senate (doubtful, IMO). Moreover, given that the funding was written into HITECH as not contingent on annual appropriations bills going forward, that would seem to insulate the money even further. Given all the acrimonious front-burner stuff facing the Hill at the moment for 2012, I am guardedly optimistic that MU money will still flow in 2012.

I think it’s safe to say there will not be any mounting of a 2/3 veto override vote regarding any emergent clawback legislation (very low probability in any event, given Senate rules) – the most overt of which has been H.R. 408, which has gone nowhere in a year (the salient recission clauses of which are SEC 301, 302 – btw, which are identical in its equivalent Senate Bill 178).

The Senate is key. The House is principally “all sound and fury, signifying nothing.” Now, in that regard, Senator Coburn – an MD, no less -- is on record favoring killing MU money (and, he has an actual vote, unlike all these Beltway HIT pundits). Nonetheless, I’m not seeing any traction on his proposal thus far.

Deven McGraw is a good cite as well, I would think, given her various insider perches.

One caveat, though: keep tabs on the accruing Poison Pill amendments to otherwise unrelated “must-pass-by-12/31” bills.

Long view big picture: the ROI case is there in any event. So, go after the MU $$$ while they are there; after all, they’re front-loaded to favor those who get in ASAP. Moreover, adroit HIT/HIE will be vital to health care organizational success irrespective of this or that federal initiative (IMO).

I could be wrong, though.

Here's what Senator Tom Coburn -- an MD, no less -- wrote in July:
“Back in Black” pp 215 – 216 Senator Tom Coburn July 2011


“End Federal Subsidies for Health Information Technology

A provision of the 2009 failed Stimulus law (American Recovery and Reinvestment Act) massively expanded the federal government’s role in health information technology. The aims many attribute to the Health Information Technology for Economic and Clinical Health (HITECH) Act sound good: using a variety of policy levers to promote the widespread adoption of health information technology and support digital sharing of clinical data among hospitals, physicians, and other health care stakeholders. However, a closer look at the data shows [sic] that Congressional action was the wrong mechanism to accomplish these goals.

Lawmakers in Congress may have been well-intended when they supported the HITECH Act, but the massive federal intrusion into health information technology is wasteful and duplicative of current business practices. According to the nonpartisan Congressional Budget Office, the use of health information technology was already projected to be widespread by the end of the decade – even without the adoption of the HITECH Act. CBO projected that, without the HITECH Act, two-thirds of physicians, approximately half of hospitals, and at least one in five critical access hospitals would still be robustly using health IT by the end of the decade. Some reports have suggested private sector health information technology in a multi-year period is far more than the federal government is projected to spend on health IT over the next decade. In fact, in a recent survey, more than half of respondents replied they have a fully operational electronic health record in at least one facility in their organization, and only 1 in 50 respondents had not yet begun to plan for the use of an EHR. The facts make it pretty clear that massive federal handouts and mandates are unnecessary to subsidize a behavior that is already being adopted on a widespread basis in the marketplace.

Additionally, the private sector has already developed compelling models for utilizing health information technology. Major health systems like the Mayo Clinic and the Cleveland Clinic all have adopted state-of-the-art health IT systems—without federal involvement. Private enterprises are leading the way in developing completely innovative approaches to health IT. Some are even exploring the development of open software for innovators to write electronic health record applications. Such an “open source” model of current business practices. According to the nonpartisan Congressional Budget Office, the use of health information technology was already projected to be widespread by the end of the decade – even without the adoption of the HITECH Act. CBO projected that, without the HITECH Act, two-thirds of physicians, approximately half of hospitals, and at least one in five critical access hospitals would still be robustly using health IT by the end of the decade. Some reports have suggested private sector health information technology in a multi-year period is far more than the federal government is projected to spend on health IT over the next decade. In fact, in a recent survey, more than half of respondents replied they have a fully operational electronic health record in at least one facility in their organization, and only 1 in 50 respondents had not yet begun to plan for the use of an EHR. The facts make it pretty clear that massive federal handouts and mandates are unnecessary to subsidize a behavior that is already being adopted on a widespread basis in the marketplace. [ did Jonathan Bush ghostwrite this part? – BG ]

Additionally, the private sector has already developed compelling models for utilizing health information technology. Major health systems like the Mayo Clinic and the Cleveland Clinic all have adopted state-of-the-art health IT systems—without federal involvement. Private enterprises are leading the way in developing completely innovative approaches to health IT. Some are even exploring the development of open software for innovators to write electronic health record applications. Such an “open source” model could help increase competition, flexibility and lower costs – all without federal action."

One way or another, we'll know before too much longer.