Nevada HIE kickoff event

My company has been designated as the not-for-profit administrator of the new Nevada Community Based HealthInsight Health Information Exchange (HIE). Today at Cashman Center in Las Vegas we held an intense day-long kickoff event comprised of founding stakeholders, our HIE consultant firm Strategies for Tomorrow, and key staff of our HIE vendor Axolotl (just recently renamed OptumInsight). Very nice turnout of extremely talented and committed people. It is an ambitious undertaking. Lots to think about and report on.

Below, our Nevada Executive Director Deborah Huber.

Above, our Nevada Vice President of Medical Affairs Jerry Reeves, MD.

I've been designated to serve on the HIE Privacy and Security Task Force, something I will relish. No shortage of issues to be resolved. I'm already Loaded for Bear on the topic.
___

"WE ARE AN 'OPT-IN' STATE"

As our kick-off event concluded, the foregoing was asserted during the final session. I thought "I must have missed something with regard to the final cut of SB 43." Someone else echoed that vocally as well, but the moment passed. I was too busy at the time playing Press Photographer for the event as well as staff participant.

SB 43 is Nevada Senate Bill 43 (PDF), the state's HIE legislation that emerged this year in the wake of Nevada having received ONC funding for a state HIE (which, btw, is not us; a publicly funded and administered NV HIE does not yet exist). The salient excerpt as it pertains to "opting in/out":

Sec. 15. NRS 439.538 is hereby amended to read as follows:

439.538
1. If a covered entity transmits electronically individually identifiable health information in compliance with the provisions of:

(a) The Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 [,] ; and
(b) Sections 2 to 12, inclusive, of this act and the regulations adopted pursuant thereto, which govern the electronic transmission of such information, the covered entity is, for purposes of the electronic transmission, exempt from any state law that contains more stringent requirements or provisions concerning the privacy or confidentiality of individually identifiable health information.

2. A covered entity that makes individually identifiable health information available electronically pursuant to subsection 1 shall allow any person to opt out [emphasis mine] of having his or her individually identifiable health information disclosed electronically to other covered entities, except:

(a) As required by the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.
(b) As otherwise required by a state law.
(c) That a person who is a recipient of Medicaid or insurance pursuant to the Children’s Health Insurance Program may not opt out [emphasis mine] of having his or her individually identifiable health information disclosed electronically.**

As used in this section: “covered entity” has the meaning ascribed to it in 45 C.F.R. § 160.103.

[** I have to say that it would not break my heart for the ACLU or some other rights entity to successfully challenge this "2nd class citizen" clause.]

My subsequent internal response upon reflection:

Notwithstanding that HIE “opt-in” is not explicitly required by SB 43 (the word “opt” only appears twice in SB 43, each time followed by the word “out” – see Section 15), HealthInsight HIE is nonetheless at liberty to establish affirmative “opt-in” as policy. There are good reasons. See the attached, sent to me the other day by Kahreen Tebeau of the Oregon Health Authority Office of Health IT.

The Nevada Administrative Code (NAC, the NV equivalent of the federal CFRs) may well at some point clarify the vagueness in SB 43 with respect to “opt whatever,” but, IMHO, “…shall allow any person to opt out of having his or her individually identifiable health information disclosed electronically to other covered entities” at 15(b)(2) is not the express semantic equivalent of “opt in.” (but, then, that’s why we have lawyers on the P&S Task Force).

Interestingly, my colleague Kevin Jones pointed me to Section 7 of SB 43. My response:

Nice catch. So, Section 7 looks to possibly be at some odds with Section 15 (“opt out”). Noteworthy is this:

The Director shall by regulation prescribe standards [emphasis mine]:

Sec 7(d) For obtaining consent from a patient before transmitting the patient’s health records to the health information exchange system, including, without limitation, standards for obtaining such consent from a child who has received health care services without the consent of a parent or guardian;

“by regulation” -- Which, as I said, goes eventually to the Nevada Administrative Code (NAC); “obtaining consent” does not, IMO, unequivocally dictate “opt-in.” Grants of “consent” are routinely obtained via active or passive opt-out. What this all says to me is that it is as yet undecided what state “administrative” procedural policy will be.

I've done some tedious probing of the Nevada Administrative Code, looking for anything generally pertaining to "consent" requirements related to health care information in our state. Not finding anything precisely relevant thus far. But, then, IANAL.

OK, it may be useful to consult with SB 43's antecedent, linchpin, ONC-approved HIE Strategic & Ops Plan.


A few salient excerpts pertaining to "consent" and "opting":

4.3.6 Patient/Consumer Engagement
While the initial phases of the NV HIE will likely exclude services that enable patients/individuals to have direct access to the NV HIE information services, during the early phases, the patient/consumer engagement will focus on education. Initial education will likely be directed towards views on how NV HIE increases integration of care for children and those with disabilities and improves outcomes, as well as issues such as guarding private data, information-sharing standards, and personal responsibility.

These initial efforts of patient engagement will be essential to the final opt-in/opt-out/hybrid model for the NV HIE patient data information governance, which has not been finalized due to ongoing legislative activities. [pg 13]

10.4.1.11 Patient/Consumer Smart Media Technology
Nevada will implement HIPAA-compliant ―health information‖ smart media technology (smart cards, flash drives, cell phone patient medical apps) for those individuals who choose to opt-out of the HIE, and as a method of supporting and protecting the electronic exchange of health-related information. [pg 69]

12.1 NV HIE Business and Governance Formation (Stages 1-3)
…In addition to the importance of having a sustainable, non-profit business to govern and operate the HIE services, we believe that the NV HIE Business formation will establish the essential ―rules of the road necessary to implement the information sharing technologies of the envisioned HIE services. For example, how will NV residents opt-out of (and possibly opt back in) having their data shared across the HIE? While this may appear simple on the surface, the question is non-trivial when considering the various channels that may need to be afforded to the individual (e.g., customer portal, primary care office, emergency room, hospital, pharmacy) and how to make patient information providers aware that data sharing is not allowed for a specific individual (with the exception of reportable public health requirements and certain Medicaid/Medicare alternatives). It is these information governance and other similarly complex requirements that will need to be understood and established prior to implementing HIE technologies or certifying existing HISPs/RHIOs for supporting HIE services in the State. [pg 74]

12.1.5.2 Consent
Consumer or patient consent is the process by which consumers control the exchange of their health information through an HIE and can be a tool to allow health care providers access to more complete health information, thereby strengthening the provider‘s ability to provide informed care and improving care coordination amongst providers.

The NV HIE Legal/Policy Workgroup will provide input to the creation of policies that will dictate to what extent, and how consumers should be able to control the exchange of their health information while balancing privacy considerations with the overall vision of the NV HIE and its potential impact on public health, the coordination of care, improved health care quality and ultimately, improved health outcomes as supported by better access to more robust patient data. [pg 82]

(bold/italic/red emphases mine)

How does another Nevada agency treat such things (the DMV)?

Interesting. I guess we can comfortably infer from this that a Nevada agency has the lawful discretion to require explicit, affirmative, documented "opt-in" to override a default presumption of one's having opted out via inaction. Moreover, I take it as a given that the HealthInsight HIE will have to comply with (or exceed) any final NAC consent regulations issued by DHHS pursuant to SB 43.

Apropos of all of this, from a broader ONC guidance document "CONSUMER CONSENT OPTIONS FOR ELECTRONIC HEALTH INFORMATION EXCHANGE: POLICY CONSIDERATIONS AND ANALYSIS":

The issue of whether, to what extent, and how individuals should have the ability to exercise control over their health information represents one of the foremost policy challenges related to the electronic exchange of health information. The current landscape of possible consent models is varied, and the factors involved in choosing among them are complex. States and other entities engaged in facilitating the exchange of electronic health information are struggling with a host of challenges, chief among them the establishment of policies and procedures for patient participation in their exchange efforts. While some have adopted policies enabling patients to exercise individual choice, others have prioritized the needs and concerns of other key stakeholders, such as providers and payers. The purpose of this paper is to discuss in detail the issues, nuanced considerations, and possible tradeoffs associated with the various consent options to help facilitate informed decision making.

Core consent options (abbreviated) for electronic exchange include the following:

• No consent. Health information of patients is automatically included—patients cannot opt out;
• Opt-out. Default is for health information of patients to be included automatically, but the patient can opt out completely;
• Opt-out with exceptions. Default is for health information of patients to be included, but the patient can opt out completely or allow only select data to be included;
• Opt-in. Default is that no patient health information is included; patients must actively express consent to be included, but if they do so then their information must be all in or all out; and
• Opt-in with restrictions. Default is that no patient health information is made available, but the patient may allow a subset of select data to be included.

As these definitions illustrate, a range of consent models can be applied in different contexts of electronic exchange in the U.S., and it is possible for there to be further permutations depending on the level of choice granularity allowed. There is also considerable variation in the type of information exchanged, ranging from the more basic (e.g., lab results) to the more mature and complex (e.g., a wide array of health information).

The consent model selected for electronic exchange, as well as the determination of which types of health information to exchange, affects many stakeholders (e.g., patients, providers, and payers). These decisions also have consequences for national policy goals, such as improving the quality of healthcare, promoting public health, engaging patients in their health care, and ensuring the privacy and security of personal health information. This discussion requires not only an appreciation of the sometimes competing interests of various stakeholders, but also consideration of the interests of the individual relative to those of society as a whole.

"...it is possible for there to be further permutations depending on the level of choice granularity allowed."

Indeed. Let's recap. As I ruminated on amid my June 18th post, ePHI privacy issues traverse four principal categories of concern -- and vary greatly from state to state:

• Data ownership;
• Rights of access (and accountability);
• Disclosure restrictions;
• Records retention requirements.

There has been much grumbling within the provider community with respect to envisioned "granularity," in particular as it pertains to proposals for patients having disclosure veto power at the datum level (e.g., "yes, you can share my CBC results, but not my latest lipid panel or pap smear or PSA. And forget about my BP or BMI").

More...

"The lawyers freak out," said Calman, agreeing that attorneys, including malpractice lawyers, are often more resistant than doctors to the idea of providing patients with access to their full medical information--and especially the notion of patients being able to include their own comments in their records...[click here for the full article]

Interesting. BTW, I've been studying "privacy" issues since grad school, albeit in a couple of different contexts. See "Privacy and the 4th Amendment amid the "War on Terror".
___

WHY DO WE EVEN CARE?

Well, as of this week we have four words: "Rupert Murdoch Hacking Scandal." Then there's stuff like this:

Today’s globally networked society places great demand on the dissemination and sharing of person-specific data for many new and exciting uses. Even situations where aggregate statistical information was once the reporting norm now rely heavily on the transfer of microscopically detailed transaction and encounter information. This happens at a time when more and more historically public information is also electronically available. When these data are linked together, they provide an electronic shadow of a person or organization that is as identifying and personal as a fingerprint even when the information contains no explicit identifiers, such as name and phone number. Other distinctive data, such as birth date and ZIP code, often combine uniquely and can be linked to publicly available information to re-identify individuals. Producing anonymous data that remains specific enough to be useful is often a very difficult task and practice today tends to either incorrectly believe confidentiality is maintained when it is not or produces data that are practically useless...

- 2001, Dr. Lataya Sweeney (PDF), now with the ONC HIT Policy Committee.

That was a decade ago. Think about how much more data are available today, and how much easier they are to capture, merge, and mine.

A bit more on Dr. Sweeney. And, relatedly, how about this?

Mr. X lives in ZIP code 02138 and was born July 31, 1945.

These facts about him were included in an anonymized medical record released to the public. Sounds like Mr. X is pretty anonymous, right?

Not if you're Latanya Sweeney, a Carnegie Mellon University computer science professor who showed in 1997 that this information was enough to pin down Mr. X's more familiar identity -- William Weld, the governor of Massachusetts throughout the 1990s.

Gender, ZIP code, and birth date feel anonymous, but Prof. Sweeney was able to identify Governor Weld through them for two reasons. First, each of these facts about an individual (or other kinds of facts we might not usually think of as identifying) independently narrows down the population, so much so that the combination of (gender, ZIP code, birthdate) was unique for about 87% of the U.S. population. If you live in the United States, there's an 87% chance that you don't share all three of these attributes with any other U.S. resident. Second, there may be particular data sources available (Sweeney used a Massachusetts voter registration database) that let people do searches to bootstrap what they know about someone in order to learn more -- including traditional identifiers like name and address. In a very concrete sense, "anonymized" or "merely demographic" information about people may be neither. (And a web site that asks "anonymous" users for seemingly trivial information about themselves may be able to use that information to make a unique profile for an individual, or even look up that individual in other databases.)

Many contemporary privacy rules and debates center on the notion of "personally identifiable information" (PII). The PII concept is used by several legal regimes and many organizations' privacy policies; generally, information that identifies a particular person is considered much more sensitive than information that does not....

...research by Prof. Sweeney and other experts has demonstrated that surprisingly many facts, including those that seem quite innocuous, neutral, or "common", could potentially identify an individual. Privacy law, mainly clinging to a traditional intuitive notion of identifiability, has largely not kept up with the technical reality.

Above, from the 2001 Sweeney paper. This goes to the whole "data mining" goal of HIE -- e.g., "CER", "comparative effectiveness research," the "big picture" end of clinical data exchange (ostensibly using "de-identified" data), beyond the more loudly touted initial end of "24/7 anytime-anywhere point-of-care data access."

Below, Dr. Sweeney explains:

For twenty dollars I purchased the voter registration list for Cambridge Massachusetts and received the information on two diskettes [20] in an attempt to complete the re-identification. Figure 15 shows that these data included the name, address, ZIP code, birth date, and gender of each voter. This information can be linked using ZIP code, birth date and gender to the medical information described in Figure 14, thereby linking diagnosis, procedures, and medications to particularly named individuals. The question that remains of course is how unique would such linking be.

The 1997 voting list for Cambridge Massachusetts contained demographics on 54,805 voters. Of these, birth date, which is the month, day, and year of birth, alone could uniquely identify the name and address of 12% of the voters. One could identify 29% of the list by just birth date and gender; 69% with only a birth date and a five-digit zip code; and 97% when the full postal code and birth date were used...

...In Massachusetts, the Group Insurance Commission (GIC) is responsible for purchasing health insurance for state employees. GIC collected de-identified patient-specific data with nearly one hundred fields of information per encounter along the lines of the fields discussed in the NAHDO list for approximately 135,000 state employees and their families. Because the data were believed to be anonymous, GIC gave a copy of the data to researchers and sold a copy to industry [21]. William Weld was governor of Massachusetts at that time and his medical records were in that data. Governor Weld lives in Cambridge Massachusetts. According to the Cambridge Voter list, six people had his particular birth date; only three of them were men; and, he was the only one in his five-digit zip code.

Clearly the risks of re-identifying data depend both on the content of released data and on other related information. Most municipalities and states sell population registers such as voter lists, local census data, birth records and motor vehicle information. There are other sources of population registers such as trade and professional association lists. Such information can often be uniquely linked to de-identified data to provide names, addresses, and other personal information [pp 49 - 51].

CHECK THIS OUT

Maine Reverts Back to Opt-Out Approach for HIE
Posted by Helen Oscislawski on June 13, 2011

In my previous post (April 26, 2011), I discussed legislation proposed by privacy advocates in Maine which would require, among other things, that patients "opt-in" before any information could be collected, accessed or disclosed through Maine's HIE HealthInfoNet. Although HealthInfoNet currently operates under the "opt-out" approach, privacy advocates had pushed for the legislation in order to more adequately safeguard patient privacy. Stakeholders had decided early on in the HIE's development that opt-in was not practical and as such, patients would be automatically enrolled in the HIE. Patients could then exercise their choice to opt-out and have their information deleted from the HIE's central data repository...

The challenges are legion, are they not?

Awesome blog, btw, Ms. Oscislawski.

But, wait, there's MORE!

News from SearchHealthIT.com:

For state HIE, patient opt-out a thorny technical issue

For all state health IT coordinators, providing patients with privacy and control of their health data is a priority. For many, it's also a legal mandate, with data privacy rules differing from state to state. However, building the IT back-end to support this flexibility in state health information exchanges, or HIEs, isn't a simple undertaking, said speakers in a session at the Health IT Connect conference in Washington D.C...

...The toughest part for state HIE architects who must support partial opt-out policies may very well be giving patients the ability to shield the disclosure of conditions such as HIV/AIDS, substance abuse or behavioral health treatment. Robinson said it's one thing to make an HIV test invisible, but someone seeing a health record might be able to figure out a person has HIV in other ways -- for example, by seeing that he takes a particular medication...

...Amy Zimmerman, chief of health IT for the Rhode Island Department of Health, said her state HIE's consent model is opt-in, with no data going into the HIE unless a patient enrolls. There are three levels of access the patient can choose upon enrolling -- full but temporary access for emergency treatment, the minimum to which all enrollees consent; a "HIPAA consent" level that gives access to all providers in the course of treatment, and a third consent level that gives permissions to individual providers.

It took 18 to 24 months of discussions with community stakeholder groups to arrive at this model, she said. It was a compromise, because in those discussions Rhode Island authorities found that each group -- providers, patients, and a legal advisory board -- were divided in their feelings toward an "all-or-nothing" opt-in approach to sharing patient data...

18 to 24 months? Yikes. We have, uh, like three? Well, in fairness, we're not the "state HIE," either. Our State government HIT entity can't even get their Medicaid provider Meaningful Use attestation portal up and running (rumor is it's going to be yet another year or more, all while an increasing number of states are taking attestations and disbursing incentive funds).

And the hits just keep on comin'...

Medical Privacy Issue: FICO Medication Adherence Score Coming
By George Gombossy | Last updated Jun 24, 2011, 11:05 am

Think you have little privacy now, wait until FICO, the company whose credit scores are frequently used to guage your credit worth, launches a new program that will allow companies to determine how likely you are to take your medicine properly.

In a recent New York Times article, FICO has “developed a new FICO Medication Adherence Score that it says can predict which patients are at highest risk for skipping or incorrectly using prescription medications.”

“We started thinking about how do consumers behave as patients,” Mark Greene, the chief executive of FICO, based in Minneapolis, told the Times. “The problem, from a math standpoint, is not all that different from banking and other industries.”...

Jeez.., I laughed when I saw that headline, even though it's not really funny. I used to work in credit risk modeling and management. See here and here.

Hmmmm... have to wonder where they'll get their data for mining and modeling?
___

OFF-TOPIC TANGENT?

An Indiana man says a blood donation center rejected him as a donor because he appears to be gay--even though he isn't. Aaron Pace, 22, recently visited Bio-Blood Components Inc., in Gary, which pays up to $40 for blood and plasma donations. But during the interview process, he said, he was told he couldn't give blood because he seems gay. Though Pace is "admittedly and noticeably effeminate," according to the Chicago Sun-Times, he says he's straight. "It's not right that homeless people can give blood but homosexuals can't," Pace told the paper. "And I'm not even a homosexual."...

OK, what, you might ask, does that have to do with HIT/HIE?

Well, consider this?

By jsimmons
Created Apr 7 2011 - 10:54am

Using electronic health records (EHRs) to gather data on sexual orientation and gender identity in federally funded surveys could help providers address specific healthcare issues among lesbian, gay, bisexual, and transgendered (LGBT) individuals, according to a new report released by the Institute for Medicine (IOM).

These questions about sexual orientation and gender identity, however, should be standardized to allow for the comparison and combination of data across large studies to analyze the unique needs of the LGBT population, added the report, which was prepared for the National Institutes of Health (NIH) to examine specific research needs.

Among one of the recommendations in the IOM report is that the Office of the National Coordinator (ONC) of Health IT include the collection of data of sexual orientation and gender as part of its Meaningful Use objective for EHRs to record demographics: This would mean that data on sexual and gender minorities would be included within the demographic information in the same way that race, language, and ethnicity data are now collected ...

That will be interesting. The "social conservative" howling, outraged opposition attack lines just write themselves. Beyond that, there will be major discomfort in many provider offices simply asking for such information. I brought it up to a doc yesterday, and she affirmed that concern.
___

OFF-TOPIC SELF-INDULGENCE

My REC blog is now a bit more than a year old. If you Google "rec blog" without the quotation marks, you get 77.5 million results. The first of which is my blog. Encase the phrase in quotes and the number drops to 50,400. Again, the first of which is mine. Pretty pleased with that.

Didn't cost me a penny. Meta-tags, baby. My relative handful of reciprocal links don't hurt, either, but it's mainly my tags "under the hood."
___

RHIO GOES UNDER

IMMEDIATE PRESS RELEASE Contact: Dr. Jerry Miller
July 11, 2011 423-646-1440

CareSpark Ceases Operations of Regional Health Information Exchange

CareSpark’s Board of Directors voted recently, with regret, to cease operations. CareSpark, despite great effort, was unable to transition from a grant and contract based nonprofit organization to a user subscription and revenue sustained entity. The Board believes this is a great loss to the region and believes that other resources needed to provide exchange services, assist providers in meeting meaningful use requirements and CareSpark’s core mission of regional health improvement through health information sharing will need to develop.

CareSpark was formed in 2005 after a two year health improvement planning process and is a regional 501(3)c non-profit organization to improve health for people in northeast Tennessee and southwest Virginia. In May CareSpark took its services offline to finish developing a new infrastructure that it hoped would meet the needs of local healthcare providers and bring additional value that providers would be willing to support financially. Because the level of financial support for this new infrastructure was not available, it was not brought online. In expectation of this new infrastructure all connections have been terminated.

CareSpark is working to contact the 38 health organizations with whom it had data sharing agreements to arrange a meeting to complete planning for a secure and orderly transition. CareSpark remains committed to safeguarding the data entrusted to it and to be transparent and community focused as it wraps up its affairs over the next several months. In addition to the data participants, CareSpark is contacting all other parties with which it has contractual relationships.

CareSpark is deeply appreciative of the more than 250 volunteers from around the region and beyond who invested their time and talent in this regional collaborative vision that achieved an operational standards-based technical infrastructure, nationally recognized data exchange capabilities and an exceptional community driven governance structure. CareSpark gained national visibility as one of nine communities involved in the development and demonstration of a Nationwide Health Information Network. These milestones were achieved so that no matter where or when a patient received care in the region and beyond, the information would be accessible to diagnose and treat patients optimally to improve care outcomes, lower stifling health care costs and reduce disproportionately high rates of diseases in the region.

During this period of winding up its affairs, the CareSpark Board of Directors remains in place to oversee the proper and orderly dissolution and termination of CareSpark’s business. All alternatives to closing have been, and will continue to be, investigated.

Wow. A cautionary tale.
___

HIT ERRATA

During one of my earlier posts (last year) I alluded to reports of calls for FDA regulation of EHRs as de facto "medical devices." Well, this was in the news earlier this week:

...the FDA has begun regulating EHRs as medical devices because, according to the agency, health IT has advanced so far that the professional intermediary is no longer required or used. Thus, under the Federal Food, Drug and Cosmetic Act, health IT is characterized as a medical device. Per voluntary reports from patients, clinicians and user facilities, the FDA has cited data indicating 260 reports of health IT-related adverse events, including 44 reported injuries and six reported deaths, resulting in the agency issuing its final rule in February classifying “Medical Device Data Systems” as low Class 1 medical devices, requiring post-market surveillance.

Oh, really? I checked with the FDA.

To answer your question, FDA’s role for EHR is not finalized. Role of FDA and other federal agencies with regards to safety of EHRs is being discussed and led by Office of the National Coordinator ( ONC)

Should you have further questions, please feel free to contact us. Thank you.

VJ Huang
Consumer Safety Officer
International Relations and External Affairs Staff
Division of Small Manufacturers, International and Consumer Assistance, OCER
Center for Devices and Radiological Health
U.S. Food and Drug Administration (FDA)

The operative CFR Final Rule pertaining to "Medical Device Data Systems" at this point is 21 CFR 880 (see page 8647, 2/15/11):

EHR and PHR systems are not included in this rulemaking, and RIS are already regulated and would not be affected by this final rule.

OK. Whatever. See also "Integration of HIT & Medical Devices."
___

MONDAY MORNING NEWS

Health Information Exchange moves closer to reality in Nevada
John Seelmeyer, 7/25/2011

Supporters of a system that will allow hospitals, physicians and others in Nevada to share patient information in real time across digital networks are confident they’ve found the right technology to get the job done.

Now they need to get often-competitive, often strongly opinionated hospital executives, physicians and others in the health care industry to break down the walls that have kept them from sharing information in the past.

HealthInsight Nevada, a Las Vegas-based nonprofit that spearheads efforts to improve the quality of health care delivery in Nevada, this month launched its community-based health information exchange in the state...

Meaningful Manual Labor

A few EHR vendors have begun to distribute detailed Meaningful Use upgrade instruction manuals (via PDFs -- I'm becoming rather adept with the comb binder). A couple are very good, essentially A to Z workflow instructions (replete with "money field" screen shots) for hitting all of the Stage One measures.

Now all we need are about 30 more of these, given that we at the HealthInsight REC are "vendor neutral" and have to support providers on close to three dozen ONC certified platforms.
___

e-prescribing is a really big deal at HHS. We have the Meaningful Use Core Measure piece, PQRS, and the MIPPA piece. e-Rx purports to bring a host of improvement/cost reduction benefits.

Well...

Cautionary reporting from Bloomberg:

“...Providers appear to be rapidly adopting electronic health records and computerized prescribing, and one of the major anticipated benefits is expected to be through medication-error reduction,” the researchers wrote. “Many of these benefits will not be realized if the electronic prescribing applications are not mature and either do not catch or even cause new medication errors.”

Wrong Dose
The most common error was the omission of key information, such as the dose of medicine and how long or how many times a day it should be taken, the researchers said. Other issues included improper abbreviations, conflicting information about how or when to take the drug and clinical errors in the choice or use of the treatment, the researchers said.

“With more than 3 billion prescriptions written annually in the U.S. alone, this could amount to 385 million errors each year, with 128 million of them having the potential to cause patient harm, said researcher Jeffrey Rothschild, from the center for patient safety research and practice at Brigham and Women’s Hospital in Boston..."

No shortage of improvement work to be tended to. "Usability," anyone? Beyond workflow improvement more generally.
___

A QUICK DIVERSION:
FEDERAL CONTRACT GS23F8127H_HHSP233201100252G

My last couple of posts have dwelled at some length on ePHI privacy and security issues. Check this out: Beltway veteran KPMG was just awarded a $9,179,011 contract to administer ARRA-HIPAA audits for the HHS OCR.

The protocol and audit program performance requested under this contract shall assist OCR in operating an audit program that effectively implements the statutory requirement to audit covered entity and business associate compliance with the HIPAA privacy and security standards as amended by ARRA...

...The government anticipates completing 150 audits of entities varying in size and scope...

$9,179,011 divided by 150 = $61,193.41 per audit.

I'm in the wrong business.
___

YET MORE ON THAT WHOLE "USABILITY" THING

NIST, ONC plan measures, testing to improve health IT usability
Posted on April 25, 2011 by Theo Mandel, Ph.D.

I’ve worked in healthcare usability for a long time and with the impetus to move all of healthcare to electronic platforms, there have been many, many unusable implementations of EHRs and EMRs.

The National Institute for Standards and Technology (NIST) and Office of the National Coordinator for Health IT (ONC) are working to provide guidelines for healthcare software usability...

au contraire

The following was submitted to ONC during their public review and comment period for their Usability certification proposal.

Usability Testing for EHRs is a Bad Idea
May 6, 2011 – by Richard M. Low, MD, CEO of Praxis® Electronic Medical Records

As a physician and as the developer of Praxis EMR, a product that has consistently ranked #1 in user satisfaction, I am concerned about the government's plans for EHR usability testing.

The EHR Usability Testing Plan you have submitted for public comment contains a fundamental flaw. The problem is that you have equated what usability means to doctors with what ease-of-use means to software developers. You begin with an observation that is on target (usability has been the #1 barrier to EHR adoption) and proceed with a well-intentioned but unwise goal (to use the power of government to improve the usability of EHRs). From there, you propose a testing approach that is based on several misconceptions.

Up till now, you deserve praise for your agency's excellent work and for your transparent decision-making process, especially considering the extreme pressures under which the agency is working. Indeed, you have done precisely what government should do: help create order out of industry chaos by setting standards; obtain critical information for public health purposes; and protect the public in terms of information security.

Equally impressive is what you decided not to do, which is to delve into product workability. This decision demonstrated an understanding on your part that the industry is in full innovation and development mode, and that rulings of this sort would harm rather than help the development of excellence in Electronic Medical Records.

It would be a shame to tarnish your exceptional record thus far by venturing into the dubious area of usability testing.

No doubt the move in this direction is prompted by the large number of unusable EHRs in the market and by the great physician dissatisfaction with many of the solutions out there. Further, computer experts have assured you that usability testing is not only possible, but an effective solution to the problem. And so the government is now seriously considering a program that will rate EHR usability.

Those of us who have been in the industry long enough remember CCHIT's attempt to do the same thing. The ratings that it issued were highly suspect, with doctors giving damning reviews to EHRs that received CCHIT's seals of approval.

To give credit where credit is due, you begin by defining usability in terms that we can all agree with:

The effectiveness, efficiency, and satisfaction with which the intended users can achieve their tasks in the intended context of product use.

From there, however, you create a testing approach that is based on several misconceptions.

First, you assume that an EHR is a "computer thing." It is not. It is a medical tool. To think of an EHR as a "computer thing" is akin to the early days of the printing press—500 years ago—when a book buyer would ask a printer for his opinion on a tome. The printer would then examine the cover, the parchment, and the binding, and pass judgment on the book's worth. Today, we all know not to judge a book by its cover. Nonetheless, by advocating usability testing, the government is creating an analogous situation; when it comes to EHRs, usability experts are the "printers" of the Information Age.

And because of the assumption of EHRs as computer things, you arrive at your second misconception, which is that EHRs should reduce their learning-curves by following the lead of commonly-used software programs. In other words, since most people who have used a computer are familiar with how pulldown menus and templates work, EHRs should go down this well-travelled road. Doing so would make the use of EHRs intuitive, or so the thinking goes.

In effect, you are applying computer thinking to a medical tool. This is a bad idea.

In this short paper, I would like to share with you my experience with EHR usability and dispel the assumptions that underlie the proposed usability testing of EHRs. My views are based on what I have learned from the development of Praxis for over 20 years, and from studying hundreds of clients who use our EHR. In addition, these views are informed by my 20 years as a Board Certified Internist and by my experiences in the areas of Emergency Medicine and Primary Care.


Templates Do Not Work
I am rather fond of Robert Frost, and to paraphrase a line from one of his most famous poems, at Praxis, we decided to go down the road less travelled by.

The first EMRs came out when I was working as a physician in Los Angeles. As an amateur computer programmer, I have always been intrigued by computers and their potential to dramatically improve the practice of medicine. I immediately came to the conclusion, however, that these first EMRs were headed down the wrong road. They were all based on templates, replete with drop-down menus and pick lists.

It has now been widely-reported in medical journals that the use of templates in EMRs pose several challenges. First, they slow down the doctor by requiring him or her to click through menus and find the right template for the case at hand. Second, they lead to increased medical and coding errors; this has been amply documented and you may refer to articles such as Hidden Malpractice Dangers in EMRs in the Medscape Business of Medicine, The Problems with EHRs and Coding in Modern Medicine, and Compliance Risks Grow with Electronic Medical Record Systems in AIS Compliance, to list just a few from the growing body of literature on just this one issue. Third and perhaps most important, templates restrict the way doctors think through a medical case; see, for instance, Dr. Jerome Groopman's book, How Doctors Think and two articles from the New England Journal of Medicine, Off the Record—Avoiding the Pitfalls of Going Electronic and Can Electronic Clinical Documentation Help Prevent Diagnostic Errors?

My disappointment with the early EMRs led me to found Praxis Electronic Medical Records. I assembled a team of developers, explained what an EMR should do, and gave them one prohibition: templates were not to be used.

I also gave them two guiding principles: 1) the noise to information ratio must be optimal, letting the user teach the program which is which, not the other way around; and 2) the program should never make any attempt to "practice medicine," but rather strive to follow the doctor's lead.

The Road Less Travelled By
Praxis EMR has been on the market for over 20 years now. It has consistently ranked #1 in user satisfaction surveys conducted by the American Academy of Family Physicians and in KLAS.

However, I suspect we would do poorly in usability under your proposed testing approach.

Praxis EMR does not look like other EMRs. It is not template-based and it does not utilize the logic of computer science. Rather, we use the logic of medical thinking as our guiding principle.**

Doctors do not all think through a medical case the same way. In fact, there is a certain art to the practice of medicine. Doctors, therefore, must be given full liberty to express themselves when they document a medical case. An EHR, then, should give them the flexibility to use their own words and to input information in the order they prefer.

Praxis gives them this freedom. The heart of Praxis is a neural network engine that learns directly from the user. As a doctor inputs his or her medical concepts, Praxis remembers them and presents them to the doctor the next time a similar case comes up. As Praxis presents these concepts, the doctor can edit them if the situation calls for it. Praxis then remembers this revised concept, as well. Over time, the need for editing is drastically reduced and soon a doctor is documenting cases in mere seconds.

In the proposed testing environment, however, Praxis would be just beginning to learn from the tester and its full potential would not be realized.

The Proper Measure
I submit to you that the most reliable measure of an EHR's usability is user satisfaction. Of course, user satisfaction is not the same as usability, but it can not be denied that the two are directly linked. Usability leads to user satisfaction. Therefore, instead of wrestling with the proper way to measure usability, the government would better serve the medical profession by measuring user satisfaction based on the real world experiences of doctors using different EMR products. This has already been done successfully by medical associations such as the American Academy of Family Physicians and by research firms like KLAS.

I understand the pressures you must be under to mitigate the terrible press that EMRs have received in general. But usability testing is not the solution. If you go down this path, you will pave the road to mediocrity. Fantastic, innovative ideas presently percolating in the EMR community would likely never see the light of day. The industry would kowtow to your lead, shelving innovative ideas to focus solely on scoring the highest on your usability tests. We have seen this happen before with CCHIT.

It is not the government's role to determine EHR usability. Presently, there are innovative EHRs in the market receiving good press and high marks on usability. Do not burden them with processes and requirements that will lead them to mediocrity. Rather, let the real experts, the medical professionals who use EHRs as part of their important everyday work, voice their preferences in the market.

Please trust the market!

A lot to ponder. Including, tangentially, apropos of ** "the logic of medical thinking as our guiding principle..."

See also my prior "cognitive traps."
___

JULY 17th UPDATE

July 16, 2011
Seeing Promise and Peril in Digital Records
By STEVE LOHR (NY TIMES)

TECHNICAL standards may seem arcane, but they are often powerful tools of economic development and social welfare. They can be essential building blocks for innovation and new industries. The basic software standards for the Web are striking proof.

Safety is also a potent argument for standards. History abounds with telling examples, like the Baltimore fire of 1904. That inferno blazed for 30 hours, destroying more than 1,500 buildings across 70 city blocks. Fire engines from other cities came to help, but could not. Their hose couplings — each a different size — did not fit the Baltimore fire hydrants. Until then, cities saw little reason to adopt a standard size coupling, and local equipment manufacturers did not want competition. So competing interests undermined the usefulness of, and investment in, the technology of the day.

Today, the matter of standards for electronic health records is raising similar concerns, prompting heated debate in recent meetings of representatives from medicine, industry, academia and government. The stakes, they say, could scarcely be higher. They agree that, when well designed and wisely used, digital records can deliver the power of better information to medicine, improving care and curbing costs. But computer forms, they add, can also be difficult to use, cluttered and distracting, causing more harm than good in health care.

“This is an issue that potentially affects the health and safety of every American,” says Ben Shneiderman, a computer scientist at the University of Maryland.

The controversy points to the delicate balancing of interests involved when creating technical standards that inherently limit some design choices yet try to keep the door open to innovation. It also raises the question of the appropriate role for government in devising such technology requirements.

At issue is the Obama administration’s plan to develop standards to measure how effective and easy digital patient records are to use — applying a research discipline known as human-computer interaction or human factors. (The International Organization for Standardization, which is based in Geneva, defines the usability of a product by three attributes: “effectiveness, efficiency and satisfaction.”)

The need to improve the usability of computerized records is clearly evident — and has been for some time. A 2009 study by the National Research Council, an arm of the National Academy of Sciences, found that electronic health record systems were often poorly designed, and so could “increase the chance of error, add to rather than reduce work flow, and compound the frustrations doing the required tasks.”...

Interesting. See also

So Many EHRs. So Expensive.
By MARGALIT GUR-ARIE

There are currently 386 software packages certified by an ONC approved certification body as ambulatory Complete EHRs, which means that the software should allow the user to fulfill all Meaningful Use requirements and possibly qualify the proud owner for all sorts of CMS incentives. There are 204 more software packages which are certified as ambulatory EHR Modules, and a proper combination of these packages could result in a Complete product, which if used appropriately could lead to the same fortuitous results...

More to come...

Use Case

The phrase "use case" is really simply software engineering jargon for "example," i.e., an example of how a user interacts with a software application to reach a goal. What follows is a sort of an emblematic HIT failure "use case" setup for J.D. Kleinke's "Dot-Gov: Market Failure And The Creation Of A National Health Information Technology System" (PDF). Given that I live in Las Vegas and work for our REC (adjunct to which we are now aggressively moving forward with a Health Information Exchange (HIE) initiative), I found this quite interesting.

JOE WILSON, a thirty-eight-year-old software engineer from Pittsburgh on his first trip to Las Vegas, is feeling out of sorts as he walks into the casino. The free drinks help his mood, and he discovers after his third that he has a serious gambling problem. At the casino’s cage, where cash, credit card capacity, and creditworthiness are turned into chips, Joe liquidates the $6,324 in his checking and savings accounts and another $8,121 from his credit cards. Twenty hours and ten drinks later, this money runs out on the craps table, but Joe secures an- other $24,983 in cash, which represents 40 percent of his retirement account and 30 percent of the equity in his home. The casino was able to find out this information about him—as well as his marital status, the names of his last three employers, the number of years he has lived at his current address and worked for his current employer, the lapsed status of an earlier life insurance policy and the paid status of another, and the absence of liens against his assets—in less than five minutes, based on his name and Social Security number. In twelve more hours, Joe has burned through the last of his cash. Then the chest pain starts.

Leaving Las Vegas. Joe is rushed to a community hospital a few blocks from the casino. He is drunk, dizzy, and disoriented and cannot give the emergency room (ER) doctors any information about his medical history. But he is able to produce a tattered insurance card from his wallet, which includes his Social Security number, listed as his “Member ID.” The hospital’s admissions clerk spends twenty minutes on the phone to confirm that Joe is indeed covered by the health insurer in Pittsburgh and that she should collect up to $500 from Joe for his visit; but the insurer’s “information specialist” cannot say exactly how much, because he cannot tell from “the computer” if Joe has met his deductible yet that year. He can tell the hospital nothing else about Joe—not his medical history, the names of his physicians, or any medications he might be on—because “the computer” has no other information about him. That information is “in the other computers.”

Joe’s condition worsens; the ER physician diagnoses a heart attack and prescribes intravenous metoprolol, a generic beta blocker. What she does not know is that until a month earlier, Joe had been taking 20 milligrams per day of Paxil (paroxetine) for depression. But a month before Joe’s trip to Vegas, his employer’s health plan had switched to a new pharmacy benefit management (PBM) company, which required Joe and his coworkers to fill their medications for chronic conditions via mail order. One of Joe’s doctor’s three medical assistants had faxed the doctor’s usual handwritten prescription for Paxil to the mail-order pharmacy.

The mail-order pharmacist misread the prescription as “Plendil,” a calcium channel blocker often used for the same purposes as beta blockers and commonly dosed at 10 milligrams per day but occasionally at 20 milligrams for patients with congestive heart failure.1 Joe had been dutifully taking the medication for the past few weeks, walking around with dangerously low blood pressure caused by high levels of the unneeded medicine. Joe’s depression had also been slowly, imperceptibly returning—hence his unusual appetite for alcohol, which lowered his low blood pressure even further, resulting in wooziness and cognition problems severe enough to render Joe vulnerable to the casino’s temptations.

In the ER, the metoprolol does the trick within minutes of entering Joe’s blood-stream: His blood pressure plummets, he goes into cardiac arrest, and he dies.
___

HIT market failure. The underlying cause of Joe’s death is health information technology (HIT) market failure. If the state of U.S. medical technology is one of our great national treasures, then the state of U.S. HIT is one of our great national disgraces. We spend $1.6 trillion a year on health care—far more than we do on personal financial services—and yet we have a twenty-first-century financial information infrastructure and a nineteenth-century health information infrastructure. Given what is at stake, health care should be the most IT-enabled of all our industries, not one of the least. Nonetheless, the “technologies” used to collect, manage, and distribute most of our medical information remain the pen, paper, telephone, fax, and Post-It note.

Meanwhile, thousands of small organizations chew around the edges of the problem, spending hundreds of millions of dollars per year on proprietary clinical IT products that barely work and do not talk to each other. Health care organizations do not relish the problem, most vilify it, many are spending vast sums on proprietary products that do not coalesce into a systemwide solution, and the investment community has poured nearly a half-trillion dollars into failed HIT ventures that once claimed to be that solution. Nonetheless, no single health care organization or HIT venture has attained anything close to the critical mass necessary to effect such a fix.

This is the textbook definition of a market failure. All but the most zealous free-market ideologues recognize that some markets simply do not work. Indeed, reasoned free-market champions often deconstruct specific market failures to elucidate normal market functioning. The most obvious examples of such failures (such as public transit and the arts) are subsidized by society at large because such subsidies yield benefits to the public that outweigh their costs. Economists refer to these net benefits as “positive externalities,” defined as effects that cannot be captured through the economic equation of direct cost and benefit.

The positive externalities of an HIT system approaching the functionality of our consumer finance IT system include reduction of medical errors like the one that killed Joe Wilson; elimination of tens of thousands of redundant and expensive tests, procedures, and medications, many of which are not only wasteful but harmful; and the coordination and consistency of medical care in ways only promised by the theoretical version of managed care. These public health benefits are well beyond the reach of a health care system characterized by the complexities of medicine and conflicts of multiple parties working at economic cross-purposes. They are trapped outside the economic equation, positive externalities of a stubbornly fee-for-service health care system that inadvertently rewards inefficiency, redundancy, excessive treatment, and rework...

Health Care’s Blue Screen Of Death: Reboot Or Reform?

The compulsion today is to find the elusive “business case” for health care IT. Legions of IT vendors and consulting companies have struggled to cobble together “the ROI” (consultantspeak for “return on investment”) to prove that an individual health care organization would benefit by investing in better IT and that the failure to date has been merely a cultural problem on the demand side (“the doctors won’t use computers”) or a sales problem on the supply side (“it’s all vaporware”). These objections are hardly sufficient to stop a force as revolutionary as IT. The practical reality is that the typical ROI is modest at best, ephemeral for most, and attainable only well past its investment horizon—a dressed-up way of saying that it exceeds the political capital of its current CEO and CIO. If there were a strong business case for a health care organization to break from the pack and build out a twenty-first-century IT system, we would have no need for this paper—or, for that matter, this entire issue of Health Affairs. If the health care IT market worked, it would have worked by now.

The ability of the gambling industry to liquidate Joe Wilson’s assets within minutes is an example of IT market success; the inability of the health care industry to catch a simple medical error during his half-day in the ER is an example of IT market failure. All parties involved in consumer financial transactions have an economic interest in seeing that those transactions work as smoothly as possible. Not so all parties involved in health care’s myriad transactions.

The business case for no HIT. The first step in understanding the real intractability of the problem is ignoring the rhetoric. There is a veritable cottage industry involving the articulation of moral outrage over the health care quality “crisis,” much of it public relations spadework for someone’s political or commercial ambition and most of it culminating in a the naïve insistence that the system is on the verge of collapse and cannot go on like this. Actually, it can and will go on like this forever, absent any major intervention by the nation’s largest health care purchaser—the U.S. government.

Why? Because in the crude fee-for-service (FFS) reimbursement system inherited by that purchaser in the 1960s and fundamentally unchanged since then, the Las Vegas hospital has little real interest in knowing Joe’s medical history. In most cases, access to such information would represent a reduction in billable services. In an industry rife with dirty little secrets, this is health care’s dirtiest: Bad quality is good for business. And the surest road to bad quality is bad or no information. The various IT systems out there are expensive to buy, implement, and train staff to use, but this expense pales in comparison to all of the pricey and billable complications those systems would prevent...

This article was published in the fall of 2005. Change a few NHE numbers and then- leading wonk names, it could have been written yesterday. Read it closely, all of it. It is excellent.


Now, we might also consider some thoughts stemming from "Property, Privacy and the Pursuit of Integrated Electronic Medical Records" (Hall, Turnage, and Turnage, PDF), another incisive piece.

...Even though e-health is growing steadily and will soon exist in some form just about everywhere, the electronic systems that are in place rarely interconnect -- a problem that is getting worse rather than better. The RAND Corporation summarizes that “the ability to share information from system to system is poor.” This is because there “is no market pressure to develop HIT systems that can talk to each other.” Instead, the “piecemeal implementation currently under way may actually create additional barriers to the development of a future standardized system because of the high costs of replacing or converting today’s non-standard systems.

The challenge is how to move an enterprise representing one-sixth of US GDP, with 13 million employees and potentially almost 300 million patients, from a decentralized, fragmented, paper based world, to an integrated, automated, networked world where information follows the patient, information-based tools can aid in decision making and quality, and population health data can be mined to improve the quality and outcome of care for all...

The authors note that ongoing legal uncertainties regarding "ownership" of patient-identifiable medical data (is it "property"? whose "property"?), coupled with strict federal and state-level privacy regulation of PHI (Protected Health Information) comprise significant potential barriers to effective, nationally seamless HIE (Health Information Exchange).

Who owns medical information? Patients, providers, both of the above, or no one? The law provides incomplete, unclear, and somewhat inconsistent answers ... property rights must be clearly established so that the respective parties know their legal default positions ... The relevant parties are in a quandary over who owns or controls what and so they do not know for sure what needs to be done to construct any particular information network model ... Accordingly, it matters a great deal to real-world actors who has exactly what rights in different aspects of medical record information.

Medical information has considerable commercial value. “[A] well-established multimillion-dollar business exists that utilizes secondary health data as its primary resource,” for purposes such as marketing to physicians or conducting medical research. Legal uncertainty or agnosticism over valuable property rights can spark a land grab that hoards rather than develops these productive assets. Once one party stakes its ownership claim, then so must all the other competing parties, for fear of being trumped. But, fencing off the terrain of medical information destroys the commons that might have supported valuable public goods. Witness the A.M.A.’s proclamation quoted above that physicians own the medical information they collect. Likewise, the Center for Studying Health System Change observed that hospitals’ greatest concern with I-EMRs is “losing competitive advantage by relinquishing control of ‘their’ data. They view[] clinical data as a key strategic asset, tying physicians and patients to their organization.”

Legal logjams also arise from privacy protections. Medical privacy is important, but we may be protecting it to a fault...

...From the economic perspective of investing in medical information, the lack of clear property rights plus the presence of strong privacy protections is the worst of both worlds. Privacy protections increase the costs of developing I-EMRs and uncertain property rights decrease the returns. How these barriers and uncertainties are resolved could determine the kinds of networks that will emerge and how efficiently they can form...

Hall et al point out that "facts" cannot be "owned." In a general, mundane sense, that is indeed the case -- not that it has ever stopped various commercial interests from trying to lay exclusive claim to all manner of public domain information. And, then, there's the complicating factor of myriad "facts" that go to "proprietary information" and "intellectual property," which are indeed "owned" and jealously guarded by their proprietors (not to mention the marketable "likenesses" of celebrities).

I have blue eyes. Who cares? I am 5'10" tall. Who cares? No one -- including me -- can really profit from knowing those facts. I weigh 170 lbs -- which makes my BMI (Body Mass Index) 24.4. Suddenly, things are a bit different, and if I weighed 50 lbs more (220) my BMI would be 31.6 (officially "high"), which would perhaps be of commercial partisan interest to [1] people trying to sell me weight loss products and services, [2] employers wanting to minimize their health care benefits cost risks, and, relatedly, [3] insurance companies (life or health) looking for an excuse to raise my rates or exclude me from coverage.

We pretty much all understand the potential adverse implications of trafficking in peoples' personal data, ranging all the way from targeted marketing to all other manner of gumshoeing and discrimination (regarding which your EHR/HIE clinical information comprise a potential treasure trove) to financial and identity theft.

GUMSHOEING "USE CASE"
(Courthouse News, June 20, 2011)

(CN) - Federal medical-privacy laws do not preempt California's own rules against doctors disclosing patient information to debt collectors, the state Supreme Court ruled.

The unanimous court revived Robert Brown's longtime crusade to hold dentist Rolf Reinholds accountable under California's Confidentiality of Medical Information Act.

Way back in 2000, Reinholds billed Brown $600 for a permanent dental crown that Brown claimed he never received. Brown refused to pay the bill, and Reinholds sent the matter to a bill collector and a credit agency, along with a copy of Brown's dental charts and the charts of Brown's minor children.

Debt-collector Stewart Mortenson in turn disclosed the Browns' confidential medical information to the consumer-reporting agencies Experian, Equifax and Trans Union, and also sent along the family's Social Security numbers, dates of birth, addresses, telephone numbers and entire dental histories.

After two years of repeated, unsuccessful demands that Mortensen stop the unauthorized disclosures, Brown sued Reinholds and Mortensen, alleging violations of the Confidentiality Act, which generally prohibits the unauthorized dissemination of medical information.

The trial court found Brown's claims too vague and dismissed them. The Court of Appeal affirmed, though for different reasons. It ruled that Brown's state law claims were preempted by the federal Fair Credit Reporting Act (FCRA).

Not so, the state's high court said Thursday.

Congress chose not address "the scope of a medical provider's duties when furnishing information to a consumer reporting agency" in the FCRA, the court found. And while Congress did address the issue somewhat in the Health Insurance Portability and Accountability Act (HIPAA), it simultaneously allowed "states to continue to regulate to the extent they desired to enact more stringent, privacy-favoring legislation," according to the ruling...

HIPAA is unique in that it reverses the otherwise default legal custom of "federal preemption" -- i.e., where state law and regulation conflict with their explicit federal counterparts, the latter typically prevail. With respect to HIPAA, state law/regulation found to be "more stringent" in the protection of PHI trumps HIPAA regulation.

A recent example from Ohio:

Privacy & Information Security Law Blog
Posted at 8:47 AM on May 7, 2010 by Hunton & Williams LLP

State Law Trumps HIPAA in Suit Over Disclosure of Medical Records

Rejecting a defense based on compliance with the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), a federal court in Ohio denied a medical clinic’s motion to dismiss invasion of privacy claims following the clinic’s disclosure of medical records to a grand jury. In Turk v. Oiler, No. 09-CV-381 (N.D. Ohio Feb. 1, 2010), plaintiff Turk had been under investigation for illegally carrying a concealed weapon and for having a weapon while under disability in violation of an Ohio law which provides that “no person shall knowingly acquire, have, carry, or use any firearm” if “[t]he person is drug dependent, in danger of drug dependence, or a chronic alcoholic.” Defendant Cleveland Clinic, where Turk was a patient, received a grand jury subpoena requesting “medical records to include but not be limited to drug and alcohol counseling and mental issues regarding James G. Turk.” When the Cleveland Clinic disclosed Turk’s medical records in response to this subpoena, Turk sued the clinic for violating his privacy rights.

In its defense, the clinic argued that a specific exemption in HIPAA permits such disclosure of medical records in response to a grand jury subpoena. Ohio’s physician-patient privilege, however, provides that a physician cannot testify as to “a communication made to the physician . . . by a patient in that relation or the physician’s . . . advice to a patient.” The court found that the term “communication,” as used in the statute, includes hospital records “and is sufficiently broad to cover any confidential information gathered or recorded within them during the treatment of a patient at the hospital.” Because the HIPAA provision exempting the disclosure would not preempt this more restrictive state law, the court denied the clinic’s motion and refused to dismiss Turk’s privacy claim. That decision may have prompted a settlement, as this week, the court granted a request by Turk to dismiss all of his claims against the clinic.

I could go on. The more I look, the more I find.

Lately I've been skulking around down in the bowels of various state laws and regulations pertaining to health information privacy. One good launch pad has been the Georgetown University Center on Medical Rights and Privacy.

A few random snips from their in-depth publications on state laws (Volume 1, Alabama-Montana, PDF; Volume 2, Nebraska-Wyoming, PDF):

New Hampshire: The medical information contained in the medical records in the possession of any health care provider is the property of the patient. [N.H. Rev. Stat. § 332-I:1.]

Medical information contained in the client’s record of a home health care provider is deemed to be the client’s property and the client has the right to a copy of these records upon request and at a reasonable cost. [N.H. Rev. Stat. § 151:21-b(II)(i).]

The medical information contained in the medical records at any licensed health care facility is the property of the patient. [N.H. Rev. Stat. § 151.21(X).]

Virginia: Although patient records are the property of the provider maintaining them, Virginia recognizes a patient’s right of privacy in the content of his medical records. [See Va. Code Ann. § 32.1-127.1:03(A).]

Medical records maintained by health care providers are the property of the provider, or the employer if the health care provider is employed by another health care provider. [Va. Code Ann. § 54.1-2403.3.] Patient records may not be transferred with the sale of a professional practice until an attempt is first made to notify patients of the pending transfer, by mail, at the patient’s last known address, and by publishing prior notice in a newspaper of general circulation within the provider’s practice area. The notice must inform patients that at their written request, within a reasonable time, records or copies can be sent to another like-regulated provider of the patient’s choice or destroyed. [Va. Code Ann. § 54.1-2405.]

Florida: The results of the DNA analysis,whether held by a public or private entity, are the exclusive property of the person tested, are confidential, and may not be disclosed without the consent of the person tested. [Fla. Stat. Ann. § 760.40.]

All “records owners,” i.e., any health care practitioner who generates a medical record, receives medical records from a previous record owner, or the practitioner’s employer, if the employer is designated as the records owner, [Fla. Stat. Ann. § 456.057(1) (defining “records owner.”)] are required to develop and implement policies, standards and procedures to protect the confidentiality and security of medical records.

Louisiana: Medical records of a patient maintained in a health care provider’s office are the property and business records of the health care provider. [La. Rev. Stat. Ann. § 40:1299.96(A)(2)(b).]

An insured’s or enrollee’s genetic information is the property of the insured or enrollee.**

Mississippi: Hospital records are the property of the hospitals. [Miss. Code Ann. § 41-9-65.]

Indiana: Providers are the owners of original health care records and they may use these records without the specific written authorization of the patient for legitimate business purposes, including submission of claims for payment from third parties; collection of accounts; litigation defense; quality assurance; peer review; and scientific, statistical and educational purposes. [Ind. Code Ann. § 16-39-5-3.]

The provider is the owner of the mental health record and is entitled to retain possession of it. [Ind. Code Ann. § 16-39-2-2.]

South Carolina: Under the Physicians’ Patient Records Act the physician is the owner of the medical record. [S.C. Code Ann. §§ 44-115-20.]

According to this resource, only New Hampshire unequivocally confers full data "ownership" on patients, though, I find the thus far couple of "genetic information" property entitlements interesting as well (e.g., FL and LA).
___

REPORT FROM RTI (PDF)
Privacy and Security Solutions for Interoperable Health Information Exchange
Report on State Medical Record Access Laws
(August 2009)

A brief excerpt...

State Laws
States use varying terms to describe the health information encompassed by individuals’ right of access, including, for example, patient records, health records, medical records, hospital records, and patient information. In many states, these terms are undefined [see, e.g., W. VA. Code § 16-29-1 (2008) (where state law gives individuals the right of access to all or a portion of the “patient’s record,” a term which is not defined in the statute or regulations)]. However, provisions in several states expressly define the relevant term in detail, specifically including in some instances medical records or information created by others [see, e.g., N.H. Code Admin. R. Ann. Med 501.02(f)(2) (2008)].

Challenges for an Electronic Environment
The fact that states use varying terms (or fail) to define health information that is subject to a right of access may prove problematic. One issue is whether the medical records or health information subject to the individual’s right of access includes material in the record that came from another source. Some health care providers apparently interpret access to medical records or health information as encompassing only information that was generated within their office or facility. In responding to an individual’s request for copies of medical records, some health care providers exclude any information in their possession that was obtained from other health care providers. While some state law provisions clearly define medical record access as including information furnished by other health care providers, most state laws governing doctors and hospitals do not expressly address this issue. The ambiguity in law on this issue, i.e., whether these health care providers must provide access to health information regardless of the originating source, may continue to prove problematic in an electronic environment where any particular health care provider likely will maintain data that originated from myriad sources.

Lots of potential digital PHI jurisdictional issues remain with respect to medical data "ownership," access, and disclosures. All of the state statutes and regulations I have examined thus far simply refer to the rights of "patients." Nothing about in-state vs out-of-state legal "residents" (indeed, the term "resident" only appears in reference to patients in long-term care settings or psych facilities). So, for example, say you are a legal resident of a state whose PHI law is "more stringent" than HIPAA (and thus nominally trumps HIPAA) and are treated in a facility in another state where HIPAA is the default, which law governs access to (and release of) your PHI? One might reflexively think it'd be the jurisdiction wherein the medical encounter occurred, but it might in fact not be all that clear.

More work for lawyers, 'eh? To wit...

HIPAA May Provide Basis for State Law Private Cause of Action
[McGuire Woods, LLP, 06/23/11]
The Health Insurance Portability and Accountability Act (HIPAA) imposes requirements on healthcare entities involved in the exchange of health information to protect the confidentiality of such information. It provides both civil and criminal penalties for individuals who improperly handle or disclose individually identifiable health information. HIPAA does not create a private right of action, under federal law. However, a recent decision by a district court in Missouri held that HIPAA may form a basis of a state law “negligence per se” claim.

In I.S. v. Washington University, E.D. Mo., No. 11-235, 6/14/11, the U.S. District Court for the Eastern District of Missouri, refused to dismiss plaintiff’s claim for negligence per se, despite its reliance on HIPAA, and remanded the case to state court. In this case, plaintiff alleged that defendant made an unauthorized release of certain medical records to plaintiff’s employer, which resulted in harm to the patient. Under Missouri law, the elements of a claim for “negligence per se” are: 1) a violation of a statute; 2) the injured plaintiff was a member of the class of persons intended to be protected by the statute; 3) the injury complained of was of the kind the statute was designed to protect; and 4) the violation of the statute was the proximate cause of injury.

In asserting negligence per se, the plaintiff relied solely on HIPAA to meet the required elements of the claim. Defendant moved to dismiss this claim in federal court on the basis that HIPAA does not create a private cause of action. However, plaintiff contended that its reference to HIPAA in its negligence per se action was merely to establish the legal duty of care rather than a means to find a private cause of action under HIPAA, and that the case should be remanded to state court as it is not a matter of federal subject matter jurisdiction. Ultimately, the court agreed and declined to dismiss the negligence per se claim, although it did remand the case to state court.

The Washington University case is not the first case to hold that HIPAA may be referenced as a basis for a state law claim. For example, in Acosta v. Byrum, 638 S.E. 2d. 246, 253 (N.C. Ct. App. 2006), the North Carolina Court of Appeals allowed a plaintiff to make an intentional infliction of emotional distress claim against a psychiatrist by relying on HIPAA. In that case, the psychiatrist allegedly allowed an office manager to have access to medical records that were used to cause harm to the patient. The plaintiff used HIPAA to establish the standard of care element required in a claim for negligence. The trial court dismissed the claim stating that HIPAA does not create a private cause of action. However, the appeals court reversed, not because HIPAA creates a private cause of action, but because the court found it appropriate to use HIPAA as establishing a standard of care in making claims that the defendant violated a standard of care.

The cases above illustrate the interplay between HIPAA and state law and open the doors to future lawsuits where plaintiffs use HIPAA as a basis for private claims. The risks of such private causes of action are only expected to increase, particularly with the expanded duties that will be laid out in the forthcoming final regulations to HIPAA, which are being modified by the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act. These final regulations will contain provisions that update HIPAA and extend yet-to-be-finalized health data privacy and security rules to healthcare entities, including funding for heightened HIPAA enforcement...

___

CODA


How a Broken Medical System Killed Google Health
Google would have had to fix a balkanized U.S. health-care system to make the service catch on.
WEDNESDAY, JUNE 29, 2011 BY DAVID TALBOT, MIT Technology Review

At the end of this year, Google Health will flatline. The service couldn't encourage many people to import or analyze their health data, and experts say its untimely death is, in many ways, an extension of U.S. health-care providers' failure to share data across institutions, or make it easy for patients to obtain it.

Google's free online service lets people upload, store, analyze, and share their health information. But there are hundreds of different health-care institutions in the U.S. that use different systems to record and store data, and many doctors don't use electronic records at all, making the task of retrieving and updating data extremely difficult for the average person, says Isaac Kohane, who directs the informatics program at Children's Hospital in Boston, and codirects Harvard Medical School's Center for Biomedical Informatics.

For Google to make its service attractive, it would have had to solve this health IT mess, which is in the early stages of being addressed through recent national policy moves. These include 2009 federal stimulus incentives for doctors and hospitals to adopt electronic medical records, and for hospitals to share data with one another.

Kohane says it will be at least five years before data flows smoothly enough to make something like Google Health worthwhile. "Google is unwilling, for perfectly good business reasons, to engage in block-by-block market solutions to health-care institutions one by one," Kohane says, "and expecting patients to actually do data entry is not a scalable and workable solution."...

Interesting.

Meaningful Use ePHI Privacy and Security compliance criteria

CORE MEASURE OBJECTIVE: Protect electronic health information (ePHI) created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities.


ASSOCIATED MEASURE: Conduct or review a security risk analysis per 45 CFR 164.308(a)(1) of the certified EHR technology, and implement security updates and correct identified security deficiencies as part of its risk management process.


METHOD OF MEASURE CALCULATION: Measure requires only a Yes/No attestation.

THRESHOLD: Conduct one security risk assessment. 


EXCLUSIONS: None.

I recently accompanied on of my REC colleagues on a "Meaningful Use training session" at one of our outpatient solo doc client sites. The vendor support rep (I won't name the product) blithely made a couple of serious misstatements of fact as he walked the physician through the core and menu set criteria. First, he stated in error that the doctor could simply export a patient CCD/CCR document (basically an XML dump of a patient record) to a PDF file and send it on to another provider as an email attachment in order to satisfy the "perform at least one test of certified EHR technology's capacity to electronically exchange key clinical information" criterion.

I had to point out that any live patient data would have to first be appropriately encrypted prior to any transmission. Failure to do so would constitute a HIPAA violation, the sanctions for which are now quite severe.

His second errant assertion was equally misinformed. He stated that the doctor was automatically in compliance with the "Protect electronic health information" criterion cited at the outset of this post -- simply by virtue of using the vendor's ONC CHPL certified release of this particular EHR platform.

Nothing could be further from the truth. He was irrelevantly referring to the NIST EHR certification standards comprising 45 CFR §170.302(o) through §170.302(w):

• Access control;
• Emergency access;
• Automatic log-off;
• Audit log;
• Integrity;
• Authentication;
• General encryption;
• Encryption when exchanging electronic health information;
• Accounting of disclosures (optional),

all of which simply address the functional capability of an EHR platform to comply with the foregoing.

And, none which has anything to do with the Meaningful Use core requirement to "conduct or review a security risk analysis" during the Attestation period.

THE AIMS OF THIS MEASURE

To be useful for significant and sustained improvements in individual and population health, health care data must be available in timely fashion to those with the requisite authority (hence the security requirement) and need to access and act upon them. Moreover, in that regard we must also be assured of the integrity of the data – i.e., we must have ongoing confidence that the data transmitted electronically (especially those with direct bearing on clinical decision-making) are exactly** those acquired and stored at the source.

** It is tangentially noteworthy that the Meaningful Use ePHI standard does not address source data “accuracy” per se (i.e., the GIGO risk – “Garbage In, Garbage Out”), regarding which the venue for patient redress (there being no affirmative, proactive provider onus) is accorded at 45 CFR 164.526: Amendment of protected health information. (a) Standard: Right to amend. (1) Right to amend. An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set. This is essentially akin to consumers’ remedies for inaccuracies that come to light in credit reporting agencies’ data.

This Meaningful Use (MU) criterion explicitly focuses on three ePHI areas:

1. Access;
2. Storage, and;
3. Transmission.

And, with respect to the foregoing, the Stage 1 MU compliance standard requires attestation of documentable demonstration of implementation of reasonable and sufficient

1. administrative safeguards;
2. technical safeguards, and;
3. physical safeguards
   

of ePHI in order to ensure that the potentially conflicting ends of patient data availability, security, and integrity are consistently resolved in documentable fashion.

Returning to the language of this Meaningful Use ePHI compliance specification:

ASSOCIATED MEASURE: Conduct or review a security risk analysis per 45 CFR 164.308(a)(1) of the certified EHR technology, and implement security updates and correct identified security deficiencies as part of its risk management process.

And then from the cited “per 45 CFR” itself,

§ 164.308 Administrative safeguards.

(a) A covered entity must, in accordance with §164.306:
(1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.

We ought make note that “accordance with §164.306” obligates the attestee to having adequately addressed all of the subsectional provisions of 45 CFR 164.3 (the breadth of “Subpart C,”):

§164.306(c) Standards. A covered entity must comply with the standards as provided in this section and in §164.308, §164.310, §164.312, §164.314, and §164.316 with respect to all electronic protected health information.

These mandate, in the aggregate, effective [1] administrative safeguards, [2] technical safeguards, and [3] physical safeguards – the gamut. Moreover, activities undertaken pursuant to compliance with this criterion must be sufficiently documented:

§ 164.316 Policies and procedures and documentation requirements.

A covered entity must, in accordance with §164.306:

(a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in §164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.

There is a six-year records retention requirement associated with the measure [§164.316(2)(i)]. Also noteworthy is that, while the various compliance specifications are denoted as either “required” or “addressable” (highlighted in the Subpart C appendix below), the latter are not to be construed as “optional.” While the measure speaks to “flexibility” and “reasonableness” with regard to implementation latitude, such are not to be construed as license for a la carte non-documentation.

See, e.g., §164.306(d)(1) through (B)(2)(e).

In light of recent national media attention regarding ePHI concerns, it is not advisable to take the foregoing lightly. For example:

HHS Inspector General reports highlight IT security gaps in health care


May 26, 2011, Baker & Hostetler LLP

On May 16, the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) issued two reports critical of the government’s efforts to build and enforce a federal information security framework for protecting individuals’ electronic protected health information (ePHI). Of particular interest to health care providers and health plans, these reports signal that heightened enforcement efforts appear likely in the future, making information security a top priority when developing and operating interoperable health care information technology (HIT).

The first OIG report, which assessed the Centers for Medicare and Medicaid Services’ (CMS’) and Office of Civil Rights’ (OCR’s) oversight of the Security Standards under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), found shortcomings in hospital information security implementation, and criticized a perceived lack of effective of oversight of such Security Standards by CMS and OCR.

The OIG audit examined information security systems at seven large hospitals located in several states. The report found 151 security vulnerabilities, ranging from insufficient password strength and unencrypted laptops containing ePHI, to lack of physical protections (e.g., locks) for computer storage rooms, inadequate encryption methods, and incomplete policies and procedures to address audit controls, backup plans and disaster contingencies. The majority of findings were rated as “high impact”, which means posing a significant risk of harm to the individuals whose ePHI was transmitted or stored in such facilities. The report concluded that the OCR needs to significantly improve oversight and enforcement of data security under HIPAA, including continuation of the compliance oversight reviews of covered entities begun in 2009 at the direction of CMS. The OIG report also referred to exercise of the specific HIPAA enforcement measures and larger penalties enacted under the 2009 American Recovery and Reinvestment Act’s Health Information Technology for Economic and Clinical Health Act (HITECH) provisions.

The second OIG report criticized the Office of the National Coordinator for Health Information Technology (ONC), the agency created under ARRA/HITECH to administer and oversee federal incentives for the adoption and meaningful use of interoperable electronic health records (EHRs), and other related national HIT initiatives. That report found that the ONC failed to incorporate general information security requirements in the measures required for certified EHRs under HITECH. While certain application security controls were included in the HIT standards, the OIG found that general security requirements for the overall security structure, policies and procedures to be specifically applied to EHR systems were lacking.

In light of these OIG reports, and of ongoing news of misappropriation of patients’ health information and wide-scale security breaches, health care providers and health plans should consider reassessing their security risk exposure and preparedness to address information security lapses and HIPAA enforcement likely to be at the forefront of the national HIT trend.

More recent news:

[eWeek.com, May 26th] Despite spending a lot of time making sure they are compliant with federal and state regulations, health care organizations claim they are still seeing a lot of data breaches.

Being regulatory-compliant does not necessarily reduce the chances of a data breach, at least for the health care industry, according to a new study. Even more worrisome, organizations appear to be focusing more on compliance and less on security.

About 56 percent of IT security professionals in the health care industry said they spend the majority of their time addressing compliance requirements, according to the results of a GlobalSign survey released May 26. Even so, 34 percent of the health care industry IT security professionals polled said their organizations experienced a patient-records data breach within the past two years.

The survey “validates” the fact that health care organizations are putting in the effort to comply with HIPAA (the Health Insurance Portability and Accountability Act), the HITECH (Health Information Technology for Economic and Clinical Health) Act, and other state and federal regulations, according to Lila Kee, chief product officer at GlobalSign. However, it also demonstrated that “checking the boxes on compliance audits” will not ensure security or privacy when it comes to sensitive data, Kee said...

I visited with another solo practice physician recently for an initial REC assessment. When I asked about written HIPAA-compliant policies and procedures, I got that too-familiar deer-in-the-headlights look. With all the recent contentious ePHI news, I don't think this is a particularly good time for providers to be ignoring or paying lip service to the breadth of HIT privacy and security concerns reflected in the foregoing Meaningful Use criterion.

TECHNICAL ADDENDUM

We at the REC have come to simply reiterate the phrase "privacy and security."


But, "privacy" per se is addressed specifically at 45 CFR 164.5nn -- Subpart E—Privacy of Individually Identifiable Health Information, which is about things such as

• patient data access;
• consents;
• disclosure;
• right of correction of erroneous PHI;
• records retention requirements.

The Meaningful Use measure recounted at the top of this post is really about ePHI "security" -- the "privacy" part appears to exceed our portfolio.

But, without PHI security there can be no patient "privacy."
___

CODA:
TRYING TO FIT DOZEN OF PAGES OF REGS INTO ONE SLIDE


Mucking around in SmartDraw one recent afternoon. Click to enlarge.