Health IT’s most pressing issues may be so prevalent that they can’t be contained to a single post, as is obvious here, the second installment in the series detailing some of the biggest IT issues. There are differing opinions as to what the most important issues are, but there are many clear and overwhelming problems for the sector. Data, security, interoperability and compliance are some of the more obvious, according to the following experts, but those are not all, as you likely know and we’ll continue to see.
Here, we continue to offer the perspective of some of healthcare’s insiders who offer their opinions on health IT’s greatest problems and where we should be spending a good deal, if not most, of our focus. If you’d like to read the first installment in the series, go here: Health IT’s Most Pressing Issues. Also, feel free to let us know if you agree with the following, or add what you think are some of the sector’s biggest boondoggles.
Michael Fimin
Michael Fimin, CEO and co-founder, Netwrix
The largest concern of any healthcare organization is protecting patient personal data. Every year healthcare entities of all sizes become victims of data leaks, fresh examples are both Anthem and Premera Blue Cross, and lose thousands of dollars mainly because of employee misbehave or human error. Being not an easy one to prevent, human factor sets IT pros a number of challenges to cope with:
1. Insider threat. Unfortunately, privilege abuse is a primary root cause for many data breaches. No matter if an employee is breaking bad or his credentials were stolen, sensitive data is put at risk. The only way to prevent insider threats is to have visibility into the IT infrastructure and be able to track any changes made to both security configurations and data. Monitor user activity and establish rigorous control over accounts with extended privileges. Regularly review all access rights to ensure that permissions are granted adequately to employees’ business needs.
2. Security of devices. In 2014 healthcare organizations suffered from physical theft or loss of electronic devices more than any other industry, said the Verizon 2014 DBIR. Without proper identity and authentication management personal data stored on these devices can be easily accessed by adversaries, leading to financial and reputational losses. If your employees’ laptop or tablets end up in the wrong hands, encryption, two-factor authentication and ability to manage the device remotely will protect your data, or at least will make hacker’s job much harder.
3. Employees’ negligence. Deliberate or accidental mistakes pose more danger to data integrity than you might think. A simple email with confidential data sent to the wrong address may lead to a huge data leak. Make sure that your employees are familiar with the company’s security policy and are aware of what they should do to maintain security each person in the company should clearly understand that integrity of information assets is their personal responsibility.
Barry Chaiken
Dr. Barry Chaiken, chief medical information officer, Infor Healthcare providers organizations invested billions of dollars purchasing and implementing electronic medical records with this investment driven by the economic incentives provided by the HITECH Act. Now that these systems are installed an up and running, organizations struggle to obtain real value from these investments. These systems were implemented with speed in mind rather than clinical transformation that improved quality and reduced costs. Now, organizations must embrace clinical transformation and change management to redo workflows and processes to effectively impact care. Organizations cannot justify their investment in EMRs unless they rework their EMR implementations to obtain true value from their deployment.”
Guest post by Ryan Howard, CEO and founder, Practice Fusion.
Ryan Howard
How many doctors have you seen in your lifetime? Don’t know or remember? You’re not alone – the average American patient will see nearly 19 different doctors during their lifetime. Nineteen different offices. Nineteen different medical charts. Nineteen different phone numbers. Nineteen different calls to track down your records. Now, can you even remember your last five doctors?
The future: Imagine this, you visit your doctor – or any doctor for that matter – and they quickly pull up your medical history. Vaccinations when you were a child? Check. Currently on a hypertensive medication? Check. Pre-disposed to a medical condition? Yep, that’s in there, too. No more arriving 20 minutes early to the doctors’ office to fill out the industry-average seven pages of paper forms. Your records – past and present – are already being reviewed by your trusted provider.
Beyond the sheer convenience, the accuracy and completeness of having your entire medical history available at the fingertips of your provider can impact your well-being and scope of care. Can you accurately remember all procedures you’ve had? And when? Or all the medications you’ve ever taken? With dates? Imagine if you were a senior. Not just daunting, but nearly impossible. Instead of going over just snippets of what you actually remember, your doctor is empowered to holistically review your entire medical history with the potential to make more informed decisions about your health.
Seem like a pipedream? If you were to ask a mere decade ago, most would have agreed. As recently as 2007, 88 percent of physicians were still charting on paper. And those physicians on an EHR system – who were paying a premium – were almost exclusively using a localized, server based platform with no connectivity. For cost perspective, according to HealthIT.gov, the average upfront cost of implementing an EHR is $33,000 per provider plus an on-going fee of $4,000 yearly, a cost-prohibitive amount for most private practices.
Fast forward to 2009 and the passage of the HITECH Act which provided billions of dollars of incentives for providers to implement an electronic health record. In addition to the incentives, new vendors appeared on the market who provided electronic health record platforms completely free-of-charge, allowing providers to reinvest the incentives in their practice as additional staff, new equipment, etc.
Guest post by Dr. Andrey Ostrovsky, co-founder and CEO, Care at Hand.
Andrey Ostrovsky, MD
Seven-hundred-and-seventy billion dollars in Medicare and Medicaid spending and more than one fifth of the federal budget is going to be spent very differently in 2018 compared to today. In particular, Health and Human Services (HHS) secretary Sylvia Burwell declared that at least 50 percent of Medicare payments will be tied to value-based models, such as bundled payment or accountable care organizations, by the end of 2018. The majority of Medicaid dollars have already shifted from fee-for-service (FFS) to managed care. Providers, payers and even patients are increasingly being held accountable for health outcomes and cost of care. So how come there is no accountability for the health IT industry?
There is no 30-day readmission penalty for EHR vendors. There is no medical-loss ratio applied to population health management platforms. There is no shared savings for predictive analytics apps supporting bundles. The lack of accountability in the health IT industry is hampering the promising shift in the rest of the healthcare system from volume to value.
Technology has the potential to speed up adoption of payment-for-performance and achievement of the Triple Aim including improving outcomes, decreasing cost and improving patient experience. However, a recent analysis by the Institute for Healthcare Improvement (IHI) found major gaps in the current digital health ecosystem with only 2 percent of technologies achieving all three aims and only 23 percent of technologies having any peer-reviewed research evidence for their claims.
While regulation can slow tech innovation and the FDA should be commended for loosening its regulatory grip over apps, financial incentives and constraints should be put in place to spread the risk – and reward – that the entire healthcare system is facing to the HIT industry as well.
Before the federal government realizes that health IT has slipped under the radar of accountability, our industry has a chance to shape it’s own future by incorporating risk-bearing into our business models. More important than the viability of technology vendors is the implication of accountability on the lives of vulnerable consumers and sustainability of providers serving those consumers.
The following guiding principles can ensure that vendors are held accountable of supporting high-quality, patient-centric delivery models and achievement of the Triple Aim:
Guest post by Ali Din, senior vice president, dinCloud.
Ali Din
With support having ended for Windows Server 2003, many organizations are left asking how to proceed with the soon-to-be obsolete server operating system. For organizations held to regulatory compliance standards, this question holds additional complexity. One of the industries undoubtedly scratching its proverbial head this week as support ends is healthcare.
Over the past few years, HIPAA, the Health Insurance Portability and Accountability Act of 1996, and HITECH, The Health Information Technology for Economic and Clinical Health Act, have largely determined the trajectory of IT and operations in healthcare. Perhaps most notably, HIPAA has helped govern patient security as healthcare institutions were incentivized to migrate health records to an electronic format through meaningful use. As EHRs, cloud and mobility solutions abounded, HIPAA guidelines dictated privacy and security standards for the industry. Today, many healthcare organizations are faced with a similar transition. Like all organizations, healthcare institutions have the option to migrate their servers to a supported operating system, which typically includes a corresponding hardware upgrade. Alternatively, they can migrate these workloads to the cloud. However, as reported by the Wall Street Journal, “analysts say that the technology [Windows Server 2003] is more prevalent in healthcare, utilities and government,” demonstrating that inaction seems to be more prevalent in the healthcare sector than one would think.
Those who have not yet migrated from Windows Server 2003 will be exposed to significant security risk and may compromise HIPAA compliance, as it is unlikely the operating system will remain a HIPAA supported platform.
The implications of not migrating extend beyond just the affected server. One unpatched vulnerability can compromise an organization’s entire infrastructure.
End of support means that Microsoft will no longer issue patches and security updates for Windows Serer 2003, and the resulting security risk is so severe, US-CERT, a branch of the Department of Homeland Security, issued a security alert warning of the “impact” of end of support. The alert states, “organizations that are governed by regulatory obligations may find they are no longer able to satisfy compliance requirements while running Windows Server 2003.”
Like the security risk, cost for extended support will also compound for healthcare organizations. Microsoft is charging $600 per server for the service, which will quickly add up.
With the risk and cost associated with not migrating, why are so many healthcare organizations approaching the deadline with no foreseeable migration plan? Like many goings-on in the industry, it’s complicated.
One factor is that some mission critical applications may not transition to a supported platform. That leaves IT administrators choosing between migration and applications that, in some cases, may be in daily use by their workforce.
And, finally, if it ain’t broke (yet), don’t fix it. Like many industries, healthcare organizations are often seeing heightened demand placed on smaller teams, which doesn’t leave ample time for proactivity. In these scenarios, migration planning may not have been prioritized with budget or resource allocation.
However, with end of support approaching in just a few days, regardless of the reason why these organizations didn’t migrate, they will soon be faced with the consequences.
Guest post by Ken Perez, vice president of healthcare policy, Omnicell.
When one thinks of the areas targeted for healthcare delivery reform by the Patient Protection and Affordable Care Act (PPACA), Medicare, the largest area for healthcare spending by the federal government, obviously comes to mind. Notably, there are more than 400 Medicare accountable care organizations, and that figure is projected to rise in the coming years.
However, Medicaid is another significant and growing area of healthcare spending that could benefit from reform.
According to the Centers for Medicare and Medicaid Services (CMS), as of February 2015, 70.5 million people—more than one in every five Americans and 25 percent more than the number of Medicare beneficiaries—were enrolled in Medicaid or the Children’s Health Insurance Program, which represents an increase of almost 40 percent from the number enrolled at the end of 2009.
In 2013, the federal government and states together spent $438 billion on Medicaid, with $250 billion (57 percent) covered by the federal government. With 28 states and the District of Columbia expanding Medicaid coverage, in 2015 the federal government will spend $343 billion on Medicaid, an amount equal to 9 percent of total federal outlays and two-thirds of Medicare expenditures. Taking into account funding by the states, well over half a trillion dollars will be spent in total on Medicaid in 2015.
Moreover, spending on Medicaid is projected to eclipse the growth of the U.S. economy over the course of the next decade. The Congressional Budget Office projects the federal government’s spending on Medicaid will reach $576 billion in 2025, a compound annual growth rate (CAGR) of 5.3 percent over 2015 to 2025. That compares with projected a 4.3 percent CAGR for U.S. gross domestic product for the same period.
Although the coverage or access-to-care issue has been partially addressed via Medicaid expansion—with much more work to be done—how to provide high-quality care in a cost-effective manner through Medicaid constitutes the next challenge.
Guest post by Dr. David Whitehouse, chief medical officer, UST Global.
“The Uberization of healthcare” has recently shown up as an expression in blogs and articles. However, each time it seems to possess a different meaning. For some, this phrase summarizes the transformation that happens when there is a deep understanding of the real hopes and needs of consumers, operationalizing them effectively. Facilitated by the latest technologies this concept is making life simpler and happier.
This concept of “uberization” keeps the comfort and concerns of consumers at heart. For others, it hints to a democratization minimizing competency, regulation, and oversight – essential ingredients to maintaining healthcare quality and standards. Some fear that this consumer empowerment will lead to people self-diagnosing, leading to the ultimate detriment of patient health with minimal support or evidence. This also raises major concerns regarding the maintenance of patient privacy. An example is when someone catches an Uber and something bad happening because the driver lacked experience.
What does all of this mean to me? Earlier this year at HIMSS in Chicago, I was looking out over the million dollar booths. I wondered how many of the vendors would remain as powerful or relevant 15 years from now. I also considered the transformation of health delivery where ACOs, PCMHs and new versions of retail health are growing. New approaches to healthcare payment and transparency are forging into the mainstream, enabling consumer empowerment, personalized medicine and cultural sensitivity. It’s all creating new levels of individuation; where we continue to struggle with effective models of behavioral change. Here is where the digitized self is beginning to show the first moves in the health field. From exercise enthusiasts to empowered consumers managing chronic illness, digestibles are being added to wearables to increase the panoply of both individualized and physiologically dynamic data, where social networking and gaming have coupled with crowd sourcing solutions and new insights to create new paths for data to create insights and action.
I was reminded that we occasionally overestimate the cognitive and logical aspects of our humanity with insufficient thought to emotional impact. Sometimes we set the bar too high for the impact disease management could have when patients are classified more specifically, bringing each individual evidence-based advice to alter their behaviors and change that path coupled with an enthusiastic coach. What we had missed was that people have messy, complicated lives with different resources practically and emotionally available both permanently and on a day-to-day basis. People who had emotional lives complicated with depression, anxiety and stress with goals for each day were not necessarily maximizing control of their chronic illness, but rather looking for moments of relief, happiness, and excitement.
I think the true power of Uber is genius. Its power partly goes beyond the world of satisfaction, which is now a major concern in medicine since it directly relates to revenue. Much of the Uber concept comes down to bliss, going beyond the typical expectations that we articulate. Satisfaction manifests when we match experiences to expectations. It goes beyond creating opportunities for moments of joy – it takes away pain points we do not even think about until they occur.
Guest post by Amit Cohen, co-founder and CEO, FortyCloud.
Remote access is changing the practice of medicine – from data collected remotely from newly developed telemedicine devices, to surgery conducted by a surgeon in an offsite location. A smartphone application, currently in development, is set to monitor a user’s voice to detect mood changes for individuals with bipolar disorder. Devices and applications such as these not only improve the quality of care available to patients across the globe, their use also results in exponential growth in the sources and volumes of data. These cutting-edge technologies present new challenges for IT professionals who are responsible for ensuring high availability (always-accessible data), scalability and flexibility for their healthcare organizations.
To enable scalable, high performance from at lower costs, even from remote locations, healthcare and pharmaceutical IT have adopted the cloud. Since cloud data centers can be diversified across the globe, cloud computing provides quick access to globally diverse users.
The cloud also offers the scalability to handle the massive influx of new data generated by new health care applications expected from the implementation of the U.S. Patient Protection and Affordable Care Act (PPACA). The U.S. Department of Health and Human Services (HHS) Stage 3 Proposed Rule, is also likely to result in additional volumes of digital data. This Rule seeks to align the EHR Incentive Programs with other CMS quality reporting programs that use certified EHR technology to promote improved patient outcomes and health.
Therefore, it is not surprising that healthcare cloud computing is forecasted to grow to $9.48 billion by 2020, according a recent study; an impressive increase from the current, 2015 market value of $3.73 billion.
Healthcare is not without its issues. Seemingly, for each source asked what the biggest problem the sector faces, there is a differing opinion on what’s most important. I’m often perplexed by the lack of cohesiveness shown toward the industry’s leading issues, too, and sometimes wonder how many of us could name the most pressing threats to the industry, as agreed upon by the community. There are clear problems – interoperability, lack of transparency, disparate systems working against each other — to name a few. So, in the following series, I’ve asked some insiders for their opinions on health IT’s greatest problems, and as you’ll see, they responses received vary greatly.
Healthcare IT struggles mightily with patient information that is not in the medical record system, but has leaked into other locations in the healthcare organization (cell phone emails, USB drives, employee desks, etc.). Healthcare organizations have moved Protected Health Information (PHI) into HIPAA compliant electronic health records (EHRs) systems, patients maintain electronic copies of their health information, which they give to their different providers as they move between appointments. This “patient distributed information” becomes PHI, with all its associated compliance and legal burdens for the health care organization.
There is liability associated with this, and information governance strategies available that reduce the associated risks. Patient distributed information is present on smartphones, tablets, laptops, and the like are not sanctioned EHR (such as email, file directories, etc.). These devices are not part of the organization’s HIPAA compliant system, and never can be. Most healthcare providers ignore the problem, which eventually leads to catastrophic security failures resulting in patient privacy breaches, and career damaging incidents for the healthcare IT department.
To eliminate the problem, IT needs to look to integrate an information governance framework that can:
Interview employees to understand how they deal with and understand this issue.
Audit, usually done with software systems, to provide objective evidence and quantification of the presence of PHI on your digital systems.
Set specific policies and procedures employees can follow in each and every situation when they come into contact with “patient distributed information.”
Provide raining and review of policies and procedures work.
Automate the policies and procedures with software systems to ensure compliance.
Surveil your digital systems is the best way to monitor and review your program, as well as seek to improve it.
Acknowledge the increasing presence of patient distributed information on your digital systems, and have a plan for how to address it. Look to information governance to establish a strategy and program to address patient distributed information. With the proper policies, procedures, training, and systems in place your organization will be able to effectively handle and mitigate the risks.
