According to a 2014 Identity Theft Resource Center Report, the healthcare industry has officially surpassed other major industries and now accounts for 42.3 percent of all data breaches recorded last year. As the number of patient medical records transitions to a digital sharing model, the potential cost of data breaches is now substantially higher than for those less regulated, like retail and public services. It’s clear that the industry is increasingly vulnerable to sophisticated cyberattacks; hackers are after vital patient information such as social security numbers and past medical records.
With limited budgets and priorities often, and rightfully, placed on patient care, many healthcare organizations lack the resources to implement stronger security levels. Despite these constraints, with the right technology and best practices in place healthcare organizations can position themselves for success.
The costs associated with “damage control” for many healthcare providers is steep with the annual cap on fines for violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and HITECH Act of 2009, up from a maximum of $25,000 per year to $1.5 million. And fines are only part of the financial burden. Investigation and legal efforts, business downtime and decreased credibility all drive up costs even further.
Unfortunately, many healthcare organizations are still facing challenges when it comes to effectively communicating and collaborating on security. In many of these healthcare organizations, there is a department for privacy and compliance and then a separate department for enterprise IT security. Functional groups are often siloed and share very little information with each other. This becomes a major issue in the event of a breach as neither side is able to understand the full spectrum of the threat without the others’ data.
The consequences of the gap between compliance and IT security becomes evident when dealing with insider threats. An individual’s actions may look legitimate, but when correlated against other activity, could indicate that malicious activity is occurring. A workstation that has always previously accessed clinical data or some other patient information doesn’t raise suspicion. But a subtle, steady increase in traffic, say of 5 percent or 10 percent, correlated with communication to an unauthorized or new IP address, likely indicates a breach. The same example could apply to an external threat with a malicious actor using social engineering methods to entice an unwitting user to download malware. Once inside the network, the malware can replicate the very same scenario. Either way, a breach has occurred. The IT security department may discover the situation, investigate and handle it and move on to the next task. But without visibility into this type of data, how would the compliance department learn about possible data leakage and take the necessary steps to investigate and report?
The Medical Memory’s mission is provide simple and convenient methods for video recording medical conversations and sharing them with patients and their families.
Elevator Pitch
The Medical Memory provides a simple and convenient method of recording medical conversations and distributing them to patients and their families.
Founder’s story
Dr. Randall Porter founded The Medical Memory to help his own patients better understand their condition and treatments. Dr. Porter recognized that his neurology patients did not comprehend the information imparted to them during appointments. Furthermore, Dr. Porter was frustrated with his inability to receive information regarding his own father’s cancer treatment in another state. Since its inception, the company’s vision has been to use video recording technologies to enhance patient understanding of their medical conditions and treatments and to share that information with family members and loved ones.
To achieve this The Medical Memory partners with doctor’s offices to make it simple for patients to request video recordings of their visits. A portable video camera is used to record discussions, imaging and demonstrations. Post visit, an email is sent to the patient with log in information to a page containing the videos. The patient simply logs in from any location with internet access to start reviewing what the doctor said. If desired, the patient can share the page with family and loved ones.
The Medical Memory is a simple and convenient method to keep patients and their loved ones informed of important medical discussions in many cases eliminating unnecessary follow-up appointments.
Marketing Strategy
The marketing strategy for The Medical Memory is a comprehensive local and national marketing and public relations campaign focusing on Dr. Porter’s personal experience with patients’ recall, the need for The Medical Memory and the benefit. The media focus is on editors, bloggers, and publications covering health, technology and startups.
In this new series, we are featuring some of the thousands of vendors who will be participating in the HIMSS15 conference and trade show. Through it, we hope to offer readers a closer look at some of the solution providers who will either be in attendance – with a booth showcasing and displaying key products and offerings – or that will have a presence of some kind at the show – key executives in attendance or presenting, for example.
Even as HIMSS Media has said that its employees will be making more of an effort this year to cover the tradeshow floor and its vendors and events, hopefully this series will give you a bit more useful information about the companies that help make this event, and the industry as a whole, so exciting.
The Usability People
The Usability People provide user experience (UX) consultation and usability testing services to clients in the US and across the globe. We have helped “mom-and-pop” shops and Internet startups, healthcare software (EHR) vendors, enterprise organizations, universities and government agencies. We have more than 25 years of experience providing user experience consultation, usability testing and interface design services to businesses of all shapes and sizes. The Usability People have the experience, knowledge and passion for UX to help your website, mobile web or phone app delight users.
Elevator Pitch
We like to tell people that we are cognitive ergonomists. That is that we take and apply the theories of psychology, specifically cognitive psychology, to the design and development of more usable software systems. We do this by helping development organizations better understand their users, and their users thinking. We work with software developers to design and test their systems to better match the workflow and mental models of those use the software every day.
Market Opportunity
EHR vendors that are seeking meaningful use Stage 2 certification are required to have a user-centered design process and to provide a report of a summative usability evaluation. We work with EHR vendors to help them understand their users, to design better software and provide the summative tests required for meaningful use Stage 2 certification.
Services and Products Offered
Safety-enhanced design (aka Usability) testing for meaningful use Stage 2 certification
User experience design, workflow, information architecture and wireframes for healthcare applications.
We conduct and report summative usability evaluations using the NISTIR 7742 Customized Common Industry Format Template for EHR usability testing suitable for presentation as the safety-enhanced design criteria portion of MU Stage 2 certification.
Problems Solved
Usability issues with EHRs and user-centered design consultation.
Value Proposition
Usability and user centered design typically has a 10 to 100 times return on investment. The savings typically are realized in reduced development costs, reduced training and documentation costs and reduced support costs. Usability in healthcare can also save a life.
PipelineRx is a telepharmacy company offering remote and SaaS pharmacy services to rural hospitals, as well as larger integrated delivery networks (IDNs). For smaller hospitals, PipelineRx offers 24/7 staffing during nights and weekends, verifying medication orders remotely to promote patient safety. The SaaS technology platform allows larger IDNs to essentially create their own telepharmacy, using one of their own pharmacists to staff additional locations.
CEO Brian Roberts has spent most of his career focused on healthcare services and staffing. Prior to co-founding PipelineRx, he was the president of Canopy Healthcare until it was acquired in late 2008. Canopy Healthcare was the leading allied healthcare staffing firm on the West Coast. Prior to Canopy Healthcare, Roberts was the EVP of business development at CHG Healthcare Services, a $600 million leader in diversified healthcare staffing which supplied physicians, pharmacists, nurses, and allied healthcare professionals to hospitals nationwide.
Here, Roberts discusses his firm and its capabilities, technology developments he’s seeing, telemedicine challenges and trends we’ll see in the coming year.
Tell me more about yourself and what inspired you to found PipelineRx?
I spent the first half of my career as a venture capitalist investing in early stage healthcare services and healthcare IT companies. I spent the second half of my career building companies from the ground up as an entrepreneur. I love the operations and technologies that are critical for building a sustainable business model. After building two successful medical staffing companies, I figured out that we could “staff” hospitals using remote pharmacists that work from home. The labor arbitrage of enabling one pharmacist to work on multiple hospitals drove on average a three to one return for hospitals. This all was enabled by creating a technology that allowed interchange between PipelineRX and hospital pharmacy information systems and EHRs.
We now have an amazing management team bringing more than 100 years of experience in building pharmacy technology companies.
Tell me more about your desire to lead a telepharmacy company? Who uses this service? How is it growing and how has it changed?
Leading PipelineRx is exhilarating each and every day. Overcoming challenges are what makes it interesting and trying to apply cloud based technology to a service that must be completed (pharmacy verification services).
Hospitals of all sizes use the service. From the small side, critical access hospitals with 25 beds use the service for long stretches, say 6 p.m. to – 6 a.m. and 24 hours on the weekends. Our service allows them to save significant costs yet have world class medical coverage of their hospital. We can also fill in if an employee pharmacist calls in sick or if there is a big snow storm and the employee pharmacist can’t make it to work. We also work with larger hospitals and hospital systems that are looking to optimize their staffing levels. While pharmacies traditionally were staffed like a firehouse with ample coverage, PipelineRx allows the hospital to staff to the median levels and then use our staff for peak or overflow. It’s been an amazing journey to see hospital administrators and C-suite’s understand that we assist in moving traditional fixed costs to variable costs through our unique service.
Here’s what we know. In the Anthem hack, it is estimated that approximately 80 million records were stolen. The Anthem hackers stole information of both employees and customers, which included names, address, emails, birth dates, medication history, employment details, family relatives and more. But while most hackers steal financial data for spending sprees – these hackers had next-step intentions with the stolen data serving as the basis for phishing emails with attachments for the purposes of installing malware using their official email accounts, gathering even more personal information, and then it was propagated across entire networks. So now what?
Know the facts. According to Privacy Rights Clearinghouse, up until Anthem, since 2006, about 6.6 million records have been exposed from 79 medical-related breaches of hacking or malware type. Last year, Community Health Systems Inc. announced a large data breach of its health system compromising data for 4.5 million patients and now Anthem at the 80 million mark. Attackers like targeting EHRs because the records are highly profitable compared to other forms of information. For example, each credit card data is valued about $1 in the black market. However, according to various sources, a partial or complete EHR can generate $50 to $100 on the black market. The high price is because of the healthcare data includes personal identity information and sometimes carries credit card information along with insurance and personal health information. So, while financial information can be tracked and secured following a breach — the healthcare information cannot be as easily tracked and resolved.
Current mandates. Every EHR provider should safeguard data and information with HIPAA-complaint communication protocols, 128-bit encryption and public key authentication. As per the HIPAA norms of strong grade encryption and authentication, providers should meet all the regulatory requirements enabling security and confidentiality. Scheduled backups of the data are essential to keeping records and information from being lost or destroyed.
Chris Strammiello, vice president of marketing and product strategy, Nuance.
Patient admissions and discharge processes implemented at many hospitals today are rife with vulnerabilities and potential HIPAA violations. One of the greatest challenges hospitals face is how they can successfully deliver on dual requirements to make the information in a patient’s electronic health record (EHR) more accessible while at the same time making it more secure, especially because of their reliance on paper, analog fax machines and unmonitored multi-function devices (MFDs).
Every time a document or form is copied, scanned, printed, faxed or emailed — on either an analog fax machine, digital MFD or mobile phone or tablet — a patient’s protected health information (PHI) can be accidentally exposed or intentionally compromised. In light of this, federal standards have now defined digital MFDs as workstations, where PHI must be protected with administrative, physical and technical safeguards that authenticate users, control access to workflows, maintain an audit trail of all activity and encrypt data at rest and in motion.
Healthcare organizations need to add a layer of security and control to electronic and paper-based patient admissions and discharge processes to help minimize the manual work and decisions that invite human error, automatically mitigate the risk of non-compliance and avoid the fines, reputation damage and other costs of HIPAA violations and privacy breaches.
As hospitals are rapidly approaching an FY 2015 deadline for meaningful use, they must demonstrate their “meaningful use” of certified EHR technology, including the ability to protect patients’ health information, or face reduced Medicare payments. The recent HIMSS Analytics survey found that despite the vast majority of hospitals reporting progress toward Stage 2 EHR, barely half of them — just 54 percent — were yet capable of protecting electronic health information, a required Core Objective in Stage 1.
Acting under provisions of HITECH, the Department of Health and Human Services Office of Civil Rights issued new rules in 2013 that enhance patients’ privacy protections, expand individuals’ rights to their health information and strengthen the government’s ability to enforce the law. One new development from these rules is that a security risk assessment tool prepared by the Office of the National Coordinator for Health Information Technology (ONC) mentions copiers 15 times as being workstations where PHI must be protected with administrative, physical and technical safeguards that authenticate users, control access to workflows, encrypt data handled on the device and maintain an audit trail of all activity.
Hospitals also need to conduct a risk assessment to identify threats and vulnerabilities (including copiers), implement and train workers in data loss protection (DLP) technology and procedures, and establish security incident reporting.
RightPatient is a division of M2SYS Technology, an ISO 9001:2008 certified company and biometric technology solution provider. M2SYS has more than a decade of biometric technology experience, with more than 300 million enrolled users in more than 100 countries.
Elevator pitch
RightPatient is the industry’s most advanced biometric patient identification, patient engagement, personalized healthcare and healthcare intelligence platform to reduce costs and liability, improve quality of care, monitor population health and enhance the patient experience. With features for wearable and biosensor integration, health games, medication alerts, proactive health management and predictive analytics, the platform also integrates with major electronic health record (EHR) systems such as Epic, Siemens, Cerner, McKesson, Meditech, IBM and many others. RightPatient is already deployed across hospitals and health systems that collectively maintain the health data of over 10 million patients.
Product/service description
RightPatient is the industry’s most advanced patient identification, patient engagement, personalized healthcare, and healthcare intelligence platform to reduce costs and liability, improve the quality of care, monitor population health, and enhance the patient experience. Our healthcare ecosystem unifies clinical knowledge through data aggregation, deep learning, and predictive analytics to personalize medicine, improve outcomes, and reduce re-admissions.
Founders’ story
Mizan Rahman
Our founder and CEO Mizan Rahman immigrated to the U.S. in the late 1990s seeking to turn some of his ideas, education, and experience into tangible products that solved problems for different verticals. He has successfully shepherded two companies from startup to a multi-million dollar companies that were eventually bought out.
Mizan now oversees the strategic and operational interests of the company worldwide combining his software engineering experience and entrepreneurial leadership with comprehensive international market intelligence to solve customer problems through identity solution ingenuity. He has successfully shepherded the growth of M2SYS as a global force in identity management, pioneering the development and launch of M2SYS’ Bio-Plugin biometric middleware and Hybrid Biometric Platform – both of which were recognized by Frost and Sullivan with prestigious awards for their design innovation.
Mizan continues to be recognized for his innovation and leadership in the field of biometric identification technology, most recently as recipient of “Technology Innovator of the Year” by InfoWorld. He is a frequent speaker in many US and international conferences, symposiums and universities such as the International Biometric Conference and MIT.
Guest post by Ken Perez, vice president of healthcare policy, Omnicell.
Ken Perez
We’ve often seen the U.S. federal government announce its intent to drive major changes in the way the healthcare system is run, only to have the private sector respond in a tepid or negative manner.
That was not the case at a January 26 Department of Health and Human Services meeting, at which HHS Secretary Sylvia M. Burwell announced concrete goals and an aggressive timeline for moving Medicare payments from fee for service to fee for value. Nearly two dozen leaders representing consumers, insurers, providers and business leaders were in attendance and clearly supportive of the vision cast by Burwell. Notably, high-ranking representatives from the American Academy of Family Physicians, the American Medical Association, the American Hospital Association, and America’s Health Insurance Plans (AHIP) were among the participants.
The announcement was a landmark one. For the first time in the history of the Medicare program, HHS has communicated quantified goals for pushing a significantly greater share of Medicare payments through alternative payment models, such as accountable care organizations (ACOs) and bundled payments. Such payments will rise from 20 percent ($72.4 billion) of Medicare payments in 2014 to 30 percent ($113 billion) in 2016 and 50 percent ($213 billion) in 2018—a compound annual growth rate of 31 percent over the five-year period.
The Usability People
