[ Thursday, June 28, 2007 ]
The state of electronic medical records in Tennessee: as you might
expect, more adoption in urban areas than rural areas.
Jeff [12:58 PM]
New Link: I've added a link on the left for a
prescription drug encyclopedia put together by the
European Organisation of Family Health Research, if you're interested in that sort of thing.
Jeff [12:51 PM]
[ Wednesday, June 27, 2007 ]
Crisis? Some people consider the low adoption rate of electronic medical records in the US by healthcare practitioners to be a "crisis." It's probably primarily a cost/benefit issue, compounded by a a few additional factors: adoption issues by frontline workers (how disruptive will this be to my high-school-educated staff?), overall cost (sure the basic system costs $X, but what about upgrades/patches/service?), interoperability and platform issues (Betamax?, or for the younger crowd, Blu-Ray or HD-DVD?), and efficacy (I know how to find information in paper records, will I be able to find it in my EMR?), all of which are, at heart, cost/benefit issues.
Another issue that's a little less of a cost-benefit issue is the security issue. HIPAA's privacy and security regulatory matrix came about because the feds figured if they were going to push people to use electronic data interchange, they would be raising the risk profile due to the electronic nature of the information and its transit in cyberspace. Electronically stored and transmitted info is at substantially more risk than info on paper, since it can be intercepted, viewed, and analyzed much more efficiently and stealthily than paper records. People are nervous about data breaches and privacy issues, and some of those people are patients of some of those providers.
That's also a cost/benefit decision. Aren't they all, ultimately?
Jeff [8:45 AM]
[ Tuesday, June 26, 2007 ]
NPI confusion: I recently had lunch with a client who told me that her local medical society was advising local physicians to closely guard their MPIs. I gotta say, I don't understand this. Physicians who see a patient pursuant to a referral will need the NPI of the referring physician to get paid. I believe CMS even used the tag line, "get it, use it, share it" to encourage providers to get signed up. There's even
this FAQ for the question, "with whom should I share my NPI?" Still, however, some providers think they need to protect their NPI like it's their social security number (most of those physicians also use their patients' social security numbers for their patient identifiers, too).
Anyway, CMS is
about to publish in the
Federal Register the information it will make available to the general public under the Freedom of Information Act out of the NPI applications of all providers. Except for social and DOB, everything, including the NPI itself, is available to the general public. So stop trying to keep it a secret!
Jeff [3:16 PM]
Hospital Sues Blogger: I heard about
this last Thursday from
Bob Coffield (himself a
blogger), but I was on vacation and didn't get a chance to post on it. I've also tried to dig up some more information out of that neck of the woods (Paris, Texas, a little northeast of here), but haven't been able to find out too much. Basically, a
blogger has been running a "
gripe site," a particular internet bugaboo of many businesses. The site has been harshly critical of Paris Regional Medical Center and its corporate parent, Essent Healthcare, as well as individual managers, it seems.
Well, the Empire has
struck back(subscription required here): Essent and PRMC have sued the unknown blogger for defaming the hospital and violating HIPAA (I haven't seen the pleadings -- c'mon, I've been on vacation, and it's tough getting back on track here with all that's piled up -- but I assume the suit is filed against a "John Doe;" the judge has ordered the cable internet provider to disclose the name and mailing location of the blogger within 20 days). On the defamation claim, I don't know about that. On the HIPAA claim, I've only read the linked articles and a bit of the blog (and its internal defensive arguments), but would note the following:
- It's not clear what the alleged HIPAA violations are, but presumably the Hospital has alleged that the blogger (or an employee feeding the blogger information) disclosed protected health information on the blog in the process of griping. I perused the site and didn't see anything that looked like PHI, but I didn't really read it that closely (sorry, the constant griping and nastiness of the site sorta depresses me). One post involves someone talking about care a family member received, which may or may not be an improper disclosure.
- The blogger, if s/he isn't a "covered entity," can't violate HIPAA. The employee is more likely to be a covered entity, and could (as in the Gibson case) be found guilty of a HIPAA violation even though s/he's not exactly a covered entity. The Hospital definitely is a covered entity, can violate HIPAA, and can be liable for an employee who violates HIPAA in a handful of situations (at least according to AUSA Pete Winn, who is one of the DOJ folks who pursue these types of things). If the disclosure is a HIPAA violation by any of the various parties, then others could potentially be found guilty on aiding and abetting grounds. So, there's some tenuousness there.
- There's no private cause of action under HIPAA, so the Hospital can't technically sue anybody for violating HIPAA. However, the Hospital can presumably sue for tort damages and base the claim on the fact that the actions of the tortfeasor were criminal in nature.
- The Hospital does seem to have confidentiality agreements with its employees, which could've been violated by the disclosure by employees to the blogger (or, if the blogger is an employee, but the blog posting). That's a different animal.
This will be an interesting case to watch.
Jeff [2:21 PM]
It's not just healthcare: for what it's worth, almost half of IT managers, according to a recent
survey, don't think their companies do enough computer security and don't think their companies could notify customers or otherwise recover from a severe data breach. That's inside and outside the healthcare arena. They also think the problem is getting worse, not better.
Jeff [2:11 PM]
CMS to Evaluate EHRS offered by other Payors: Four health plans (Kaiser, University of Pittsburgh, Humana and HIP) have
agreed to make the EHRs they offer to their commercial beneficiaries available to their Medicare beneficiaries as well, through the
CMS portal, so that CMS can track the usage and get a handle on what works best for Medicare beneficiaries. Of course, we're talking generally about an older population engaging in internet exchanges, but that's always going to be the case with any EDI or similar issue; no product or program is going to work for everyone. Beneficiaries choose to participate and choose who can access the information, which should alleviate some of the concerns of the "out there" privacy mavens.
We'll see how it goes. I suspect we'll eventually end up with a handful of on-line EHR providers and a handful of smart-card type EHR providers, probably with some crossover relationships as well (so you can sync your smart-card with your on-line EHR).
Jeff [11:15 AM]
[ Friday, June 22, 2007 ]
Another payor-sponsored EHR: This time, it's the Memphis Managed Care Corporation teaming up with MEDecision to offer beneficiaries a unified place to keep all of their physician and hospital records, lab tests, etc. The product is MEDecision's Patient Clinical Summary (PCS). You can't tell from the
press release, but if participation by beneficiaries is voluntary, it would be a nice set-up: folks worried about the privacy implications can simply not participate. Although I wonder if, sorta like the arguments against privatizing Social Security, that voluntary component will be thrown under the bus by privacy Nazis.
Jeff [9:15 AM]
[ Wednesday, June 20, 2007 ]
JPD in the News: Not really, but I did give an online interview on Monday to Lora Bentley of IT Business Edge, an IT news aggregator, about HIPAA and the Piedmont audit. The brief interview is posted
here, and Lora blogs about our exchange
here.
Jeff [7:27 PM]
24 Questions: The HIPAA world is abuzz today (sorry, I was on a plane today, so I'm just now getting to it) with
rumors of a leaked document from the government in the Piedmont Hospital case in Georgia. Allegedly, the document contains 24 questions from the government addressed to Piedmont, making up the central core of OCR's audit. It would be a very, very good idea to look at these questions, which primarily involve requests for proof of policies and procedures in place for some pretty standard HIPAA security matters. If your organization wouldn't be able to quickly and fully respond to these questions, you got some work to do. Not just for HIPAA purposes; some of these are good general information security requirements.
Jeff [7:19 PM]
[ Tuesday, June 19, 2007 ]
Indiana RHIO: Here's an interesting
article on the regional health information exchange for Indianapolis. You can't argue with the benefits, but it's worth noting that the possibility of a bad actor at one of the contact entities looking at information they shouldn't definitely expands when the number of people with access expands.
Jeff [8:14 AM]
[ Monday, June 18, 2007 ]
Smart-Card EHRs: It seems that tere are at least two competing technology platforms for EHRs: the server-based type and the portable type. The insurance company supported EHRs discussed in the previous post will reside on a server that beneficiaries can access via passwords (and presumably let their physicians access). Here's
an article on the "smart card" type of EHRS. Each has obvious benefits: the smart card is more secure (Do you trust your insurance company not to dig into your EHR looking for reasons to drop you? How secure do you think their password protection is?), but if you leave it in your other pants or in the glove box of your car and you're in an accident and unable to tell the caregivers where it is, it's not much good. Both may be viable technologies, since that will give the public the opportunity to choose their own "security vs. information exchange" tradeoff.
Jeff [11:06 AM]
PHR Access vs. Privacy: At personal health records begin to roll out, particularly as insurance companies and others make them available to beneficiaries, the policy arguments between privacy advocates and those pushing for better care through better information exchange are starting to be
hashed out. That's good, since it's important to talk about these things if there's going to be a proper balance.
Jeff [11:02 AM]
EHR Standards: HL7, a healthcare standards organization, has
released a profile of the structural requirements for an electronic health record. To the extent standardization aids in commercial development and usage, this should move EHR's along. However, the continuing issue will be privacy versus access.
Jeff [8:13 AM]
[ Thursday, June 14, 2007 ]
Virginia Tech Report faults privacy law threats: The US Departments of Justice, Health and Human Services, and Education
jointly produced a
report at the request of President Bush outlining the causes and issues raised by the Virginia Tech massacre. One issue clearly raised is the (real or perceived) inability of law enforcement, healthcare, and school officials to share information on the mental health of individuals. Some of the hesitancy to share information is accurate -- HIPAA and other laws do (rightly) restrict the ability of some people to share information. But some of the hesitancy is based on fear and ignorance, since in some instances there is no legal restriction on sharing the information.
Ultimately, this is the dichotomy and dilemma at the heart of medical information privacy: Absolute privacy is detrimental to health and safety, and finding a balance between privacy and health/safety isn't easy, because the balance point is different in just about every case.
Jeff [10:34 AM]
[ Wednesday, June 13, 2007 ]
1,000 Posts: What do you know, this is the 1,000th post on the HIPAA Blog. And I'm still on vacation. Sorry I don't have a fish picture to post.
Jeff [9:53 PM]
Ohio Hospital Network Sets up Web-Based EHR for Employees: Kettering Health Network in Dayton has set up a
web-based EHR for its employees who are insured by Anthem BC/BS. Participation is optional, naturally.
Jeff [9:49 PM]
[ Monday, June 11, 2007 ]
Electronic Health Records and Privacy: more
discussion of the inherent conflict.
Jeff [10:03 AM]
[ Tuesday, June 05, 2007 ]
EHRs: here's an
OpEd piece in the NY Times arguing that EMRs oughta be in place. All valid points. As long as you don't care about the privacy or security of the information . . . .
Jeff [11:50 AM]
Another Hospital Data Breach: Here's
another one from the Pacific northwest. Stevens Hospital in Seattle inadvertently allowed web access to about 500 patients' records, including social security numbers, due to a subcontractor's error.
Jeff [11:46 AM]
Personal Health Records -- Risks and Benefits: While waiting for a conference call this morning, I was going through some ModernHealthcare's that had stacked up in my inbox (with their "Daily Dose" emails every day, I'm not as careful to get through the print edition in a timely fashion), and saw a great article on PHRs and why doctors are a little leery of them. Unlike an Electronic Medical Record, which is the physician's or hospital's medical file turned into electronic format, a PHR is a load of patient data that can contain all types of personal information about the patient that wouldn't appear in a physician's office file (or at least not in the office files of every physician that has seen that patient). It is more a "personal" record. Imagine a card in your wallet with a chip in it (or even a chip implanted in your skin) that contains information on your allergies, current prescriptions, past medical history, and the like; it could contain information from lots of different doctors, and even information that no doctor might have (over the counter medication or supplements you take, for example). That would be very helpful if you were in an auto accident and couldn't communicate with the ER staff. But on the downside, if you show up with hundreds of pages worth of information, the ER physicians might have to spend more time reading your past history of pink-eye and childhood tonsilectomies to make sure there's nothing hidden in the PHR that would come back to bite them if something went wrong (which often happens with ER patients).
There's also the issue of GIGO (garbage in, garbage out); if the PHR contains bad information (or even extraneous information, since in some situations every second counts), it could result in worse care than if there were no PHR to start with.
Anyway, the two part article (
here and
here) is definitely worth a read.
Jeff [9:08 AM]
[ Monday, June 04, 2007 ]
Social Security Administration Privacy Policies: It seems the Social Security Administration has decided to re-codify its
internal privacy policies, since they haven't done so since the Carter Administration. Basically, it's just a recitation of the rights of a citizen who is in contact with the SSA, for example a benefit recipient.
Jeff [10:42 AM]
[ Friday, June 01, 2007 ]
Private Causes of Action under HIPAA: I think it's pretty clear at this point that there's no private cause of action for a patient to sue a doctor or hospital for a HIPAA violation. But as I've noted time and again, that doesn't mean that providers can willy-nilly breach HIPAA and only have to worry about what the relatively-inert OCR might do; the HIPAA privacy and security standards are effectively delineated standards-of-care, and a failure to meet that standard might not allow a lawsuit for the breach of HIPAA, but might be proof in a lawsuit for some other tort related to the failure to meet the standard of care. In fact, according to the
National Law Journal, hospitals and physicians have figured this out, and are concerned.
Two comments: this isn't anything I'm hearing from my clients and other contacts. I think everyone knows that HIPAA's out there, and they are aware that the downside from a breach will be much bigger if it's the patient that sues rather than OCR pursuing a complaint. So this isn't new news. And I also think it's pretty well accepted that even though the patient may have a private cause of action under a breach-of-duty claim, the patient would have to (i) prove the HIPAA violation to prove the failure to meet the standard of care, and (ii) show actual damages. The fact is that unless identity theft comes into play (in which case the healthcare nature of the lost data is pretty much irrelevant), most losses of medical data don't usually cause much damage to the patient.
Jeff [2:11 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
