As IT departments throughout the country work to protect the privacy of and ensure the data integrity of patient records, it's important to understand the threats we all face.
Websense has issued their 2012 threat report, which I recommend you download and read (it's free)
You'll discover that in 2012
• 82% of web-based malware is hosted on compromised legitimate hosts
• 55% of data-stealing malware communications are web-based
• 43% of the activity inside of Facebook is categorized as streaming media
• 60% of phishing attacks are hosted in the United States
• 36% of malware is hosted in the United States
IT departments are challenged with protecting security with sometimes unpopular policies and difficult to use technologies. It's very cool to see the 2012 threat report which validates the work we have to do.
Friday, April 27, 2012
Thursday, April 26, 2012
Our Cancer Journey Week 19
Last week, Kathy's oncologists made the decision to stop Taxol chemotherapy permanently because Kathy has lost so much function in her hands and feet. Yesterday Kathy had a diagnostic mammogram and breast MRI to evaluate the impact of her treatment on the tumor. We'll now move to the next phase of treatment decision making. Will she benefit from any additional chemotherapy or can we move on to surgery, either lumpectomy or mastectomy?
It's been three weeks since Kathy last received Taxol and sensation is beginning to return to her 4th and 5th fingers. Her thumbs, 2nd and 3rd fingers, and palms are still too numb to feel a pin prick. Taxol affects each patient differently. The degree of numbness, the recovery between treatments, and the amount of permanent disability are highly variable. Kathy's clinicians believe she is among the most sensitive patients to Taxol.
Chemotherapy is not a precise science. There is no controlled trial that suggests 5 cycles of Taxol are insufficient and 9 cycles are perfect. For Kathy, the 5 cycles she received may have given her the best balance of benefit and risk.
Given that chemotherapy was stopped, an objective analysis of the tumor is important. Does she have residual cells or has all 5 centimeters of the tumor disappeared?
Here's her mammography report:
Left breast with two clips, no visible mass, left axilla scar, skin thickening
Impression - resolution of tumor mass since 12/2011
The radiologist reading the study called the result "miraculous"
We'll have an interpretation of her MRI tomorrow.
Our next step is to confer with her care team and decide if there is any benefit to additional chemotherapy, such as a final cycle of Adriamycin/Cytoxan. Kathy's hair is beginning to grow back (described by her as gray/white peach fuzz) and her body is starting to recover from weeks of intravenous poisons. Her liver enzymes were elevated modestly last week, likely due to the Taxol, providing further evidence that chemotherapy drugs are not benign. She'd prefer to close the chemotherapy chapter and move on to surgery as soon as possible. During this entire process, it was not the loss of a breast that was her greatest concern, but the cumulative effect of chemotherapy on her mind, body, and spirit. It would be good to declare the chemotherapy process finished.
In the upcoming days, we'll finalize a go forward plan. It may be that lumpectomy in May followed by radiation this Summer will be our final steps on this journey. More to come!
It's been three weeks since Kathy last received Taxol and sensation is beginning to return to her 4th and 5th fingers. Her thumbs, 2nd and 3rd fingers, and palms are still too numb to feel a pin prick. Taxol affects each patient differently. The degree of numbness, the recovery between treatments, and the amount of permanent disability are highly variable. Kathy's clinicians believe she is among the most sensitive patients to Taxol.
Chemotherapy is not a precise science. There is no controlled trial that suggests 5 cycles of Taxol are insufficient and 9 cycles are perfect. For Kathy, the 5 cycles she received may have given her the best balance of benefit and risk.
Given that chemotherapy was stopped, an objective analysis of the tumor is important. Does she have residual cells or has all 5 centimeters of the tumor disappeared?
Here's her mammography report:
Left breast with two clips, no visible mass, left axilla scar, skin thickening
Impression - resolution of tumor mass since 12/2011
The radiologist reading the study called the result "miraculous"
We'll have an interpretation of her MRI tomorrow.
Our next step is to confer with her care team and decide if there is any benefit to additional chemotherapy, such as a final cycle of Adriamycin/Cytoxan. Kathy's hair is beginning to grow back (described by her as gray/white peach fuzz) and her body is starting to recover from weeks of intravenous poisons. Her liver enzymes were elevated modestly last week, likely due to the Taxol, providing further evidence that chemotherapy drugs are not benign. She'd prefer to close the chemotherapy chapter and move on to surgery as soon as possible. During this entire process, it was not the loss of a breast that was her greatest concern, but the cumulative effect of chemotherapy on her mind, body, and spirit. It would be good to declare the chemotherapy process finished.
In the upcoming days, we'll finalize a go forward plan. It may be that lumpectomy in May followed by radiation this Summer will be our final steps on this journey. More to come!
Wednesday, April 25, 2012
Five IT Tactics of an Accountable Care Organization
I recently presented a webinar outlining the the IT work ahead to support Accountable Care Organizations.
Here are the slides that I used.
I recommended five priorities to create a foundation for care management and population health:
1. Universal adoption of EHRs - every clinician in an ACO needs to record data electronically, ideally using the same EHR vendor. If not the same EHR, then using common pick lists/vocabularies enables data to be comparable across practices. At BIDMC we created a model office workflow to ensure data is recorded by individuals with the same role at the same time in the same processes using the same value sets.
2. Healthcare Information Exchange - data should be shared among caregivers for care coordination and panel management. Approaches can include viewing data in remote locations, pushing summaries between providers, or pulling summaries from multiple sites of care. BIDMC has created novel approaches to secure data sharing as well as participated in many federal and state HIE pilots.
3. Business Intelligence/Analytics - once data is collected and shared, it needs to be analyzed retrospectively to identify gaps in care and prospectively to ensure patients receive the right care at the right time during their encounters with clinicians. BIDMC has worked with the Massachusetts eHealth Collaborative to create a community-wide quality data center as well as piloted popHealth to support our analytic needs.
4. Universal availability of PHRs - engaging patients and families in their care, ensuring communication of care plans and achieving seamless handoffs, is essential to keeping patients well. BIDMC has offered comprehensive PHRs to all of its patients since 1999.
5. Decision Support Services - care management requires alerts, reminders, pathways, and guidelines. Ideally, all members of the care team will receive decision support inside their electronic record based on enterprise rule sets. At BIDMC, we've used the concept of Decision Support Service Providers to to turn data into knowledge and wisdom inside our EHRs and web applications.
Of these five tactics, the biggest challenge is defining the care management rules - what conditions, wellness measures, home care interventions, best practices, and evidence should be incorporated into the point of care and analytic systems? Yesterday, at the BIDMC Clinical IT Governance Committee, we agreed to to charter a working group of experts to set these priorities so that our care management strategy is well planned and not a random collection of individual projects, driven by individuals with specific niche requirements (squeaky wheels or siloed departmental requests). It's a good start.
Here are the slides that I used.
I recommended five priorities to create a foundation for care management and population health:
1. Universal adoption of EHRs - every clinician in an ACO needs to record data electronically, ideally using the same EHR vendor. If not the same EHR, then using common pick lists/vocabularies enables data to be comparable across practices. At BIDMC we created a model office workflow to ensure data is recorded by individuals with the same role at the same time in the same processes using the same value sets.
2. Healthcare Information Exchange - data should be shared among caregivers for care coordination and panel management. Approaches can include viewing data in remote locations, pushing summaries between providers, or pulling summaries from multiple sites of care. BIDMC has created novel approaches to secure data sharing as well as participated in many federal and state HIE pilots.
3. Business Intelligence/Analytics - once data is collected and shared, it needs to be analyzed retrospectively to identify gaps in care and prospectively to ensure patients receive the right care at the right time during their encounters with clinicians. BIDMC has worked with the Massachusetts eHealth Collaborative to create a community-wide quality data center as well as piloted popHealth to support our analytic needs.
4. Universal availability of PHRs - engaging patients and families in their care, ensuring communication of care plans and achieving seamless handoffs, is essential to keeping patients well. BIDMC has offered comprehensive PHRs to all of its patients since 1999.
5. Decision Support Services - care management requires alerts, reminders, pathways, and guidelines. Ideally, all members of the care team will receive decision support inside their electronic record based on enterprise rule sets. At BIDMC, we've used the concept of Decision Support Service Providers to to turn data into knowledge and wisdom inside our EHRs and web applications.
Of these five tactics, the biggest challenge is defining the care management rules - what conditions, wellness measures, home care interventions, best practices, and evidence should be incorporated into the point of care and analytic systems? Yesterday, at the BIDMC Clinical IT Governance Committee, we agreed to to charter a working group of experts to set these priorities so that our care management strategy is well planned and not a random collection of individual projects, driven by individuals with specific niche requirements (squeaky wheels or siloed departmental requests). It's a good start.
Tuesday, April 24, 2012
Managing Distributed Authentication
As the nation begins its pilots of pioneer Accountable Care Organizations and shares more data for care coordination and population management, IT departments will be asked to make clinical records available to increasing numbers of loosely affiliated clinicians and staff.
The challenge will be managing the authentication and authorization of a diverse population of legitimate users.
BIDMC stakeholders met this week to discuss best practices for managing distributed authentication while protecting privacy. We suggested three approaches:
1. Use well defined rules to approve new accounts for external organizations in addition to implementing robust audit systems for monitoring account use
As clinical relationships become increasingly complex, it is no longer sufficient to use staff/credentialing privileges as the gating factor for creating accounts with clinical access rights. Organizational legal relationships (agreements signed between entire organizations), chain of command sponsorship (MD leadership at an organization requests access for appropriate clinicians), and patient referral patterns (coordination of care requires specific team member access) are all valid reasons for authorizing users. Since management of accounts across organizations is challenging, it is important to review audit trails via automated and manual methods, enforcing minimal need to know and appropriate clinical data use policies. We already use a variation of this approach for those external clinicians caring for BIDMC patients who need access to our read-only web-based provider portal.
2. Federated authentication
Although one organization can issue credentials to employees of affiliates, it is challenging to monitor changes in the status of users at outside organizations. What if a clinician's role changes or they leave? If one organization trusts the credentials of another organization, a federated approach can provide more timely oversight of access rights. At Beth Israel Deaconess, we've created a technology that enables EHRs at outside organizations to access records of patients shared in common with BIDMC - the "magic button". A trusted associated organization manages clinical access to its own systems, and then grants those authorized users rights to BIDMC records for only those patients registered at the local site and BIDMC. Although comprehensive legal agreements to enable this approach take time to create, the benefit is better account oversight when roles change at outside organizations.
3. State HIE trust fabric
Approaches 1+2 work well for clinician access to provider portals. For State HIE approaches that involve pushing data between organizations, another approach is possible - using certificates to create a trust fabric for the entire community. As part of the Massachusetts HIE infrastructure, we're creating directories and security certificates that enable any provider to securely transmit content to any other provider with patient consent. Processes are created to issue certificates to trusted organizations which sign Data Use and Reciprocal Support Agreements (DURSA). Once the security infrastructure and agreements are in place, any clinician can leverage the community trust fabric, using their existing EHRs and organizational credentials, to send data to another clinician.
Accountable Care Organizations and integrated delivery networks have the challenge of sharing more data at the same time that the regulatory/compliance environment requires greater security. These three approaches are all useful tactics for the authentication and authorization management improvements we will all have to make in the months ahead.
The challenge will be managing the authentication and authorization of a diverse population of legitimate users.
BIDMC stakeholders met this week to discuss best practices for managing distributed authentication while protecting privacy. We suggested three approaches:
1. Use well defined rules to approve new accounts for external organizations in addition to implementing robust audit systems for monitoring account use
As clinical relationships become increasingly complex, it is no longer sufficient to use staff/credentialing privileges as the gating factor for creating accounts with clinical access rights. Organizational legal relationships (agreements signed between entire organizations), chain of command sponsorship (MD leadership at an organization requests access for appropriate clinicians), and patient referral patterns (coordination of care requires specific team member access) are all valid reasons for authorizing users. Since management of accounts across organizations is challenging, it is important to review audit trails via automated and manual methods, enforcing minimal need to know and appropriate clinical data use policies. We already use a variation of this approach for those external clinicians caring for BIDMC patients who need access to our read-only web-based provider portal.
2. Federated authentication
Although one organization can issue credentials to employees of affiliates, it is challenging to monitor changes in the status of users at outside organizations. What if a clinician's role changes or they leave? If one organization trusts the credentials of another organization, a federated approach can provide more timely oversight of access rights. At Beth Israel Deaconess, we've created a technology that enables EHRs at outside organizations to access records of patients shared in common with BIDMC - the "magic button". A trusted associated organization manages clinical access to its own systems, and then grants those authorized users rights to BIDMC records for only those patients registered at the local site and BIDMC. Although comprehensive legal agreements to enable this approach take time to create, the benefit is better account oversight when roles change at outside organizations.
3. State HIE trust fabric
Approaches 1+2 work well for clinician access to provider portals. For State HIE approaches that involve pushing data between organizations, another approach is possible - using certificates to create a trust fabric for the entire community. As part of the Massachusetts HIE infrastructure, we're creating directories and security certificates that enable any provider to securely transmit content to any other provider with patient consent. Processes are created to issue certificates to trusted organizations which sign Data Use and Reciprocal Support Agreements (DURSA). Once the security infrastructure and agreements are in place, any clinician can leverage the community trust fabric, using their existing EHRs and organizational credentials, to send data to another clinician.
Accountable Care Organizations and integrated delivery networks have the challenge of sharing more data at the same time that the regulatory/compliance environment requires greater security. These three approaches are all useful tactics for the authentication and authorization management improvements we will all have to make in the months ahead.
Monday, April 23, 2012
Common Terminology Services
The HIT Standards Committee has tirelessly focused on content, vocabulary and transport standards. When it comes to vocabularies, they've tried to do three things
1. Select one vocabulary per domain of medicine (problems, medications, laboratories, demographic elements, structured data questionnaires etc.), which they've achieved n the 2014 edition of the standards and certification NPRM recommendations.
2. Recommend that the National Library of Medicine is the optimal organization for doing content review of value sets, offering feedback to value set and measure developers.
3. Recommend that a government "value set hosting entity" distribute all the necessary vocabularies and code sets, making them available for download or real time query.
For #3, we'll need a body of standards to enable the sharing of value sets. From our investigation thus far, the Common Terminology Services (CTS) family of standards seems like the leading candidate to enable automated exchange of vocabulary resources.
What is CTS?
It is the work of some 20 years, merging early terminology services work (Pathak, et al; LexGRID, JAMIA) and the 3M/Intermountain work into the LexGrid environment . It has evolved through three standards organizations CTS1 (in HL7 and ISO) and CTS2 (in the Object Management Group). It is now an industry standard through OMG.
What does it do?
The core principle is that we should not have different ways (Custom programming, REST protocols, SPARQL queries , etc) of accessing terminologies. CTS2 is a unifying access method for terminologies, and ontologies that is an Application Programming Interface (API) specification, and easily deployed through REST or SPARQL queries. It supports things as simple as word/code pairs, and full ontologies such as OWL. It forms the backbone of the National Center for Biomedical Ontologies (NCBO) and earlier versions of at the National Cancer Institute LexEVS services. General Electric has adopted it, as the core terminology services in their work with Intermountain Healthcare (Huff et al). The specification is public and an open-source reference implementation will soon be available. Any company or group is free to establish as CTS2 service.
NLM is working on CTS2 support for its terminology services.
Although you may not have heard of CTS, it will be an important mechanism for EHRs to download and query the curated vocabularies and code sets required for Meaningful Use in 2014 and beyond.
Thanks to Chris Chute and the folks at Mayo for briefing me about it.
1. Select one vocabulary per domain of medicine (problems, medications, laboratories, demographic elements, structured data questionnaires etc.), which they've achieved n the 2014 edition of the standards and certification NPRM recommendations.
2. Recommend that the National Library of Medicine is the optimal organization for doing content review of value sets, offering feedback to value set and measure developers.
3. Recommend that a government "value set hosting entity" distribute all the necessary vocabularies and code sets, making them available for download or real time query.
For #3, we'll need a body of standards to enable the sharing of value sets. From our investigation thus far, the Common Terminology Services (CTS) family of standards seems like the leading candidate to enable automated exchange of vocabulary resources.
What is CTS?
It is the work of some 20 years, merging early terminology services work (Pathak, et al; LexGRID, JAMIA) and the 3M/Intermountain work into the LexGrid environment . It has evolved through three standards organizations CTS1 (in HL7 and ISO) and CTS2 (in the Object Management Group). It is now an industry standard through OMG.
What does it do?
The core principle is that we should not have different ways (Custom programming, REST protocols, SPARQL queries , etc) of accessing terminologies. CTS2 is a unifying access method for terminologies, and ontologies that is an Application Programming Interface (API) specification, and easily deployed through REST or SPARQL queries. It supports things as simple as word/code pairs, and full ontologies such as OWL. It forms the backbone of the National Center for Biomedical Ontologies (NCBO) and earlier versions of at the National Cancer Institute LexEVS services. General Electric has adopted it, as the core terminology services in their work with Intermountain Healthcare (Huff et al). The specification is public and an open-source reference implementation will soon be available. Any company or group is free to establish as CTS2 service.
NLM is working on CTS2 support for its terminology services.
Although you may not have heard of CTS, it will be an important mechanism for EHRs to download and query the curated vocabularies and code sets required for Meaningful Use in 2014 and beyond.
Thanks to Chris Chute and the folks at Mayo for briefing me about it.
Friday, April 20, 2012
Cool Technology of the Week
Here's the engineering challenge - how do you make an infrared heat lamp secure (so that it does not fall into the brooder and start a fire), yet infinitely adjustable so that it be can be raised and lowered easily to adjust the temperature?
The answer - a locking, ratcheted pulley system.
I secure my racing kayak to my Prius roof rack using the Thule Quick Draw which includes a carabiner, S-hook, and rope ratcheting pulleys.
Now, our heat lamp is secured to an overhead pipe via 8 feet of nylon rope and a ratchet. Just pull on the rope to securely raise the lamp - it cannot fall. To lower, release the ratchet button.
I have a digital thermometer inside the brooder as general guidance, but watch the chicks behavior for a more accurate assessment of their comfort. If they are clustered together for warmth, I lower the lamp two inches. If they are separated and hiding in the corner of the brooder to cool down, I raise the lamp two inches. At this point, they're eating, drinking, and peeping comfortably - a glorious first week of chicken life.
A safe, easy to adjust brooder heat control using a ratcheted pulley system from my Thule rack. That's cool.
Thursday, April 19, 2012
Our Cancer Journey Week 18
On Friday, after careful consideration, the BIDMC oncologists elected not to treat Kathy because her side effects from Paclitaxel (Taxol) were so severe - increasing pain and numbness in her hands and feet. She cannot hold a pencil, use a paintbrush, or eat with chopsticks. She has to nap mid day because of fatigue caused by constant neuropathic pain. Thus far, the Vitamin B6 has not helped and her clinicians recommended Gabapentin (Neurontin) to reduce the discomfort. She's not enthusiastic about masking symptoms. She'd prefer to monitor her body's progress objectively.Kathy's attitude toward cancer treatment is aggressive - "poison me today for a cure tomorrow". She can accept short term pain for long term gain. The problem with neuropathy is that it may be permanent. She admits that permanent loss of her ability to create art or feel the difference between silk and sandpaper is challenging to accept.
Tomorrow, her clinicians will evaluate her progress and consider several options:
*Stop chemotherapy and await the results of the April 25 imaging studies. She may already be treated sufficiently
*Continue chemotherapy with an agent similar to Paclitaxel called Docetaxel (Taxotere)
*Stop the entire class of Taxane therapies and return to a cycle of Adriamycin/Cytoxan since that seemed to work so well in her early therapy
There are many possibilities and we're confident that all will be well.
Last Saturday we visited the Erikson Grain Mill, a family operated supplier of feeds for chickens, horses, and other farm animals. As luck would have it, a customer just cancelled their order for six Araucana/Ameraucana chicks (photo above). Moments after we arrived another family offered to adopt them, but we had already made up our minds. On Saturday at 2pm we became chicken farmers. Our young hens are enjoying the warmth and security of their new brooder (a Rubbermaid 37 gallon storage container), infrared lamp, and feeder. While at Erikson's we ordered the remainder of our 2012 coop population - 2 Buff Orpingtons, 2 Brahmas, and 2 Jersey Giants.
There's one other addition to our property that will begin life in our coop but then free range - Guinea Fowl. I've had Lyme disease twice and the Guinea Fowl are well known tick eaters. They'll start in our brooder for 6 weeks, live in the coop for 6 additional weeks, then we'll let them free range over our 15 acres, training them to return to the coop at night for safety.
Although Kathy's hands and feet are numb, she's very capable of caring for the new additions to our lives. Our move preparations are nearly complete so she can turn her attention to our next life phase. It's much more enjoyable to design the ideal coop for a small flock of chickens than to focus on the short term disability caused by cancer treatment. There are even a few chick brooder engineering problems for me to solve. More about that in tomorrow's post.
Subscribe to:
Posts (Atom)
