I've recently been asked to describe our approach to security timeouts for clinical applications. Maintaining confidentiality of healthcare data is a balance between ease of use and bullet proof security. In an ultimately secure configuration, all logins would require hardware tokens, timeouts would be under a minute, and no remote access would be available. Clearly, such restrictions would be very secure, but so hard to use that patient care may suffer. As an analogy, I tell my staff that the most secure library would never allow its books to be checked out.
What have we done? Virtually all our applications are web-based and we've set a 20 minute timeout for all the web applications we create. Additionally, we have a 20 minute timeout on our SSLVPN for remote access, and a 20 minute timeout for Citrix access. In our experience, 20 minute timeouts enable clinicians to login, check results, talk to patients, complete a note, write prescriptions, and keep the office running without requiring a frustrating number of logins each day.
The one area where we've used a different approach is the fast paced Emergency Department.
The ED is a challenging computing environment - dozens of users are sharing relatively few machines for just a few minutes at a time. Interruptions are common and although we reinforce the importance of logging off, a security model cannot rely on people remembering to do that. The computer must determine whether the authenticated user is still present and if not, it must restrict access to private data.
Ideally, the computer would use physical detection such as face recognition or signals from an RFID chip on (or in) the user. However, widespread implementation of these systems is complex and expensive, so in most cases the computer must try to infer user presence from available data.
The ED Dashboard is a web based application that uses javascript to detect mouse movement and typing. If three minutes go by without the user moving the mouse or typing a key it will assume they have left and close the browser's window, hiding all PHI. To avoid closing the window on a user who is still working, there is an indicator that shows the countdown and slowly blinks when 30 seconds remain. As the time approaches zero, the blinking becomes faster and more frenetic in an attempt to catch the eye of the user, if they are still present. A simple twitch of the mouse is all that's needed -- that resets the timer back to three minutes. If the user does not respond in the allotted time, the system initiates a log off sequence that first saves their work before closing the window.
For the current application and use, three minutes strikes the right balance-- if the user is actively working on the computer, the timer will invisibly reset as a side-effect of their work. If they are sitting and reading a note or talking, then wiggling the mouse once every few minutes is a minor imposition.
New functionality, such as clinical documentation and mobile computing are changing the way people use these systems, and requires re-evaluation of this setup. We are also looking at biometric login capabilities to make secure login much easier and therefore the lessen the inconvenience of timing out.
In addition to all these timeout features, we have a comprehensive access auditing system. Auditing is an often overlooked but important adjunct to timeouts. A decade ago, we began with a manual review of access made by users each month. When then implemented an automated report. We added IP location information to the report and started tracking accesses from unusual locations. Our next steps are to continue to add more systems into the audit and to enhance the sophistication of the automation. Our ultimate goal is to run nightly heuristics on log information, cross walk that data with the Active Directory logs, network logs and historical patterns to identify any accesses that look questionable for manual review.
Tuesday, December 9, 2008
Monday, December 8, 2008
Obama's Economic Plan
At 11am on Saturday December 6, President-elect Obama announced the three major pillars of his economic recovery plan: rebuild our roads/bridges, enhance our schools including broadband, and deploy electronic health records for every clinician and hospital in the US.
I've written several recent blogs about the cost of electronic health records, the state of interoperability, and my predictions for the early healthcare IT activities of the Obama administration.
I can summarize all my advice to the new administration in one sentence:
Allocate Federal funds of $50,000 per clinician to states, which will be held accountable (use it or lose it) for rapid, successful implementation of interoperable CCHIT certified electronic records with built in decision support, clinical data exchange, and quality reporting.
Not only will this improve care coordination which will lead to better healthcare value (reduced cost, enhanced quality), it will create jobs.
Just how many? For just the Beth Israel Deaconess Community Clinician project, here's the list of jobs we created:
In 2009, we will implement 150 physicians in 75 practices, or 13 physicians in 6 practices per month. The direct staff we'll need are:
Massachusetts eHealth Collaborative: 6 FTEs (5 practice consultants plus a project manager)
Concordant: 9 FTEs (5 on-site assessment/design/deployment/support, 2 technical lead/system architect, 2 project management)
eClinicalWorks: 4 FTEs (3 on-site trainers, plus part of a product specialist and a project manager)
At BIDMC, the project is run by 3 FTEs (Project Director, Technical Lead, Senior Practice Consultant)
Thus we've created 22 jobs for the rollout and support of our EHR project. Multiply this by the number of clinicians needing EHRs in the country and you'll see that the Obama plan will create tens of thousands of new high tech jobs.
When I've discussed the Obama Economic plan with my colleagues, some have said that it's too early to invest in EHRs because they are not yet standards-based or fully interoperable. I believe that commercial EHRs are good enough and as of 2008, we have many real examples of data sharing. Here are the statistics from our work in Massachusetts that includes homegrown EHRs, eClinicalWorks, GE Centricity, Next Gen, Allscripts/Misys, and Epic.
NEHEN - In 2008, we've done 60 million data exchange transactions a year from EHRs, practices management systems, and hospital information systems.
MA-Share - We've done half a million e-prescribing transactions among providers, payers and pharmacies. Every discharge from the hospital and emergency department at BIDMC generates a standards-based clinical summary which is sent electronically to PCPs and referring clinicians. In 2009, we'll expand this to include referral workflow, community to community exchange, and several additional hospitals including Children's.
Massachusetts eHealth Collaborative - We've wired three communities (Brockton, Newburyport, North Adams) with roughly 500,000 patients, 597 physicians in 142 practices in 192 sites, and 4 hospitals including hospital-based laboratories and imaging centers. North Adams went live in May 2007, Newburyport went live in September 2008, and Brockton is 40% complete. Data exchange includes problem lists, procedures, allergies, medications, demographics, smoking status, diagnoses, lab results and radiology results. Standards used include HL7 2.6, Continuity of Care Record/Document, NCPDP Script 8.1, LOINC, CPT4, ICD9, and RxNorm. Over 90% of patients have opted in for community data sharing. Over 300,000 records have been exchanged, all from existing commercial EHRs.
Thus, the EHRs are ready, the standards are harmonized, the architecture is designed, and the only barrier is political. The Obama commitment to a nationwide EHR implementation effort means that 2009 is the tipping point. Let us band together, payer, provider, employer and patient, to make it happen!
I've written several recent blogs about the cost of electronic health records, the state of interoperability, and my predictions for the early healthcare IT activities of the Obama administration.
I can summarize all my advice to the new administration in one sentence:
Allocate Federal funds of $50,000 per clinician to states, which will be held accountable (use it or lose it) for rapid, successful implementation of interoperable CCHIT certified electronic records with built in decision support, clinical data exchange, and quality reporting.
Not only will this improve care coordination which will lead to better healthcare value (reduced cost, enhanced quality), it will create jobs.
Just how many? For just the Beth Israel Deaconess Community Clinician project, here's the list of jobs we created:
In 2009, we will implement 150 physicians in 75 practices, or 13 physicians in 6 practices per month. The direct staff we'll need are:
Massachusetts eHealth Collaborative: 6 FTEs (5 practice consultants plus a project manager)
Concordant: 9 FTEs (5 on-site assessment/design/deployment/support, 2 technical lead/system architect, 2 project management)
eClinicalWorks: 4 FTEs (3 on-site trainers, plus part of a product specialist and a project manager)
At BIDMC, the project is run by 3 FTEs (Project Director, Technical Lead, Senior Practice Consultant)
Thus we've created 22 jobs for the rollout and support of our EHR project. Multiply this by the number of clinicians needing EHRs in the country and you'll see that the Obama plan will create tens of thousands of new high tech jobs.
When I've discussed the Obama Economic plan with my colleagues, some have said that it's too early to invest in EHRs because they are not yet standards-based or fully interoperable. I believe that commercial EHRs are good enough and as of 2008, we have many real examples of data sharing. Here are the statistics from our work in Massachusetts that includes homegrown EHRs, eClinicalWorks, GE Centricity, Next Gen, Allscripts/Misys, and Epic.
NEHEN - In 2008, we've done 60 million data exchange transactions a year from EHRs, practices management systems, and hospital information systems.
MA-Share - We've done half a million e-prescribing transactions among providers, payers and pharmacies. Every discharge from the hospital and emergency department at BIDMC generates a standards-based clinical summary which is sent electronically to PCPs and referring clinicians. In 2009, we'll expand this to include referral workflow, community to community exchange, and several additional hospitals including Children's.
Massachusetts eHealth Collaborative - We've wired three communities (Brockton, Newburyport, North Adams) with roughly 500,000 patients, 597 physicians in 142 practices in 192 sites, and 4 hospitals including hospital-based laboratories and imaging centers. North Adams went live in May 2007, Newburyport went live in September 2008, and Brockton is 40% complete. Data exchange includes problem lists, procedures, allergies, medications, demographics, smoking status, diagnoses, lab results and radiology results. Standards used include HL7 2.6, Continuity of Care Record/Document, NCPDP Script 8.1, LOINC, CPT4, ICD9, and RxNorm. Over 90% of patients have opted in for community data sharing. Over 300,000 records have been exchanged, all from existing commercial EHRs.
Thus, the EHRs are ready, the standards are harmonized, the architecture is designed, and the only barrier is political. The Obama commitment to a nationwide EHR implementation effort means that 2009 is the tipping point. Let us band together, payer, provider, employer and patient, to make it happen!
Friday, December 5, 2008
Cool Technology of the Week
As we prepare for compliance with Massachusetts Data Protection regulations, I've been checking out ways to encrypt, remotely manage, and track the location of mobile devices.I recently had lunch with John Livingston, CEO of
Absolute Software to discuss their laptop encryption and asset tracking solutions . I agreed to serve as a personal beta tester of their new Blackberry Computrace Mobile location tracking and data protection solution.
Here was my evaluation. On Monday, I installed the agent on my Blackberry Bold 9000 and boarded a plane for Rapid City, South Dakota. I spent the day with the board of Regional Hospital to discuss their options for EHR rollout and community connectivity throughout Western South Dakota. While sitting in a diner near Mt. Rushmore and staring into my vegan mashed potatoes, I had the sudden compulsion to drive to Devil's Tower, Wyoming (pictured above) about 100 miles away.
I left I90 at exit 199 and drove the scenic route through Hulett, Wyoming to arrive at the base of the tower at sunrise. Other than a flock of turkeys and a herd of deer, I was the only human for miles. I ran around the base passing hundreds of Native American prayer cloths and offerings. I drove back along Highway 14 through Spearfish, South Dakota to the Rapid City Airport and flew to Denver. From Denver I returned to Boston, then Wellesley, then Harvard.
The Absolute Computrace agent tracked my every move in High Plains, and my entire route to Boston and back.
The Computrace Customer Center keeps a record of all my Blackberry locations and makes it easy to track me, track my devices, report a theft, and if needed do a remote wipe of all the data on my devices.
I've given my wife and daughter a login to the site so they can track me at all times. Although the Absolute products are primarily encryption, tracking, and data protection systems, they are also a very cool geotracking system for Blackberry owners (with their consent).
Tracking my devices and tracking me on the web, that's cool!
Thursday, December 4, 2008
A Toolbox for Sustainable City Living
It's a small world and we're all connected.
A few weeks ago, I was playing my Japanese flute in a forest near my home in Wellesley. A gentleman stopped to listen and introduced himself as Gregory Peterson, a Harvard alum who owns a communications firm. He wondered if I was a musician. I explained that I was a CIO. He then asked if knew anything about Green IT. I told him that I've blogged extensively about it.
Greg introduced me to Susan Labandibar, President of Tech Networks of Boston. She, Greg and I had a vegan lunch last week at My Thai Vegan Cafe in Brookline. Susan is also a vegan and is deeply committed to sustainability in IT and in life.
We talked about Power Usage Effectiveness and measuring the energy savings of Cloud Computing/Software as a Service. We talked about thin client computing. We talked about virtualization.
I truly believe that in an era of constrained resources, rising expenses and a faltering economy, all of these issues will be increasingly important to CIOs and I expect Susan's company to be very successful.
On a personal note, Susan gave me a copy of "Toobox for Sustainable City Living" by Scott Kellogg and Stacy Pettigrew. It's available from South End Press.
I've written about lowering my impact on the planet and my dreams of a greener existence.
This book is a great primer for those seeking to move off the grid. Admittedly, some may find the recommendations a bit extreme, but I really appreciated the authors' point of view.
Although I've considered building a solar cell array on the south facing rooflines of my house, solar cells have a reasonably short lifespan and require a high level of technological sophisticated to fabricate.
Creating passive solar systems which capture the sun's light via south facing greenhouse windows, using biofuels, and building small scale wind power are ultimately more sustainable because a non-technological society can easily create and install such systems.
The book includes chapters on sustainable food strategies, water collection/purification, waste recycling, energy, and bioremediation of pollutants.
When I read this book, I really thought of Myst. Imagine a world in which the inhabitants create self sufficient communities using basic technologies in advanced ways to achieve sustainable, environmentally friendly homes.
I realize that the idea of growing your own foods, providing for your own water, harnessing your own energy, and recycling your wastes seems out of the mainstream for the 21st century. However, as resources become more constrained and the world economy seems increasingly unstable, such self sufficiency seems very forward looking. I want my daughter to inherit a planet she can thrive in, so I will pursue sustainability in my own incremental way, for the rest of my life.
A few weeks ago, I was playing my Japanese flute in a forest near my home in Wellesley. A gentleman stopped to listen and introduced himself as Gregory Peterson, a Harvard alum who owns a communications firm. He wondered if I was a musician. I explained that I was a CIO. He then asked if knew anything about Green IT. I told him that I've blogged extensively about it.
Greg introduced me to Susan Labandibar, President of Tech Networks of Boston. She, Greg and I had a vegan lunch last week at My Thai Vegan Cafe in Brookline. Susan is also a vegan and is deeply committed to sustainability in IT and in life.
We talked about Power Usage Effectiveness and measuring the energy savings of Cloud Computing/Software as a Service. We talked about thin client computing. We talked about virtualization.
I truly believe that in an era of constrained resources, rising expenses and a faltering economy, all of these issues will be increasingly important to CIOs and I expect Susan's company to be very successful.
On a personal note, Susan gave me a copy of "Toobox for Sustainable City Living" by Scott Kellogg and Stacy Pettigrew. It's available from South End Press.
I've written about lowering my impact on the planet and my dreams of a greener existence.
This book is a great primer for those seeking to move off the grid. Admittedly, some may find the recommendations a bit extreme, but I really appreciated the authors' point of view.
Although I've considered building a solar cell array on the south facing rooflines of my house, solar cells have a reasonably short lifespan and require a high level of technological sophisticated to fabricate.
Creating passive solar systems which capture the sun's light via south facing greenhouse windows, using biofuels, and building small scale wind power are ultimately more sustainable because a non-technological society can easily create and install such systems.
The book includes chapters on sustainable food strategies, water collection/purification, waste recycling, energy, and bioremediation of pollutants.
When I read this book, I really thought of Myst. Imagine a world in which the inhabitants create self sufficient communities using basic technologies in advanced ways to achieve sustainable, environmentally friendly homes.
I realize that the idea of growing your own foods, providing for your own water, harnessing your own energy, and recycling your wastes seems out of the mainstream for the 21st century. However, as resources become more constrained and the world economy seems increasingly unstable, such self sufficiency seems very forward looking. I want my daughter to inherit a planet she can thrive in, so I will pursue sustainability in my own incremental way, for the rest of my life.
Wednesday, December 3, 2008
The Costs of Accelerating EHR Adoption
Many studies have demonstrated that Electronic Health Records (EHRs) can improve quality and reduce costs through coordinated delivery of the right care at the right time. The escalating cost of healthcare and the downturn in the economy are the perfect storm to create real urgency for implementing Healthcare Information Technology.
Many clinicians cannot afford EHR implementation. Stark safe harbors help physicians affiliated with hospital systems but do not help unaffiliated clinicians.
An early priority for the Obama administration should be decisive, rapid action to accelerate the adoption of EHRs via broadened Medicare/Medicaid incentives to implement and use Certification Commission on Healthcare Information Technology (CCHIT) certified products. Federal funds are needed to subsidize implementation teams and locally credible EHR champions who inspire and motivate providers at the grass roots level in each State. In order to receive funding, States should have to create EHR adoption services that effectively and efficiently deploy EHRs to achieve low failure rates and meet quality/safety goals. Funds should include direct payment, low interest loans, tax credits, pay for performance incentives, and penalties for delayed adoption. Grant funding, however, is probably not an effective vehicle, since it doesn't give Federal/State governments enough control, nor is it usually focused on sustainability.
How much is needed? Our Massachusetts experience suggests that approximately $350 million is needed to complete the rollout of EHRs in our state - about $50,000 per practicing unaffiliated clinician.
Here are the breakdowns of community EHR implementation costs at BIDMC/BIDPO, the Massachusetts eHealth Collaborative, and the New York Department of Health and Hygiene EHR project.
Assumptions:
1) Software costs include only the direct licensing costs for EHR and non-EHR software. MAeHC software costs are higher because several different EHRs were implemented, creating more complexity.
2) The NYC costs do not include non-EHR software
3) Hardware includes practice-level and central-site hardware.
4) People includes direct services from staff, whether vendor-provided or sponsor-provided.
5) These costs are for implementation only. The average annual per physician support costs are roughly $5,500 per user for BIDMC and $6,500 per user for MAeHC.
Further detail:
1) BIDMC includes 300 docs. MAeHC includes 575 docs. NYC includes 1,200 docs.
2) The people costs are not directly comparable, because neither MAeHC nor NYC have accounted for the entire provider-side of the costs of hardware integration. For example, with MAeHC, vendors designed and the hospitals implemented the local ASP environments, but we do not know the labor cost at the hospitals. With the BIDMC project all costs are explicit because the ASP environment was outsourced. The NYC practices are purchasing hardware on their own, so we do not know the exact costs.
3) BIDMC will get some scale benefit once the number of implementations grows. The per user people costs include the design and build of the central site and the cost of the Project Management Office.
4) BIDMC actual hardware costs will probably be higher based on the implementations to date because the practices are purchasing more equipment than original budgeted (i.e. more printers, laptops, and tablets for support staff)
As a country, we have enough experience with live implementations to know what needs to be done to implement EHRs and the cost of doing it. The time for grants and experimentation has passed. To borrow a marketing slogan, the time is right to "Just Do it" by providing financial incentives.
Many clinicians cannot afford EHR implementation. Stark safe harbors help physicians affiliated with hospital systems but do not help unaffiliated clinicians.
An early priority for the Obama administration should be decisive, rapid action to accelerate the adoption of EHRs via broadened Medicare/Medicaid incentives to implement and use Certification Commission on Healthcare Information Technology (CCHIT) certified products. Federal funds are needed to subsidize implementation teams and locally credible EHR champions who inspire and motivate providers at the grass roots level in each State. In order to receive funding, States should have to create EHR adoption services that effectively and efficiently deploy EHRs to achieve low failure rates and meet quality/safety goals. Funds should include direct payment, low interest loans, tax credits, pay for performance incentives, and penalties for delayed adoption. Grant funding, however, is probably not an effective vehicle, since it doesn't give Federal/State governments enough control, nor is it usually focused on sustainability.
How much is needed? Our Massachusetts experience suggests that approximately $350 million is needed to complete the rollout of EHRs in our state - about $50,000 per practicing unaffiliated clinician.
Here are the breakdowns of community EHR implementation costs at BIDMC/BIDPO, the Massachusetts eHealth Collaborative, and the New York Department of Health and Hygiene EHR project.
| Costs per licensed user | BIDMC | MAEHC | NYC |
| Software | 5,998 | 10,800 | 4,500 |
| Hardware | 10,561 | 17,783 | 15,000 |
| People | 29,641 | 17,660 | 16,000 |
| Total | 46,200 | 46,243 | 35,500 |
Assumptions:
1) Software costs include only the direct licensing costs for EHR and non-EHR software. MAeHC software costs are higher because several different EHRs were implemented, creating more complexity.
2) The NYC costs do not include non-EHR software
3) Hardware includes practice-level and central-site hardware.
4) People includes direct services from staff, whether vendor-provided or sponsor-provided.
5) These costs are for implementation only. The average annual per physician support costs are roughly $5,500 per user for BIDMC and $6,500 per user for MAeHC.
Further detail:
1) BIDMC includes 300 docs. MAeHC includes 575 docs. NYC includes 1,200 docs.
2) The people costs are not directly comparable, because neither MAeHC nor NYC have accounted for the entire provider-side of the costs of hardware integration. For example, with MAeHC, vendors designed and the hospitals implemented the local ASP environments, but we do not know the labor cost at the hospitals. With the BIDMC project all costs are explicit because the ASP environment was outsourced. The NYC practices are purchasing hardware on their own, so we do not know the exact costs.
3) BIDMC will get some scale benefit once the number of implementations grows. The per user people costs include the design and build of the central site and the cost of the Project Management Office.
4) BIDMC actual hardware costs will probably be higher based on the implementations to date because the practices are purchasing more equipment than original budgeted (i.e. more printers, laptops, and tablets for support staff)
As a country, we have enough experience with live implementations to know what needs to be done to implement EHRs and the cost of doing it. The time for grants and experimentation has passed. To borrow a marketing slogan, the time is right to "Just Do it" by providing financial incentives.
Tuesday, December 2, 2008
An Epidemic of Overtreatment
This blog entry was co-authored with Rich Parker MD, Assistant Professor, Internal Medicine, Healthcare Associates.
Healthcare costs in the US are approaching 17% of the GDP and may be as high as 20% in the next few years.
What is causing the US to have the highest cost and lowest value for the healthcare dollar? Simple - it's overtreatment.
Overtreatment takes many forms - from over ordering expensive diagnostic tests to the prescribing of expensive and sometimes unneeded therapeutics.
There are many reasons for this. Here are just a few:
1. Incentives are misaligned. Healthcare reimbursement in the US pays for quantity, not quality. This means that clinicians benefit from performing more procedures, hospitals benefit from more diagnostic testing, and the pharmaceutical industry benefits from adoption of new name brand drugs. If you do not believe this to be the case, spend a day in an ambulatory care clinic or a hospital and see what goes on. Ask any resident, fellow or attending how many tests and treatments are unneeded. We believe that paying for wellness or paying for outcomes will solve this piece of the overtreatment puzzle. If doctors and hospitals had to live within a budget, diagnostic and treatment strategies would change quickly and become less expensive for all of us with equally good clinical outcomes.
2. We've attended many gatherings where parents discuss brand name powerful antibiotics and recommend that they become the first line drug for treatment of anything their children complain about. "Don't accept Amoxicillin, go for the Augmentin or Cipro". John's daughter is 16 and has not ever taken an antibiotic in her life. She's had a few viruses, but no virus is cured by antibiotics. Overtreatment of the pediatric population with powerful antibiotics creates resistant organisms that make children sicker and create a dependency on ever more powerful antibiotics. The problem with adults is equally severe. Watch the evening news and within an hour you'll hear about a dozen brand name pharmaceuticals treating diseases you've never heard of, but may now suspect you have. The United States is the only country in the world that allows “direct to consumer” advertising. We believe this advertising should be regulated to solve this piece of the overtreatment puzzle. Those advertising dollars end up coming out of your pocket too!
3. Some patients are not willing to accept risk or shared decisionmaking with their doctors. They want to begin the evaluation of back pain with an MRI instead of trying a course of gentle exercise and pain meds. Many issues do not have a clean or simple diagnosis. Eat right, exercise, avoid caffeine/nicotine, and let the body heal itself. For many conditions, rest and time cure the problem. Although the healthcare systems of Canada and the UK have their problems, the fact that access to expensive diagnostics is limited enables patients and their doctors to work together on simpler evaluations and therapies as a first step. We need to change the cultural expectation that expensive tests are "first line".
4. As a country the US eats poorly, avoids exercise, drinks an infusion of lattes, and then wants to take a pill to make all the lifestyle diseases go away. Lifestyle issues should be treated with lifestyle changes, not pharmaceuticals or nutraceuticals. Our own experience convinced us of this. John gave up the lattes, the super-sized meals, and began daily exercise 7 years ago. Since that time, all his lifestyle diseases have disappeared.
5. Overtreatment begets overtreatment. If a lifestyle disease is treated with pharmaceuticals, it's likely that those medications will cause side effects. The symptoms of side effects lead to further diagnostic testing and more pharmaceuticals are often the result. We know several patients who are on medications for hypertension due to overeating, H2 blockers due to excess caffeine/nicotine consumption, and several medications to treat the side effects of their initial medications. Two or three medications can fast become ten. We've suggested taking a medication holiday with appropriate clinical supervision, redesigning their diets, and beginning daily exercise. The answer we often hear is that taking all those pills, having all those tests, and visiting their clinician often is easier than changing their lifestyle.
6. Today on the local radio station, an attorney asked the question "have you ever had a bad outcome or misdiagnosis? I've been holding doctors accountable for 30 years. Call me and we'll get you the cash settlement you deserve." There are bad doctors. There are doctors who are unskilled at surgery or provide very non-standard care. However, most clinicians are trying to do the right thing. Medicine is not an exact science. It's based on experience and probabilities. This means that even the best clinician will miss a rare disease or an atypical presentation of a common disease. As a country, we need to realize that delayed or misdiagnosis will occur despite best efforts and accept a low level of imperfect outcomes instead of forcing every doctor to overtreat every patient in the pursuit of 100% certainty. Both patients and doctors together must accept some degree of uncertainty or we will continue to bankrupt our system.
Our economy has lost its competitive edge because our healthcare costs have ballooned to extreme levels due to misaligned incentives, overzealous pharmaceutical marketing, expectations of high cost testing/therapeutics, excessive administrative costs and complications due to overprescribing and fear of litigation.
The diagnosis of overtreatment is simple. The therapies are complex. We've proposed a few fixes above and will continue to write this topic in blogs to come.
Healthcare costs in the US are approaching 17% of the GDP and may be as high as 20% in the next few years.
What is causing the US to have the highest cost and lowest value for the healthcare dollar? Simple - it's overtreatment.
Overtreatment takes many forms - from over ordering expensive diagnostic tests to the prescribing of expensive and sometimes unneeded therapeutics.
There are many reasons for this. Here are just a few:
1. Incentives are misaligned. Healthcare reimbursement in the US pays for quantity, not quality. This means that clinicians benefit from performing more procedures, hospitals benefit from more diagnostic testing, and the pharmaceutical industry benefits from adoption of new name brand drugs. If you do not believe this to be the case, spend a day in an ambulatory care clinic or a hospital and see what goes on. Ask any resident, fellow or attending how many tests and treatments are unneeded. We believe that paying for wellness or paying for outcomes will solve this piece of the overtreatment puzzle. If doctors and hospitals had to live within a budget, diagnostic and treatment strategies would change quickly and become less expensive for all of us with equally good clinical outcomes.
2. We've attended many gatherings where parents discuss brand name powerful antibiotics and recommend that they become the first line drug for treatment of anything their children complain about. "Don't accept Amoxicillin, go for the Augmentin or Cipro". John's daughter is 16 and has not ever taken an antibiotic in her life. She's had a few viruses, but no virus is cured by antibiotics. Overtreatment of the pediatric population with powerful antibiotics creates resistant organisms that make children sicker and create a dependency on ever more powerful antibiotics. The problem with adults is equally severe. Watch the evening news and within an hour you'll hear about a dozen brand name pharmaceuticals treating diseases you've never heard of, but may now suspect you have. The United States is the only country in the world that allows “direct to consumer” advertising. We believe this advertising should be regulated to solve this piece of the overtreatment puzzle. Those advertising dollars end up coming out of your pocket too!
3. Some patients are not willing to accept risk or shared decisionmaking with their doctors. They want to begin the evaluation of back pain with an MRI instead of trying a course of gentle exercise and pain meds. Many issues do not have a clean or simple diagnosis. Eat right, exercise, avoid caffeine/nicotine, and let the body heal itself. For many conditions, rest and time cure the problem. Although the healthcare systems of Canada and the UK have their problems, the fact that access to expensive diagnostics is limited enables patients and their doctors to work together on simpler evaluations and therapies as a first step. We need to change the cultural expectation that expensive tests are "first line".
4. As a country the US eats poorly, avoids exercise, drinks an infusion of lattes, and then wants to take a pill to make all the lifestyle diseases go away. Lifestyle issues should be treated with lifestyle changes, not pharmaceuticals or nutraceuticals. Our own experience convinced us of this. John gave up the lattes, the super-sized meals, and began daily exercise 7 years ago. Since that time, all his lifestyle diseases have disappeared.
5. Overtreatment begets overtreatment. If a lifestyle disease is treated with pharmaceuticals, it's likely that those medications will cause side effects. The symptoms of side effects lead to further diagnostic testing and more pharmaceuticals are often the result. We know several patients who are on medications for hypertension due to overeating, H2 blockers due to excess caffeine/nicotine consumption, and several medications to treat the side effects of their initial medications. Two or three medications can fast become ten. We've suggested taking a medication holiday with appropriate clinical supervision, redesigning their diets, and beginning daily exercise. The answer we often hear is that taking all those pills, having all those tests, and visiting their clinician often is easier than changing their lifestyle.
6. Today on the local radio station, an attorney asked the question "have you ever had a bad outcome or misdiagnosis? I've been holding doctors accountable for 30 years. Call me and we'll get you the cash settlement you deserve." There are bad doctors. There are doctors who are unskilled at surgery or provide very non-standard care. However, most clinicians are trying to do the right thing. Medicine is not an exact science. It's based on experience and probabilities. This means that even the best clinician will miss a rare disease or an atypical presentation of a common disease. As a country, we need to realize that delayed or misdiagnosis will occur despite best efforts and accept a low level of imperfect outcomes instead of forcing every doctor to overtreat every patient in the pursuit of 100% certainty. Both patients and doctors together must accept some degree of uncertainty or we will continue to bankrupt our system.
Our economy has lost its competitive edge because our healthcare costs have ballooned to extreme levels due to misaligned incentives, overzealous pharmaceutical marketing, expectations of high cost testing/therapeutics, excessive administrative costs and complications due to overprescribing and fear of litigation.
The diagnosis of overtreatment is simple. The therapies are complex. We've proposed a few fixes above and will continue to write this topic in blogs to come.
Monday, December 1, 2008
Interoperability Advice for the New Administration
As policymakers consider ways to reduce healthcare cost and improve quality, I'm often asked about the current readiness of standards and interoperability.
I believe that standards are no longer the rate limiting step.
On November 12, I presented an overview of standards readiness to Secretary Leavitt and AHIC. The video is available online
My presentation begins at 1 hour and 8 minutes. Anyone wanting to view it can just use real player to advance to that point.
You'll see that as a country, we have finished:
2006 - Personal Health Records, Laboratories, Biosurveillance
2007 - Medications, Quality, Clinical Summaries
2008 - Medical devices, Referrals, Family History/Genome, Secure messaging, Public Health Reporting, Immunizations
In 2009, we'll complete Newborn screening, Clinical Trials/Research and close a few minor gaps
All the stakeholders (vendors, government, academic, pharma, labs, payers, providers, patients) have agreed on the needed standards by consensus. Secretary Leavitt has Recognized all the 2006 and 2007 standards and will be Accepting the 2008 standards on January 8, 2009. Recognition means that the standards are required for use by all Federal agencies. Acceptance means that a year of testing begins and Recognition will follow.
Thus, there is no need to wait for the standards. Vendors are beginning to implement these standards and the Certification Commission on Health Information Technology is beginning to require them.
If standards are not the issue, what about security and privacy? As readers of my blog know, I am passionate about the need to protect confidentiality.
I believe that security is no longer the rate limiting step.
The standards for security were finished in 2007. They are available online and have been fully incorporated into all the HITSP interoperability specifications including all the needed security standards to support encryption, authentication, authorization, audit trials, non-repudiability, and patient consent.
These security standards can enforce any local privacy policies - from something basic like HIPAA to something complex like the Massachusetts approach to opt-in consent at the institutional level.
It is true that the US has very heterogeneous privacy policies in states and localities that pre-empt HIPAA, but that is not a security or technology issue.
What about architecture?
I think that we've done enough pilots and experiments to know what architecture we need.
The US already has a functional architecture for e-Prescribing including retrieval of comprehensive medication history. The US already has a functional architecture for exchange of lab results among providers, patients and commercial labs.
What's missing is a clinical summary exchange that ensures care coordination among providers of care and patients. I've written about a simple, internet-based, service oriented architecture that can securely exchange structured healthcare data between stakeholders. This can approach can be used to
a. Send / push / route hospital data to appropriate parties
b. Send / push / route visit and other data in support of referral consultation
c. Send / push / route visit and other data for standardized quality reporting
d. Send / push / route data for patient health records (PHRs)
Note that none of these transactions creates new privacy issues. Every one of them is currently required by good medical practice or by law, and are performed on paper today.
Thus, interoperability is implementable today with harmonized standards, appropriate security, and a service oriented architecture using the internet.
Now we need incentives to implement it.
Data exchange is a public good in many ways, so it will be challenging to fund purely based on local stakeholder contributions. There is a need for Federal leadership and funding to mandate very specific transactions on a defined implementation timetable. We should accelerate adoption through the same approach the US is using for e-Prescribing: regulation to create mandates and incentives to create urgency, followed by penalties for late implementation.
Experience has taught me that it's best to automate existing processes rather than trying to simultaneously change process and add technology. The approach I've presented above is a good short term solution. In the long term, let's hope that patients become a steward for their own data via PHRs or establish a "medical home" - a primary care giver who coordinates all their care. The architecture could easily evolve such that every entity which provides care has to push the data into a "medical home" EHR in a standardized fashion.
I believe that standards are no longer the rate limiting step.
On November 12, I presented an overview of standards readiness to Secretary Leavitt and AHIC. The video is available online
My presentation begins at 1 hour and 8 minutes. Anyone wanting to view it can just use real player to advance to that point.
You'll see that as a country, we have finished:
2006 - Personal Health Records, Laboratories, Biosurveillance
2007 - Medications, Quality, Clinical Summaries
2008 - Medical devices, Referrals, Family History/Genome, Secure messaging, Public Health Reporting, Immunizations
In 2009, we'll complete Newborn screening, Clinical Trials/Research and close a few minor gaps
All the stakeholders (vendors, government, academic, pharma, labs, payers, providers, patients) have agreed on the needed standards by consensus. Secretary Leavitt has Recognized all the 2006 and 2007 standards and will be Accepting the 2008 standards on January 8, 2009. Recognition means that the standards are required for use by all Federal agencies. Acceptance means that a year of testing begins and Recognition will follow.
Thus, there is no need to wait for the standards. Vendors are beginning to implement these standards and the Certification Commission on Health Information Technology is beginning to require them.
If standards are not the issue, what about security and privacy? As readers of my blog know, I am passionate about the need to protect confidentiality.
I believe that security is no longer the rate limiting step.
The standards for security were finished in 2007. They are available online and have been fully incorporated into all the HITSP interoperability specifications including all the needed security standards to support encryption, authentication, authorization, audit trials, non-repudiability, and patient consent.
These security standards can enforce any local privacy policies - from something basic like HIPAA to something complex like the Massachusetts approach to opt-in consent at the institutional level.
It is true that the US has very heterogeneous privacy policies in states and localities that pre-empt HIPAA, but that is not a security or technology issue.
What about architecture?
I think that we've done enough pilots and experiments to know what architecture we need.
The US already has a functional architecture for e-Prescribing including retrieval of comprehensive medication history. The US already has a functional architecture for exchange of lab results among providers, patients and commercial labs.
What's missing is a clinical summary exchange that ensures care coordination among providers of care and patients. I've written about a simple, internet-based, service oriented architecture that can securely exchange structured healthcare data between stakeholders. This can approach can be used to
a. Send / push / route hospital data to appropriate parties
b. Send / push / route visit and other data in support of referral consultation
c. Send / push / route visit and other data for standardized quality reporting
d. Send / push / route data for patient health records (PHRs)
Note that none of these transactions creates new privacy issues. Every one of them is currently required by good medical practice or by law, and are performed on paper today.
Thus, interoperability is implementable today with harmonized standards, appropriate security, and a service oriented architecture using the internet.
Now we need incentives to implement it.
Data exchange is a public good in many ways, so it will be challenging to fund purely based on local stakeholder contributions. There is a need for Federal leadership and funding to mandate very specific transactions on a defined implementation timetable. We should accelerate adoption through the same approach the US is using for e-Prescribing: regulation to create mandates and incentives to create urgency, followed by penalties for late implementation.
Experience has taught me that it's best to automate existing processes rather than trying to simultaneously change process and add technology. The approach I've presented above is a good short term solution. In the long term, let's hope that patients become a steward for their own data via PHRs or establish a "medical home" - a primary care giver who coordinates all their care. The architecture could easily evolve such that every entity which provides care has to push the data into a "medical home" EHR in a standardized fashion.
Subscribe to:
Posts (Atom)
