Protect, Protect, Protect. Now Share

Later this week, I'm joining a healthsystemCIO.com webinar about security and health information exchange.

A theme I discuss frequently in my keynotes and lectures is the current regulatory challenge which suggests we should engage patients/families,  share data for care coordination in accountable care organizations, and use registries to analyze population health/public health all while keeping the data security and respecting patient privacy preferences.   It's a tall order.

As I've posted previously, BIDMC hired Deloitte to perform a security assessment of our policies and technologies.   Going through the assessment has given me a great opportunity to review the security standard practices in the healthcare industry and the best practices across all industries.

We've reviewed emerging techniques in Data Loss Prevention (DLP),  Governance/Risk/Compliance (GRC) tools, Enterprise audit log analysis tools, Learning Management Systems, and Network Access Control.

BIDMC has implemented or is implementing most of these.

At the same time, we're passionate about healthcare information exchange technologies for provider/provider summaries and patient/provider communications (portals, automated blue button, and state hie connections to patients).

Here are the slides I'll use in the webinar, illustrating that it possible to secure the enterprise and at the same time use Direct-enabled, certificate protected, health information exchange with patients, providers, and payers.

The most secure library in the world would not check out any books - it would be a secure but useless library.   We must protect privacy and at the some time share information.   It is possible to achieve a balance that does both.

I look forward to the webinar.

recomended product suport by amazon

Cool Technology of the Week

While I was at AMIA this week, Will Ross of Redwood MedNet, introduced me to a low cost interoperability solution for small practices in rural locations.   It's similar in concept to the interoperability appliances that Massachusetts has used in its HIE.  Will calls his appliance the
 "HIE Plug".

The HIE Plug is a secure health data endpoint built on a generic small form factor hardware device.  The all open source software stack runs on a Marvel Kirkwood ARM CPU @ 1.2Ghz with 512M RAM.  The hardware draws under 5 watts of power.

• 2 x Gigabit Ethernet 10/100/1000 Mbps
• 2 x USB 2.0 ports (Host)
• 1 x eSATA 2.0 port- 3Gbps SATAII
• 1 x SD Socket for user expansion/application
• WiFi: 802.11 b/g/n
• Bluetooth: Bluetooth 2.1 + EDR

This hardware is marketed under the trade name "DreamPlug".

The HIE Plug open source software stack installed on the device includes:

1.  Debian Wheezy with the Linux 3.* kernel.

2.  EncFS provides an encrypted filesystem in user-space running without any special permissions and with the FUSE library and Linux kernel module to provide the filesystem interface.

3.  Mirth Connect - health data integration engine, a robust Enterprise Service Bus tool fluent in all common health data formats and communication services.  Mirth Connect includes a robust dashboard to manage many individual integration engine channels, which can be taught variously to listen for data, push data, pull data, transform data, etc.  Mirth Connect channels are written in Javascript.

4.  Apache Derby database stores the health data messages prior to forwarding to the HIE.  The database runs in the encrypted filesystem.  If power to the device is lost the part of the filesystem where the database resides cannot be re-mounted and unencrypted without the proper credentials. Local storage can be configured to trim/remove its local store of messages at a pre-defined time.

5.  OpenVPN client bundle for secure TLS connectivity back to the managed VPN Access Server.

6.  Samba (file server) and CUPS (print server) installed.  Either one or both can be configured and deployed as needed - - no services are enabled by default.  This allows delivery or consumption of a file through a shared folder on the HIE Plug, or delivery of a print job to an internal network printer or a remote network printer.

7.  lighttpd webserver -  to provide web based applications or information to clients.

The HIE Plug was tested in a pilot deployment at three sites in early 2012, and is now rolling out to general production across dozens of health care facilities participating in Redwood MedNet.   Up front deployment cost is $300 per practice.  Technical support by Redwood MedNet is included under the standard HIE bidirectional data service subscription fee, which is $200/provider/year for outpatient practices.

Mirth has been used for Direct demonstrations, so it is a very reasonable choice as an integration engine supporting Meaningful Use Stage 2 exchanges.

A $300 HISP in a box - that's cool!

recomended product suport by amazon

Building Unity Farm - Preparing for Winter

This week we've had our first hard freeze in Massachusetts - 22 degree temperatures last night.   How have we prepared the farm for winter?

1.  All outside water supplies are off and drained.   A yard hydrant provides water inside the barn and since its water supply is 4 feet below ground, deeper than the frost line, it does not freeze.

2.  All barn doors and windows are closed to minimize wind inside.  Extra straw provides a layer of insulation.   The animals are fully fleeced.   Llama/Alpaca and Great Pyrenees Mountain dogs enjoy the cold weather - it's the wind and the rain that is problematic.   The barn protects them.

3.  All our over wintering raised bed plants (such as garlic and various herbs) have been protected under salt marsh hay or moved indoors.

4. We use heated buckets to keep water from freezing in the barn.   We use a thermostatically controlled chicken waterer base to keep the coop water from freezing.

5. Although the coop keeps the chickens out of the wind and rain, we need to protect their sensitive combs and waddles.   We put 150 watt heater panels near their nightly roosting area and near their daily eating area.   They can always seek a warm up when the temperature plummets.

One issue we're still addressing - what to do if power fails.   We are currently installing a propane fueled generator to ensure our animals have heat, light and water even if falling trees or severe winds bring down power lines.    During Hurricane Sandy we lost power for 7 hours.  We stored a few days of water in the barn just in case, but did not need them.

We have enough food stored in our barn loft to last until Spring for all the animals.

The first hard freeze went well.   I think we're ready for our first winter on Unity Farm.

recomended product suport by amazon

The United States Health Information Knowledgebase

I have long suggested that we have a single place to access standards, implementation guides, test scripts, guidelines, and code sets.

The National Library of Medicine is building a national resource for vocabularies and code sets.

In the meantime, the best centralized resource we have for HIT related knowledge assets is the United States Health Information Knowledgebase (USHIK)

USHIK is an on-line, publicly accessible registry and repository of healthcare-related data, metadata and standards.

In particular, I think you will find the Meaningful Use Stage 2 criteria listed on the site (including the quality measures) to be particularly useful.

Go to the USHIK site and click on Meaningful Use box at the top left. You will be directed to that site.

Once there you can click on Value Sets or click on Download (on left-hand side) to get to the files.  

Thanks much to AHRQ and Michael Fitzmaurice for creating and curating USHIK.

recomended product suport by amazon

The AMIA Healthcare Information Exchange Debate

Today I'm in Chicago at the American Medical Informatics Association annual meeting, joining my colleagues Mark Frisse, Bill Yasnoff and Latanya Sweeney to debate the question:

"Resolved - Health information exchange organizations should shift their principal focus to consumer-mediated exchange in order to facilitate the rapid development of effective, scalable, and sustainable health information infrastructure."

Mark and I were assigned "oppose".   Bill and Latanya were assigned "support".   It was made clear that our positions were assigned and did not necessary reflect our personal opinions.  (Note to Christine Bechtel and Leslie Kelly Hall - you know how I feel about the question of patient and family engagement.)

Here's what I said:

I really like the idea of patient mediated exchange and eventually we will widely support both provider and patient mediated exchange (as Meaningful Use Stage 2 will require).  However, in the short term, there are implementation issues that will delay widespread use of patient mediated exchange.

a.  There are 500,000 providers in the US and 300 million patients.   Doing identity management on 500,000 licensed/credentialed professionals easier than issuing credentials to 300 million patients.
b.  Clinicians fear that loss of data integrity will result in increased liability.   How will we ensure the non-repudiatibility of data exchanged between providers if patients collect and edit it first i.e. might Tylenol #3 for pain be changed to Oxycontin for pain?  At present we lack the metadata and digital signatures that will guarantee provenance and integrity of patient mediated data
c.  Many EHRs include features that support provider to provider workflow, but few accept incoming patient generated or stewarded data

These are short term issues that will be address in the next few  years, but the resolution calls for "rapid development".  

Why will provider to provider exchange be more rapid to implement?

1.  Provider mediated exchange is simple

HIEs can push data from organizational entity to organizational entity without having to uniquely identify the patient on a community-wide level.   Although there are many Mary Smith's in the community, there are very few in an individual provider's practice. When a message arrives to a provider concerning Mary Smith, the provider can easily attach it to the correct record.    In Massachusetts there are 20,000 providers and many are associated with a few large organizations running about a dozen different EHRs.  In our HIE we can do connect everyone with a few hundred organization level network connections.   Compare this complexity with the issue of messaging to 7 million unique patients.    

2.  Public and Private provider-based exchanges are already implemented.  Per a recent survey completed at the School of Public Health, over 100 HIEs are actively exchanging real data in the US.  Massachusetts has been exchanging data since 1997 and its HIEs have always been sustainable.

3.  Pushing data between providers does not require complex consent frameworks, it simply replaces the fax machine used in today's processes.   Thus the policies around using an HIE for pushing data are already in place.

4.  Existing EHRs and PHRs support provider directed exchange, since many federal and state demonstration projects have focused on provider-based architectures.

5.  Although we ultimately need both provider and consumer mediated exchanges, I predict 80% of patients will defer to their provider.  My parents, like many older Americans believe  their providers should collect and organize the data, serving as a kind of patient-centered electronic medical home.   Patients can view the collected data via the PHR offered by their primary care clinician.

I wonderful set of point/counterpoint discussion on this topic filled 90 minutes.

The end result - the audience seemed evenly split on the resolution.   We were both right - provider and patient mediated exchanges are needed.

A great discussion.

recomended product suport by amazon

The Election and Healthcare IT

Tomorrow the Presidential election process comes to an end and the advertising will finally stop.   We'll all be relieved.   I especially look forward to a quiet dinner at home without robotic election-related calls.

What about healthcare IT?  Will differences in the Obama and Romney platforms impact the momentum of Meaningful Use?

Here's what I believe.

The Obama Healthcare IT platform builds on what we've created over the past few years.   It will continue to leverage the federal advisory committees (Policy and Standards) to engage a wide array of stakeholders.   It will persist the progression to Meaningful Use Stage 3 and possibly future stages.   It will embrace certification now the temporary certification process has been replaced with a permanent one.   It will support the initiatives of the Standards and Interoperability framework (S&I), although the end of stimulus funds from ARRA means that ONC will move some of the S&I initiatives to private/public partnerships.  It will support the current leadership at ONC - Farzad and his delegates such as Steve Posnack, Doug Fridsma, and Judy Murphy.

The Romney Healthcare IT platform notes that information technology has broad bipartisan support.   No one argues that a foundation of healthcare IT implemented properly is essential for accountable care organizations.   Quality, safety, and efficiency  all benefit from the process enhancement afforded by healthcare IT.    Michael Leavitt, former Secretary of HHS and chair of the American Health Information Community (AHIC) will lead the Romney transition team and Leavitt has years of experience with healthcare IT issues from the early days of ONC.     As Governor of Massachusetts, Romney supported the early EHR rollout efforts of the Massachusetts eHealth Collaborative.

However, there have been aspects of the Romney Healthcare IT platform which are concerning.

In my conversations with reporters, there has been a consensus that the Romney campaign will terminate stimulus related programs such as Meaningful Use.  I'm concerned that eliminating Stage 2 and 3 stimulus dollars would slow the pace of adoption we've achieved over the past few years.

Further, the Romney campaign has noted that interoperability standards are lacking and if vendors are given a mandate, standards will be widely adopted.

I'm concerned that Romney's advisors do not realize how successful the federal advisory committee process has been.   The Healthcare IT Standards Panel (HITSP) in the Bush administration was a wonderful group of people trying very hard to make a difference.  When Obama was first elected I suggested that continuing HITSP would be better than forming a new federal advisory committee (Healthcare IT Standards Committee - HITSC).

Over the past four years, I've realized that HITSC has engaged more stakeholders and recommended simpler, easy to implement standards because it was not dominated by vendors which introduce their own biases.    Giving standards-making to a consortium of vendors would be a step backwards.

I always try to ignore election year politics and work above the fray.  Regardless of who is elected, I will work with them and continue my passion for standards and interoperability.

If Romney is elected let's hope he is a funder of healthcare IT and not just a cheerleader.   Let's also hope that he examines the lessons learned over the past 8 years and realizes that we're on the right track for interoperability.   Eliminating meaningful use and turning standards-making over to the vendors would not accelerate our progress.

recomended product suport by amazon

Cool Technology of the Week

While in China last week, I participated in a ribbon cutting ceremony for a new private (rather than public) funded hospital. Each patient room included several high tech amenities including showers that transition from clear glass to frosted glass at the touch of the button.

How is that accomplished?   Simple - smart glass that  employs polymer dispersed liquid crystal devices.

A liquid mix of polymer and liquid crystals is placed between two sheets of glass.  When no voltage is applied, the crystals are randomly aligned and the panel is translucent.   When voltage is applied, the crystals are aligned and light passes without scattering, making it appear clear.

No curtains and no blinds are needed.

If power fails, privacy is protected.

Glass that changes from cloudy to clear at the touch of button.   That's cool!

recomended product suport by amazon

Building Unity Farm - Animal Healthcare

In addition to physical maintenance of the farm (food, water, and manure management), my wife and I are responsible for all the animal healthcare.  We have a traveling vet, Cindy Fuhs, who can manage the major issues (what do you do when your llama has a breech birth?), but there are daily and monthly aspects of care and wellness we manage ourselves.

Here's a summary of what we do by species

Chickens:
Like all flocks, ours has a pecking order.  Those lowest on the pecking order can develop dermatological conditions when their feathers are pulled out or they are scratched by chickens higher on the pecking order.    Our chickens get along particularly well (even our two roosters), but we have snap on "chicken jackets" we can use to protect exposed skin if feathers become too thin.   All our hens receive supplemental calcium which they can eat freelyto ensure they have enough raw materials to create strong eggs.   Barnyards host moisture loving bacteria and species like pseudomonas can cause devastating eye infections.  Each day when they return to their roost I examine their eyes for discharge or any signs of trauma that could lead to infection.   Our most docile chicken did have a corneal abrasion from pecking and developed a pseudomonas infected corneal ulcer.   I treated it with a fluoroquinolone (ofloxacin eye drops) a few hours after it started and the chicken is now completely well.

Guinea fowl:
The guineas are free ranging and experience a wide array of foods, predators, and physical activity as they explore our 15 acres of woodlands.  Each night when they come home to roost, I examine them for any signs of physical injury.  I also watch their eyes for signs of infection.   Finally I watch for changes in their bowel habits as an early sign of systemic infection or parasites that could lead to dehydration or weight loss.

Llamas/Alpacas:
One of the clearest indications of overall camelid health is weight loss.  Every month we weigh every animal using a 4 foot long "stand on" platform scale.   Since coming to our farm, every animal has gained 10 pounds, putting them near their ideal weights.   You do not want obese animals so every month we check their "body score", the camelid equivalent of the triceps fat measurement test, to ensure their bodies are fit.   Parasitic infections are a significant issue during warm months in New England, so from April to October we give injections of Ivermectin.   During our monthly herd health examinations, we clean their ears, examine their eyes, and check for fungal infections between their toes.   We do an overall dermatological check and treat any skin lesions with the same approach used in humans per the medical student dictum "if it is dry, make it wet.  if it is wet, make it dry.  always use steroids".   Finally we trim all toenails every month, a particularly fun job with a 300 pound llama.

Dogs/Cats:
Our veterinary care is very similar to that which many of you do already - control fleas/ticks, prevent heart worm, monitor oral health, and support overall physical well being.   Our Great Pyrenees puppy recently had a corneal abrasion when he accidentally ran under the llama and she stepped on him.    We treated that with ofloxacin.    One of our house cats died of stage 4 pancreatic cancer - we did home hospice care with morphine analogs.

Rabbits:
We examine the rabbits for signs of physical injury, skin problems, and eye issues.  Our male rabbit had a corneal abrasion caused by pecking from one of the chickens.  We treated him with ofloxacin.

The number of eye issues this summer seems high but it was likely due to the startup of the farm - we move all the animals into new surroundings and created many new interactions.   Now that everyone is comfortable with their living quarters and each other, I do not expect many future physical injuries.

My emergency medicine training definitely comes in handy while caring for the citizens of Unity farm.   I only wish they were a little more forthcoming with chief complaints and history.  It's hard to deliver care when your patients are non-verbal.  Hat's off to veterinarians everywhere!

recomended product suport by amazon

Reflecting on Our IT Progress

In a time of EHR naysayers, mean-spirited election year politics, and press misinterpretation (ONC and CMS do not intend to relax patient engagement provisions), it's important that we all send a unified message about our progress on the national priorities we've developed by consensus.

1.   Query-based exchange - every country in the world that I've advised (Japan, China, New Zealand, Scotland/UK, Norway, Sweden, Canada,  and Singapore)  has started with push-based exchange,replacing paper and fax machines with standards-based technology and policy.   Once "push" is done and builds confidence with stakeholders, "pull" or query-response exchange is the obvious next step.  Although there are gaps to be filled, we can and should make progress on this next phase of exchange.   The naysayers need to realize that there is a process for advancing interoperability and we'll all working as fast as we can.   Query-based exchange will be built on top of the foundation created by Meaningful Use Stage 1 and 2.

2.  Billing - although several reports have linked EHRs to billing fraud/abuse and the recent OIG survey seeks to explore the connection between EHR implementation and increased reimbursement, the real issue is that EHRs, when implemented properly, can enhance clinical documentation.  The work of the next two years as we prepare for ICD-10 is to embrace emerging natural language processing technologies and structured data entry to create highly reproducible/auditable clinical documentation that supports the billing process.  Meaningful Use Stage 1 and 2 have added content and vocabulary standards that will ensure future documentation is much more codified.

3.  Safety - some have argued that electronic health records introduce new errors and safety concerns.  Although it is true that bad software implemented badly can cause harm, the vast majority of certified EHR technology enhances workflow and reduces error.  Meaningful Use Stage 1 and 2 enhance medication accuracy and create a foundation for improved decision support.  The HealtheDecisions initiative will bring us guidelines/protocols that add substantial safety to today's EHRs.

4.  Privacy and Security - some have argued that EHRs reduce security by making records available in electronic form, possibly over internet connections.   Efforts to enhance certification of the security of EHRs, encrypt data at rest, and create guidance for EHR modules that interoperate with built in security will further protect the data that needs to be shared for care coordination and population health.

5. Innovation - some have argued that meaningful use led to the growth of a small number of vendors and dependency/lock in with those vendors.    Meaningful Use Stage 2 requires interoperability between vendors, export of data from EHRs to reduce lock in, and standards that will enable a new generation of modular "plug ins".   I'm confident that SHARP grant funded work, like the SMART initiative will lead to an ecosystem of applications from small vendors - an app store for health.

Thus, our mantra should be that Meaningful Use Stage 1 and 2 have created a foundation for query-based exchange, accurate billing, safety, security, and innovation.

Stage 3 work is already in progress and from the early thinking that I've seen (will post a blog about that in a few weeks), the trajectory of Meaningful Use will address all the naysayers concerns.

recomended product suport by amazon

The Next Phase of State HIE Planning

With the Golden Spike on October 16, Massachusetts began a new era of healthcare information exchange.   Now that we have momentum and the perfect storm for innovation with alignment of government, industry, academia, stakeholders, and funding,  we want to rapidly advance to the next phase.

Last week, while I was in China, a group from Massachusetts visited CMS in Baltimore to present the Phase 2 plans.   Here is the powerpoint they used.

A few key points

1.  After summarizing the accomplishments of our Phase 1 go live, they presented the sustainability model in detail (see slide 15-16).   The tiered pricing was developed based on several key principles (see slide 13-14) such as the need for large organizations which derive high value from the HIE to subsidize small practices which have limited resources and bandwidth for new projects.   The end result is that comprehensive HIE services cost a solo practitioner just $5/month.

2.  We know that "push" transactions are easiest from a policy and technology perspective, so Phase 1 was limited to use cases like PCP to Specialist, Provider to Public Health, and Hospital to PCP exchange.    We also know that "pull" transactions have a great deal of value by providing just in time delivery of community wide longitudinal health records (slide 21).   Pull models require significantly more complex technology and policy.    Pull models require a master patient index/record locator service and some means of recording consent to disclose records.   Rather than declare that the standards are not ready, the informatics challenges are too great, and the consent models are too complex, we're just moving forward with an aggressive timeline to get it done in 12-18 months.  (timeline is on slide 31)

3.  With Phase 1, we built a guiding coalition of providers, payers, patients, government, and employers to break down barriers and create community wide demand for the service.  Where there were standards gaps we filled them with simple SOAP-based XML exchanges (provider directory query/response).   In this next phase, we're going to do the same thing as outlined in slides 23-30.   Is there a simple set of standards for managing consent that is widely deployed in the industry?  No - we'll create one and refine it in actual production across thousands of users and millions of transactions.   Is there a simple set of RESTful interfaces for query/response retrieval of records across a complex community of non-affiliated organizations?  No - we'll create one and show that it works really well.   To date, our implementation guides for SOAP/REST XML exchanges are less than 10 pages each and do the job well.   Of course we'll use existing mature standards where they exist but we will not select implementation guides that fail the standards readiness criteria simply because the right standards have not yet been invented yet.

Over the next few months our push HIE will grow to scale as more providers and vendor products are connected to it.   Currently NEHEN, our administrative transaction HIE in Massachusetts, does over 100 million exchanges per year, so we're confident we can achieve and support clinical healthcare information exchange at large volumes.    We'll dive headlong into the pull HIE work very soon as the funding is finalized.   We'll broadly share our lessons learned, our policies, and our technology.

It's a great time for HIE in Massachusetts and I hope we can be a catalyst for wider push and pull HIE adoption in the country.

recomended product suport by amazon

On the Road in China

Last week I spent 5 days in Shanghai and Hangzhou as part of an American delegation advising Chinese government and private sector leaders about healthcare reform.

We met with the Mayor of Shanghai, the Health Minister of Shanghai, many hospital presidents, and several public health officials.

The themes we highlighted included:

*Quality must be measured, not assumed, and this should be enabled by the universal adoption of electronic health records

*Data should be shared among caregivers with a focus on longitudinal coordination of wellness rather than episodic treatment of illness

*A primary care model coordinating patient treatment via a team that knows patient care plans and preferences will be more efficient than the current model in China in which the patient can go anywhere without a referral.   A simple headache might be first evaluated by a neurosurgeon at a tertiary care facility.

*The measures of success should be healthcare value (quality/cost), safety, and patient satisfaction

My role was to spread the gospel of Meaningful Use.   I highlighted the multi-phased journey in the US and our focus on policy outcomes rather than hardware/software implementation.

I toured several facilities and had the opportunity to study the IT infrastructure and applications used in different settings.

A few observations:

*Shanghai community hospitals have deployed a standardized EHR that is good enough - it enables enough clinical documentation to provide continuity of care.

*Tertiary facilities have not widely adopted advanced clinical IT systems.  They have focused on  administrative transactions (registration/scheduling) and ancillary automation (lab/rad/pharmacy) but not provider order entry, decision support, or clinical documentation.   The systems are optimized for episodic and not continuous care.

*This is my third visit to Shanghai and I've advised their health information exchange efforts by suggesting content, vocabulary and transport standards.    Shanghai is piloting health information exchange that involves transport of XML-based summary records over VPN.  The Chinese have a national identifier they use for healthcare and have privacy policy that makes data sharing a public good in society.    Culturally, there seem to be few expectations of healthcare data privacy.    Limited regulatory/compliance oversight enables the Chinese to move quickly but also providers fewer controls.   There is very little assertion of malpractice.

My conclusion from these Chinese visits is that healthcare IT challenges are similar worldwide.   I enjoy sharing our US experiences with other countries and look forward to the day when continuous lifetime coordinated care based on interoperability of data is a worldwide possibility.

recomended product suport by amazon