I've written several posts about the issues that keep me up at night. Here's what I wrote in 2011.
Today, my team presented a list of risks to the Compliance, Audit and Risk Committee at BIDMC. Here's my list of top risks for 2012:
1. Old Internet browsers - many vended clinical applications require specific versions of older browsers such as Internet Explorer 6, which are known to have security flaws. We've worked diligently to eliminate, upgrade or replace applications with browser specificity. At this point we are 96% Internet Explorer 8/Firefox 7/Safari 5 minimizing our risks to the extent possible.
2. Local Administrative rights - Of our 18,000 devices on the network, a few thousand are devices that require the user to have local administrative rights to run their niche applications (often the research community doing cutting edge research with open source or self developed software). We have done everything possible to eliminate Local Administrative rights on our managed devices.
3. Outbound transmissions - Security has historically focused on blocking evil actors from the internet. Given the current challenges of malware and infections brought in from the outside, it's equally critical to block unexpected outbound activity.
4. Public facing websites - any machine that touches the internet has the potential to be targeted for attack. We've implemented proxy servers/web application firewalls on most public websites.
5. Identity and Access management - Managing the ever changing roles and rights of individuals in a large complex organization with many partners/affiliates is challenging. If an affiliate asks for access to an application, how do you automatically deactivate accounts when users leave an affiliate, given the lack of direct employment relationships?
6. Anti-virus - the best anti-virus applications only catch about 50% of malware. Thus, a multi-layered defense is required. However, adding all those layers impacts performance and can result in false positives. Balancing security, reliability, and performance is challenging.
7. Security awareness - When that phishing email arrives asking users for their username/password, social security number, and a DNA sample, some people still fall for it. Many users surf sites that are known virus distribution sites. Even social networking is a vector for malware.
8. Keystroke loggers and screen scrapers - mobile devices and home computers beyond IT control may contain keystroke loggers that capture user credentials, bypassing encryption, VPNs, and other layers of security.
9. Forensics - increasingly sophisticated security infrastructure implies more events to research which requires additional staff that are challenging to find, recruit and retain.
10. Third party desktop software - it's no longer the operating system that presents the greatest risk, but security holes in Java and Adobe products such as Flash.
Security is journey and you'll never be done. The hope is that your risk profile improves over time as more of the environment is locked down, creating a restrictive rather than permissive infrastructure which makes services available by exception to the minimum extent necessary while balancing security and ease of use. As I've said before, this is a Cold War at a time when Meaningful Use encourages more data sharing and breach reporting/regulatory penalties are increasingly severe. All you can do is your best, given fixed resources and time. And try to get some sleep.
Tuesday, April 10, 2012
Monday, April 9, 2012
The Medicare Electronic Prescribing Incentive Program and Meaningful Use
I was recently asked by BIDMC clinical leaders to describe the difference between the Medicare Electronic Prescribing Incentive Program and the Meaningful Use Stage 1 core requirement to e-Prescribe.
Some clinicians are receiving Medicare penalties/fee reductions even though they have achieved the much more rigorous Meaningful Use requirements.
The Medicare Electronic Prescribing Incentive Program and Meaningful Use are two separate initiatives with two separate requirements, although both promote the use of electronic prescribing through the use of incentives and payment adjustments.
The Medicare Electronic Prescribing Incentive Program promotes electronic prescribing by requiring that an eligible professional report the electronic prescribing activities using G-codes in billing claims for 10 encounters per year.
The Meaningful Use Stage 1 requirements promote electronic prescribing by requiring that clinicians meet an electronic prescribing objective by electronically prescribing at least 40% of permissible prescriptions.
Beginning 2012, Congress authorized payment adjustments for clinicians who did not become successful electronic prescribers under the Medicare Electronic Prescribing Incentive Program . The 2011 Medicare Physician Fee Schedule outlined the requirements to avoid the 2012 payment adjustment. Eligible professionals were required to report the electronic prescribing measure using the G8553 g-code via claims for at least 10 unique visits where the clinician generated an electronic prescription from Jan. 1, 2011 – June 30, 2011.
Since Meaningful Use does not require claims-based reporting of e-prescribing, it is possible that clinicians could have achieved Meaningful Use but still been subject to the 2012 eRx payment adjustment.
Clinicians cannot receive incentives under both programs, but they can be penalized under the Medicare Electronic Prescribing Incentive Program. The AMA produced a useful guide to incentives and penalties.
The Medicare Electronic Prescribing program applies to 2013 and 2014 and then will end. Thus, make sure you enter your G-codes for 10 encounters that included e-prescribing even if you have attested for Meaningful Use. That way, you'll avoid the penalties.
Some clinicians are receiving Medicare penalties/fee reductions even though they have achieved the much more rigorous Meaningful Use requirements.
The Medicare Electronic Prescribing Incentive Program and Meaningful Use are two separate initiatives with two separate requirements, although both promote the use of electronic prescribing through the use of incentives and payment adjustments.
The Medicare Electronic Prescribing Incentive Program promotes electronic prescribing by requiring that an eligible professional report the electronic prescribing activities using G-codes in billing claims for 10 encounters per year.
The Meaningful Use Stage 1 requirements promote electronic prescribing by requiring that clinicians meet an electronic prescribing objective by electronically prescribing at least 40% of permissible prescriptions.
Beginning 2012, Congress authorized payment adjustments for clinicians who did not become successful electronic prescribers under the Medicare Electronic Prescribing Incentive Program . The 2011 Medicare Physician Fee Schedule outlined the requirements to avoid the 2012 payment adjustment. Eligible professionals were required to report the electronic prescribing measure using the G8553 g-code via claims for at least 10 unique visits where the clinician generated an electronic prescription from Jan. 1, 2011 – June 30, 2011.
Since Meaningful Use does not require claims-based reporting of e-prescribing, it is possible that clinicians could have achieved Meaningful Use but still been subject to the 2012 eRx payment adjustment.
Clinicians cannot receive incentives under both programs, but they can be penalized under the Medicare Electronic Prescribing Incentive Program. The AMA produced a useful guide to incentives and penalties.
The Medicare Electronic Prescribing program applies to 2013 and 2014 and then will end. Thus, make sure you enter your G-codes for 10 encounters that included e-prescribing even if you have attested for Meaningful Use. That way, you'll avoid the penalties.
Friday, April 6, 2012
The Health Informatics Industry Maturity Survey
Although I normally write a cool technology update on Friday, today I want to share an important survey - the 2012 Deloitte-AMIA Health Informatics Industry Maturity Survey targeting US-focused provider, health plan and life sciences organizations.
This project will help us all understand the alignment of healthcare informatics efforts, organizational strategy, and business alignment. If this first iteration goes well, Deloitte and AMIA hope to make it an annual survey, opening it to a wider audience that includes public health, government, and perhaps making it global in scope.
I completed it on behalf of BIDMC and look forward to the results. As you can imagine, I said that informatics is critically important and needs more institutional funding!
This project will help us all understand the alignment of healthcare informatics efforts, organizational strategy, and business alignment. If this first iteration goes well, Deloitte and AMIA hope to make it an annual survey, opening it to a wider audience that includes public health, government, and perhaps making it global in scope.
I completed it on behalf of BIDMC and look forward to the results. As you can imagine, I said that informatics is critically important and needs more institutional funding!
Thursday, April 5, 2012
Our Cancer Journey Week 16
Kathy returns to chemotherapy tomorrow although the numbness in her hands and feet has not changed and she now has a probable tear of a ligament in her right knee, which gives new meaning to limping through her treatments.
Many people responded to my March 29 post with concern that Kathy and I might lose our optimism, given all the events happening in our lives simultaneously.
We have two responses to the events that life throws at us
1. First, we have the support of each other. We have not been apart more than a few days for past 32 years and have the same passion, infatuation, and mutual respect for each other we had on day 1.
2. Second, we believe that everything happens for a reason.
We do not follow any formal religion, although I was baptized a Catholic and Kathy was raised in a Methodist household. We have great respect for the world's religions and feel a special affinity to the Japanese Shinto believe that there is spirituality in every rock, tree, and mountain.
However, we do have a sense that some karmic force guides us on the path of life. We've had many high highs and an equal number of low lows. At the time, we had no idea why the bad things happened, only to discover later that they changed our path to enable an even greater positive event.
Before Kathy's cancer diagnosis, we were looking at Vermont farm property, realizing that it would be challenging to juggle our full time careers in Boston and life in Vermont. We were willing to consider a Boston apartment during the week and rural Vermont on weekends.
The cancer diagnosis made us realize that we needed to be close to Boston for treatment and stay together in a single location all week long.
Our attention turned to property in Sherborn and Harvard, MA. We bid on one property in Sherborn and the seller decided not to sell. We were disappointed at the time, but the challenge enabled us to find an even better, more suitable property that we've agreed to purchase. We move April 27.
Our Wellesley home was the subject of many inquiries even before it was listed. We accepted one offer, but they buyers had bid on two properties and decided to purchase another home. Again, we were disappointed but we kept preparing our home for the best open house possible. We received several offers on the first day and we believe that following the standard listing process, instead of a pre-sale, will be a better outcome for everyone.
It seems odd that cancer would lead us to a farm in Sherborn and a good sale of our existing Wellesley home, but it did.
Kathy will be cured, I'm confident of that, so this series of events, however painful and stressful, will make us stronger and even better poised for the future.
So tomorrow, we'll continue with the chemotherapy, documenting the numbness and the side effects. Next week, Kathy will see an orthopedist for a probable medial collateral ligament tear. And we'll finish the inspections and contingencies that are part of selling our home.
Everything happens for a reason. By Summer, we'll be transitioned to our new life and will finally appreciate the reasons behind the path that we're traversing.
Many people responded to my March 29 post with concern that Kathy and I might lose our optimism, given all the events happening in our lives simultaneously.
We have two responses to the events that life throws at us
1. First, we have the support of each other. We have not been apart more than a few days for past 32 years and have the same passion, infatuation, and mutual respect for each other we had on day 1.
2. Second, we believe that everything happens for a reason.
We do not follow any formal religion, although I was baptized a Catholic and Kathy was raised in a Methodist household. We have great respect for the world's religions and feel a special affinity to the Japanese Shinto believe that there is spirituality in every rock, tree, and mountain.
However, we do have a sense that some karmic force guides us on the path of life. We've had many high highs and an equal number of low lows. At the time, we had no idea why the bad things happened, only to discover later that they changed our path to enable an even greater positive event.
Before Kathy's cancer diagnosis, we were looking at Vermont farm property, realizing that it would be challenging to juggle our full time careers in Boston and life in Vermont. We were willing to consider a Boston apartment during the week and rural Vermont on weekends.
The cancer diagnosis made us realize that we needed to be close to Boston for treatment and stay together in a single location all week long.
Our attention turned to property in Sherborn and Harvard, MA. We bid on one property in Sherborn and the seller decided not to sell. We were disappointed at the time, but the challenge enabled us to find an even better, more suitable property that we've agreed to purchase. We move April 27.
Our Wellesley home was the subject of many inquiries even before it was listed. We accepted one offer, but they buyers had bid on two properties and decided to purchase another home. Again, we were disappointed but we kept preparing our home for the best open house possible. We received several offers on the first day and we believe that following the standard listing process, instead of a pre-sale, will be a better outcome for everyone.
It seems odd that cancer would lead us to a farm in Sherborn and a good sale of our existing Wellesley home, but it did.
Kathy will be cured, I'm confident of that, so this series of events, however painful and stressful, will make us stronger and even better poised for the future.
So tomorrow, we'll continue with the chemotherapy, documenting the numbness and the side effects. Next week, Kathy will see an orthopedist for a probable medial collateral ligament tear. And we'll finish the inspections and contingencies that are part of selling our home.
Everything happens for a reason. By Summer, we'll be transitioned to our new life and will finally appreciate the reasons behind the path that we're traversing.
Wednesday, April 4, 2012
The Magic of Doing One Thing at a Time
I've previously written about multitasking and work induced attention deficit disorder.
I've also written about the burden of having two workdays every 24 hours - one for meetings and one for email
Yesterday, I was sent a post from the Harvard Business Review that summarizes these issues very well.
It highlights the problem and a series of solutions.
Nearly half of employees report the overwhelming stress and burden of their current jobs, not based on the hours they work, but the volume of multitasking - too many simultaneous inputs in too little time. They've lost the sense of a beginning, middle, and an end to their day, their tasks and their projects. There is no work/life boundary.
As a case in point, I'm writing now while doing email and listening to a Harvard School of Public Health eHealth symposium. Am I being more productive or just doing a greater quantity of work with less quality?
The author of the post points to evidence that multi-tasking increases the time to finish a task by 25%. He also notes that our energy reserves are depleted by a constant state of post traumatic stress induced by our continuous connectivity.
He suggests three strategies
1. Rather than multi-task, reduce meeting times to 45 minutes, leaving 15 minutes for email catchup and transition.
2. Do not expect and do not support the notion that email should be a real time activity.
3. Take breaks and ensure there are boundaries between work and non-work activities.
He suggests three personal best practices
1. Do your most important task of the day without interruption first thing in the morning. That's what I've done for years.
2. Create specific dedicated time for long term, creative thinking.
3. Take vacations.
A great post. Unless all of us declare that the multi-tasking emperor has no clothes, continuous partial attention will only get worse.
I've also written about the burden of having two workdays every 24 hours - one for meetings and one for email
Yesterday, I was sent a post from the Harvard Business Review that summarizes these issues very well.
It highlights the problem and a series of solutions.
Nearly half of employees report the overwhelming stress and burden of their current jobs, not based on the hours they work, but the volume of multitasking - too many simultaneous inputs in too little time. They've lost the sense of a beginning, middle, and an end to their day, their tasks and their projects. There is no work/life boundary.
As a case in point, I'm writing now while doing email and listening to a Harvard School of Public Health eHealth symposium. Am I being more productive or just doing a greater quantity of work with less quality?
The author of the post points to evidence that multi-tasking increases the time to finish a task by 25%. He also notes that our energy reserves are depleted by a constant state of post traumatic stress induced by our continuous connectivity.
He suggests three strategies
1. Rather than multi-task, reduce meeting times to 45 minutes, leaving 15 minutes for email catchup and transition.
2. Do not expect and do not support the notion that email should be a real time activity.
3. Take breaks and ensure there are boundaries between work and non-work activities.
He suggests three personal best practices
1. Do your most important task of the day without interruption first thing in the morning. That's what I've done for years.
2. Create specific dedicated time for long term, creative thinking.
3. Take vacations.
A great post. Unless all of us declare that the multi-tasking emperor has no clothes, continuous partial attention will only get worse.
Tuesday, April 3, 2012
The Menu Set Options Not Chosen
Hospitals and eligible professionals are attesting to Meaningful Use at an accelerating rate. To me, the Stage 1 Menu Set options NOT CHOSEN are the most valuable predictor of the challenging areas in Stage 2, since all the Stage 1 Menu Set items become Core in Stage 2.
At the January HIT Policy Committee, CMS presented an overview of Menu Set items deferred. Interestingly, the items deferred in Stage 1 are those most likely required for successful Accountable Care Organizations and interoperability.
The top items hospitals deferred are: Summary of care at transitions (93% deferred), medication reconciliation (75%), and provide educational resources to patients (62%).
The top items Eligible Professionals deferred are: Summary of care at transitions (85% deferred), patient reminders sent via patient preference (77%), medication reconciliation (56%), provide timely electronic access to data via PHR (62%), and provide educational resources (49%).
Submitting reportable lab results and syndromic surveillance for Public Health were largely deferred as well.
Since Meaningful Use Stage 2 has a first attestation date of October 1, 2014 with a one year reporting period, EHR vendors must support these functions via certified systems and clinicians should be using these capabilities by October 1, 2013.
Given that the Stage 2 NPRM will be finalized by August, and you'll have one year to fully implement all this functionality, I suggest working now on these Menu Set options not chosen:
1. Work with your EHR vendor to create a summary of care document (C32 for now, Consolidated CDA in 2013) and partner with your state HIE or other vendor to send these summaries to stakeholders such as primary care providers.
2. Work with e-prescribing networks and your EHR vendor to implement medication reconciliation that leverages outpatient prescription records available from national databases.
3. Work with your EHR vendor and third party knowledge services companies to make patient educational materials available in appropriate languages for your population.
4. Work with your local or state public health department to implement immunization, reportable lab, and syndromic surveilance transactions
5. Work with your EHR vendor to implement patient portals tethered to your EHR or transmission of summary data to non-tethered patient portals such as Microsoft Healthvault.
Robert Frost took the road less traveled and it made all the difference. In 2012, focus on the Menu Set Options Not Chosen and it will make all the difference in your preparations for Stage 2.
At the January HIT Policy Committee, CMS presented an overview of Menu Set items deferred. Interestingly, the items deferred in Stage 1 are those most likely required for successful Accountable Care Organizations and interoperability.
The top items hospitals deferred are: Summary of care at transitions (93% deferred), medication reconciliation (75%), and provide educational resources to patients (62%).
The top items Eligible Professionals deferred are: Summary of care at transitions (85% deferred), patient reminders sent via patient preference (77%), medication reconciliation (56%), provide timely electronic access to data via PHR (62%), and provide educational resources (49%).
Submitting reportable lab results and syndromic surveillance for Public Health were largely deferred as well.
Since Meaningful Use Stage 2 has a first attestation date of October 1, 2014 with a one year reporting period, EHR vendors must support these functions via certified systems and clinicians should be using these capabilities by October 1, 2013.
Given that the Stage 2 NPRM will be finalized by August, and you'll have one year to fully implement all this functionality, I suggest working now on these Menu Set options not chosen:
1. Work with your EHR vendor to create a summary of care document (C32 for now, Consolidated CDA in 2013) and partner with your state HIE or other vendor to send these summaries to stakeholders such as primary care providers.
2. Work with e-prescribing networks and your EHR vendor to implement medication reconciliation that leverages outpatient prescription records available from national databases.
3. Work with your EHR vendor and third party knowledge services companies to make patient educational materials available in appropriate languages for your population.
4. Work with your local or state public health department to implement immunization, reportable lab, and syndromic surveilance transactions
5. Work with your EHR vendor to implement patient portals tethered to your EHR or transmission of summary data to non-tethered patient portals such as Microsoft Healthvault.
Robert Frost took the road less traveled and it made all the difference. In 2012, focus on the Menu Set Options Not Chosen and it will make all the difference in your preparations for Stage 2.
Monday, April 2, 2012
More PopHealth Lessons learned
In the March HIT Standards Committee we highlighted 3 gaps in the standards needed to calculate quality metrics automatically from EHRs
1. A longitudinal (not encounter level) patient summary format to transmit appropriate data elements from an EHR to a quality measurement entity
2. A batch reporting format to transmit data elements for multiple patients to a quality measurement entity
3. Although PQRI XML and QRDA have been suggested for reporting data between quality measurement entities and organizations that use this data for payment/compliance, there is not a widely adopted standard for quality reporting in production today.
As I wrote in a wrote in a previous post, ONC/MITRE/BIDMC/Massachusetts eHealth collaborative worked together to evaluate the PopHealth tool with 2 million Continuity of Care Documents.
The full results of that analysis are now available and here's the document for public circulation.
Key lessons learned include
1. The CCD is a “post-encounter message” not a lifetime clinical summary optimized for quality measurement
The CCD/C32 was designed as an encounter level summary from a single organization. Each patient will have multiple CCD/C32s but there are no well defined process for merging CCDs from multiple institutions and applications. popHealth was expecting each C32 to contain the complete clinical history for one patient since quality measures are often focused on longitudinal treatment of patient, not a single encounter.
2. Meaningful Use Stage 1 permitted multiple vocabularies (or did not specify a vocabulary) resulting in optionality/variability in CCDs
BIDMC's CCD uses SNOMED for diagnosis, CPT for procedure coding and LOINC for vital signs. popHealth expected SNOMED for procedure coding and vital signs.
Meaningful Use Stage 2 will correct this problem by specifying one vocabulary without optionality for each portion of the record
3. Quality numerators and denominators are imprecisely defined
Since quality measures are not defined in precise "SQL" or e-measure form, humans have to read the text of the measure and decide how to implement it. For example, does less than or equal to 84 years old refer to 84 years and 0 days verses 84 years and 364 days
Thus, to accelerate quality measurement in the US we should
1. Chose a clinical summary standard for transmission of longitudinal patient care data to quality measurement entities
2. Specify a one vocabulary without optionality for each portion of the record
3. Use e-measurements format to describe numerators and denominators in machine readable logic
If we do this, we'll be able to widely deploy popHealth to automatically calculate quality measures on data exchange from EHRS. We'll also be able to more effectively use architectures like QueryHealth that submit questions to the data rather than aggregate the data into a central quality measurement entity.
The Standards Committee is already hard at work on all these standards.
1. A longitudinal (not encounter level) patient summary format to transmit appropriate data elements from an EHR to a quality measurement entity
2. A batch reporting format to transmit data elements for multiple patients to a quality measurement entity
3. Although PQRI XML and QRDA have been suggested for reporting data between quality measurement entities and organizations that use this data for payment/compliance, there is not a widely adopted standard for quality reporting in production today.
As I wrote in a wrote in a previous post, ONC/MITRE/BIDMC/Massachusetts eHealth collaborative worked together to evaluate the PopHealth tool with 2 million Continuity of Care Documents.
The full results of that analysis are now available and here's the document for public circulation.
Key lessons learned include
1. The CCD is a “post-encounter message” not a lifetime clinical summary optimized for quality measurement
The CCD/C32 was designed as an encounter level summary from a single organization. Each patient will have multiple CCD/C32s but there are no well defined process for merging CCDs from multiple institutions and applications. popHealth was expecting each C32 to contain the complete clinical history for one patient since quality measures are often focused on longitudinal treatment of patient, not a single encounter.
2. Meaningful Use Stage 1 permitted multiple vocabularies (or did not specify a vocabulary) resulting in optionality/variability in CCDs
BIDMC's CCD uses SNOMED for diagnosis, CPT for procedure coding and LOINC for vital signs. popHealth expected SNOMED for procedure coding and vital signs.
Meaningful Use Stage 2 will correct this problem by specifying one vocabulary without optionality for each portion of the record
3. Quality numerators and denominators are imprecisely defined
Since quality measures are not defined in precise "SQL" or e-measure form, humans have to read the text of the measure and decide how to implement it. For example, does less than or equal to 84 years old refer to 84 years and 0 days verses 84 years and 364 days
Thus, to accelerate quality measurement in the US we should
1. Chose a clinical summary standard for transmission of longitudinal patient care data to quality measurement entities
2. Specify a one vocabulary without optionality for each portion of the record
3. Use e-measurements format to describe numerators and denominators in machine readable logic
If we do this, we'll be able to widely deploy popHealth to automatically calculate quality measures on data exchange from EHRS. We'll also be able to more effectively use architectures like QueryHealth that submit questions to the data rather than aggregate the data into a central quality measurement entity.
The Standards Committee is already hard at work on all these standards.
Subscribe to:
Posts (Atom)
