N.S.A. Able to Foil Basic Safeguards of Privacy on Web, Including Medical Records - Yet Another Reason To Be Concerned About What You Tell Your Physician

There's already a major issue with privacy and protection of medical records in electronic form.  See the multiple blog posts at this query link:  http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy

Now this from the New York Times:

N.S.A. Able to Foil Basic Safeguards of Privacy on Web
By NICOLE PERLROTH, JEFF LARSON and SCOTT SHANE
September 5, 2013

The National Security Agency is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents.

The agency has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans and others around the world, the documents show.  

But don't worry, your electronic medical records are secure, and will NEVER be used for political purposes by your adversaries...

Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. Having lost a public battle in the 1990s to insert its own “back door” in all encryption, it set out to accomplish the same goal by stealth. 

The agency, according to the documents and interviews with industry officials, deployed custom-built, superfast computers to break codes, and began collaborating with technology companies in the United States and abroad to build entry points into their products. The documents do not identify which companies have participated.

At least we may have gotten faster PC's as a side result of the research that supported these efforts.

... the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.

Some of the agency’s most intensive efforts have focused on the encryption in universal use in the United States, including Secure Sockets Layer, or SSL; virtual private networks, or VPNs; and the protection used on fourth-generation, or 4G, smartphones. Many Americans, often without realizing it, rely on such protection every time they send an e-mail, buy something online, consult with colleagues via their company’s computer network, or use a phone or a tablet on a 4G network. 

Might as well just send them a copy of all your communications to spare them the effort...

... Ladar Levison, the founder of Lavabit, wrote a public letter to his disappointed customers, offering an ominous warning. “Without Congressional action or a strong judicial precedent,” he wrote, “I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.”

Hey, how about let's ALL have our medical records stored by health IT companies providing ASP (Application service provider, http://en.wikipedia.org/wiki/Application_service_provider) offsite EHR hosting services to hospitals and clinics...

From the site "techdirt.com":

Allegedly the NSA and GCHQ (UK Government Communications Headquarters) have basically gotten backdoors into various key security offerings used online, in part by controlling the standards efforts, and in part by sometimes covertly introducing security vulnerabilities into various products. They haven't "cracked" encryption standards, but rather just found a different way in. The full report is worth reading ... (http://www.techdirt.com/articles/20130905/12295324417/nsa-gchq-covertly-took-over-security-standards-recruited-telco-employees-to-insert-backdoors.shtml).

Half facetiously: unless you're a real nobody, if you, say, contracted V.D. from that sexy prostitute at that Vegas Convention, you perhaps better not tell your doctor about it.

Maybe this is what it will take to get the government to start taking electronic medical record privacy, confidentiality and security more seriously.

Our legislators, like everyone else, have a stake in the game.

-- SS

Michael Millenson and "the adamant refusal by hospitals and doctors to adopt electronic records no matter what the evidence"

Over at Health Beat by Maggie Mahar appears a piece critical of NYT reporter Julie Creswell's Feb. 20, 2013 article "A Digital Shift on Health Data Swells Profits in an Industry."  (The piece was also cross-posted at The Health Care Blog.)  There have been several responses highly critical of the NYT article recently in various venues.

The Health Beat piece "The Health IT Scandal the NY Times Didn’t Cover" is by Michael L. Millenson, president of Health Quality Advisors LLC in Highland Park, IL, and the author of the critically acclaimed book, Demanding Medical Excellence: Doctors and Accountability in the Information Age published in 2000.

I bought and read that book at the time.

The posting at Health Beat contains the following statement:

The actual scandal is more complicated and scary. It has to do with the adamant refusal by hospitals and doctors to adopt electronic records no matter what the evidence. 

I am profoundly disappointed by this statement in view of issues (frequently written about here and elsewhere) such as:

• The conflicting literature by credible and responsible parties on health IT's real-world value and risks as it exists today;  
• Fiduciary obligations of hospital executives to maintain safe operating conditions; 
• Legal and ethical obligations of physicians to resist technology they find or believe harmful without rigorous proof of its beneficence and efficacy (which includes the absence of major evidence conflicts); 
• The evidence of major and frequent flaws, bugs and "glitches", some of which are alarming;

not to mention:

• The 500+ reader comments in response to Creswell's article, many by clinicians describing why they don't like today's health IT; 
• Examples of unintended adverse consequences such as here (plus at least 5 other IT-related crippling injuries and/or deaths of infants I know of but cannot speak about), and here, and here;
• Other factors as at this blog and at my teaching site here.

I am trying to find a polite term for the statement, and struggling to do so in view of the author's prior work, which I admired.

The statement really is saying:

... It [the "scandal"] has to do with the adamant refusal by hospitals and doctors to adopt electronic records no matter what the evidence ... which is all exceptionally robust and positive, leaving no room whatsoever for reasonable doubt or caution.

Regrettably, here is the most polite term I can come up with describing the statement:

Preposterous.

If anyone takes offense to that term, please suggest a more precise one.

Perhaps a book needs to be written entitled "Demanding Information Technology Excellence: Health IT and Accountability in the Information Age."

-- SS

Mar. 4, 2013 addendum:

In a response to a reader's comment to the cross-posting of this piece at The Health Care Blog (link), Millenson responds:

"platon20: my point, that EMRs were available in the 1970s but never changed their interface because doctors never cared enough to demand it, is not refuted by your argument, but confirmed."

This is bizarre and inconsistent with my experience and that of other Chief Medical Informatics Officers I've mentored or spoken with.  Since my entry into the domain of Medical Informatics 21 years ago I've heard many physicians, myself included [1], demand that health IT sellers and/or hospital IT departments "improve the user interface", among other areas for improvement. 

Based on my own observations and that of others (e.g., via reader comments at my teaching site dating to at least 1999), these pleas have often fallen on the deaf - and in some cases ill-informed and/or incompetent - ears of hospital senior and IT executives and industry pundits.  The latter have often responded by accusing the physicians of being "Luddites" or technophobes, and the advocates for change such as myself "anti-health IT."

The most stunning example regarding this phenomenon is the industry pushback against Prof. Jon Patrick at U. Sydney, and the ignoring of his work (on both the user experience and the fundamental software engineering quality) sitting on a University server for several years now, regarding a major U.S. ED EHR slated for rollout in an entire state of Australia.  

With usability issues now being forced of the industry for reconsideration by HHS via NIST, the industry response has been to claim that "usability is in the eye of the beholder" and other frivolous claims, up to and including interference in the the public comments period on Meaningful Use via ghostwriting, and possibly outrageous statements (although that issue became anechoic), to get their way, which is to do little or nothing on that score.

I remind Millenson that "improving the user experience" of health IT cuts into the bottom line.

[1] e.g.,  in a project initiated 20 years ago by the clinicians themselves - in a critical care area no less - in which I had to take over through force of will from the hospital's own IT department and COO and  re-engineer not just the commercial user interface but the entire dataset itself.  The project ultimately proved successful after my intervention, but the mid-level executive who facilitated my takeover to do that, and I, were punished by our superiors for our efforts.

-- SS

New York Times: "A Digital Shift on Health Data Swells Profits in an Industry"

The New York Times has published an article today by Julie Creswell entitled "A Digital Shift on Health Data Swells Profits in an Industry."  It is available at this link.

... While proponents say new record-keeping technologies will one day reduce costs and improve care [only when today's bad health IT is abolished - see here - ed.], profits and sales are soaring now across the records industry. At Allscripts, annual sales have more than doubled from $548 million in 2009 to an estimated $1.44 billion last year, partly reflecting daring acquisitions made on the bet that the legislation would be a boon for the industry. At the Cerner Corporation of Kansas City, Mo., sales rose 60 percent during that period. With money pouring in, top executives are enjoying Wall Street-style paydays.

None of that would have happened without the health records legislation that was included in the 2009 economic stimulus bill — and the lobbying that helped produce it. Along the way, the records industry made hundreds of thousands of dollars of political contributions to both Democrats and Republicans. In some cases, the ties went deeper. Glen E. Tullman, until recently the chief executive of Allscripts, was health technology adviser to the 2008 Obama campaign. As C.E.O. of Allscripts, he visited the White House no fewer than seven times after President Obama took office in 2009, according to White House records.

The article does not reveal anything that readers of this blog did not know already.

The push for the financial incentives and profits were also written about at the The Huffington Post Investigative Fund by investigative reporter Fred Schulte, now at the Center for Public Integrity ("Stimulus Fuels Gold Rush For Electronic Health Systems"), and in the Washington Post by Robert O'Harrow Jr. (which I wrote about at this post:  The Machinery Behind Healthcare Reform: How the HIT Lobby is Pushing Experimental and Unsafe Technology on Unconsented Patients and Clinicians).

Rather than re-hash the issues, I wanted to focus on some of the current NYT reader comments:

... After a visit to a Florida hospital for suspicion of heart attack, I asked for a copy of my records to give my home (IL) physician. I was shocked to read that I had had "anal surgery." When I reviewed these records with my doctor, she told me that I had probably told the admitting ER nurse I had recently had a colonoscopy, so the closest coding information their electronic system allowed was anal surgery. So, how can these inaccuracies which will live on forever electronically be helpful toward patient care? The old acronym GIGO certainly applies here--garbage in; garbage out.

... This article highlights only one aspect of the "Failed Promise of Electronic Health Records". Through lobbying but also supported by a study from the RAND organization, the three final 2008 presidential candidates, Hillary Clinton, John McCain, and Barack Obama outbid each other with promises to spend billions to entice doctors to use electronic record systems. Unfortunately, because of unsolved documentation problems, such systems are often disliked and slow the process. Instead of creating interoperability, electronic medical record systems (EMRs) with limited functionality and benefits were created. In particular, true interoperability has been neglected and attempts to create it through networks in the form of CHINs, RHIOs, and HIEs have failed.

... Mr. Tullman's comment is priceless. “I think it’s very common with every administration that when they want to talk about the automotive industry, they convene automotive executives, and when they want to talk about the Internet, they convene Internet executives." Of course, when "they" want to radically alter the way doctors do their jobs, "they" talk to academics, lawyers, publicly traded insurance CEOs and internet executives. Today's diatribe about quality care being more important than quantity care is laugh out loud funny. Unless you're a physician. Only in America does getting paid less and less, with more clerical data entry record-keeping at every step just to get paid and protect against lawsuit, translate into an incentive to provide quality care. Somebody prescribe a dose of common sense. Oops. Too late.

... Every person needs a national health ID with up to date health information. To say that the current EMR systems are problematic would be an understatement. They take away face time with patients, the M.D.'s talents and time are wasted doing data entry and worst of all ,they are potentially dangerously flawed. An example is a recent patient I saw who was treated by a number of physicians. His medications had required significant changes which were done by 2 different M.D.'s from his main doctor. Both gave him computer generated lists from the same system. Both had a mixture of unmatching generic and proprietary names, the patient's actual medicines from the pharmacy had a mixture and different doses from the Dr.'s orders. He was trying to set up his week's supply. But didn't know which proprietary name went with which medicine. These systems should have been tried out on a small scale and approved by M.D.'s before this became law. The VA system which is time tested, physician friendly and free only the VA is using. These other systems are set up to maximize profits for the IT companies, cost the physicians huge amounts to install, cost the hospitals huge amounts esp when they are changing from one system to another due to problems when they were advertised to maximize hospital billing. This another example of our distorted legislative process where profits and politics take precedence over people.

... I am a dermatologist in private practice who teaches at a local medical school part time. Electronic records are problematic. Every doctor I know feels they take time away from being a doctor. I literally don't know a single colleague who feels their benefits are worth the extra time involved. In medical school, we learned how to record notes in medical records so that patient care is improved from visit to visit. In short, we use notes from the previous visits to assist in our decisions in subsequent examinations. In today's digital world, most doctors I know are forced to change their notation style to justify payments from insurance companies. The more detailed the note in the medical record, the lower the chance that an insurance company downgrades the fee charged to the patient. Thus, notes are now longer and more detailed than they were ten years ago. The problem with such notes is that they are filled with detritus geared to prevent payment reduction rather than aimed at improving continuity of patient care from visit to visit. The impact of this adoption of electronic medical records is that insurance company computer systems can easily sift through notes to reduce compensation to doctors who spend more time with patients and who write cleaner, more efficient notes.

... I still use pen and paper.  One requirement would fix this mess: interoperability No, NOT the "industry supported" standard. Thats a joke. Industry wants NO inter-operability because they want to lock us in to a an individual product, The government has a great EMR (the VA system). All commercial ones should be forced to be able to export data in a way that is 100% compatible with that. As such, they would then be 100% compatible with each other. Some of my colleagues are now on their third EMR product in 7 years. Why? Big company buys company B and then stops supporting it. The doctor is forced to switch to Big Company's new product. Of course the data does not transfer over so the doctor has to go through the crude data-entry mess all over.

... The folly of relying only on digital records. Without constant and costly software and hardware upgrades, your digital medical records will be rendered obsolete. Could be a matter of years or decades, but it will happen. Not only that, digital proprietary systems are at huge risk if the private for-profit company goes bankrupt. Paper records can last 1000 years.

... Another scam. Very expensive and involved for end user:ie doctor. Have had to hire an IT company to assist, have to pay annually for service contract, upgrades and what the article didn't mention was the "meaningful use" criteria that all doctors have to comply with in order to pass government inspection for a rebate. The software vendors, labs, and others are charging doctors extra for software upgrades and abilities to comply with each "meaningful use" component . This is already costing more money and aggravation than the worth of the government rebate. Who will subsidize this? Doctors are starting to lose interest. We know this is another corrupt government sponsored ploy and only the tip of the iceberg. If the government were to have spent the 19 billion with a consortium of vendors such as google apple and microsoft, the goal of free software provision capable of interexchangeable data would likely have been completed with all providers on board.

... Common sense can tell you that the real value of these systems is marginal. Much of medical treatment is "incident specific" where history is not necessary. Most PCP's already have a system that works. In larger systems and for complex diseases, perhaps EMR are beneficial but not for routine care. As has been noted, all sorts of problems arise with EMR's: destruction of MD-pt relationship, incorrect data being entered and never removed, cumbersome and expensive requirements of instituting and maintaining the system, etc. It is awful that physicians and patients are "used" in the service of politicians and EMR execs.

... As a practicing physician I have to struggle everyday with the Citrix and Quickbase electronic records. The Electronics Medical Records industry has been getting the gold promised by the government in exchange of a very poor and deficient product. The EMR industry has been selling to the healthcare providers, in need of electronic records, the equivalent of the Formaldehyde-contaminated trailer homes sold to FEMA for the Katrina homeless.

These are just from the first page of comments.  Read the article and the comments at the link above.

My observation is that it seems that as transparency increases, the public "gets it" that these systems are not the panacea the industry wants us to believe, and may impede the clinicians trying to treat them.

Now, when will the government "get it" that they've been had?

-- SS

Addendum:  another "anecdote" just caught my eye because it sings an unfortunate familiar tune to me:

So much data, so little knowledge. My best friend's father just died because none of his who-knows-how-many physicians took the time to actually read and anaylze the reams of info they were dutifully inputting. They killed him with an overdose of one drug and not enough of another.  Useful data collection and analysis is one thing, but what we seem to have now is just institutionalized hoarding. More data doesn't make anyone safer (except the data companies), just like stacks of old magazines or cans of beans makes one safer. More is NOT better; it is just more. More time and more expense wasted on stuff and less spent on actual health care. You've got to USE anything or it is just more useless and potentially dangerous stuff.

-- SS

New York Times: "In Second Look, Few Savings From Digital Health Records", and AMA Med News on EHR Harms

This post should perhaps be entitled "I told you so."

A letter I wrote in response to the Wall Street Journal's "A Health-Tech Monopoly", Feb. 11, 2009 was published Feb. 18, 2009 under the header Digitizing Medical Records May Help, but It's Complex.

I wrote:

Dear Wall Street Journal,

You observe that the true political goal is socialized medicine facilitated by health care information technology. You note that the public is being deceived, as the rules behind this takeover were stealthily inserted in the stimulus bill.

I have a different view on who is deceiving whom. In fact, it is the government that has been deceived by the HIT industry and its pundits. Stated directly, the administration is deluded about the true difficulty of making large-scale health IT work. The beneficiaries will largely be the IT industry and IT management consultants.

For £12.7 billion the U.K., which already has socialized medicine, still does not have a working national HIT system, but instead has a major IT quagmire, some of it caused by U.S. HIT vendors.

HIT (with a few exceptions) is largely a disaster. I'm far more concerned about a mega-expensive IT misadventure than an IT-empowered takeover of medicine.

The stimulus bill, to its credit, recognizes the need for research on improving HIT. However this is a tool to facilitate clinical care, not a cybernetic miracle to revolutionize medicine. The government has bought the IT magic bullet exuberance hook, line and sinker.

I can only hope patients get something worthwhile for the $20 billion.

Scot Silverstein, M.D.
Faculty, Biomedical Informatics
Drexel University Institute for Healthcare Informatics
Philadelphia

I also had penned essays on the need for a moratorium on HITECH (Nov. 2008, "Should The U.S. Call A Moratorium On Ambitious National Electronic Health Records Plans?" and Jan. 2009, "I Ask Again: Should The U.S. Call A Moratorium On Ambitious National Electronic Health Records Plans?").  My theme was that the issues with implementation of good health IT and elimination of bad health IT, and the issue of how to implement most efficiently, needed to be better understood before a national rollout.  Hold off multi-billion dollar national initiatives "until we know how to get HIT right", I wrote.

Now the New York Times has this, citing a new RAND paper:

In Second Look, Few Savings From Digital Health Records
By REED ABELSON and JULIE CRESWELL

January 10, 2013

The conversion to electronic health records has failed so far to produce the hoped-for savings in health care costs and has had mixed results, at best, in improving efficiency and patient care, according to a new analysis by the influential RAND Corporation.

Optimistic predictions by RAND in 2005 helped drive explosive growth in the electronic records industry and encouraged the federal government to give billions of dollars in financial incentives to hospitals and doctors that put the systems in place.

“We’ve not achieved the productivity and quality benefits that are unquestionably ["unquestionably?" why?- ed.]  there for the taking,” said Dr. Arthur L. Kellermann, one of the authors of a reassessment by RAND that was published in this month’s edition of Health Affairs, an academic journal.

Noted is the provenance of the 2005 report that created the windfall for the electronic records industry:

RAND’s 2005 report was paid for by a group of companies, including General Electric and Cerner Corporation, that have profited by developing and selling electronic records systems to hospitals and physician practices. Cerner’s revenue has nearly tripled since the report was released, to a projected $3 billion in 2013, from $1 billion in 2005.

A retraction:

The report predicted that widespread use of electronic records could save the United States health care system at least $81 billion a year, a figure RAND now says was overstated. The study was widely praised within the technology industry and helped persuade Congress and the Obama administration to authorize billions of dollars in federal stimulus money in 2009 to help hospitals and doctors pay for the installation of electronic records systems ... But evidence of significant savings is scant, and there is increasing concern that electronic records have actually added to costs by making it easier to bill more for some services.

In my Feb. 2009 WSJ letter, I'd written that "it is the government that has been deceived by the HIT industry and its pundits. Stated directly, the administration is deluded about the true difficulty of making large-scale health IT work. The beneficiaries will largely be the IT industry and IT management consultants."  It appears I was correct.

Officials at RAND said their new analysis did not try to put a dollar figure on how much electronic record-keeping had helped or hurt efforts to reduce costs. But the firm’s acknowledgment that its earlier analysis was overly optimistic adds to a chorus of concern about the cost of the new systems and the haste with which they have been adopted.

Not mentioned are harms that bad health IT is creating.

The recent analysis was sharply critical of the commercial systems now in place, many of which are hard to use and do not allow doctors and patients to share medical information across systems. “We could be getting much more if we could take the time to do a little more planning and to set more standards,” said Marc Probst, chief information officer for Intermountain Healthcare, a large health system in Salt Lake City that developed its own electronic records system

A "little more" planning?  How about several years' worth, to ensure the technologies are safe, effective and properly vetted, along with a system for post-market surveillance as exists in other healthcare sectors?

Technology “is only a tool,” said Dr. David Blumenthal, who helped oversee the federal push for the adoption of electronic records under President Obama and is now president of the Commonwealth Fund, a nonprofit health group. “Like any tool, it can be used well or poorly.” While there is strong evidence that electronic records can contribute to better care and more efficiency, Dr. Blumenthal said, the systems in place do not always work in ways that help achieve those benefits.

Dr. Blumenthal seems to be triangulating from his earlier 2010 NEJM statement that:

... The widespread use of electronic health records (EHRs) in the United States is inevitable. EHRs will improve caregivers’ decisions and patients’ outcomes. Once patients experience the benefits of this technology, they will demand nothing less from their providers. Hundreds of thousands of physicians have already seen these benefits in their clinical practice.

Meantime, in the real world signs of my expressed concerns about a quagmire are appearing:

... Late last year, a physician practice in Panama City, Fla., filed a lawsuit against the health care technology firm Allscripts after the company stopped supporting an electronic records system called MyWay that it had sold to 5,000 small-group physicians at a cost of $40,000 per physician. The lawsuit said that the system had problems and that the physician group was unable to meet the criteria for federal incentive money. A spokeswoman for Allscripts said it would defend itself vigorously.

A clue as to the candidness of the new report:

... The new analysis was not sponsored by any corporations, said Dr. Kellermann, who added that some members of RAND’s health advisory board wanted to revisit the earlier analysis.

Finally, this from the horse's mouth:

Dr. David J. Brailer, who was the nation’s first health information czar under President George W. Bush, said he still believed tens of billions of dollars could eventually be squeezed out of the health care system through the use of electronic records. In his view, the “colossal strategic error” that occurred was a result of the Obama administration’s incentive program.

I repeat my admonition from 2009 that I can only hope patients get something worthwhile for the $20 billion, which by now is probably many times that amount.

Finally, I note the American Medical News cites me in a Jan. 14, 2013 article as follows:

... Other experts on health IT said the Pennsylvania [PA Patient Safety Authority] study probably underestimates the extent of health IT safety problems. They say that is because the research is based on voluntary reports and that health professionals are unaware that a patient safety incident was caused by an EHR failure.

“These systems are incredibly complex,” said Scot M. Silverstein, MD, a consultant in medical informatics at Drexel University in Philadelphia. “They’re not just huge filing cabinets, they are enterprise resource management systems. There are many ways that things can go wrong that may not be seen as the computer having caused the mess-up in the first place.”

For example, he said, it would be difficult for a practicing physician to detect when data are missing from a record or that an alert failed to pop up.

Yet the title of the article is "EHR-related errors soar, but few harm patients" with a table at the bottom labeled "How rarely EHR problems harm patients." More evidence that EHRs always receive special accommodation. 

I was an invited reviewer of the PA Patient Safety Authority report, and wrote about the major deficiencies of its dataset at my posts Dec. 13, 2012 post "Pennsylvania Patient Safety Authority: The Role of the Electronic Health Record in Patient Safety Events" and a follow-up Dec. 19 post "A Significant Additional Observation on the PA Patient Safety Authority Report -- Risk."

My major point was that one simply cannot know what one cannot know, when using a very incomplete dataset gathered in a setting of systematic impediments to accuracy and completeness.  For instance, as I wrote in those earlier posts, through my work I personally know of cases of harms up to and including death that should have been in the PA database, but apparently are not - and I'm just one person.

We simply don't know in 2013 how many EHR errors harm patients, and the effects of increasing adoption by organizations and physicians less technology-able than current adopters.  I hope the magnitude of harms is truly small, but hope is not enough; this study and report was just a 'dipping of the toes into the water' towards understanding the realities.

Incidentally, we also don't know how severely the known toxic effects of bad health IT might affect care in times of duress, e.g., an epidemic.  However, I am certainly not sanguine about EHRs in their present state as robustly facilitating national emergency preparedness.

My dreaded prediction for the future?  A 2016 AMA News story entitled "Known EHR-related harms soar."

-- SS

Cybernetik Über Alles Again: HHS and Sebelius - Hospitals And Their Computers Have More Rights Than Patients

A Nov. 29, 2012 New York Times article by Reed Abelson entitled "Medicare Is Faulted on Shift to Electronic Records" observes that:

The conversion to electronic medical records — a critical piece of the Obama administration’s plan for health care reform — is “vulnerable” to fraud and abuse because of the failure of Medicare officials to develop appropriate safeguards, according to a sharply critical report to be issued Thursday by federal investigators [the report from HHS OIG is here - ed.] ... Medicare, which is charged with managing the incentive program that encourages the adoption of electronic records, has failed to put in place adequate safeguards to ensure that information being provided by hospitals and doctors about their electronic records systems is accurate. To qualify for the incentive payments, doctors and hospitals must demonstrate that the systems lead to better patient care, meeting a so-called meaningful use standard by, for example, checking for harmful drug interactions. [I note that meeting EHR "meaningful use" standards does not necessarily signify better care; the "standards" are experimental - ed.]

Hospitals and doctors are lying about their EHR efforts, in order to gain incentive payments, it seems.

In an article "IG says program is 'vulnerable' to abuse, better oversight needed", Fred Schulte at the Center for Public Integrity notes:

... the Centers for Medicare and Medicaid Services has since paid out more than $3.6 billion to medical professionals who made the switch without verifying they are meeting the required quality goals, according to a new federal audit to be released today

Observes the CEO of the American Health Information Management Association:

“We’ve gone from the horse and buggy to the Model T, and we don’t know the rules of the road. Now we’ve had a big car pileup,” said Lynne Thomas Gordon, the chief executive of the American Health Information Management Association, a trade group in Chicago. 

More Horse and Buggy than Model T.  At least the Model T was reasonably dependable. 

Also mentioned is this:

House Republicans echoed these concerns in early October in a letter to Kathleen Sebelius, secretary of health and human services. Citing the Times article, they called for suspending the incentive program until concerns about standardization had been resolved. “The top House policy makers on health care are concerned that H.H.S. is squandering taxpayer dollars by asking little of providers in return for incentive payments,” said a statement issued at the same time by the Republicans, who are likely to seize on the latest inspector general report as further evidence of lax oversight. Republicans have said they will continue to monitor the program.

In her letter in response, which has not been made public, Ms. Sebelius dismissed the idea of suspending the incentive program, arguing that it “would be profoundly unfair to the hospitals and eligible professionals that have invested billions of dollars and devoted countless hours of work to purchase and install systems and educate staff.”

I was taught "first, do no harm."  Fairness to patients injured and killed by this technology in its present "Horse and Buggy" state (buggy being a particularly apropos term) seems not a matter of particularly high concern to HHS.   A suspension of incentives would slow the adoption rate down, necessary in order to "get the bugs" out of the technology before mass deployment and develop safety, validation and surveillance standards (currently non-existent), as I wrote in my Oct. 24, 2012 "Letter To U.S. Senators and Representatives Who've Sought HHS Input On EHR Problems."

This is despite the fact that FDA, IOM and others have indicated the level of harm is not known, due to systematic impediments to diffusion of that knowledge (see IOM statements in the midsection of my post on health information technology hyper-enthusiasm at this link, and an internal FDA memo on HIT safety at this link). 

HHS seems to care not about health and human services, or at best to be severely misguided.  "Cybernetik Über Alles" seems their current credo.

-- SS

A Response to the NY Times Article "Ups and Downs of EMRs" So Full Of The Usual Refrains, I Am Using It To Throw A Spotlight On Those Endlessly-Repeated Memes

My Google search alert turned up a response to the Oct. 8, 2012 NY Times article The Ups and Downs of Electronic Medical Records by Milt Freudenheim.

It was posted on the blog of a company Medical-Billing.com and is filled with the usual rhetoric and perverse excuse-making.

It is, in fact, so laden with typical industry refrains and excuse-making that I am using it to throw a spotlight on the misconceptions and canards proffered by that industry in defense of its uncontrolled practices:

A Response to the NY Times on Electronic Medical Records
Posted on October 10, 2012 by Kathy McCoy

A recent article by the New York Times entitled “The Ups and Downs of Electronic Medical Records” has generated a lot of discussion among the HIT community and among healthcare professionals.

It’s an excellent article, looking at concerns that a number of healthcare professionals have about the efficiency, accuracy and reliability of EMRs. One source quoted, Mark V. Pauly, professor of health care management at the Wharton School, said the health I.T. industry was moving in the right direction but that it had a long way to go before it would save real money.

“Like so many other things in health care,” Dr. Pauly said, “the amount of accomplishment is well short of the amount of cheerleading.”

Seriously? I can’t believe we’re still having this conversation.  [Emphasis in the original - ed.] 

I can believe it -- and quite seriously -- as it's a "conversation" long suppressed by the health IT industry and its pundits.

Seriously, I can't believe the comment about "it's an excellent article"; that comment appears to merely be a distraction for the interjection of attacks upon the substance of selfsame "excellent" article.

In a world where I can go to Lowe’s and they can tell me what color paint I bought a year ago, or I can call Papa John’s and they know what my usual pizza order is, how can we expect less from our healthcare systems?

Because healthcare is not at all like buying paint and ordering a pizza, being several orders of magnitude more demanding and complex and on many different planes (e.g, educational, organizational, social and ethical to name a few).  Only the most avid IT hyper-enthusiast (or those prone to ignoratio elenchi) would make such a risible comparison.

I recently joined a new healthcare system, and I have been impressed and pleased by their use of EMR and technology. I no longer have to worry about whether I told the new specialist everything he or she needed to know about my health history; it’s in my record. I no longer have to remember when I had my last tetanus shot; it’s in my record.

My care is coordinated between doctors, labs, etc., better than it ever has been before. In the past, I felt as though my healthcare was a giant patchwork quilt—and some of the stitches were coming loose, frankly. This new system with a widely used EMR, to me, is a huge improvement.

The problem with this argument is that n=1, and the going's not yet gotten tough, such as it had for people injured or killed as a result of the experimental state of current health IT.

Granted, the problems cited in the article are real and need to be addressed. 

Another dubious statement to be followed with excuses ... here it is:

However, the article itself mentions some redundancies that are in place to insure that a system going down doesn’t throw the entire Mayo Clinic into freefall. And certainly, additional redundancies may be needed to insure that prescriptions aren’t incorrectly sent to a pharmacy for the wrong patient, etc.

Those "redundancies" are not complete, do not cover for all aspects of enterprise health IT when it is down, and necessarily compromise patient care when they have to be called upon.   I, for one, a physician, would not enjoy being a patient nor taking care of patients when the "IT lights" go out.

Do doctors and medical staff need to learn how to code correctly so that they aren’t accused of cloning? Yes—but that’s a relatively easy problem to fix. The problem has already been identified, and training has already begun to address the issue.

Cloning of notes and "coding correctly" are two entirely different issues.  Easy to fix?  The health IT industry has been saying all its problems are easy to fix, i.e., in version 2.0 ... for the past several decades, when few if any problems have been.

I have been through this type of problem before, as have many of you, with new systems. It’s called a learning curve, and it’s relatively easy to work through with patience and determination. I have encountered situations before where the team I was working with threw up their hands when they ran into problems learning a new database system and said “It doesn’t work.” Yet in time, they learned to love the system—and some of the biggest doubters became the experts on it.

I surmise that since they were forced into using it, the Stockholm Syndrome was likely at work.  However, speculation aside, the seemingly banal statement that "it’s called a learning curve" is an ethical abomination.  The subjects of these systems are human beings, not lab rats.

Further, health IT is not a "database system."  It is an enterprise clinical resource and clinician workflow control and regulation device.  This statement illustrates the dangers of having personnel of a technical focus in any kind of authority role in health IT.  Their education and worldview is far too narrow.

Healthcare professionals overcome more difficult challenges than this every day; they bring people back from the dead, for Pete’s sake! I have no doubt that they will adapt and learn to utilize EMRs so that they improve healthcare and take patient care to levels currently unimaginable.

Wrong solution, completely ignoring (or perhaps I should say willfully ignorant of) the fact that there's good health IT and bad health IT (GHIT/BHIT).  The IT industry needs to adapt to healthcare professionals, not the other way around, by producing GHIT and banishing BHIT.  This point needs to be frequently repeated, I surmise, due to tremendous disrespect for healthcare professionals by the industry.

And to say, as was quoted in the article: “The technology is being pushed, with no good scientific basis”? Ridiculous, with all due deference to Dr. Scot M. Silverstein, a health I.T. expert at Drexel University who reports on medical records problems on the blog Health Care Renewal and made the statement.

The only thing "ridiculous" is that Ms. McCoy was clearly too lazy to check the very blog she cites, as conspicuously cited in the NY Times article itself.  (That assumes she has the education and depth to understand its arguments and copious citations.)

Lack of RCT's, supportive studies weak at best with literature conflicting on value, National Research Council indicating current health IT does not support clinician cognitive processes, known harms but IOM/FDA both admitting the magnitude of EHR-related harms is unknown, usability poor and in need of significant remediation, cost savings in doubt - these are just a few examples of where the science (as medicine knows it) does not in 2012 support hundreds of billions of dollars for a national rollout of experimental health IT.

I wish it were not so, but alas, that is the current reality.

Database management of information has been proven to be an improvement on paper records in just about every industry there is; healthcare will not be an exception.

Ignoring the repeated "database" descriptor, I agree, eventually, that electronic information systems will improve upon paper.  That's why I began a postdoctoral fellowship in Medical Informatics two decades ago.  However, the technology in its present form interferes with care and is an impediment to the collection and accuracy of that data, and the well being of its subjects, e.g.:  

• Next-generation phenotyping of electronic health records, George Hripcsak,David J Albers, J Am Med Inform Assoc, doi:10.1136/amiajnl-2012-001145 .  The national adoption of electronic health records (EHR) promises to make an unprecedented amount of data available for clinical research, but the data are complex, inaccurate, and frequently missing, and the record reflects complex processes [economic, social, political etc. that bias the data - ed.] aside from the patient's physiological state.

As I've written before, a good or even average paper system is better for patients than bad health IT, and the latter prevails over good health IT in 2012.

These issues seem chronically to be of little interest to the hyper-enthusiasts as I've written here and here (perhaps the author of the Medical Billing blog post could use her wrist and eyes and navigate there and read).

Is it hard? Yes, it’s hard. To quote the movie A League of Their Own, “If it were easy, everyone would do it.”

It's even harder to do when apologists make excuses shielding a very dysfunctional industry.

Everyone can’t do it. But I have no doubt that healthcare professionals will do it. Remember that part about bringing people back from the dead? This is a lesser miracle.

If qualified healthcare professionals were in charge of the computerization efforts, there would be a smoother path.

However, that is sadly not the case.  It will not happen until enough pressure is brought to bear on the IT industry and its apologists, which I believe will most likely only happen though coercion, not debate.

Finally, the endless stream of excuses and rhetoric that confuse non-healthcare professionals, such as typical patients who are the subjects of today's premature grand health IT experiment and our decision-makers in Washington, needs to be relentlessly challenged.  The stakes are the well being of anyone needing medical care.

-- SS

Note:  my formal reply to the Medical Billing blog post above awaits moderation.  I am reproducing it here:

1. Scot Silverstein, MD on 12 Oct 2012 at 3:59 pm #
   Your comment is awaiting moderation.
   
   Dear Ms. McCoy,
   
   Will all due deference, your own experience with EHR’s is obviously limited.
   
   Your comments demonstrate an apparent lay level of understanding of medicine and healthcare informatics.
   
   “Ridiculous?” “Learning curve?” I.e., experimentation on non-consenting human subjects putting them at risk with an unregulated, unvetted medical technology? That is, as kindly as I can put it, a perverse statement.
   
   Perhaps I am too harsh. You clearly didn’t check the link to the Healthcare Renewal blog conspicuously placed in the NYT article by Milt Freudenheim.
   
   I suggest you should educate yourself on the science and ethics of medicine and healthcare informatics.
   
   I am posting the gist of your comments, and my reply, at that blog.
   
   I do not think most truly informed patients would agree to being guinea pigs as your comments suggest is simply part of the “leaning curve.”
   
   Scot Silverstein, M.D.
   
   

I'll bet the author of the Medical-Billing.com post never heard critique like this coming from today's typical abused-into-submission, learned helplessness-afflicted physicians.

A bit harsh?  Lives are at stake.

-- SS

New York Times: "The Ups and Downs of Electronic Medical Records"

The "downs" of health IT have rarely been presented in a prominent public forum.

After a recent Center for Public Integrity series and New York Times story on EHR-related upcoding, the New York times does so again.  This blog is cited:

October 8, 2012
The Ups and Downs of Electronic Medical Records
New York Times
By MILT FREUDENHEIM

The case for electronic medical records is compelling: They can make health care more efficient and less expensive, and improve the quality of care by making patients’ medical history easily accessible to all who treat them.

Small wonder that the idea has been promoted by the Obama administration, with strong bipartisan and industry support. The government has given $6.5 billion in incentives, and hospitals and doctors have spent billions more.

But as health care providers adopt electronic records, the challenges have proved daunting, with a potential for mix-ups and confusion that can be frustrating, costly and even dangerous. 

"Dangerous" is the concept that has been most lacking in public debate.  Through my many years of writing on health IT difficulties and more recently my legal work, I know of injuries and deaths caused or contributed to by bad health IT (e.g., see here and here).  I experienced a tragedy in my own family as well.

The New York Times has done a significant public service in mentioning this critical issue, long hushed by the hyper-enthusiasts to whom computers seem to hold more rights than people, and to whom plans for a "cybernetic healthcare utopia" override long held principles and standards for human subject research protections.

Some doctors complain that the electronic systems are clunky and time-consuming, designed more for bureaucrats than physicians. Last month, for example, the public health system in Contra Costa County in California slowed to a crawl under a new information-technology system. 

Doctors told county supervisors they were able to see only half as many patients as usual as they struggled with the unfamiliar screens and clicks. Nurses had similar concerns. At the county jail, they said, a mistaken order for a high dose of a dangerous heart medicine was caught just in time. 

That scenario, not at all unique (e.g., see New York Times, "Designed for Efficiency, New Computer Software at Health Dept. Misfires", Nov. 2010 and my comments here), is a warning that the technology needs significant work and cannot just be rammed into place.

The first national coordinator for health information technology, Dr. David J. Brailer, was appointed in 2004, by President George W. Bush. Dr. Brailer encouraged the beginnings of the switch from paper charts to computers. But in an interview last month, he said: “The current information tools are still difficult to set up. They are hard to use. They fit only parts of what doctors do, and not the rest.”

Refreshing candor that should be coming from the present ONC leader, not the two-generations-ago former incumbent.

Like all computerized systems, electronic records are vulnerable to crashes. Parts of the system at the University of Pittsburgh Medical Center were down recently for six hours over two days; the hospital had an alternate database that kept patients’ histories available until the problem was fixed. 

Those crashes are also not uncommon.  See for instance my posts on the common refrain when that happens that "patient care has not been compromised" (query link).

Even the internationally respected Mayo Clinic, which treats more than a million patients a year, has serious unresolved problems after working for years to get its three major electronic records systems to talk to one another. Dr. Dawn S. Milliner, the chief medical informatics officer at Mayo, said her people were “working actively on a number of fronts” to make the systems “interoperable” but acknowledged, “We have not solved that yet.”

Perhaps the worst example of that phenomenon is the DoD-VA interface debacle.  See my apparently popular (based on "hits") March 2010 post "VA / DoD EHR Interface Debacle: Will It Take the Luminosity Of A Dozen Supernovas To Shed Light On The Obvious About Healthcare IT?"

Still, Dr. Milliner added that even though there a lot of challenges, the benefits of information technology are “enormous” — improved safety and quality of care, convenience for patients and better outcomes in general.

Enormous?  It is quite clear that this has not been proven in the real world with large scale health IT, especially in its present form.  It may be the case that the improvements will be modest at best.  Many if not most healthcare problems may not be related to documentation at all (see my Dec. 2010 post "Is Healthcare IT a Solution to the Wrong Problem?" for instance).  Also, as I've written, a good or even fair paper record system is better for patients than BHIT (bad health IT).

In the rare event that a large-scale system goes down at Mayo, backup measures are ready, teams are called in to make rapid repairs, and if necessary “everyone is ready to go on paper,” Dr. Milliner said. 

Paper records do not unexpectedly "go down" en masse.

Reliable data about problems in the electronic systems is hard to come by, hidden by a virtual code of silence enforced by fears of lawsuits and bad publicity. A recent study commissioned by the government sketches the magnitude of the problem, calling for tools to report problems and to prevent them. 

"Omertà" is perhaps the best term of art for this form of silence...

Based on error rates in other industries, the report estimates that if and when electronic health records are fully adopted, they could be linked to at least 60,000 adverse events a year.

My own estimates are much higher if the technology and its industry are not first drastically reformed, as in my April 2010 post "If The Benefits Of Healthcare IT Can Be Guesstimated, So Can And Should The Dangers."

The Obama administration will issue a report on patient safety issues in early November, the current national coordinator, Dr. Farzad Mostashari, said in an interview. That report was requested last year by a panel on health I.T. safety at the Institute of Medicine, a unit of the National Academies of Science.

Considering the available data is limited, as per the FDA and IOM itself (see addendum here), the report should be immediately suspect for underestimation/cheerleading if not whitewashing.

... Elisabeth Belmont, a lawyer for the MaineHealth system, based in Portland, advises hospitals to reject contract language that could leave them responsible for settling claims for patient injuries caused by software problems.

The IT industry is quite mature and no longer merits such special accommodation.  As in other industries, liability should be covered by the industry itself, not by customers (and patient victims).  See "No More Soft Landings for Software: Liability for Defects in an Industry That Has Come of Age", Frances E. Zollers, Andrew McMullin, Sandra N. Hurd, and Peter Shears, Santa Clara Computer & High Technology Law Journal, May 2005.

The institute also recommended that software manufacturers be required to report deaths, serious injuries or unsafe conditions related to information technology. So far, however, neither a new safety agency nor such a reporting system has been adopted.  Some of the largest software companies have opposed any mandatory reporting requirement.

Post market surveillance is standard for other medical device sectors and the pharma industry, as well as other mission critical IT sectors.  The continuing, remarkable special accommodation for health IT is unearned, unjustified and ethically inexplicable.

Critics are deeply skeptical that electronic records are ready for prime time. “The technology is being pushed, with no good scientific basis,” said Dr. Scot M. Silverstein, a health I.T. expert at Drexel University who reports on medical records problems on the blog Health Care Renewal. He says testing these systems on patients without their consent “raises ethical questions.” 

In other words, while I am an advocate for good health IT, the technology is not yet ready to be pushed nationally.  Bad health IT prevails.  From my Medical Informatics teaching site:

Good Health IT ("GHIT") is defined as IT that provides a good user experience, enhances cognitive function, puts essential information as effortlessly as possible into the physician’s hands, keeps eHealth information secure, protects patient privacy and facilitates better practice of medicine and better outcomes.

Bad Health IT ("BHIT") is defined as IT that is ill-suited to purpose, hard to use, unreliable, loses data or provides incorrect data, causes cognitive overload, slows rather than facilitates users, lacks appropriate alerts, creates the need for hypervigilance (i.e., towards avoiding IT-related mishaps) that increases stress, is lacking in security, compromises patient privacy or otherwise demonstrates suboptimal design and/or implementation. 

(I would replace the term "critic" with "realist" and/or "patient rights advocate.")

Another critic, Dr. Scott A. Monteith [who has guest-posted at this blog - ed.], a psychiatrist and health I.T. consultant in Michigan, notes that Medicare and insurance companies generally do not pay for experimental treatments that have not proved their effectiveness ... Dr. Monteith said the electronic systems were “disrupting traditional medical records and, beyond that, how we think” — the process of arriving at a diagnosis. For example, the diagnosing process can include “looking at six pieces of paper,” he said. “We cannot do that on a monitor. It really affects how we think.”

The systems are disruptive due to the paradigm changes, made far worse by their also often being mission hostile in design.

“The problem is each patient is an individual,” said Ms. Burger, who is president of the California Nurses Association. “We need the ability to change that care plan, based on age and sex and other factors.” She acknowledged that the system had one advantage: overcoming the ancient problem of bad handwriting. “It makes it easier for me to read progress notes that physicians have written, and vice versa,” she said.

While this is true, it is also true that the loss of context and structure produces legible gibberish that does not relate the patient narrative well.  Also, the same legibility improvement could be obtained via word processors - or typewriters - that cost far less than the tens of millions of dollars or more per organization that clinical IT commonly costs.

Some experts said they were hopeful that the initial problems with electronic records would be settled over time.

I'm one of them.  Without major health IT industry reforms, however, including strict adherence to evidence-based practices (as that selfsame industry sector demands of medicine and ironically and hypocritically claims its products will enable), I don't expect to see the problems settled in my lifetime.

Dr. Brailer, who now heads Health Evolution Partners, a venture capital firm in San Francisco, said that “most of the clunky first-generation tools” would be replaced in 10 years. “As the industry continues to grind forward, costs will go down,” he said. 

One should ask - why are 'first generation' tools still in abundance, decades into the healthcare information technology industry?  Further, as the industry "grinds forward" without oversight and patient protections, people will be injured.

Mark V. Pauly, professor of health care management at the Wharton School, said the health I.T. industry was moving in the right direction but that it had a long way to go before it would save real money.  “Like so many other things in health care,” Dr. Pauly said, “the amount of accomplishment is well short of the amount of cheerleading.”

That is an understatement.

(Not covered in this article perhaps due to limited space are the issues of information security, privacy and confidentiality that are compromised by current clinical IT.)

In conclusion, it is good that the New York Times has brought the downsides into the public eye.  While the technology's not "ready for prime time", a story like this is ready for prime time, and is in fact long overdue:

-- SS