An Idiotically-Designed EHR Medication Discontinuation "Feature"

Over at The Healthcare Blog, Michael Chen, MD, a family physician and EHR designer in Portland, Oregon wrote a piece entitled "Why EHR Design Matters" (http://thehealthcareblog.com/blog/2013/12/18/why-ehr-design-matters/).  I am cited.

Dr. Chen reports on a major commercial EHR with the following "feature":

... In this well known EHR, you are presented a medication list for a patient. As a physician, you assume that this list is a current medication list and is up to date.  However, the reality is that this EHR system automatically removes a medication from the list when it is determined to be expired even if it should be appearing on the current medication list.

When a physician prescribes a medication from this system, it calculates the duration of usage of the medication based on the instructions, quantity of medication prescribed, and the number of refills. Once the duration exceeds the number of days that has elapsed since the prescription was made, the medication is taken off the current list automatically by the EHR.  

In other words, the EHR drops the medication from the meds list when the time elapsed exceeds the amount of time the total # of doses written for would be consumed.   As any medical student would say, "that's just brilliant."

Now, taken at face value, this sounds like the logical approach to manage a medication list and utilizes the computing power that an EHR will gladly show off as a benefit to physicians.

Misuses, actually, and at the Warp-10 speeds of today's machines, that's a lot of misuse...

Unfortunately, the EHR programmers failed to understand that medications are not taken regularly by all patients all the time. In fact, no physician assumes that at all. So why should an EHR make that assumption? Furthermore, there are plenty of treatments that are to be taken only as needed so how can an EHR account for that? Absolutely, impossible.

Perhaps the designers and programmers, simply brimming with medical degrees and expertise, thought they knew everything about medicine.  After all, you go to see a doctor, the doctor taps on you and squeezes here and there, puts a stethoscope on you, then pulls out a prescription pad and scribbles a few lines.  How hard can medicine be compared to, say, programming?

Here's how this "feature" worked out in the real world:

So I recently treated a patient that reportedly has asthma. I happened to look at a previous note and find out that the patient was denied a refill request for Albuterol, a bronchodialator that is meant to be taken as needed. She ended up in a life threatening asthma flare up and needed emergent care. It turns out the physician on call who was given the refill request several days prior didn’t realize that the EHR removed the Albuterol from her list and subsequently instructed that the patient needed to have a physician visit for having the medication prescribed. After going through 2 different windows and unclicking a check box, I was able to identify that the patient did in fact have an active prescription for Albuterol, but the EHR made it disappear. She has used it infrequently, probably because her asthma was well controlled. Unfortunately, she ended up in worse shape when she needed the medication the most.

It's a good thing the patient didn't go into Status Asthmaticus (http://emedicine.medscape.com/article/2129484-overview) and suffer severe complications, or die ... (if she had, would any of the system designers, programmers and/or purchasers have shared in liability?)

I think it fair to say this EHR "feature" was idiotically conceived, designed and implemented, and that term is the most polite I can come up with.  Failure to know what they were doing, especially in the domain of medicine, compounded by failure to consult someone - even someone with basic medical commonsense -  who would see the folly and danger of such a "feature" is inexcusable. 

The state of clinical IT will improve when such characters are placed very far from any computer that is to be used in life-critical settings, of which medicine is by definition, or at least have their work subject to rigorous testing and validation by those who know what they're doing.

That will not happen, of course, until health IT is more rigorously regulated.

-- SS

The Camel's Aching Back - Johnson and Johnson and Novartis Fined 16 Million Euro for "Anticompetitive" Scheme to Delay Generic Fentanyl

Legal and regulatory actions unfavorable for giant pharmaceutical, biotechnology and device company Johnson and Johnson just keep coming.  We last discussed such a story only two weeks ago here. 

The Latest Case

This latest story got only desultory US coverage from the wire services.  The most complete version is in the European Commission press release. 

The basics were:

The European Commission has imposed fines of € 10 798 000 on the US pharmaceutical company Johnson & Johnson (J&J) and € 5 493 000 on Novartis of Switzerland. In July 2005, their respective Dutch subsidiaries concluded an anticompetitive agreement to delay the market entry of a cheaper generic version of the pain-killer fentanyl in the Netherlands, in breach of EU antitrust rules.

In more detail,

J&J initially developed Fentanyl and has commercialised it in different formats since the 1960s. In 2005, J&J's protection on the fentanyl depot patch had expired in the Netherlands and Novartis' Dutch subsidiary, Sandoz, was on the verge of launching its generic fentanyl depot patch. It had already produced the necessary packaging material. 

However, in July 2005, instead of actually starting to sell the generic version, Sandoz concluded a so-called 'co-promotion agreement' with Janssen-Cilag, J&J's Dutch subsidiary. The agreement provided strong incentives for Sandoz not to enter the market. Indeed, the agreed monthly payments exceeded the profits that Sandoz expected to obtain from selling its generic product, for as long as there was no generic entry. Consequently, Sandoz did not offer its product on the market. The agreement was stopped in December 2006 when a third party was about to launch a generic fentanyl patch.

The agreement therefore delayed the entry of a cheaper generic medicine for seventeen months and kept prices for fentanyl in the Netherlands artificially high - to the detriment of patients and taxpayers who finance the Dutch health system.

The obligatory colorful bits,

 Why did J&J and Novartis conclude that agreement? According to internal documents Sandoz would abstain from entering the Dutch market in exchange for 'a part of [the] cake'. Instead of competing, Janssen-Cilag and Sandoz agreed on cooperation so as 'not to have a depot generic on the market and in that way to keep the high current price'. Janssen-Cilag did not consider any other existing potential partners for the so-called 'co-promotion agreement' but just focused on its close competitor Sandoz. Sandoz engaged in very limited or no actual co-promotion activities.

So, 

 The Commission therefore concluded that the object of this agreement was anticompetitive and infringed Article 101 of the Treaty on the functioning of the European Union (TFEU). 

Johnson and Johnson's Ever Lengthening Unhappy Legal History

There have been so many settlements made by, fines assessed against, and other adverse legal actions affecting Johnson and Johnson in the recent past that we must make a major revision of our summary of such cases (see same appended at the end of this post.)

Yet despite all these actions, there is no hint that anything will change at the company.  After all, it is extremely profitable, and all the fines, while they individually appear large, are not a big fraction of the money it brings in.  And, as we have noted far too often, not one of these actions actually provides any negative consequences, much less severely punishes anyone at the company who authorized, directed, or implemented the bad behavior.  

Instead, the leadership of the company continues to make itself very rich. As we wrote here,  Mr William Weldon, the outgoing CEO on whose watch most of the misbehavior resulting in the legal actions listed in the appendix below occurred, retired with a huge retirement package, after receiving extremely generous compensation prior to that.  The new CEO as of April, 2012,  Mr  Alex Gorsky, per the company's 2013 proxy statement, already owns more than 190,000 Johnson and Johnson shares,  and received $10,977,109  total compensation in 2012.  Mr Weldon received over $29 million in total compensation just for 2012, the year in which he retired.  Other top executives received from over $3.5 million to over $8 million. One can only imagine how much top executives are making this year.

So Johnson and Johnson, once admired for proclaiming in its famous credo to "put the needs and well-being of the people we serve first," now seems to put its own hired managers first.  It boggles the mind that despite this amazing record of bad behavior, the executives who presided over it still have jobs, have made no obvious changes in how they manage the company, and in fact continue to get ridiculously rich.  The board of directors, which includes the President of the University of Michigan, a Professor and Emeritus Chancellor and Vice President of Health Affairs at Emory, a Professor at MIT, a former FDA Commissioner, and Senior Fellow at the Brookings Institute, and the Vice Chancellor of Health Sciences, Dean of the David Geffen School of Medicine at the University of California, Los Angeles (UCLA); Chief Executive Officer of the UCLA Health System, who seemingly ought to care about the integrity of evidence, protecting patients from harm, and the need for simple honesty, have not obviously done anything about the apparent massive violation of the company credo that has made its managers wealth.   Other than the stockholder lawsuit discussed below, the supposed owners of the company seem to be mute.

When will the straws break the camel's back?  In the absence of such a fracture, I repeat like an old, broken record... 

Many of largest and once proud health care organizations now have recent records of repeated, egregious ethical lapses. Not only have their leaders have nearly all avoided penalties, but they have become extremely rich while their companies have so misbehaved.

These leaders seem to have become like nobility, able to extract money from lesser folk, while remaining entirely unaccountable for bad results of their reigns. We can see from this case that health care organizations' leadership's nobility overlaps with the supposed "royalty" of the leaders of big financial firms, none of whom have gone to jail after the global financial collapse, great recession, and ongoing international financial disaster (look here). The current fashion of punishing behavior within health care organization with fines and agreements to behave better in the future appears to be more law enforcement theatre than serious deterrent.  As Massachusetts Governor Deval Patrick exhorted his fellow Democrats, I exhort state, federal (and international, for that  matter) law enforcement to "grow a backbone" and go after the people who were responsible for and most profited from the ongoing ethical debacle in health care.

Again, true health care reform would make leaders of health care organization accountable for their organizations' bad behavior.

Appendix - Johnson and Johnson Recent Legal Record

2010

- Convictions in two different states in 2010 for misleading marketing of Risperdal
- A guilty plea for misbranding Topamax in 2010
2011

- Guilty pleas to bribery in Europe in 2011 by Johnson and Johnson's DePuy subsidiary
- A guilty plea for marketing Risperdal for unapproved uses in 2011 (see this link for all of the above)
- A guilty plea to misbranding Natrecor by J+J subsidiary Scios (see post here)
2012

- In 2012, testimony in a trial of allegations of unethical marketing of the drug Risperdal (risperidone) by the Janssen subsidiary revealed a systemic, deceptive stealth marketing campaign that fostered suppression of research whose results were unfavorable to the company, ghostwriting, the use of key opinion leaders as marketers in the guise of academics and professionals, and intimidation of whistleblowers. After these revelations, the company abruptly settled the case (see post here).
-  Also in 2012,  Johnson & Johnson was fined $1.1 billion by a judge in Arkansas for deceiving patients and physicians again about Risperdal (look here).
-  Also in 2012, Johnson & Johnson announced it would pay $181 million to resolve claims of deceptive advertising again about Risperdal (see this post). 

2013

-  In 2013, Johnson & Johnson settled case by shareholders alleging that management made misleading statements and withheld material information about manufacturing problems (see this post)

-  In 2013, Johnson & Johnson Janssen subsidiary pleaded guilty to a charge of misbranding Risperdal, and settled for a total of $2.2 billion allegations that it promoted the drug for elderly demented patients and adolescents without an indication, and despite evidence of its harms (see this post). 

-  In 2013, Johnson & Johnson DePuy subsidiary agreed to settle with multiple plaintiffs for $2.5 billion allegations that it sold defective mental-on-metal artificial hip, and hid evidence of its harms .

- In 2013, Johnson & Johnsonn Janssen subsidiary was found by two juries to have concealed harms of its drug Topamax (see this post for this and above case).

- In 2013, Johnson & Johnson Ethicon subsidiary's Advanced Surgical Products and two of its executives agreed to settle charges by US FDA that is sold mislabeled products used to sterilize equipment such as endoscopes (see this post).

- In 2013, Johnson & Johnson fined by European Commission for anticompetitive practices, that is, collusion with Novartis to delay marketing generic version of Fentanyl (in the current post above). 

A Second Order Cover Up? - Judge Finds Boehringer Ingelheim Allowed Destruction of Records Bearing on Allegations of Cover Up of Drug Adverse Effects

This case generated little coverage, a story in Bloomberg, and a post on PharmaLot, but perhaps should have received more attention.

Background - the Pradaxa Case

The background, per Bloomberg, is that

Boehringer [Ingelheim BmbH] is preparing to face the first federal court trial of claims that it hid Pradaxa’s bleeding risks. 

Pradaxa is dabigatran, a new anti-coagulant drug that can be used without frequent monitoring of blood tests, as is required when using the older drug warfarin.  However, unlike warfarin, the effects of dabigatran cannot be quickly reversed should a patient on the drug start to bleed.

The reason for the trial is that

Patients and their families alleged that Boehringer executives knew Pradaxa posed a deadly risk to some consumers when they brought the drug to the U.S. market in October 2010. Unlike older blood thinners, researchers said, Pradaxa has no antidote to reverse its effects, which can lead to so-called bleed-out deaths.

Pradaxa has generated more than $1 billion in sales worldwide for Boehringer, the world’s biggest family-owned drugmaker. Researchers have found it more effective at preventing strokes than older competitors, including Bristol-Myers Squibb Co.’s Coumadin.

Consumers’ lawyers contend that Boehringer officials marketed the drug as superior to existing blood thinners when they knew its performance was not better than similar medicines.

Pradaxa has been linked to more than 500 U.S. deaths over a two-year period, and Boehringer faces claims that it sold the drug knowing the medicine could cause bleed-outs among some patients, according to a federal panel that tracks consolidated cases. 

The Judge Found that by Letting Documents Vanish, the Company Committed "Egregious Wrongs"

The trial has not yet begun, and the allegations by the plaintiffs are unproven.  However, Boehringer Ingelheim already is the subject of a finding by the judge,

Boehringer Ingelheim GmbH  GmbH, the German family-owned drugmaker, withheld or failed to preserve 'countless' files sought by patients suing over the company’s blood thinner Pradaxa and must pay a fine of almost $1 million, a judge ruled. 

U.S. District Judge David Herndon in East St. Louis, Illinois, who’s overseeing more than 1,700 consolidated lawsuits over claims that Pradaxa caused excessive and sometimes fatal bleeding, concluded that Boehringer executives acted 'in bad faith' by failing to ensure that documents and files about the drug’s development and marketing were preserved.

'The wrongs here are egregious,' Herndon said in yesterday’s ruling. 'The gross inadequacy' of the company’s efforts to safeguard the documents justified a sanction of more than $931,000 against Boehringer, the judge said. 

The ruling apparently affirmed allegations made by the plaintiffs' lawyers,

The company can’t produce files of a high-level scientist involved in developing Prada’s or documents by consultants who worked on the marketing plan, patients’ lawyers alleged in court filings. The company also failed to order employees to save phone messages about their work on the medicine, they added. 

Of course, Boehringer Ingelheim contended otherwise,

 Boehringer said it has made 32 million pages of material about the drug available to the plaintiffs and has been bombarded with 'overly burdensome' document requests by patients’ lawyers, according to court filings. The company also argued that many of the documents sought by the plaintiffs’ attorneys are not relevant to the claims at issue. 

The judge vigorously disagreed,

In his 51-page ruling, Herndon said he was forced to deal with claims that Boehringer was improperly withholding documents from the inception of the case consolidation in 2012. Pradaxa suits filed in federal court across the country were gathered before Herndon for pretrial information exchanges.

Boehringer officials 'made misrepresentations' about their efforts to preserve documents and failed to take obvious steps to preserve files and other records, the judge said.

Boehringer executives 'failed to ensure the auto-delete feature of their employee cellphones, company owned and personal, was disengaged for the purpose of preserving text messages,'  Herndon said. This move 'allowed countless records to be destroyed.' 

Summary

We have now discussed numerous examples of what appears to be organized deception by health care organizations about their products or their conduct.  Recent examples included a settlement by Johnson and Johnson of a case alleging its subsidiary had hid evidence about problems with a device for sterilization of endoscopes (look here), and just before that a settlement in cases in which the same company was alleged to have hidden evidence about problems with a prosthetic hip device, and the drug Topamax (look here).

The current case is an example of a second order deception, covering up an alleged cover up of a drug's adverse effects. 

It appears that a culture of deception has taken hold in many of the world's most important health care organizations.  Deception and dishonesty may be seen as acceptable if it increases revenue, and hence the enrichment of top company insiders.  This seems to be the natural result of the belief that revenue is the only important goal, a product of the financialization of the world produced by the shareholder value ideology that dominates most Western business schools.  Pope Francis had a more incisive description of it, "the idolatry of money."

Without vigorous efforts to discover and counteract the countless deceptions that big health care organizations use to make more money and make their executives richer, we will continue to pay ever more for ever poorer results for patients' and the public's health.

Roy M. Poses MD for Health Care Renewal

Yet Another "Anecdote" - Inpatient Results of Electronic Prescribing "Disappointing"

Many of those in the Medical Informatics community, especially the academics in the upper echelons of the American Medical Informatics Association, are not of a risk recognition / risk management mindset.  Typical of academics, they are often also hostile towards dissent from the party line, as you can read about at my post "The Dangers of Critical Thinking in A Politicized, Irrational Culture" at http://hcrenewal.blogspot.com/2010/09/dangers-of-critical-thinking-in.html.

The academics, with a few exceptions, have repeatedly conflated scientific anecdotes of supposed positive results from health IT with risk management-relevant incident reports of bad outcomes and 'near misses', as an Australian colleague wrote about, via me, on August 17, 2011 at "Anecdotes and Medicine, We are Actually Talking About Two Different Things" at http://hcrenewal.blogspot.com/2011/08/from-senior-clinician-down-under.html).

They dismiss the latter incident reports, even when from well-qualified observers, while giving great attention and credence to the former [a few years as a safety manager in a large urban transit authority disabused me of that type of behavior - ed.], when the former conveniently fit their most cherished beliefs about the beneficence and efficacy of today's health IT.  Further, quality or lack thereof of the former type of evidence is often not considered.  See for instance my post of March 9, 2011 "ONC: The Benefits Of Health Information Technology: A Review Of The Recent Literature Shows Predominantly Positive Results" at http://hcrenewal.blogspot.com/2011/03/benefits-of-health-information.html for a stunning example of this phenomenon directly from the national leadership of health IT.

In my view, this phenomenon has led to a substantial loss of focus on health IT realities needed in order to remediate the industry and realize the true benefits of which the technology is capable.

Now there's yet another "anecdote" at Med Page Today.com for the experts to chomp on:

http://www.medpagetoday.com/MeetingCoverage/ASHP/43400?utm_source=cardio-meetings&utm_medium=email&utm_content=mpt&utm_campaign=DCH

E-Prescribing: Inpatient Results Disappointing
Published: Dec 12, 2013
By Sarah Wickline , Contributing Writer, MedPage Today

ORLANDO -- Electronic prescription order entry and medication reconciliation reduced some errors in hospital settings but increased others, and did not meet overall expectations, researchers reported here.

After implementation of a computerized prescriber order entry (CPOE) system, one hospital experienced a 29.2% increase in medication dispensation errors (P less than 0.05), Ramadas Balasubramanian, PharmD, PhD, of the Carolinas Medical Center-Pineville in Charlotte, N.C., and colleagues reported at the midyear meeting of the American Society of Health-System Pharmacists.

It is likely these are qualified observers who in fact might be expected to be biased towards showing good results of this technology.

In a second study, another hospital experienced a 12% improvement in accuracy (P less than 0.001) after implementation of electronic medication reconciliation charts, according to Jill Covyeou, PharmD, of Ferris State University in Big Rapids, Mich., and colleagues.

For the tens of millions of dollars likely spent to achieve a mere 12% improvement, one wonders if a far less expensive investment in experienced human resources might not have accomplished the same results or even far better.

For their study, Balasubramanian and colleagues looked at the impact of CPOE on medication errors in a community hospital setting.

At the end of 2011, when the Carolinas Medical Center-Pineville hospital had only 119 beds, officials there implemented the CPOE-CANOPY system. In early 2012, the hospital nearly doubled in capacity to 210 beds and opened the pharmacy to 24-hour operation. The researchers looked at medical errors from October 2008 through October 2012.

The categories of medication errors included: drug omission, administration at the wrong time, unauthorized drug, wrong dose, and wrong form of dose.

Any of which, of course, can harm or kill, I note.

There was a 57% increase in medication doses from prior to the CPOE system to after implementation, but even after volume adjustments, the number of errors per 1,000 dispensed medications still increased by 29.2% (P less than 0.05).

Bad health IT such as CPOE systems designed for (per Joan Ash) "calm and solitary office environments" would be expected to perform more poorly as caseloads increase and clinicians have less time for computer fritter.

Unauthorized drug dispensation and improper dose of medication decreased post-CPOE, but drug omission and administration at the wrong time were responsible for the increase.

Those seem to match the expressed concerns of another large group of "anecdote-profferers", e.g., the nurses at my Nov. 17, 2013 post "Another 'Survey' on EHRs - Affinity Medical Center (Ohio) Nurses Warn That Serious Patient Complications 'Only a Matter of Time' in Open Letter" at http://hcrenewal.blogspot.com/2013/11/another-survey-on-ehrs-affinity-medical.html:

From those nurses' Open Letter to management on health IT risks:

... Some of the concerns that nurses have brought to the attention of management include:

• Medication errors/scanning issues - perhaps the biggest concern of all RNs
• RNs unable to access patient records for hours at  a time
• Incorrect descriptors and inaccurate drop-down menus
• Incorrect calculations in the I&O and MAP [mean arterial pressure - ed.] portions of the chart 
• Inaccurate medication times and the inability of RNs to ensure medications are scheduled correctly
• Endless loops of computer prompts that are unable to be dismissed by RNs in an emergency

Back to the current Med Page Today.com article:

The use of CPOE software created a time cut-off issue that explained the wrong time of administration increase, the study authors told MedPage Today. If drugs were ordered 5 minutes after the cut-off for the morning medication administration, they would not make it to the patient until the evening rounds unless a special alert was sent to the nurse staff.

That is, a time-eating and fragile (and thus potentially dangerous} workaround.  I note that one does not have to work around something that is not standing in their way.

Balasubramanian and colleagues suggested that the lack of flexibility in the CPOE software was responsible for the drastic increase in medication errors, despite the fact that they thought it would improve error rates across the board.

In other words, the software is not truly fit for purpose.  See definition of "bad health IT" below.

... The authors suggested that electronic prescribing would be better with electronic medical records. "[E]lectronic prescribing alone may fail to increase medication list accuracy to the extent we would like," Covyeou wrote.

Replace "may fail" with "in our case, did fail."

The point about adding an EHR is certainly in the category of "wishful thinking."

If the EHRs are bad health IT, I opine the situation would likely get even worse (cf. Affinity Health, above).

From my site at http://cci.drexel.edu/faculty/ssilverstein/cases/: 

Bad Health IT ("BHIT") is ill-suited to purpose, hard to use, unreliable, loses data or provides incorrect data, is difficult and/or prohibitively expensive to customize to the needs of different medical specialists and subspecialists, causes cognitive overload, slows rather than facilitates users, lacks appropriate alerts, creates the need for hypervigilance (i.e., towards avoiding IT-related mishaps) that increases stress, is lacking in security, compromises patient privacy or otherwise demonstrates suboptimal design and/or implementation.

In summary, the technology is not a panacea, and can in fact be worse than paper.  Those who blindly ignore that reality and push for mass rollout of this still-experimental technology "no matter what" do not share, in my opinion, the ethics I was taught in Medical School.

-- SS

BLOGSCAN - US Supreme Court Turns Down Pfizer Appeal of RICO Conviction

Pfizer Inc, which boasts of being the world's largest research based pharmaceutical company, also seems to be one of the world's largest examples of health care corporations that have withstood an amazing number of settlements, fines, and at times convictions for misbehavior without major apologies, significant changes in leadership or corporate culture, or bankruptcy.  (Look here for a list of the cases, and here for all we have written about Pfizer).  

Pfizer, amazingly, has the malodorous distinction of having been convicted by a US jury as a RICO - a racketeering influenced corrupt organization in 2010 (look here).  Pfizer executives, of course, kept their office of counsel busy by appealing the conviction, all the way up to the US Supreme Court.

As discussed on the 1BoringOldMan blog, the court has now turned down the appeal and let the conviction, which had been affirmed by lower federal court, stand.   So Pfizer is now officially a racketeering influenced corrupt organization.  

Yet although the description of the RICO statute that 1BoringOldMan quoted notes the law can be used to go after the leaders of organized crime, no individual at Pfizer who authorized, directed, or implemented the relevant misbehavior, which was in this case the promotion of Neurontin for off-label uses, for which its benefits were at best unproven, at worse nonexistent, even if its harms are well-documented.  Thus even this RICO conviction has not affected the impunity of top health care corporate leaders. 

As we have said endlessly, true health care reform will not occur until the leaders of large health care organizations are made accountable for their actions, and are prevented from becoming amazingly rich while their organizations repeatedly commit unethical or illegal acts that harm patients' and the public's health.   

ADDENDUM (14 December,2013) - The followup post at 1BoringOldMan on this topic includes some optimism that now that the validity of the RICO concept applied to a large health care corporation has been affirmed, more stringent law enforcement may follow.  

Roy M. Poses MD for Health Care Renewal

JOBSCAN - Project Officer to Address Corruption in the Pharmaceutical and Health Care Sector in the UK

It is extremely rare that I see a job posting relevant to Health Care Renewal, but amazingly saw one today:

Job Opportunities at Transparency International

Project Officer, Corruption in Pharmaceutical & Healthcare Sector, Transparency International UK

Application Closing Date - 03 Jan 2014
Job Start Date - February 2014 or as soon as possible thereafter
Duration - This appointment is for one year initially
Pay Scale - £26,000-30,000 pa depending on experience
Location - Transparency International UK, London, UK
View the whole posting

I would urge anyone interested to apply soon.  The deadline is coming up.  I am glad to see that Transparency International in the UK is addressing corruption in health care. 

Roy M. Poses MD on Health Care Renewal

44% of hospitals reported to HHS that they can delete the contents of their EHR audit logs whenever they'd like?

Modern Healthcare published an article "Feds eye crackdown on cut-and-paste EHR fraud" on Dec. 10, 2013 by Joe Carlson.

The article is about federal efforts to reduce the amount of clinician cut-and-paste from prior notes of a patient - which can even be done between charts of different patients.  This practice can result in overbilling for work not actually performed.  The practice can also result in no-longer-accurate data being carried forward; I have been consultant to cases where that phenomenon, in my opinion, contributed to grave patient injury in cases that have settled out of court.

It is at this link:  http://www.modernhealthcare.com/article/20131210/NEWS/312109965/feds-eye-crackdown-on-cut-and-paste-ehr-fraud?utm_source=articlelink&utm_medium=website&utm_campaign=TodaysHeadlines#

Subscription required, but googling the article title may allow reading it in its entirety.

The article begins:

Federal officials say the cut-and-paste features common to electronic health records invite fraudulent use of duplicated clinical notes and that there is a need to clamp down on the emerging threat. That concern is enhanced by the fact that it's too easy to turn off features of EHR systems that allow tracking of sloppy or fraudulent records.

In an audit report released Tuesday morning (PDF), [HHS Office of Inspector General, "NOT ALL RECOMMENDED FRAUD SAFEGUARDS HAVE BEEN IMPLEMENTED IN HOSPITAL EHR TECHNOLOGY"], HHS agencies confirmed that they are developing comprehensive plans to deter fraud and abuse involving EHRs, including guidelines for cut-and-paste features. The issue arises at a time when critics say federally subsidized digital patient record systems are sometimes being used inappropriately by providers to drive up reimbursement.

“Certain EHR documentation features, if poorly designed or used inappropriately, can result in poor data quality or fraud,” according a report from HHS' Office of the Inspector General.

None of this is a surprise to me, and to readers of this blog.

However, the real "money quote" in the article, I believe, is this:

"In addition, only 44% of hospitals' “audit log” systems could record whether cut-and-paste was used to enter data, and an identical percentage of hospitals reported [to OIG] that they can delete the contents of their internal audit logs whenever they'd like."

From page 11 of the HHS OIG Report linked above (http://www.modernhealthcare.com/assets/pdf/CH92135129.PDF):

[In 2006, ONC contracted with RTI International (RTI) to develop recommendations to enhance data protection; increase data validity, accuracy, and integrity; and strengthen fraud protection in EHR technology.]

... Hospitals' control over audit logs may be at odds with their RTI- recommended use as fraud safeguards:

RTI recommends that EHR users not be allowed to delete the contents of their audit log so that data are always available for fraud detection, yet nearly half of hospitals (44 percent) reported that they can delete their audit logs. Although these hospitals reported that they limit the ability to delete the audit log to certain EHR users, such as system administrators, one EHR vendor noted that any software programmer could delete the audit log.

RTI recommends that the ability to disable the audit log be limited to certain individuals, such as system administrators, and that EHR users, such as doctors and nurses, be prevented from editing the contents of the audit log because these actions can compromise the audit log's effectiveness. Hospitals reported they have the ability to disable (33 percent) and edit (11 percent) their audit logs, although they reported restricting those abilities to certain EHR users, such as system administrators or EHR vendors. All four EHR vendors we spoke with reported that the audit logs cannot be disabled in their products, but one vendor again noted that a programmer could disable the audit log.

I further note that, being voluntarily provided, i.e., not part of a formal investigation of any specific organization, those numbers are likely low, perhaps very low considering this issue.

An audit log or audit trail is an automatically-generated dataset, invisible to most users, containing items such as who viewed records, the date/time/location of viewing, and indication of actions they may have performed on the records such as editing/changes/additions/deletions, etc.

As an EHR itself is a collection of magnetized or optically encoded bits on some computer storage medium, it cannot be authenticated as complete and free from alteration by humans.

The audit trail is the only way to authenticate an EHR printout, however (as well as EHR screenshots or any other electronic data turned into a tangible form from those bits) as complete and free from alteration.

If an EHR printout cannot be authenticated as complete and free from alteration, its trustworthiness and perhaps even court admissibility as a business record under an exception to the hearsay rules regarding evidence may be damaged or invalidated.

My concern is that, if true, and considering the conflict of interest a hospital has regarding hiding potential fraud or malpractice that could cost them millions of dollars, a capability to "delete the contents of their internal audit logs whenever they'd like" and to edit audit trails (which based on the capabilities of relational databases also implies an ability to delete sections of audit logs selectively and/or to substitute false data) is simply alarming.

I don't think the EHR pioneers intended EHRs to be used for purposes of allowing evidence spoliation without traceability ...

-- SS

Dec. 13, 2013 Addendum:

I received the following reply from EHR compliance expert Dr. Reed D. Gelzer.  Re-posted with permission:

Good morning Dr Silverstein,

Thank you yet again for the illumination that you bring to matters of truth in Healthcare Information Technology.

Regarding the OIG report’s source document, the 2007 report to the ONC, I was the Fraud Prevention Workgroup Chair for that project, working under Principal Investigators Dr. Don Simborg and Susan Hanson, former Chair of AHIMA. 

For anyone who is interested in this subject matter, I would recommend that you go to the source document and, among other things, review the list of contributors.  These were all individuals who volunteered time to attempt to mitigate harms of defective HIT, in their capacities of records management systems, nearly 8 years ago now.   Many have gone on into leadership roles in related organizations and domains, some still working towards trustworthy health information technology systems.

I believe that I can say that none of those working on the report then would have believed that it was conceivable that even our most basic recommendations regarding the fitness of audit functions would remain "novel" in the industry in 2013.  One cannot be surprised at the low level of authenticity supports in hospitals’ EHRs systems given that fitness as record management systems for patient care has, to date, been either neglected or presumed, not tested or attested.   I am gratified that our 2007 work was utilized for the OIG report to illuminate the deplorable state of integrity supports in these patient care information systems.  This will undoubtedly spur interest in supportive resources such as the HL7 EHR System Functional Model Standard and the HL7 Records Management and Evidentiary Support Profile Standard.

All of us who worked on that ONC report are, I hope, as gratified as I am that the OIG removed our work product from its designated obscurity.   We developed the guidelines via methods that were more qualitative than quantitative, entirely intended to guide initial implementation backed by more methodical research.   We represented the most informed at that time, including those like myself and my ADIC associate Patricia Trites who had performed compliance testing on over 30 among the leading EHRs at the time and found extraordinary ranges of deficiencies, including audit functions that could be disabled at will.   Standards and tools existed then to support mitigation of risks and those Standards and tools have expanded since.  Now that the events and ONC decisions that led to inactions on the report are now in the past, we can more rapidly achieve the potentials nascent in HIT by rendering it more trustworthy, usable, and safe.

Thank you again for your ongoing vigilance.

Sincerely,

Reed D. Gelzer, MD, MPH, CHCC
Trustworthy EHR, LLC
Co-Facilitator, HL7 Records Management and Evidentiary Support Workgroup

To this I add that I also would not have found it conceivable that my concerns about bad health IT and the risks of patient harm it poses, as well as common healthcare IT project mismanagement, of which I started writing about in 1998 (http://cci.drexel.edu/faculty/ssilverstein/cases/) would remain "novel" ideas in the industry in 2013.

The Obamacare healthcare exchange website debacle has made the latter issue mainstream.  The former issues still need more sunlight.

-- SS

2/4/14 addendum:

HHS is apparently starting to pay attention to the importance of robust and secure EHR audit trails.

I note in the HHS document "Meaningful Use Stage 2, 2014 Edition EHR CERTIFICATION CRITERIA 45 CFR 170.314", page 7, regarding audit trails, available at this writing at http://www.healthit.gov/sites/default/files/meaningfulusetablesseries2_110112.pdf:

§170.314(d)(2) Auditable events and tamper-resistance.

(i) Record actions. EHR technology must be able to:

(A) Record actions related to electronic health information in accordance with the standard specified in § 170.210(e)(1);
(B) Record the audit log status (enabled or disabled) in accordance with the standard specified in § 170.210(e)(2) unless it cannot be disabled by any user; and
(C) Record the encryption status (enabled or disabled) of electronic health information locally stored on end-user devices by EHR technology in accordance with the standard specified in § 170.210(e)(3) unless the EHR technology prevents electronic health information from being locally stored on end-user devices (see 170.314(d)(7) of this section).

(ii) Default setting. EHR technology must be set by default to perform the capabilities specified in paragraph (d)(2)(i)(A) of this section and, where applicable, paragraphs (d)(2)(i)(B) or (d)(2)(i)(C), or both paragraphs (d)(2)(i)(B) and (C).

(iii) When disabling the audit log is permitted. For each capability specified in paragraphs (d)(2)(i)(A), (B), and (C) of this section that EHR technology permits to be disabled, the ability to do so must be restricted to a limited set of identified users.

(iv) Audit log protection. Actions and statuses recorded in accordance with paragraph (d)(2)(i) must not be capable of being changed, overwritten, or deleted by the EHR technology.

(v) Detection. EHR technology must be able to detect whether the audit log has been altered. 

From a posting at http://healthcaresecprivacy.blogspot.com/2012/09/meaningful-use-stage-2-audit-logging.html:

... The Information that needs to be recorded: § 170.210(e)(1)(i):  These rules [in a column I did not show here - ed.] identify “sections 7.2 through 7.4, 7.6, and 7.7 of the standard specified”. This is simply the list of attributes that an audit log entry should contain that ASTM E2147 says are mandatory, and excludes the values it outlines as important but not mandatory. Below is about 90% of what is in section 7, I didn't want to copy all of it out of respect for the copyright. But, the part missing is just a one-line definition of each item, nothing more than that.

7. Audit Log Content
7.1 Audit log content is determined by regulatory initiatives, accreditation standards, and principles and organizational needs. Information is needed to adequately understand and oversee access to patient identifiable data in health information systems in order to perform security oversight tasks responsibly.
Logs must contain the following minimum data elements:
7.2 Date and Time of Event
7.3 Patient Identification
7.4 User Identification
7.5 Access Device (optional)
7.6 Type of Action (additions, deletions, changes, queries, print, copy)
7.7 Identification of the Patient Data that is Accessed(optional)
7.8 Source of Access (optional unless the log is combined from multiple systems or can be indisputably inferred)
7.9 Reason for Access (optional)
7.10 If capability exists, there should be recognition that both an electronic “copy” operation and a paper “print” operation are qualitatively different from other actions.

I am not sanguine about the "optional" components, especially 7.7 - the actual data that was accessed and acted upon.

I also note it is stunning that these audit trail 'rules' have only been promulgated recently.  It will be interesting to see how rigorous the EHR "certification" process will be regarding audit trails.

-- SS