Another Reason to Put Everyone's Confidental Medical Information Into Today's Massively Secure (Surely They Are, No?) EHR systems

Office of Inspector General
Department of the Treasury
Oct. 17, 2013

Audit report

INFORMATION TECHNOLOGY: OCC's (Office of the Comptroller of the Currency) Network and Systems Security Controls Were Deficient

PDF available at: http://www.treasury.gov/about/organizational-structure/ig/Audit%20Reports%20and%20Testimonies/OIG-14-001.pdf

Highlights:

... To accomplish our objective, we performed a series of internal and external vulnerability assessments and penetration tests on OCC’s workstations, servers, network-attached peripherals (such as cameras and printers), infrastructure devices, and Internet websites.

... We determined that OCC’s security measures were not sufficient to fully prevent and detect unauthorized access into its network and systems by internal threats,or external threats that gained an internal foothold. Also, OCC’s security measures were not adequate to fully protect personally identifiable information (PII) from Internet-based threats.

We found that default factory-preset administrative usernames and passwords were present in OCC’s systems. In one test we conducted, we discovered a default username and password of an internal service account on an OCC server which had local administrator privileges. We used those privileges and deployed our penetration test tool’s agents to the host server. That server contained password hashes for local and domain administrator accounts. Using these hashes, we obtained a domain administrator’s password, which we then used to log on to the network domain controller. With full access given to a typical domain administrative account, we created a domain administrator account and thereby had full control of OCC’s network.

... In accordance with our Rules of Engagement, we did not attempt to perform actions that would disrupt OCC’s operations, such as deleting data, powering off servers or other resources, locking out accounts, and similar activities, any of which could have resulted in interruption or shutdown of devices or services. However, malicious attackers would have no such restrictions against performing these actions

... Because systems and devices connected to OCC’s internal network could freely communicate between one another, with very little internal partitioning, we successfully attacked multiple OCC systems in a very short amount of time from a single workstation.

I offer no additional comments other than, if Treasury's IT security is this lax, just imagine how secure your health information is, sitting on servers at Podunk Hollow General Hospital.

-- SS

Health Care Experience? - Hospital CEOs Don't Need No Stinkin' Health Care Experience

It looks like the complete takeover of health care by generic managers is nigh. 

Who Are Now Candidates to be Hospital CEOs?

On PRWeb is a summary of data about what sort of CEO candidates hospitals' boards of trustees are seeking:

A Black Book Rankings poll of 1,404 healthcare provider organizations’ human resources officers and board members revealed the developing trend affecting the way headhunters will seek candidates. Black Book estimates that two-thirds of CEOs hired in 2014 will have little to no healthcare sector experience, in favor of non-industry productivity, business development and financial management experts with heavy technological expertise.

From where are the new CEOs coming?

 Among survey respondents, the most intriguing new hospital CEO candidates are emerging from the Venture Capital, Private Equity industry (idealized by 42% of survey participants), Finance and Accounting (40%), Banking (32%), Technology (22%), Marketing and Sales (19%), Not-for-Profits ( 14%), and Pharma/Biotech (12%).

Note that the CEO candidates did not seem particularly intimidated by running a hospital without any relevant experience, knowledge, or possibly values.

 94% of new CEOs without extensive hospital backgrounds indicate they do not believe healthcare expertise is required for replacing other senior leadership team members after a management overhaul.

Why Are Health Care Naive CEOs Increasingly Common?

What is causing the attractiveness of candidates without background in, knowledge of, to particular agreement with the values of health care?

'An outside hire will not have developed hospital management skills from within or understand an organization's unwritten rules at first, but that’s not a bad thing either as more hospitals face fresh ideas to avoid bankruptcy, expedite smoother consolidations, conquer payment reform, and productivity issues,' said Doug Brown, Managing Partner of Black Book™.

In addition,

A new CEO’s first decisions are often distruptive to a hospital’s staff, particularly the incumbent management team. 'An outsider's perspective on hospital operations will be controversial but often credited in several facility turnarounds for bolstering organizational financial stability, and ultimately profitability,' noted Brown.

It is not just Mr Brown's opinion,

89% of board members hiring outsiders agree that broad business operational expertise and singular vision pays off with fresh perspectives on efficiencies, value, cost savings, and the goodwill to the community.

What particular circumstances might prompt hospital boards to look for health care naive CEO candidates?

 'Hospitals facing stalled growth or new competitive challenges need fresh thinking. Hiring internal candidates with the same norms and values as your current team will not meet the long term strategic growth needs of the hospital organization. Relevant outside thinking makes a valuable contribution, enhancing business vitality, longevity and sustainability. Staying contemporary, revitalizing your brand, enhancing products and expanding into new markets all begin with the next person you interview and add to your senior leadership team,' added Brown.

By the way, similar surveys suggest the same trend affecting other parts of health care,

Payers, chains, ancillaries, ACOs, support firms, vendors, medical product manufacturers and pharmaceutical firms are tapping other business’ top talent, a major shift from the 'healthcare industry experience only' mindset for executive placement that has prevailed since the 1970’s, according to corresponding Black Book 2013 surveys.

Discussion

 In 1988, Alain Enthoven advocated in Theory and Practice of Managed Competition in Health Care Finance, a book published in the Netherlands, that to decrease health care costs it would be necessary to break up the "physicians' guild" and replace leadership by clinicians with leadership by managers (see 2006 post here). Thus from 1983 to 2000, the number of managers working in the US health care system grew 726%, while the number of physicians grew 39%, so the manager/physician ratio went from roughly one to six to one to one (see 2005 post here). As we noted here, the growth continued, so there are now 10 managers for every US physician.

Health care went from being controlled by clinicians to controlled by a growing volume of managers.  Most of these managers were generic, in that they had little if any knowledge of, experience in, or sympathy to the values of health care. These generic managers have used the same techniques advocated for the management of supermarkets or automobile manufacturers to manage health care organizations, despite all the obvious differences in context, goals, values, and people involved.  They also have been trained in theory of maximizing shareholder value (even though non-profit health care organizations have no shareholders), which actually means maximizing short-term revenue (financialization), and then using that revenue as an excuse to plutocratic pay packages for management.

The survey results above say the takeover is nearly complete.  The majority of top hospital management recruits are now generic.  It appears that the majority of top management recruits  in health insurance, medical device, pharmaceutical, and other health care corporations are also now generic  The reasons for their recruitment suggest that those exerting stewardship over hospitals are completely abandoning interest in improving health care, patients' outcomes, clinical practice, or anything related.  Instead, look at the wording (highlighted in color thus above) reflecting their concerns.

This is all about

 productivity issues

long term strategic growth

business vitality

revitalizing your brand

efficiencies 

cost saving

profitablity

Nobody is talking about quality of care, improving practice, patients' outcomes, public health, or about honesty, integrity, and particularly not about putting patients first.

Instead, it is now going to be all about the money. 

So of course the US has the most expensive health care (non) system in the world, and that system manages to at best be mediocre by nearly every measure of health outcomes. 

I say once again that true health care reform would put in place leadership that understands the health care context, upholds health care professionals' values, and puts patients' and the public's health ahead of extraneous, particularly short-term financial concerns. We need health care governance that holds health care leaders accountable, and ensures their transparency, integrity and honesty.

But this sort of reform would challenge the interests of the generic managers who are getting very rich off the current system.  So I am afraid the US may end up going far down this final common pathway before enough people manifest enough strength to make real changes.

EHR cut-and-paste problem is only one of the several mechanisms to clone documentation - and facilitate fraud

In my Dec. 10, 2013 post "44% of hospitals reported to HHS that they can delete the contents of their EHR audit logs whenever they'd like" (http://hcrenewal.blogspot.com/2013/12/44-of-hospitals-reported-to-oig-that.html) I observed that the "money quote" of the Modern Healthcare article that prompted the post, "Feds eye crackdown on cut-and-paste EHR fraud" by Joe Carlson was not the issue of EHR cut-and-paste features and billing fraud, but EHRs and audit trail alteration.

Dr. Stephen R. Levinson, an E/M compliance and healthcare quality expert among other areas of expertise (see http://www.linkedin.com/in/stephenlevinson), wrote me with the following regarding the issue I glossed over in favor of the audit trail concerns, namely, EHR cloning.

Reproduced with Dr. Levinson's permission:

This long-recognized and high-profile problem [EHR cut and paste, copy forward, etc. - ed.] covers only one of the several mechanisms EHRs provide to create CLONED Documentation.

Other non-compliant short-cuts include documentation by exception (auto-entry of extensive negative history reviews and normal comprehensive examinations), use of restricted pick list words and phrases, and "translation."

Translation is my own terminology for taking actively entered "yes" or "no" responses in medical history (and "normal" or "abnormal" findings in physical exam) and using pre-loaded software to convert (i.e., translate) the response to a long pseudo dictation paragraph. For example, check a box for lungs being "normal" may automatically appear in a paragraph as "lungs clear to percussion and auscultation; respiratory effort is normal on inspiration and expiration with normal excursions of the diaphragm; there are no rales or rhonchi, and no wheezes are present."

This extended statement will appear identically in patient after patient and visit after visit, regardless of whether this level exam was performed. Further, the likelihood of every patient having completely normal lungs is non-existent.  [This is one mechanism by which reams of "legible gibberish" are produced even with modest hospital stays, e.g., see my Feb. 27, 2011 post "Two Weeks, Two Reams" at http://hcrenewal.blogspot.com/2011/02/electronic-medical-records-two-weeks.html - ed.]

Finally, although cloned documentation is egregious, there are four other equally egregious non-compliant documentation and coding features, common to most EHRs, that are being totally ignored by OIG. These 4 features are:

1) non-compliant coding engines (including failure to consider medical necessity of the level of care)

2) Replacing narrative documentation of differential diagnoses with billing codes (ICD-9) and billing semantics

3) Failure to document the qualitative components of E/M coding, while addressing only quantitative components (e.g., when patient has a positive response to review of systems question on chest pain, compliance (and quality care) requires further investigation and documentation of further details; most current systems either lack ability to document these details or fail to guide and require physicians to document them)

4) Failure to incorporate consideration of "medical necessity" (indicated in E/M coding as the "nature of the presenting problems") into care, documentation, and coding

As evidenced by these explanations, common commercial EHRs in use today were either designed by amateurs or by crooks, with the gatekeepers turning a blind eye towards abuses since at least 2007 (per commenter and EHR compliance expert Dr. Reed Gelzer who, at http://hcrenewal.blogspot.com/2013/12/44-of-hospitals-reported-to-oig-that.html, indicated ONC and OIG knew of these issues since a 2007 report he contributed to).

The gatekeepers have turned a blind eye, that is, until now when they've finally opened one eye very slightly, like a ten-day-old puppy, as the abuses become more widely known.

Young puppy begins to open its eyes.

-- SS

An Idiotically-Designed EHR Medication Discontinuation "Feature"

Over at The Healthcare Blog, Michael Chen, MD, a family physician and EHR designer in Portland, Oregon wrote a piece entitled "Why EHR Design Matters" (http://thehealthcareblog.com/blog/2013/12/18/why-ehr-design-matters/).  I am cited.

Dr. Chen reports on a major commercial EHR with the following "feature":

... In this well known EHR, you are presented a medication list for a patient. As a physician, you assume that this list is a current medication list and is up to date.  However, the reality is that this EHR system automatically removes a medication from the list when it is determined to be expired even if it should be appearing on the current medication list.

When a physician prescribes a medication from this system, it calculates the duration of usage of the medication based on the instructions, quantity of medication prescribed, and the number of refills. Once the duration exceeds the number of days that has elapsed since the prescription was made, the medication is taken off the current list automatically by the EHR.  

In other words, the EHR drops the medication from the meds list when the time elapsed exceeds the amount of time the total # of doses written for would be consumed.   As any medical student would say, "that's just brilliant."

Now, taken at face value, this sounds like the logical approach to manage a medication list and utilizes the computing power that an EHR will gladly show off as a benefit to physicians.

Misuses, actually, and at the Warp-10 speeds of today's machines, that's a lot of misuse...

Unfortunately, the EHR programmers failed to understand that medications are not taken regularly by all patients all the time. In fact, no physician assumes that at all. So why should an EHR make that assumption? Furthermore, there are plenty of treatments that are to be taken only as needed so how can an EHR account for that? Absolutely, impossible.

Perhaps the designers and programmers, simply brimming with medical degrees and expertise, thought they knew everything about medicine.  After all, you go to see a doctor, the doctor taps on you and squeezes here and there, puts a stethoscope on you, then pulls out a prescription pad and scribbles a few lines.  How hard can medicine be compared to, say, programming?

Here's how this "feature" worked out in the real world:

So I recently treated a patient that reportedly has asthma. I happened to look at a previous note and find out that the patient was denied a refill request for Albuterol, a bronchodialator that is meant to be taken as needed. She ended up in a life threatening asthma flare up and needed emergent care. It turns out the physician on call who was given the refill request several days prior didn’t realize that the EHR removed the Albuterol from her list and subsequently instructed that the patient needed to have a physician visit for having the medication prescribed. After going through 2 different windows and unclicking a check box, I was able to identify that the patient did in fact have an active prescription for Albuterol, but the EHR made it disappear. She has used it infrequently, probably because her asthma was well controlled. Unfortunately, she ended up in worse shape when she needed the medication the most.

It's a good thing the patient didn't go into Status Asthmaticus (http://emedicine.medscape.com/article/2129484-overview) and suffer severe complications, or die ... (if she had, would any of the system designers, programmers and/or purchasers have shared in liability?)

I think it fair to say this EHR "feature" was idiotically conceived, designed and implemented, and that term is the most polite I can come up with.  Failure to know what they were doing, especially in the domain of medicine, compounded by failure to consult someone - even someone with basic medical commonsense -  who would see the folly and danger of such a "feature" is inexcusable. 

The state of clinical IT will improve when such characters are placed very far from any computer that is to be used in life-critical settings, of which medicine is by definition, or at least have their work subject to rigorous testing and validation by those who know what they're doing.

That will not happen, of course, until health IT is more rigorously regulated.

-- SS

The Camel's Aching Back - Johnson and Johnson and Novartis Fined 16 Million Euro for "Anticompetitive" Scheme to Delay Generic Fentanyl

Legal and regulatory actions unfavorable for giant pharmaceutical, biotechnology and device company Johnson and Johnson just keep coming.  We last discussed such a story only two weeks ago here. 

The Latest Case

This latest story got only desultory US coverage from the wire services.  The most complete version is in the European Commission press release. 

The basics were:

The European Commission has imposed fines of € 10 798 000 on the US pharmaceutical company Johnson & Johnson (J&J) and € 5 493 000 on Novartis of Switzerland. In July 2005, their respective Dutch subsidiaries concluded an anticompetitive agreement to delay the market entry of a cheaper generic version of the pain-killer fentanyl in the Netherlands, in breach of EU antitrust rules.

In more detail,

J&J initially developed Fentanyl and has commercialised it in different formats since the 1960s. In 2005, J&J's protection on the fentanyl depot patch had expired in the Netherlands and Novartis' Dutch subsidiary, Sandoz, was on the verge of launching its generic fentanyl depot patch. It had already produced the necessary packaging material. 

However, in July 2005, instead of actually starting to sell the generic version, Sandoz concluded a so-called 'co-promotion agreement' with Janssen-Cilag, J&J's Dutch subsidiary. The agreement provided strong incentives for Sandoz not to enter the market. Indeed, the agreed monthly payments exceeded the profits that Sandoz expected to obtain from selling its generic product, for as long as there was no generic entry. Consequently, Sandoz did not offer its product on the market. The agreement was stopped in December 2006 when a third party was about to launch a generic fentanyl patch.

The agreement therefore delayed the entry of a cheaper generic medicine for seventeen months and kept prices for fentanyl in the Netherlands artificially high - to the detriment of patients and taxpayers who finance the Dutch health system.

The obligatory colorful bits,

 Why did J&J and Novartis conclude that agreement? According to internal documents Sandoz would abstain from entering the Dutch market in exchange for 'a part of [the] cake'. Instead of competing, Janssen-Cilag and Sandoz agreed on cooperation so as 'not to have a depot generic on the market and in that way to keep the high current price'. Janssen-Cilag did not consider any other existing potential partners for the so-called 'co-promotion agreement' but just focused on its close competitor Sandoz. Sandoz engaged in very limited or no actual co-promotion activities.

So, 

 The Commission therefore concluded that the object of this agreement was anticompetitive and infringed Article 101 of the Treaty on the functioning of the European Union (TFEU). 

Johnson and Johnson's Ever Lengthening Unhappy Legal History

There have been so many settlements made by, fines assessed against, and other adverse legal actions affecting Johnson and Johnson in the recent past that we must make a major revision of our summary of such cases (see same appended at the end of this post.)

Yet despite all these actions, there is no hint that anything will change at the company.  After all, it is extremely profitable, and all the fines, while they individually appear large, are not a big fraction of the money it brings in.  And, as we have noted far too often, not one of these actions actually provides any negative consequences, much less severely punishes anyone at the company who authorized, directed, or implemented the bad behavior.  

Instead, the leadership of the company continues to make itself very rich. As we wrote here,  Mr William Weldon, the outgoing CEO on whose watch most of the misbehavior resulting in the legal actions listed in the appendix below occurred, retired with a huge retirement package, after receiving extremely generous compensation prior to that.  The new CEO as of April, 2012,  Mr  Alex Gorsky, per the company's 2013 proxy statement, already owns more than 190,000 Johnson and Johnson shares,  and received $10,977,109  total compensation in 2012.  Mr Weldon received over $29 million in total compensation just for 2012, the year in which he retired.  Other top executives received from over $3.5 million to over $8 million. One can only imagine how much top executives are making this year.

So Johnson and Johnson, once admired for proclaiming in its famous credo to "put the needs and well-being of the people we serve first," now seems to put its own hired managers first.  It boggles the mind that despite this amazing record of bad behavior, the executives who presided over it still have jobs, have made no obvious changes in how they manage the company, and in fact continue to get ridiculously rich.  The board of directors, which includes the President of the University of Michigan, a Professor and Emeritus Chancellor and Vice President of Health Affairs at Emory, a Professor at MIT, a former FDA Commissioner, and Senior Fellow at the Brookings Institute, and the Vice Chancellor of Health Sciences, Dean of the David Geffen School of Medicine at the University of California, Los Angeles (UCLA); Chief Executive Officer of the UCLA Health System, who seemingly ought to care about the integrity of evidence, protecting patients from harm, and the need for simple honesty, have not obviously done anything about the apparent massive violation of the company credo that has made its managers wealth.   Other than the stockholder lawsuit discussed below, the supposed owners of the company seem to be mute.

When will the straws break the camel's back?  In the absence of such a fracture, I repeat like an old, broken record... 

Many of largest and once proud health care organizations now have recent records of repeated, egregious ethical lapses. Not only have their leaders have nearly all avoided penalties, but they have become extremely rich while their companies have so misbehaved.

These leaders seem to have become like nobility, able to extract money from lesser folk, while remaining entirely unaccountable for bad results of their reigns. We can see from this case that health care organizations' leadership's nobility overlaps with the supposed "royalty" of the leaders of big financial firms, none of whom have gone to jail after the global financial collapse, great recession, and ongoing international financial disaster (look here). The current fashion of punishing behavior within health care organization with fines and agreements to behave better in the future appears to be more law enforcement theatre than serious deterrent.  As Massachusetts Governor Deval Patrick exhorted his fellow Democrats, I exhort state, federal (and international, for that  matter) law enforcement to "grow a backbone" and go after the people who were responsible for and most profited from the ongoing ethical debacle in health care.

Again, true health care reform would make leaders of health care organization accountable for their organizations' bad behavior.

Appendix - Johnson and Johnson Recent Legal Record

2010

- Convictions in two different states in 2010 for misleading marketing of Risperdal
- A guilty plea for misbranding Topamax in 2010
2011

- Guilty pleas to bribery in Europe in 2011 by Johnson and Johnson's DePuy subsidiary
- A guilty plea for marketing Risperdal for unapproved uses in 2011 (see this link for all of the above)
- A guilty plea to misbranding Natrecor by J+J subsidiary Scios (see post here)
2012

- In 2012, testimony in a trial of allegations of unethical marketing of the drug Risperdal (risperidone) by the Janssen subsidiary revealed a systemic, deceptive stealth marketing campaign that fostered suppression of research whose results were unfavorable to the company, ghostwriting, the use of key opinion leaders as marketers in the guise of academics and professionals, and intimidation of whistleblowers. After these revelations, the company abruptly settled the case (see post here).
-  Also in 2012,  Johnson & Johnson was fined $1.1 billion by a judge in Arkansas for deceiving patients and physicians again about Risperdal (look here).
-  Also in 2012, Johnson & Johnson announced it would pay $181 million to resolve claims of deceptive advertising again about Risperdal (see this post). 

2013

-  In 2013, Johnson & Johnson settled case by shareholders alleging that management made misleading statements and withheld material information about manufacturing problems (see this post)

-  In 2013, Johnson & Johnson Janssen subsidiary pleaded guilty to a charge of misbranding Risperdal, and settled for a total of $2.2 billion allegations that it promoted the drug for elderly demented patients and adolescents without an indication, and despite evidence of its harms (see this post). 

-  In 2013, Johnson & Johnson DePuy subsidiary agreed to settle with multiple plaintiffs for $2.5 billion allegations that it sold defective mental-on-metal artificial hip, and hid evidence of its harms .

- In 2013, Johnson & Johnsonn Janssen subsidiary was found by two juries to have concealed harms of its drug Topamax (see this post for this and above case).

- In 2013, Johnson & Johnson Ethicon subsidiary's Advanced Surgical Products and two of its executives agreed to settle charges by US FDA that is sold mislabeled products used to sterilize equipment such as endoscopes (see this post).

- In 2013, Johnson & Johnson fined by European Commission for anticompetitive practices, that is, collusion with Novartis to delay marketing generic version of Fentanyl (in the current post above). 

A Second Order Cover Up? - Judge Finds Boehringer Ingelheim Allowed Destruction of Records Bearing on Allegations of Cover Up of Drug Adverse Effects

This case generated little coverage, a story in Bloomberg, and a post on PharmaLot, but perhaps should have received more attention.

Background - the Pradaxa Case

The background, per Bloomberg, is that

Boehringer [Ingelheim BmbH] is preparing to face the first federal court trial of claims that it hid Pradaxa’s bleeding risks. 

Pradaxa is dabigatran, a new anti-coagulant drug that can be used without frequent monitoring of blood tests, as is required when using the older drug warfarin.  However, unlike warfarin, the effects of dabigatran cannot be quickly reversed should a patient on the drug start to bleed.

The reason for the trial is that

Patients and their families alleged that Boehringer executives knew Pradaxa posed a deadly risk to some consumers when they brought the drug to the U.S. market in October 2010. Unlike older blood thinners, researchers said, Pradaxa has no antidote to reverse its effects, which can lead to so-called bleed-out deaths.

Pradaxa has generated more than $1 billion in sales worldwide for Boehringer, the world’s biggest family-owned drugmaker. Researchers have found it more effective at preventing strokes than older competitors, including Bristol-Myers Squibb Co.’s Coumadin.

Consumers’ lawyers contend that Boehringer officials marketed the drug as superior to existing blood thinners when they knew its performance was not better than similar medicines.

Pradaxa has been linked to more than 500 U.S. deaths over a two-year period, and Boehringer faces claims that it sold the drug knowing the medicine could cause bleed-outs among some patients, according to a federal panel that tracks consolidated cases. 

The Judge Found that by Letting Documents Vanish, the Company Committed "Egregious Wrongs"

The trial has not yet begun, and the allegations by the plaintiffs are unproven.  However, Boehringer Ingelheim already is the subject of a finding by the judge,

Boehringer Ingelheim GmbH  GmbH, the German family-owned drugmaker, withheld or failed to preserve 'countless' files sought by patients suing over the company’s blood thinner Pradaxa and must pay a fine of almost $1 million, a judge ruled. 

U.S. District Judge David Herndon in East St. Louis, Illinois, who’s overseeing more than 1,700 consolidated lawsuits over claims that Pradaxa caused excessive and sometimes fatal bleeding, concluded that Boehringer executives acted 'in bad faith' by failing to ensure that documents and files about the drug’s development and marketing were preserved.

'The wrongs here are egregious,' Herndon said in yesterday’s ruling. 'The gross inadequacy' of the company’s efforts to safeguard the documents justified a sanction of more than $931,000 against Boehringer, the judge said. 

The ruling apparently affirmed allegations made by the plaintiffs' lawyers,

The company can’t produce files of a high-level scientist involved in developing Prada’s or documents by consultants who worked on the marketing plan, patients’ lawyers alleged in court filings. The company also failed to order employees to save phone messages about their work on the medicine, they added. 

Of course, Boehringer Ingelheim contended otherwise,

 Boehringer said it has made 32 million pages of material about the drug available to the plaintiffs and has been bombarded with 'overly burdensome' document requests by patients’ lawyers, according to court filings. The company also argued that many of the documents sought by the plaintiffs’ attorneys are not relevant to the claims at issue. 

The judge vigorously disagreed,

In his 51-page ruling, Herndon said he was forced to deal with claims that Boehringer was improperly withholding documents from the inception of the case consolidation in 2012. Pradaxa suits filed in federal court across the country were gathered before Herndon for pretrial information exchanges.

Boehringer officials 'made misrepresentations' about their efforts to preserve documents and failed to take obvious steps to preserve files and other records, the judge said.

Boehringer executives 'failed to ensure the auto-delete feature of their employee cellphones, company owned and personal, was disengaged for the purpose of preserving text messages,'  Herndon said. This move 'allowed countless records to be destroyed.' 

Summary

We have now discussed numerous examples of what appears to be organized deception by health care organizations about their products or their conduct.  Recent examples included a settlement by Johnson and Johnson of a case alleging its subsidiary had hid evidence about problems with a device for sterilization of endoscopes (look here), and just before that a settlement in cases in which the same company was alleged to have hidden evidence about problems with a prosthetic hip device, and the drug Topamax (look here).

The current case is an example of a second order deception, covering up an alleged cover up of a drug's adverse effects. 

It appears that a culture of deception has taken hold in many of the world's most important health care organizations.  Deception and dishonesty may be seen as acceptable if it increases revenue, and hence the enrichment of top company insiders.  This seems to be the natural result of the belief that revenue is the only important goal, a product of the financialization of the world produced by the shareholder value ideology that dominates most Western business schools.  Pope Francis had a more incisive description of it, "the idolatry of money."

Without vigorous efforts to discover and counteract the countless deceptions that big health care organizations use to make more money and make their executives richer, we will continue to pay ever more for ever poorer results for patients' and the public's health.

Roy M. Poses MD for Health Care Renewal

Yet Another "Anecdote" - Inpatient Results of Electronic Prescribing "Disappointing"

Many of those in the Medical Informatics community, especially the academics in the upper echelons of the American Medical Informatics Association, are not of a risk recognition / risk management mindset.  Typical of academics, they are often also hostile towards dissent from the party line, as you can read about at my post "The Dangers of Critical Thinking in A Politicized, Irrational Culture" at http://hcrenewal.blogspot.com/2010/09/dangers-of-critical-thinking-in.html.

The academics, with a few exceptions, have repeatedly conflated scientific anecdotes of supposed positive results from health IT with risk management-relevant incident reports of bad outcomes and 'near misses', as an Australian colleague wrote about, via me, on August 17, 2011 at "Anecdotes and Medicine, We are Actually Talking About Two Different Things" at http://hcrenewal.blogspot.com/2011/08/from-senior-clinician-down-under.html).

They dismiss the latter incident reports, even when from well-qualified observers, while giving great attention and credence to the former [a few years as a safety manager in a large urban transit authority disabused me of that type of behavior - ed.], when the former conveniently fit their most cherished beliefs about the beneficence and efficacy of today's health IT.  Further, quality or lack thereof of the former type of evidence is often not considered.  See for instance my post of March 9, 2011 "ONC: The Benefits Of Health Information Technology: A Review Of The Recent Literature Shows Predominantly Positive Results" at http://hcrenewal.blogspot.com/2011/03/benefits-of-health-information.html for a stunning example of this phenomenon directly from the national leadership of health IT.

In my view, this phenomenon has led to a substantial loss of focus on health IT realities needed in order to remediate the industry and realize the true benefits of which the technology is capable.

Now there's yet another "anecdote" at Med Page Today.com for the experts to chomp on:

http://www.medpagetoday.com/MeetingCoverage/ASHP/43400?utm_source=cardio-meetings&utm_medium=email&utm_content=mpt&utm_campaign=DCH

E-Prescribing: Inpatient Results Disappointing
Published: Dec 12, 2013
By Sarah Wickline , Contributing Writer, MedPage Today

ORLANDO -- Electronic prescription order entry and medication reconciliation reduced some errors in hospital settings but increased others, and did not meet overall expectations, researchers reported here.

After implementation of a computerized prescriber order entry (CPOE) system, one hospital experienced a 29.2% increase in medication dispensation errors (P less than 0.05), Ramadas Balasubramanian, PharmD, PhD, of the Carolinas Medical Center-Pineville in Charlotte, N.C., and colleagues reported at the midyear meeting of the American Society of Health-System Pharmacists.

It is likely these are qualified observers who in fact might be expected to be biased towards showing good results of this technology.

In a second study, another hospital experienced a 12% improvement in accuracy (P less than 0.001) after implementation of electronic medication reconciliation charts, according to Jill Covyeou, PharmD, of Ferris State University in Big Rapids, Mich., and colleagues.

For the tens of millions of dollars likely spent to achieve a mere 12% improvement, one wonders if a far less expensive investment in experienced human resources might not have accomplished the same results or even far better.

For their study, Balasubramanian and colleagues looked at the impact of CPOE on medication errors in a community hospital setting.

At the end of 2011, when the Carolinas Medical Center-Pineville hospital had only 119 beds, officials there implemented the CPOE-CANOPY system. In early 2012, the hospital nearly doubled in capacity to 210 beds and opened the pharmacy to 24-hour operation. The researchers looked at medical errors from October 2008 through October 2012.

The categories of medication errors included: drug omission, administration at the wrong time, unauthorized drug, wrong dose, and wrong form of dose.

Any of which, of course, can harm or kill, I note.

There was a 57% increase in medication doses from prior to the CPOE system to after implementation, but even after volume adjustments, the number of errors per 1,000 dispensed medications still increased by 29.2% (P less than 0.05).

Bad health IT such as CPOE systems designed for (per Joan Ash) "calm and solitary office environments" would be expected to perform more poorly as caseloads increase and clinicians have less time for computer fritter.

Unauthorized drug dispensation and improper dose of medication decreased post-CPOE, but drug omission and administration at the wrong time were responsible for the increase.

Those seem to match the expressed concerns of another large group of "anecdote-profferers", e.g., the nurses at my Nov. 17, 2013 post "Another 'Survey' on EHRs - Affinity Medical Center (Ohio) Nurses Warn That Serious Patient Complications 'Only a Matter of Time' in Open Letter" at http://hcrenewal.blogspot.com/2013/11/another-survey-on-ehrs-affinity-medical.html:

From those nurses' Open Letter to management on health IT risks:

... Some of the concerns that nurses have brought to the attention of management include:

• Medication errors/scanning issues - perhaps the biggest concern of all RNs
• RNs unable to access patient records for hours at  a time
• Incorrect descriptors and inaccurate drop-down menus
• Incorrect calculations in the I&O and MAP [mean arterial pressure - ed.] portions of the chart 
• Inaccurate medication times and the inability of RNs to ensure medications are scheduled correctly
• Endless loops of computer prompts that are unable to be dismissed by RNs in an emergency

Back to the current Med Page Today.com article:

The use of CPOE software created a time cut-off issue that explained the wrong time of administration increase, the study authors told MedPage Today. If drugs were ordered 5 minutes after the cut-off for the morning medication administration, they would not make it to the patient until the evening rounds unless a special alert was sent to the nurse staff.

That is, a time-eating and fragile (and thus potentially dangerous} workaround.  I note that one does not have to work around something that is not standing in their way.

Balasubramanian and colleagues suggested that the lack of flexibility in the CPOE software was responsible for the drastic increase in medication errors, despite the fact that they thought it would improve error rates across the board.

In other words, the software is not truly fit for purpose.  See definition of "bad health IT" below.

... The authors suggested that electronic prescribing would be better with electronic medical records. "[E]lectronic prescribing alone may fail to increase medication list accuracy to the extent we would like," Covyeou wrote.

Replace "may fail" with "in our case, did fail."

The point about adding an EHR is certainly in the category of "wishful thinking."

If the EHRs are bad health IT, I opine the situation would likely get even worse (cf. Affinity Health, above).

From my site at http://cci.drexel.edu/faculty/ssilverstein/cases/: 

Bad Health IT ("BHIT") is ill-suited to purpose, hard to use, unreliable, loses data or provides incorrect data, is difficult and/or prohibitively expensive to customize to the needs of different medical specialists and subspecialists, causes cognitive overload, slows rather than facilitates users, lacks appropriate alerts, creates the need for hypervigilance (i.e., towards avoiding IT-related mishaps) that increases stress, is lacking in security, compromises patient privacy or otherwise demonstrates suboptimal design and/or implementation.

In summary, the technology is not a panacea, and can in fact be worse than paper.  Those who blindly ignore that reality and push for mass rollout of this still-experimental technology "no matter what" do not share, in my opinion, the ethics I was taught in Medical School.

-- SS