BLOGSCAN - US Supreme Court Turns Down Pfizer Appeal of RICO Conviction

Pfizer Inc, which boasts of being the world's largest research based pharmaceutical company, also seems to be one of the world's largest examples of health care corporations that have withstood an amazing number of settlements, fines, and at times convictions for misbehavior without major apologies, significant changes in leadership or corporate culture, or bankruptcy.  (Look here for a list of the cases, and here for all we have written about Pfizer).  

Pfizer, amazingly, has the malodorous distinction of having been convicted by a US jury as a RICO - a racketeering influenced corrupt organization in 2010 (look here).  Pfizer executives, of course, kept their office of counsel busy by appealing the conviction, all the way up to the US Supreme Court.

As discussed on the 1BoringOldMan blog, the court has now turned down the appeal and let the conviction, which had been affirmed by lower federal court, stand.   So Pfizer is now officially a racketeering influenced corrupt organization.  

Yet although the description of the RICO statute that 1BoringOldMan quoted notes the law can be used to go after the leaders of organized crime, no individual at Pfizer who authorized, directed, or implemented the relevant misbehavior, which was in this case the promotion of Neurontin for off-label uses, for which its benefits were at best unproven, at worse nonexistent, even if its harms are well-documented.  Thus even this RICO conviction has not affected the impunity of top health care corporate leaders. 

As we have said endlessly, true health care reform will not occur until the leaders of large health care organizations are made accountable for their actions, and are prevented from becoming amazingly rich while their organizations repeatedly commit unethical or illegal acts that harm patients' and the public's health.   

ADDENDUM (14 December,2013) - The followup post at 1BoringOldMan on this topic includes some optimism that now that the validity of the RICO concept applied to a large health care corporation has been affirmed, more stringent law enforcement may follow.  

Roy M. Poses MD for Health Care Renewal

JOBSCAN - Project Officer to Address Corruption in the Pharmaceutical and Health Care Sector in the UK

It is extremely rare that I see a job posting relevant to Health Care Renewal, but amazingly saw one today:

Job Opportunities at Transparency International

Project Officer, Corruption in Pharmaceutical & Healthcare Sector, Transparency International UK

Application Closing Date - 03 Jan 2014
Job Start Date - February 2014 or as soon as possible thereafter
Duration - This appointment is for one year initially
Pay Scale - £26,000-30,000 pa depending on experience
Location - Transparency International UK, London, UK
View the whole posting

I would urge anyone interested to apply soon.  The deadline is coming up.  I am glad to see that Transparency International in the UK is addressing corruption in health care. 

Roy M. Poses MD on Health Care Renewal

44% of hospitals reported to HHS that they can delete the contents of their EHR audit logs whenever they'd like?

Modern Healthcare published an article "Feds eye crackdown on cut-and-paste EHR fraud" on Dec. 10, 2013 by Joe Carlson.

The article is about federal efforts to reduce the amount of clinician cut-and-paste from prior notes of a patient - which can even be done between charts of different patients.  This practice can result in overbilling for work not actually performed.  The practice can also result in no-longer-accurate data being carried forward; I have been consultant to cases where that phenomenon, in my opinion, contributed to grave patient injury in cases that have settled out of court.

It is at this link:  http://www.modernhealthcare.com/article/20131210/NEWS/312109965/feds-eye-crackdown-on-cut-and-paste-ehr-fraud?utm_source=articlelink&utm_medium=website&utm_campaign=TodaysHeadlines#

Subscription required, but googling the article title may allow reading it in its entirety.

The article begins:

Federal officials say the cut-and-paste features common to electronic health records invite fraudulent use of duplicated clinical notes and that there is a need to clamp down on the emerging threat. That concern is enhanced by the fact that it's too easy to turn off features of EHR systems that allow tracking of sloppy or fraudulent records.

In an audit report released Tuesday morning (PDF), [HHS Office of Inspector General, "NOT ALL RECOMMENDED FRAUD SAFEGUARDS HAVE BEEN IMPLEMENTED IN HOSPITAL EHR TECHNOLOGY"], HHS agencies confirmed that they are developing comprehensive plans to deter fraud and abuse involving EHRs, including guidelines for cut-and-paste features. The issue arises at a time when critics say federally subsidized digital patient record systems are sometimes being used inappropriately by providers to drive up reimbursement.

“Certain EHR documentation features, if poorly designed or used inappropriately, can result in poor data quality or fraud,” according a report from HHS' Office of the Inspector General.

None of this is a surprise to me, and to readers of this blog.

However, the real "money quote" in the article, I believe, is this:

"In addition, only 44% of hospitals' “audit log” systems could record whether cut-and-paste was used to enter data, and an identical percentage of hospitals reported [to OIG] that they can delete the contents of their internal audit logs whenever they'd like."

From page 11 of the HHS OIG Report linked above (http://www.modernhealthcare.com/assets/pdf/CH92135129.PDF):

[In 2006, ONC contracted with RTI International (RTI) to develop recommendations to enhance data protection; increase data validity, accuracy, and integrity; and strengthen fraud protection in EHR technology.]

... Hospitals' control over audit logs may be at odds with their RTI- recommended use as fraud safeguards:

RTI recommends that EHR users not be allowed to delete the contents of their audit log so that data are always available for fraud detection, yet nearly half of hospitals (44 percent) reported that they can delete their audit logs. Although these hospitals reported that they limit the ability to delete the audit log to certain EHR users, such as system administrators, one EHR vendor noted that any software programmer could delete the audit log.

RTI recommends that the ability to disable the audit log be limited to certain individuals, such as system administrators, and that EHR users, such as doctors and nurses, be prevented from editing the contents of the audit log because these actions can compromise the audit log's effectiveness. Hospitals reported they have the ability to disable (33 percent) and edit (11 percent) their audit logs, although they reported restricting those abilities to certain EHR users, such as system administrators or EHR vendors. All four EHR vendors we spoke with reported that the audit logs cannot be disabled in their products, but one vendor again noted that a programmer could disable the audit log.

I further note that, being voluntarily provided, i.e., not part of a formal investigation of any specific organization, those numbers are likely low, perhaps very low considering this issue.

An audit log or audit trail is an automatically-generated dataset, invisible to most users, containing items such as who viewed records, the date/time/location of viewing, and indication of actions they may have performed on the records such as editing/changes/additions/deletions, etc.

As an EHR itself is a collection of magnetized or optically encoded bits on some computer storage medium, it cannot be authenticated as complete and free from alteration by humans.

The audit trail is the only way to authenticate an EHR printout, however (as well as EHR screenshots or any other electronic data turned into a tangible form from those bits) as complete and free from alteration.

If an EHR printout cannot be authenticated as complete and free from alteration, its trustworthiness and perhaps even court admissibility as a business record under an exception to the hearsay rules regarding evidence may be damaged or invalidated.

My concern is that, if true, and considering the conflict of interest a hospital has regarding hiding potential fraud or malpractice that could cost them millions of dollars, a capability to "delete the contents of their internal audit logs whenever they'd like" and to edit audit trails (which based on the capabilities of relational databases also implies an ability to delete sections of audit logs selectively and/or to substitute false data) is simply alarming.

I don't think the EHR pioneers intended EHRs to be used for purposes of allowing evidence spoliation without traceability ...

-- SS

Dec. 13, 2013 Addendum:

I received the following reply from EHR compliance expert Dr. Reed D. Gelzer.  Re-posted with permission:

Good morning Dr Silverstein,

Thank you yet again for the illumination that you bring to matters of truth in Healthcare Information Technology.

Regarding the OIG report’s source document, the 2007 report to the ONC, I was the Fraud Prevention Workgroup Chair for that project, working under Principal Investigators Dr. Don Simborg and Susan Hanson, former Chair of AHIMA. 

For anyone who is interested in this subject matter, I would recommend that you go to the source document and, among other things, review the list of contributors.  These were all individuals who volunteered time to attempt to mitigate harms of defective HIT, in their capacities of records management systems, nearly 8 years ago now.   Many have gone on into leadership roles in related organizations and domains, some still working towards trustworthy health information technology systems.

I believe that I can say that none of those working on the report then would have believed that it was conceivable that even our most basic recommendations regarding the fitness of audit functions would remain "novel" in the industry in 2013.  One cannot be surprised at the low level of authenticity supports in hospitals’ EHRs systems given that fitness as record management systems for patient care has, to date, been either neglected or presumed, not tested or attested.   I am gratified that our 2007 work was utilized for the OIG report to illuminate the deplorable state of integrity supports in these patient care information systems.  This will undoubtedly spur interest in supportive resources such as the HL7 EHR System Functional Model Standard and the HL7 Records Management and Evidentiary Support Profile Standard.

All of us who worked on that ONC report are, I hope, as gratified as I am that the OIG removed our work product from its designated obscurity.   We developed the guidelines via methods that were more qualitative than quantitative, entirely intended to guide initial implementation backed by more methodical research.   We represented the most informed at that time, including those like myself and my ADIC associate Patricia Trites who had performed compliance testing on over 30 among the leading EHRs at the time and found extraordinary ranges of deficiencies, including audit functions that could be disabled at will.   Standards and tools existed then to support mitigation of risks and those Standards and tools have expanded since.  Now that the events and ONC decisions that led to inactions on the report are now in the past, we can more rapidly achieve the potentials nascent in HIT by rendering it more trustworthy, usable, and safe.

Thank you again for your ongoing vigilance.

Sincerely,

Reed D. Gelzer, MD, MPH, CHCC
Trustworthy EHR, LLC
Co-Facilitator, HL7 Records Management and Evidentiary Support Workgroup

To this I add that I also would not have found it conceivable that my concerns about bad health IT and the risks of patient harm it poses, as well as common healthcare IT project mismanagement, of which I started writing about in 1998 (http://cci.drexel.edu/faculty/ssilverstein/cases/) would remain "novel" ideas in the industry in 2013.

The Obamacare healthcare exchange website debacle has made the latter issue mainstream.  The former issues still need more sunlight.

-- SS

2/4/14 addendum:

HHS is apparently starting to pay attention to the importance of robust and secure EHR audit trails.

I note in the HHS document "Meaningful Use Stage 2, 2014 Edition EHR CERTIFICATION CRITERIA 45 CFR 170.314", page 7, regarding audit trails, available at this writing at http://www.healthit.gov/sites/default/files/meaningfulusetablesseries2_110112.pdf:

§170.314(d)(2) Auditable events and tamper-resistance.

(i) Record actions. EHR technology must be able to:

(A) Record actions related to electronic health information in accordance with the standard specified in § 170.210(e)(1);
(B) Record the audit log status (enabled or disabled) in accordance with the standard specified in § 170.210(e)(2) unless it cannot be disabled by any user; and
(C) Record the encryption status (enabled or disabled) of electronic health information locally stored on end-user devices by EHR technology in accordance with the standard specified in § 170.210(e)(3) unless the EHR technology prevents electronic health information from being locally stored on end-user devices (see 170.314(d)(7) of this section).

(ii) Default setting. EHR technology must be set by default to perform the capabilities specified in paragraph (d)(2)(i)(A) of this section and, where applicable, paragraphs (d)(2)(i)(B) or (d)(2)(i)(C), or both paragraphs (d)(2)(i)(B) and (C).

(iii) When disabling the audit log is permitted. For each capability specified in paragraphs (d)(2)(i)(A), (B), and (C) of this section that EHR technology permits to be disabled, the ability to do so must be restricted to a limited set of identified users.

(iv) Audit log protection. Actions and statuses recorded in accordance with paragraph (d)(2)(i) must not be capable of being changed, overwritten, or deleted by the EHR technology.

(v) Detection. EHR technology must be able to detect whether the audit log has been altered. 

From a posting at http://healthcaresecprivacy.blogspot.com/2012/09/meaningful-use-stage-2-audit-logging.html:

... The Information that needs to be recorded: § 170.210(e)(1)(i):  These rules [in a column I did not show here - ed.] identify “sections 7.2 through 7.4, 7.6, and 7.7 of the standard specified”. This is simply the list of attributes that an audit log entry should contain that ASTM E2147 says are mandatory, and excludes the values it outlines as important but not mandatory. Below is about 90% of what is in section 7, I didn't want to copy all of it out of respect for the copyright. But, the part missing is just a one-line definition of each item, nothing more than that.

7. Audit Log Content
7.1 Audit log content is determined by regulatory initiatives, accreditation standards, and principles and organizational needs. Information is needed to adequately understand and oversee access to patient identifiable data in health information systems in order to perform security oversight tasks responsibly.
Logs must contain the following minimum data elements:
7.2 Date and Time of Event
7.3 Patient Identification
7.4 User Identification
7.5 Access Device (optional)
7.6 Type of Action (additions, deletions, changes, queries, print, copy)
7.7 Identification of the Patient Data that is Accessed(optional)
7.8 Source of Access (optional unless the log is combined from multiple systems or can be indisputably inferred)
7.9 Reason for Access (optional)
7.10 If capability exists, there should be recognition that both an electronic “copy” operation and a paper “print” operation are qualitatively different from other actions.

I am not sanguine about the "optional" components, especially 7.7 - the actual data that was accessed and acted upon.

I also note it is stunning that these audit trail 'rules' have only been promulgated recently.  It will be interesting to see how rigorous the EHR "certification" process will be regarding audit trails.

-- SS

For Whom the Door Revolves - from For-Profit Contract Research Organization Leadership to Surgeon General?

The new nominee to be US Surgeon General is Dr Vivek Murthy, as announced in the Boston Globe White Coat Notes blog in November.  A Boston Globe article a few days described not only his "healthy lifestyle" which included ingestion of "unflavored almond milk, raw carrots, and high-protein grains," as well as the practice of yoga, but how he has

strived to use his medical degree to help patients beyond the hospital walls through starting health care companies and nonprofits. His supporters hope that his record stands out....

While the US Surgeon General has little power, occupants of the office have tried to use it as a bully pulpit, often for public health issues.  For example, Dr C Everett Koop was known for his campaign against smoking, and his advocacy for public health measures to combat HIV.   Most previous Surgeons General came from academic, public health, and/or practice backgrounds (Dr Koop was Physician-in-Chief of the Childrens Hospital in Philadelphia; his successor, Dr Antonia Caremello was in academic pediatrics, private practice, and at the NIH; then Dr M Jocelyn Elders also came from academic pediatrics, etc.)

Dr Murthy superficially seems to come from this tradition.  The Globe article noted his "professional life as a Brigham and Women's Hospital [a prestigious Harvard teaching institution] physician."

However, Dr Murthy was also described by the official statement nominating him to be surgeon general as "Co-Founder and Chairman of the Board of TrialNetworks, formerly known as Epernicus, since 2007."  The Globe called it a "software start-up company in Needham ... to help drug developers efficiently collect information from clinical trials."

But wait, an op-ed in early December in USA Today called him a "self described passionate entrepreneur" and "a part-time physician and a full-time businessman."  In fact, the TrialNetworks web-site describes a company that

provides sponsors and CROs the industry's only Clinical Trial Optimization System. Using this modern and intuitive cloud-based technology, customers such as Merck & Co. and Infinity Pharmaceuticals are able to transform the quality and efficiency of clinical operations at each stage of a trial from feasibility through closeout. Companies ranging from biotechs to Top-10 pharmas have implemented the TrialNetworks platform for use in Phase I-IV trials by more than 25,000 site staff in 60 countries.

Thus, TrialNetworks is a form of for-profit contract research organization in that it is apparently paid by drug and biotechnology companies to help them do clinical trials and other clinical research.

Its website includes customer testimonials from  Merck, Biogen Idec, Infinity Pharmaceuticals, and Ariad Pharma.

So apparently Dr Murthy, if approved, may be the first US Surgeon General to come through the revolving door from a leadership position in a company that is a variant on the for profit contract research organization theme, an organization that supports clinical research by the pharmaceutical industry, and has major pharmaceutical and biotechnology corporate clients.  As we have discussed, most clinical research is now sponsored, and effectively run by for-profit drug, biotechnology and device companies, and is devoted to efforts by these companies to assess their own products, often ostensibly as required for regulatory approval, but often influenced by marketing considerations.  Unfortunately, the domination of clinical research by those with vested interests in having the research turn out in favor of their own products has resulted in many examples of manipulation of the research, and suppression when that manipulation has failed to produce the desired results.

So the obvious concern about Dr Murthy would be whether he would use his bully pulpit only to support patients' and the public's health,  or would his prior experience in a leadership position in commercially sponsored pharmaceutical research influence him in favor of that industry's priorities?

As we have discussed, US health care is now dominated by for-profit corporations, and these organization can command the effort of multi-million or billion dollar marketing and public relations divisions to sell their products and the policy positions they favor.  These organizations hardly are in need of more bully pulpits.  Yet it seems that this new appointment will further increase the influence in government of big health care business, rather than that of health care professionals, patients, and the people in general.

Sadly, it seems that Dr Murthy's nomination is just the latest example of how leadership of health care in government and in the corporate world now overlaps, and how the role of "pure" health care practitioners and health care academics in government has waned.  As we previously noted,  the system in which government and big corporations largely overlap in terms of their leadership and presumably goals is called corporatism.  One can argue that such systems end up being run primarily for the benefit of corporate and government insiders.

 Until we dispel the fog of corporatism that has spread over the government that was once supposed to be of the people, by the people, and for the people, expect no real health care reform, and expect continuing rising costs, declining access, and worsening patient care. Obviously, true health care reform would start with the government and its officials putting patients' and the public's health first, way ahead of the financial comfort of corporate leaders.

I would note that neither the currently controversial and now operational Affordable Care Act, nor any of its opponents schemes for alternatives addresses this issue.

by Roy M. Poses MD for Health Care Renewal 

Sickness in the Information Technology Sector: Technical problems, discord plagued Maryland health care site

Eye-opening, ground-level, no-holds-barred accounts of IT mismanagement and mayhem are too rare, considering the stakes in 2013.  The behind-the-scenes crap that goes on needs a great deal of sunlight. Below is such an account of great merit, in the Baltimore Sun.

First, I note physicians and nurses are generally able to collaborate to take care of sick patients.  They are natural "team players"; taking care of patients is their professional calling.  I did it all the time in my patient care years, especially in critical care settings, where lack of collaboration with colleagues could lead to dead patients.

IT personnel are another species entirely.  It's all about territory, competition, self-promotion, empire-building, drinking from the ever-flowing fountain of money, etc.; process matters more than results; and to hell with the end users, let alone patients.

Here is, in macro form, the Fifty Shades of Mass Dysfunction I've often encountered when my professional work intersected with IT personnel, whether in hospitals or industry.  And I was supposed to simply "shut up" about this crap - i.e., go along to get along:

Technical problems, discord plagued Maryland health care site
http://www.baltimoresun.com/health/bs-hs-exchange-woes-20131207,0,6559272.story 

By Meredith Cohn and Andrea K. Walker, The Baltimore Sun 10:50 p.m. EST, December 7, 2013

Although state officials have provided the public scant detail about the troubled launch of Maryland's version of Obamacare, emails and documents show that the project was beset behind the scenes for months by an array of technical issues, warring contractors and other problems.

Since Maryland's online health exchange opened Oct. 1 for people to buy insurance under the Affordable Care Act — and immediately crashed — the two main companies in charge of the website have taken their fight to court, a corporate project manager was replaced and a high-powered consulting firm was quietly brought in to restore order. Though state officials initially said the crash of the online exchange was an unexpected and fixable problem, emails and documents obtained by The Baltimore Sun through state open-records laws outline serious issues before and after the launch.

The revelations came just days before Rebecca Pearce, the head of the exchange, resigned. State officials announced that move Friday night and pulled Carolyn Quattrocki from the governor's health reform office to serve as an interim replacement

I am going to reproduce some paragraphs that show just how chaotic are the processes - in any health IT endeavor, whether they be for the exchanges that are essential to getting insured, or to the hospital IT systems that are essential to getting out of the hospital in something other than a pine box.

Emphases mine:

Just two weeks before the launch, Pearce visited the prime contractor's Linthicum headquarters and found a room of empty seats. She fired off an email questioning the company's commitment to resolve problems and reminding the contractors of what was at stake: "Tonight, I am begging. I don't know how else to say it: we have got to make this a reality."

Despite her proddings, in-fighting between contractor Noridian Healthcare Solutions and a key subcontractor, EngagePoint Inc., disintegrated amid finger-pointing and accusations in court papers. At one point, after Noridian severed contractual ties between the companies but continued to ask for help, EngagePoint CEO Pradeep Goel emailed Noridian officials: "Are you people on crack cocaine?"

Contractors, subcontractors, all offering "solutions" in healthcare and all likely to have not a single soul on board with anything beyond a merchant-computing background.

And nice, friendly questions amongst the friendly, collaborative finger-pointing and accusations typical of the IT world when mass mayhem occurs.

And a begging boss?  How lovely.

... Pearce, who was hired in 2011 at a salary of $175,000, declined to comment on problems surrounding the exchange or her resignation.  [If I were her I would have resigned out of disgust with these idiots.  Oh wait - I did leave IT positions for reasons, in part, like that  - ed.]

The emails provided by the state covered the two weeks before and after the website launch. They give only a limited behind-the-scenes view of creating and launching the exchange. Officials withheld an unknown number of emails, saying state law exempts them from disclosure because they involved the decision-making process of high-ranking executive officials.

The troubles in Maryland mirror problems faced by other state exchanges, as well as the federal portal providing insurance options to consumers in 36 states.

 Emails withheld under claims of legal privilege means we'll never know all the dirt.

... In Maryland, Sharfstein said the complexity was compounded because of an aging state Medicaid computer system that needed to be integrated into the exchange. Officials also chose to customize existing technology that proved tougher to retrofit than expected, he said.

"Unlike buying a book online from Amazon, this process is more akin to applying for a passport, buying a home, and receiving an individually calculated tax credit all through a single web portal," O'Malley said Friday night. "We had more user glitches and user problems than we had hoped.

"A longer testing period might have allowed us to prioritize and address more of these problems before the launch date. Time and ultimate success will tell whether the decision to purchase off-the-shelf software and employ multiple contractor entities were good or bad decisions."

"Hope" is not a proper project management technique of which I am aware, especially in a project of the admitted complexity as this one.

"Tougher to retrofit than expected?" Expected by whom?  IT "experts" who believe in unicorns and the tooth fairy?  I point out that in medicine, such mistakes are called "malpractice."

A longer testing period might have allowed us to address more problems?  But they went live anyway?

... In early 2012, the state gave a $71 million contract to develop the website to a Noridian-led team that included Curam Software, IBM and Connecture. To save time in creating the exchange, the Maryland legislature exempted the contract from the normal procurement process, and North Dakota-based Noridian outscored three other bidders.

Sharfstein said Noridian will likely remain at work in its Linthicum offices beyond its contract's year-end expiration. The company has already been paid about $57 million but the state contract allows penalties for delays. State officials declined to comment on whether any penalties will be sought.

Noridian is ultimately responsible for delivering the system, Sharfstein said. EngagePoint, which is based in Calverton, was not included in the original contract and appeared to have been hired without the exchange's knowledge, officials said.

The state first learned of the companies' "deep strains" in the three months before the website launched, according to documents in U.S. District Court in Baltimore. The issues disputed included accounting, project management, intellectual property and payment.

Emails offer a glimpse at how their differences affected efforts to build the site and then fix post-launch problems. Pearce repeatedly questioned the contractors' commitment to the project after Gov. Martin O'Malley announced on national TV that Maryland's site would go live on time.

On Sept. 22, after Sen. Barbara Mikulski echoed the governor in publicly applauding Maryland's readiness, Pearce wrote the contractors: "It's time to get this right. Now. Period."

Noridian was also criticizing the subcontractor it hired. On Sept. 25, Noridian's project manager wrote to Goel, complaining that EngagePoint refused to perform critical work: "EngagePoint is responsible for 'designing and implementing [an exchange] system,'" the project manager wrote.

The 8 a.m. launch was supposed to allow the estimated 800,000 uninsured Marylanders to sign in and browse 45 plans from six insurers. Officials had warned of "bumps in the road," but the site crashed in minutes.

... "As the executives in charge of this program, I would like to understand from you exactly what is happening with the project and what you are doing to address the issues," she wrote to the contractors at 7:56 a.m. on Oct. 2. By 4:10 p.m., she questioned why 85,000 people had hit the "get started" button, but there fewer than 500 accounts had been created.

About a half-hour later, she wrote to the contractors, "Can you please provide an update on what is going on right now? Who is on site? What has anyone learned?"

Some of the companies' emails focused on achievements rather than dwelling on worsening problems.

Noridian CEO Tom McGraw wrote to state officials on Oct. 4, "We have seen increases in all aspects of the system performance over the last several hours and anticipate that these will start showing in the next report."

But four days later McGraw notified state officials that the project manager was being replaced.

Conflict, favoritism, fighting, "it's not my job", lies, spin, stonewalling, strife ... chaos.

"Efforts to build the site and then fix post-launch problems" is also typical of the IT world.  In health IT, especially clinical IT, those harmed or killed during the "fixing" process are considered a necessary sacrifice, a "bump in the road."

... Paul von Ebers, CEO of Noridian Mutual Insurance Co., Noridian's parent company, wrote on Oct. 10 that the consultants "expressed concern with ongoing coordination issues between the Noridian and EngagePoint teams." He requested a meeting to resolve "working differences" between the companies.

This was days before Noridian fired EngagePoint, sparking the angry email exchanges and dueling lawsuits between the companies. Noridian then sought to hire EngagePoint workers; EngagePoint sued and was met with a counter-suit.

"We are expected to do piecemeal work for Noridian after contract termination because you just woke up and decided you don't know what you are doing?" Goel wrote Oct. 26. "We are not going to respond to ridiculous emails from Noridian demanding our team members show up for work after being escorted out of the office."

That's the path to progress:  firing subcontractors and attempting to steal their employees, and lawsuits and countersuits.

I could go on, but read the entire postmortem account (itself rare in large IT projects) at the Baltimore Sun link above.

Some of the de-identified cases at my academic site on health IT difficulties reflect this type of discord; some are mine personally such as at http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=clinical%20computing%20problems%20in%20ICU , http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=Cardiology%20story and http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=Cultures%20of%20mismanagement%20toxic%20to%20healthcare%20quality.

I was expected to "go along to get along" with this BS, and was deemed "not a team player" when I spoke up for enduser (clinician) and ultimate customer (patient) rights.

In summary, the IT world is demonstrably dysfunctional, with the types of conflict as in the Baltimore Sun story more the rule than the exception, especially where healthcare is concerned.  Good, relatively brief resources for better understanding these issues are the following papers:

Social Informatics.  An introductory essay entitled “Learning from Social Informatics” by R. Kling at the University of Indiana can be found at this link (PDF).  The book “Understanding And Communicating Social Informatics” by Kling, Rosenbaum & Sawyer, Information Today, 2005 (Amazon.com link here) was based on this essay.

Pessimism, Computer Failure, and Information Systems Development in the Public Sector.  (Public Administration Review 67;5:917-929, Sept/Oct. 2007, Shaun Goldfinch, University of Otago, New Zealand).  Cautionary article on IT that should be read by every healthcare executive documenting the widespread nature of IT difficulties and failure, the lack of attention to the issues responsible, and recommending much more critical attitudes towards IT.  linkto pdf

“Defensive climate in the computer science classroom” by Barker et al., Univ. of Denver.  Link here(subscription required).  May help explain the control-seeking culture of IT personnel.   As part of an NSF-funded IT workforce grant, the authors conducted ethnographic research to provide deep understanding of the learning environment of computer science classrooms. Categories emerging from data analysis included 1) impersonal environment and guarded behavior; and 2) the creation and maintenance of informal hierarchy resulting in competitive behaviors. These communication patterns lead to a defensive climate, characterized by competitiveness rather cooperation, judgments about others, superiority, and neutrality rather than empathy.

If a person thinks this technology will "revolutionize" healthcare anytime soon, considering the "people issues" involved let alone the technical ones, then that person is either hopelessly naïve, or needs a mental health evaluation (colloquially, "needs their head examined").

-- SS

But Don't Worry, Your Health Information is Secure: the Enforcers are Themselves Incompetent and Broke

Another in my "But Don't Worry, Your Health Information is Secure" series (see http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy) ... a promise blindly made by the healthcare information technology hyper-enthusiasts.

The Office of the Inspector General for HHS just issued a report finding that the Office of Civil Rights (OCR), which is charged with enforcing the HIPAA/HITECH law, had itself failed to adequately protect the security of the health information it handled. Specifically OIG found that OCR “focused on system operability to the detriment of system and data security.”

From “The Office for Civil Rights Did Not Meet All Federal Requirements in Its Oversight and Enforcement of the Health Insurance Portability and Accountability Act Security Rule”, p. ii (Nov. 2013).  http://oig.hhs.gov/oas/reports/region4/41105025.asp

Summary:

The Office for Civil Rights (OCR) did not meet certain Federal requirements critical to the oversight and enforcement of the Health Insurance Portability and Accountability Act Security Rule (Security Rule). OCR had not assessed risks, established priorities, or implemented controls for its Federal requirements to provide for periodic audits of covered entities to ensure their compliance with Security Rule requirements. In addition, OCR's Security Rule investigation files did not contain required documentation supporting key decisions made because management had not implemented sufficient controls, including supervisory review and documentation retention, to ensure investigators follow investigation policies and procedures for properly initiating, processing, and closing Security Rule investigations. Further, OCR had not fully complied with Federal cybersecurity requirements for its information systems used to process and store investigation data because it focused on system operability [I presume they mean 'interoperability' - ed.] to the detriment of system and data security.

We recommended that OCR (1) assess the risks, establish priorities, and implement controls for its HITECH auditing requirements; (2) provide for periodic audits in accordance with HITECH to ensure Security Rule compliance at covered entities; (3) implement sufficient controls, such as supervisory reviews and documentation retention, to ensure policies and procedures for Security Rule investigations are followed; and (4) implement the National Institute of Standards and Technology Risk Management Framework for systems used to oversee and enforce the Security Rule. In its comments on our draft report, OCR generally concurred with our recommendations and described the actions it has taken to address them. In specific comments on our second recommendation, however, OCR explained that no funds had been appropriated for it to maintain a permanent audit program and that funds used to support audit activities previously conducted were no longer available.

The enforcers are themselves negligent, incompetent and broke.  And hospitals are expected to keep electronic protected health information secure?

I comment no further.  What more could I possibly write?

-- SS

Dec. 9, 2013 Addendum:

This woman would probably agree that this is a problem

Dec. 9, 2013
http://www.thestar.com/news/gta/2013/11/28/disabled_woman_denied_entry_to_us_after_agent_cites_supposedly_private_medical_details.html

Disabled woman denied entry to U.S. after agent cites supposedly private medical details

A Toronto woman is shocked after she was denied entry into the U.S. because she had been hospitalized for clinical depression.

Ellen Richardson went to Pearson airport on Monday full of joy about flying to New York City and from there going on a 10-day Caribbean cruise for which she’d paid about $6,000.

But a U.S. Customs and Border Protection agent with the Department of Homeland Security killed that dream when he denied her entry.

“I was turned away, I was told, because I had a hospitalization in the summer of 2012 for clinical depression,’’ said Richardson, who is a paraplegic and set up her cruise in collaboration with a March of Dimes group of about 12 others.

The Weston woman was told by the U.S. agent she would have to get “medical clearance’’ and be examined by one of only three doctors in Toronto whose assessments are accepted by Homeland Security. She was given their names and told a call to her psychiatrist “would not suffice.’’

At the time, Richardson said, she was so shocked and devastated by what was going on, she wasn’t thinking about how U.S. authorities could access her supposedly private medical information.

“I was so aghast. I was saying, ‘I don’t understand this. What is the problem?’ I was so looking forward to getting away . . . I’d even brought a little string of Christmas lights I was going to string up in the cabin. . . . It’s not like I can just book again right away,’’ she said, referring to the time and planning that goes into taking a trip as a disabled person.

Richardson said she’d had no discussion whatsoever with the agent at the airport about her medical history or background.

Read the whole thing.

-- SS

On Hypervigilance Due to Bad Health IT: "Texting While Doctoring: A Patient Safety Hazard"

An Opinion piece "Texting While Doctoring: A Patient Safety Hazard" appeared in the Annals of Internal Medicine of 3 December 2013, authored by Christine A. Sinsky, MD and John W. Beasley, MD.  Dr. Sinsky is known to me to be what some would call a "heatlhcare IT iconoclast" (more accurately represented by the term "healthcare IT gadfly/realist" IMO).

In the piece the authors comment on the distractions caused by the technology, leading to doctors missing important cues in the exam room and to and impaired problem-solving.  This is part of a larger phenomenon that has been called "skill-degrading" or "de-skilling", e.g., see my April 16, 2010 post "Health Information Technology Basics From Calif. Nurses Association and National Nurses Organizing Committee" at http://hcrenewal.blogspot.com/2010/04/health-information-technology-basics.html).  

These effects are likely to be further worsened as more and more clerical tasks such as order entry, the authors point out, get shifted to medical professionals.  To new readers: note that computerized order entry is often a complex and convoluted process; the CPOE systems are most decidedly NOT mere "typewriters for orders."  See, for instance, part 6 of my series on "Mission-hostile health IT" at http://hcrenewal.blogspot.com/2009/02/it-makes-healthcare-easier-is-this.html.

Most of the Annals article is available as a free preview at http://annals.org/article.aspx?articleid=1784295 as of this writing and is worth reviewing.

Article preview, click to enlarge

I found one passage in particular striking, though.  In my ongoing discussions with computer scientist/informaticist/polymath Dr. Jon Patrick at U. Sydney (http://www.healthll.com.au/?page_id=440) , the issue of hypervigilance necessitated by bad health IT came up, and we arrived at the definition of same seen at my teaching site at http://cci.drexel.edu/faculty/ssilverstein/cases/:

Bad Health IT ("BHIT") is defined as IT that is ill-suited to purpose, hard to use, unreliable, loses data or provides incorrect data, is difficult and/or prohibitively expensive to customize to the needs of different medical specialists and subspecialists, causes cognitive overload, slows rather than facilitates users, lacks appropriate alerts, creates the need for hypervigilance (i.e., towards avoiding IT-related mishaps) that increases stress, is lacking in security, compromises patient privacy or otherwise demonstrates suboptimal design and/or implementation. 

Note this passage in Dr. Sinsky and Beasley's opinion piece:

"I am always multitasking ... I am entering orders, checking labs, downloading information while I talk to the patient.  It requires chronic hypervigilance, which is exhausting and demands conscious effort to stay in the 'present' with the patient" (Day S., Personal communication.)  Click to enlarge.

I don't know if Dr. Day had seen my materials, but I suspect the exhausting hypervigilance is all too common, just not much publicized due to the secretive, closed, retaliatory-towards-whistleblowers nature of the healthcare IT sector.

I ask:  is this what we really want, in pursuit of some uncertain cybernetic miracle?

I note that the healthcare IT experiment (and the technology is experimental), long usurped from the Medical Informatics pioneers who trained me and put in the hands of commercial interests and those of a mercantile/manufacturing/management computing background, is increasingly a failure.

-- SS