Poor Prognosis for Privacy

By Melinda Beck
The Wall Street Journal
Originally published May 1, 2013

The sharing of Americans' health information is set to explode in coming years, with millions of patients' medical records converted to electronic form and analyzed by health-care providers, insurers, regulators and researchers.

That has prompted concerns over privacy—and now, new federal rules that aim to give patients more control over their information are posing technical and administrative problems for the doctors and hospitals that have to implement them.

Information-technology experts say the challenges illustrate how difficult it may be to protect sensitive patient information as digitization of the health-care industry expands.

"The reality is, our ability to exchange electronic information is already well beyond our ability to control it," says John Leipold, CEO of Valley Hope Technology in Norton, Kan., which makes electronic record systems for behavioral-health providers.

The new rules are part of a revision of the 1996 Health Insurance Portability and Accountability Act, known as HIPAA. They went into effect in March, but providers have until Sept. 23 to comply.

One key new provision requires doctors and hospitals not to disclose medical information to a patient's insurer if the patient requests it and pays for the services out-of-pocket. The information can be noted in the patient's medical file, but stopping it being revealed to insurers inadvertently may be difficult, some health-care providers say.

The entire story is here.

You will likely hit a pay-wall for this story.

Large HMO Cited in Mental Health Care Cover-up

Nancy A. Melville
Medscape Medical News
Apr 03, 2013

California's Department of Managed Health Care (DMHC) has cited Kaiser Permanente for using a deceptive dual record-keeping system to cover up violations of the state's "timely access" law, which restricts the amount of time mental health patients should have to wait for an appointment, as well as for other violations.

In a report filed last month, the DMHC concludes that many Kaiser mental health patients faced extensive waiting periods for appointments, well beyond the 10 days for a regular appointment that the law requires.

(cut)

Clinician Whistle-blowers

The violations were discovered through a standard survey or evaluation process that the DMHC uses to review compliance by all California health plans.

After the review was underway, complaints regarding timely access violations were brought forward by a group of Kaiser Permanente's own mental health clinicians, who were represented by the National Union of Healthcare Workers (NUHW). Those complaints were considered and incorporated in the evaluation, Rouillard said.

Among the psychologists lodging complaints was Andris Skuja, PhD, who said the violations had been observed for years before the clinicians referred their concerns to the DMHC.

"Over a number of years, we tried many internal mechanisms with Kaiser to address some mounting concerns we had about the adequacy of treatment," Dr. Skuja told Medscape Medical News.

The entire story is here.

A previous news story about this topic can be found here.

Kaiser Permanente cited for EHR mental health violations

By Jennifer Bresnick
EHR Intelligence
Originally published on March 20, 2013

Kaiser Permanente, the largest healthcare provider in California, has been cited by the California Department of Managed Healthcare (DMHC) for keeping two sets of patient records: an official EHR that it showed to state inspectors, and a parallel paper record that hid violations of the state’s “timely access” law that mandates shorter wait times for mental healthcare than Kaiser was able to provide.  The inaccuracies involved in the HMO’s dual record keeping system meant that mental health patients may have waited weeks longer than the law stipulates for appointments, resulting in illegal denials of access to care for schizophrenia, autism, depression and suicidal ideation, among other serious conditions.

The problem stems from Kaiser’s double appointment keeping procedures.  While there is an electronic version – the version that gets reported to government officials – Kaiser also used paper lists in some facilities, rendering its electronic appointment wait time calculators useless.

The entire story is here.

Thanks to Ed Zuckerman for this story.

Familiarity breeds doctor contempt with EHRs

Experts say meaningful use is contributing to the growth of electronic health record systems, but it also has a negative effect on EHR user-friendliness.

By Pamela Lewis Dolan
amednews.com
Originally published March 18, 2013

The meaningful use incentive program has resulted in more physicians implementing electronic health record systems and using them in advanced ways. Yet doctors' dissatisfaction with the systems has increased.

Theories for what is driving the dissatisfaction include rushed implementations, too little training and physicians doing too much too soon as they struggle to meet meaningful use requirements, other federal mandates and changes to the health care landscape. EHR vendors also are thought to be taking on too much in too little time. As they rush to deliver products certified for meaningful use, usability may have suffered.

A survey by AmericanEHR Partners of 4,279 clinicians, including primary care physicians, specialists and diagnostic professionals, found that user satisfaction declined from 39% in 2010 to 27% in 2012. The rate of those “very dissatisfied” increased from 11% to 21% during the same period. The findings were presented in March at the Healthcare Information and Management Systems Society annual conference in New Orleans.

The entire article is here.

Survey: Too many EHR alerts could lead to missing test results

By Andis Robeznieks
ModernHealthcare.com
Originally posted March 4, 2013

The information deluge unleashed by electronic health-record systems could cause physicians to miss notifications of abnormal test results, according to a survey of primary-care practitioners with the U.S. Veterans Affairs Department. Missing those notifications could delay needed care for patients, according to the physicians, nurse practitioners and physicians assistants surveyed.

Researchers from several Houston institutions—including the Houston VA Health Services Research and Development Center of Excellence—surveyed almost 2,600 VA primary-care practitioners from June 2010 through November 2010 regarding EHR-based alerts. Almost 30% acknowledged missing notification of test results that led to care delays, according to a research letter in the American Medical Association journal JAMA Internal Medicine (formerly the Archives of Internal Medicine).

The entire story is here.

'Not One Successful EHR System In Whole World'

Longtime advocate of computerizing healthcare C. Peter Waegemann calls current health IT policy 'misguided.'

By Neil Versel
InformationWeek
Originally posted on December 17, 2012

While federal health IT officials were touting the perceived successes of their efforts to increase physician usage of electronic health records (EHRs), one longtime advocate of EHRs was criticizing the whole direction of health IT policy.

"In my opinion, there is not one successful EHR system in the whole world," said C. Peter Waegemann, who founded and ran the Boston-based Medical Records Institute from 1984 to 2009. "User friendliness, usability, and interoperability are not there," he added in an interview with InformationWeek Healthcare.

He defined a successful EHR as one that is fully interoperable. "We have been focusing too much on documentation [for the purpose of reimbursement]," he said. This point has not been lost on the Obama administration, which has warned providers about using EHRs to "game the system."

Still, Waegemann believes the administration has not been aggressive enough with its $27 billion federal Meaningful Use EHR incentive program, based on published rules for Stage 2 and early recommendations for Stage 3. "MU2 and MU3 are just small steps. They rely on old technology," Waegemann said.

He noted that a number of leading EHR systems are written in the MUMPS programming language that originated at Massachusetts General Hospital in the late 1960s. Meaningful Use also relies on outdated standards such as version 2.x of Health Level Seven International's messaging standards rather than the more recent version 3.

The entire story is here.

Medicare Is Faulted on Shift to Electronic Records

By REED ABELSON
The New York Times
Originally Published: November 29, 2012

The conversion to electronic medical records — a critical piece of the Obama administration’s plan for health care reform — is “vulnerable” to fraud and abuse because of the failure of Medicare officials to develop appropriate safeguards, according to a sharply critical report to be issued Thursday by federal investigators.

The use of electronic medical records has been central to the aim of overhauling health care in America. Advocates contend that electronic records systems will improve patient care and lower costs through better coordination of medical services, and the Obama administration is spending billions of dollars to encourage doctors and hospitals to switch to electronic records to track patient care.

But the report says Medicare, which is charged with managing the incentive program that encourages the adoption of electronic records, has failed to put in place adequate safeguards to ensure that information being provided by hospitals and doctors about their electronic records systems is accurate. To qualify for the incentive payments, doctors and hospitals must demonstrate that the systems lead to better patient care, meeting a so-called meaningful use standard by, for example, checking for harmful drug interactions.

The entire article is here.

EHRs Push Private Practice Docs Out of Business

Growing numbers seek employment, in part because government-mandated technology costs too much

By Ken Terry
Information Week
Originally published November 9, 2012


Sixty-one percent of independent physicians are seeking employment, and the majority of those doctors say that the government requirement for them to adopt and show meaningful use of an electronic health record (EHR) is one reason, a new Accenture report finds.

The paper, entitled "Clinical Transformation: New Business Models for a New Era in Healthcare," notes that the percentage of private practice physicians in the workforce dropped from 57% in 2000 to 39% in 2012. By the end of next year, Accenture forecasts, only 36% of physicians will be self-employed.

The biggest reason for doctors to seek employment, the Accenture survey shows, is the cost of doing business as an independent practitioner. Eighty-seven percent of respondents who were looking for a job cited that challenge, and 61% checked off "the prevalence of managed care." Government EHR requirements and maintaining/managing staff each were mentioned by 53% of doctors.

The entire story is here.

HHS IG pledges focus on Medicare billing abuse involving electronic records

Inclusion in IG work plan for 2013 follows Center's 'Cracking the Codes' series

By Fred Schulte
The Center for Public Integrity
Originally published October 24, 2012


Federal officials will focus on possible Medicare overbilling by doctors and hospitals that use electronic medical records, a top government fraud investigator said  Wednesday, in announcing investigative priorities for the coming year.

“Electronic medical records can improve quality of care and efficiency and help us uncover cases of fraud and abuse. At the same time, we must guard against the use of electronic records to cover up crime,” said Daniel Levinson, the Department of Health and Human Services inspector general, in a video presentation.

The video posted on the agency’s website on Wednesday summarized the inspector general’s “work plan,” for 2013, a listing of Medicare and Medicaid fraud fighting efforts the agency plans to emphasize.

The entire article is here.

To Encrypt Email or Not to Encrypt Email? Practical Answers to a Question That Is Surprisingly Complex

by Elizabeth H. Johnson
Poyner Spruill LLP
Originally posted on October 5, 2012


Health care providers frequently ask us whether they have to encrypt emails, particularly those sent to patients who have asked for an emailed copy of their health records. Since patients have a right to receive electronic copies of their health records, emailing them a copy when they ask for it seems like the right thing to do.

Unfortunately, the decision actually is more complicated. HIPAA requires that all electronic transmissions of protected health information (PHI) be encrypted. That means ALL of them … fax, email, web-based and otherwise. The requirement applies regardless of the identity of the recipient or patient, and the recipient cannot “undo” or waive the requirement by consenting to the receipt of unencrypted emails.

(cut)

One more time in English? Health care providers are allowed to send PHI in unencrypted emails but only after they engage in the analysis described above and document their determination. It is a violation of the HIPAA Security Rule to send unencrypted emails containing PHI without first having performed and documented that analysis. A single violation can carry a penalty as high as $50,000, a useful figure to contemplate if you think encryption is too expensive to implement. Encryption also carries the benefit of qualifying for a “safe harbor” under HIPAA’s breach notification requirements. A security incident that would otherwise require notification is not considered a breach if the PHI affected were encrypted and the encryption key has not been compromised.

The entire article is here.

Thanks to Marlene Maheu for this article via LinkedIn.

The Ups and Downs of Electronic Medical Records

By MILT FREUDENHEIM
The New York Times
Originally published October 8, 2012

The case for electronic medical records is compelling: They can make health care more efficient and less expensive, and improve the quality of care by making patients’ medical history easily accessible to all who treat them.

Small wonder that the idea has been promoted by the Obama administration, with strong bipartisan and industry support. The government has given $6.5 billion in incentives, and hospitals and doctors have spent billions more.

But as health care providers adopt electronic records, the challenges have proved daunting, with a potential for mix-ups and confusion that can be frustrating, costly and even dangerous.

Some doctors complain that the electronic systems are clunky and time-consuming, designed more for bureaucrats than physicians. Last month, for example, the public health system in Contra Costa County in California slowed to a crawl under a new information-technology system.

The entire story is here.

EHRs could mean fewer malpractice claims

By Mike Milard
IT Health News
Originally published August 3, 2012

A study by Harvard Medical School-affiliated researchers, published in June in the Archives of Internal Medicine, showed that Massachusetts physicians who used electronic health records saw a reduction in malpractice claims.

Correlation does not imply causation, of course. But the report's authors say their findings suggest, "implementation of EHRs may reduce malpractice claims and, at the least, appears not to increase claims as providers adapt to using EHRs."

(cut)

"We found that the rate of malpractice claims when EHRs were used was about one-sixth the rate when EHRs were not used," the researchers write. "This study adds to the literature suggesting that EHRs have the potential to improve patient safety and supports the conclusions of our prior work, which showed a lower risk of paid claims among physicians using EHRs. By examining all closed claims, rather than only those for which a payment was made, our findings suggest that a reduction in errors is likely responsible for at least a component of this association, since the absolute rate of claims was lower post-EHR adoption."

The entire article is here.

EHR Adoption By Doctors Reaches 55 Percent

Kaiser Health News
Originally published July 19, 2012

Physician adoption of the electronic health record (EHR) may be at — or even past — the proverbial tipping point, or so suggests a government study released yesterday that is a litany of progress. In 2011, 55% of physicians reported having adopted an EHR, and of those, 85% said they were either somewhat or very satisfied with the technology, according to the report from the US Centers for Disease Control and Prevention (CDC). Roughly 3 in 4 physicians using EHRs said the software enhanced overall patient care. And 71% of digital physicians would buy their EHR program again.

More can be found here.

As records go online, clash over mental care privacy

By Liz Kowalczyk
The Boston Globe - Health and Wellness
Originally published June 21, 2012

At her weekly therapy sessions, Julie revealed her most uncomfortable secrets: depression, debt, childhood sexual abuse. Her psychiatrist at Massachusetts General Hospital would then type a summary into Julie’s computerized medical record.

With that, more than 200 pages of sensitive notes became available to any doctor who cared for her within the sprawling Partners HealthCare system. She discovered this only when one doctor later referenced the notes.

Julie, a 43-year-old lawyer, was unnerved, then angry. “The details are really nobody’s business,” she said.

But Partners disagrees. Doctors must have a complete picture to make accurate diagnoses, the organization argues. And having different rules for psychiatric records contributes to the stigma of mental illness.

The entire story is here.

Secrets And Electronic Health Records: A Privacy Concern

By David Schultz
The KNH Blog
Originally published on June 11, 2012

Does your orthodontist or opthamologist need to know what you tell your psychotherapist in order to provide you with quality care? In the age of electronic medical records, a whole range of health care providers may have access to this information whether you want them to or not.

(cut)

Here’s what many say is the problem: If a mental health specialist types up his or her notes from a therapy session and puts them into a patient’s electronic medical record, that file can be shared with any doctor the patient sees within their health system. And, because of a loophole in the Health Insurance Portability and Accountability Act, or HIPAA, there’s nothing a patient can do to stop this from happening.

Many mental health professionals, who consider their patients’ privacy and confidentiality to be sacrosanct, find this appalling. But often times, the decision of how they file their patients’ records is not up to them.

The entire blog post is here.

Record Keeping in the Cloud: Ethical Considerations

*Professional Psychology: Research & Practice" has scheduled an article for publication in a future issue of the journal: "Record Keeping in the Cloud: Ethical Considerations."

The authors are Robert L. Devereaux and Michael C. Gottlieb.

Here's an excerpt: "In this article, we briefly review technological advances in electronic storage, define "the cloud" and explain how it functions, discuss risks and benefits of its use, and provide questions for practitioners when considering the appropriateness of maintaining patient records in this manner."

Here's another excerpt: "Consider the following example. A practitioner, using an online patient management system, decides to change service providers for any number of reasons (e.g., cost, poor service). The stored patient data may be contained within a proprietary system that cannot be easily migrated to a new system/provider. As mentioned previously, online service providers each have a unique system and moving from one to another might require unknown amounts of time, resources, and temporary loss of access to patient records during the move. In addition to the possible frustration of a transition process, it would be important for the practitioner to understand how data are deleted from the old system. For example, Facebook, a cloud-based social profile software system, maintains user accounts even after they are inactivated at the user's request. Permanently deleting the account is much more involved, and there is no way of knowing if Facebook maintains historical records of old accounts, although this may be discussed in their Terms and Conditions of Use Agreement. This could also be the case for other online storage or electronic medical record companies, and practitioners are well advised to investigate this matter before agreeing to store records on the cloud. Also, a practitioner would need to decide how much information to disclose to clients as part of a continued informed consent process if/when he or she decides to move records from one company to another. Such disclosure would need to be consistent with the level of detail about record keeping provided to the client at the onset of treatment."

Here's how the article concludes: "With the broad spectrum of electronic storage and management options available to practitioners, the abdication of control to a third-party, cloud-based company may represent unnecessary additional risk at this relatively early stage. In part, aggregation of documents from users worldwide may create a much more appealng target for malicious hackers than a single office with only a few patient documents. Also, the question of liability has not yet been clearly defined. We are responsible for protecting patient information, but computing companies carry no such obligation beyond their own internal policies and contractual obligations. We recommend that practitioners who move their EHR to the cloud do so with caution and careful consideration of the accompanying risks and benefits."

The author note provides the following contact information for reprint requests, questions, or comments: Robert

L. Devereaux, Division of Psychology, Department of Psychiatry, University of Texas Southwestern Medical Center, Dallas, TX 75390-9044;  E-mail: robert.devereaux@utsouthwestern.edu

Thanks to Ken Pope for this information.

Link to APA's Record Keeping Guidelines

Legal Risks of Going Paperless

By Alicia Gallegos

amednews.com

Originally published March 5, 2012

Defense attorney Catherine J. Flynn knows how electronic medical records can overwhelm — and often change — the course of a medical liability lawsuit.

In one of her cases, a New Jersey doctor being sued for medical negligence has been accused by a plaintiff’s attorney of modifying a patient’s electronic history. A printing glitch caused the problem, Flynn said, but the accusation has meant extra time and defense costs. Computer screen shots were reviewed, more evidence was gathered and additional arguments were made.

“This has taken a life of its own, and we’ve done virtually no discovery on the medical aspects of the case,” she said. “The cost of the e-discovery alone is in excess of $50,000.”

System breaches. Modification allegations. E-discovery demands. These issues are becoming common courtroom themes as physicians transition from paper to EMRs, legal experts say. Not only are EMRs becoming part of medical negligence lawsuits, they are creating additional liability.

Across the country, the move from paper to electronically stored health data is growing. The 2009 federal stimulus package provided federal funds for the creation of a health information technology infrastructure. Health professionals can receive up to $44,000 for Medicare or nearly $64,000 for Medicaid by adopting electronic medical records.

Studies are mixed about how EMRs will impact liability for physicians. A 2010 survey by Conning Research and Consulting, an insurance industry research firm, found that most insurers believe medical claims will rise during the move from paper to electronic records. Lawsuits probably will decrease after an adjustment period, the study said. A report in the Nov. 18, 2010, issue of The New England Journal of Medicine said doctors should expect a varied landscape of liability risks and benefits as EMR adoption unfolds.

Whatever the future holds for EMRs, it’s important that doctors reduce their liability risks during system implementation, legal experts say. Being aware of potential legal pitfalls prevents doctors from falling victim to technology intended to do good — not cause hardship.

“It’s all about the system that’s in place and the integrity of that system,” Flynn said. “You can only do what the system allows you to do. If you have a good system in place, then the doctors are protected — even from themselves.”

The entire story is here.

Privacy and Security for EHR: US and EU Compared

PRIVACY AND SECURITY IN THE IMPLEMENTATION OF

HEALTH INFORMATION TECHNOLOGY (ELECTRONIC

HEALTH RECORDS): U.S. AND EU COMPARED

By Janine Hiller, Matthew McMullen, Wade Chumey, and David Baumer

Abstract

The importance of the adoption of Electronic Health Records (EHRs) and the associated cost savings cannot be ignored as an element in the changing delivery of health care. However, the potential cost savings predicted in the use of EHR are accompanied by potential risks, either technical or legal, to privacy and security. The U.S. legal framework for healthcare privacy is a combination of constitutional, statutory, and regulatory law at the federal and state levels. In contrast, it is generally believed that EU protection of privacy, including personally identifiable medical information, is more comprehensive than that of U.S. privacy laws. Direct comparisons of U.S. and EU medical privacy laws can be made with reference to the five Fair Information Practices Principles (FIPs) adopted by the Federal Trade Commission and other international bodies. The analysis reveals that while the federal response to the privacy of health records in the U.S. seems to be a gain over conflicting state law, in contrast to EU law, U.S. patients currently have little choice in the electronic recording of sensitive medical information if they want to be treated, and minimal control over the sharing of that information. A combination of technical and legal improvements in EHRs could make the loss of privacy associated with EHRs de minimis. The EU has come closer to this position, encouraging the adoption of EHRs and confirming the application of privacy protections at the same time. It can be argued that the EU is proactive in its approach; whereas because of a different viewpoint toward an individual’s right to privacy, the U.S. system lacks a strong framework for healthcare privacy, which will affect the  implementation of EHRs. If the U.S. is going to implement EHRs effectively, technical and policy aspects of privacy must be central to the discussion.

The entire .pdf can be found here.

Thanks to Ken Pope for this lead.