Yesterday, the Governor's Healthcare IT Conference included remarks from Massachusetts HHS Secretary Bigby, Former National Coordinator David Blumenthal, Governor Deval Patrick, Special Assistant to the Administrator of CMS Sachin Jain, and a panel of industry experts.
Here are the key points.
Secretary Bigby introduced the meeting by noting the importance of healthcare IT for increasing safety, quality, efficiency, patient engagement, and equity in healthcare across the Commonwealth.
David Blumenthal summarized the accomplishments of ONC over the past two years and highlighted the work left to be done. He noted that the HITECH act and its meaningful use constructs are a "downpayment" on healthcare reform, creating the the necessary infrastructure over years to enable changes in healthcare delivery and reimbursement. The trajectory that we're on for meaningful use includes three stages: stage 1 which aligns incentives for providers to adopt and use EHRs, stage 2 which provides the standards and tools to exchange data and stage 3 which provides decision support tools and analytics. In each stage, privacy protection is a high priority. Breach notification requirements have been enhanced and penalties for breaches have been levied.
Thus far, 700 healthcare IT products have been certified, many by companies with less than 50 employees. 36,000 providers have registered to participate in incentive programs. $64 million has already been paid to 500 organizations as part of the Medicaid incentive program. On May 18 the Medicare incentive payments begin. 56 state designated health information exchanges have been created and 56 state HIE coordinators have been named. 62 Regional Extension Centers have been created which have enrolled 67,000 providers. About 25% of all primary care clinicians in the country now participate in regional extension center programs.
There has been a market change - Meaningful Use is becoming an emblem of quality. 80% of all hospitals intend to participate in stage 1 of Meaningful Use. The challenges ahead are many - we need additional standards, enhanced technology, and additional policy. However, the major change we need is cultural. Communities need to demand and encourage data sharing for care coordination, public health, and other uses.
Deval Patrick's remarks demonstrated significant domain expertise about healthcare IT and health information exchange. He highlighted Massachusetts' pivotal role as a leader in HIT product development, job creation, health information exchange, policymaking, and training. He encouraged all of us to break down data silos and create data liquidity - accelerating data exchange among payers, providers, and patients regardless of organizational boundaries.
Sachin Jain highlighted the importance of the CMS Center for Innovation noting that it empowers the CMS administrator to expand local demonstration projects to national scale if there is evidence they improve quality/reduce cost. The $1 billion dollar Partnership for Patients program is a part of the CMS Center for Innovation.
We closed the day with panel session of healthcare IT stakeholders
Alice Coombs, MD, President, Massachusetts Medical Society
Karen Bell, MD, MMS, Chair, Certification Commission for Health Information Technology
Lynn Nicholas, President, Massachusetts Hospital Association
Charlotte Yeh, MD, Chief Medical Officer, AARP Services
Alice highlighted the need for usability of EHRs such that clinician workflow is aided, not impeded by technology.
Karen discussed the need for clinicians to look beyond basic federal certification and think about clinical decision support features, data portability, security protections and vendor commitments to usability.
Lynn noted that CPOE and other technologies can introduce errors and adverse events. We need to ensure the technology is implemented wisely and clinicians are appropriately trained.
Charlotte represented the needs of consumers and suggested we embrace technology that brings demonstrated value to patients. As we think about PHRs, home care devices, and patient engagement, we must evolve from actions done "to the patient" to "for the patient" to "with the patient".
The bottom line - we should ensure our EHRs have the functionality we need to support safe, quality, efficient care with health information exchange, decision support, and security protections. We want these applications to be highly useable and integrated into workflows. We want them to incorporate policies that enhance the patient and provider experience.
I also made remarks about the need for additional standards that will be done to enable all these goals. I'll expand on our "Summer Camp of Standards" work next week.
Tuesday, 10 May 2011
Monday, 9 May 2011
Speed Dating for IT
As a CIO, I gather information about new products and innovation in many ways. I search the web for emerging technologies, read numerous publications/newsletters, and constantly meet with vendors and IT professionals who are creating novel applications.
However, it's not the most efficient way to rapidly assess whether products are operational or exist only in powerpoint.
BluePrint Healthcare IT - a company founded in 2003 to provide security, privacy, compliance and risk management services to hospitals and healthcare systems - has created a new approach to solve the problem of connecting early stage innovators and customers. They call it Speed Dating for IT.
Their BluePrint Health IT Innovation Summit Series is aligned with current innovation programs and initiatives sponsored by HHS and ONC promoting new technologies.
The idea is simple:
10 healthcare technology companies and 10 healthcare providers interact virtually within the framework of a "Health IT Innovation Matching System". Then, in one place at one time, those that match can meet for a dialog about piloting these new applications, realizing that there is risk but also market differentiation for those early adopters that achieve breakthrough results.
I like it - a kind of eHarmony for IT. I can pre-screen my vendors and we can determine if there is a fit before we spend time in meetings.
BIDMC will participate in the May 26 event. I'll let you know how Speed Dating for IT goes. My wife has given her approval.
However, it's not the most efficient way to rapidly assess whether products are operational or exist only in powerpoint.
BluePrint Healthcare IT - a company founded in 2003 to provide security, privacy, compliance and risk management services to hospitals and healthcare systems - has created a new approach to solve the problem of connecting early stage innovators and customers. They call it Speed Dating for IT.
Their BluePrint Health IT Innovation Summit Series is aligned with current innovation programs and initiatives sponsored by HHS and ONC promoting new technologies.
The idea is simple:
10 healthcare technology companies and 10 healthcare providers interact virtually within the framework of a "Health IT Innovation Matching System". Then, in one place at one time, those that match can meet for a dialog about piloting these new applications, realizing that there is risk but also market differentiation for those early adopters that achieve breakthrough results.
I like it - a kind of eHarmony for IT. I can pre-screen my vendors and we can determine if there is a fit before we spend time in meetings.
BIDMC will participate in the May 26 event. I'll let you know how Speed Dating for IT goes. My wife has given her approval.
Friday, 6 May 2011
Cool Technology of the Week
However, there is an issue - when I look down, I lose my distance vision. My prescription is -7 diopters so I cannot easily switch between two pairs of glasses, one for distance and one for closeup. An ideal bifocal would enable me to change the my glasses prescription in real time.
That's now possible with the PixelOptics electronic lens built with liquid crystal technology.
The lenses are made by Panasonic and change prescription on command, either via head movement or by activating a switch.
The hold a charge for 3 days.
Currently, they cost about $1000, but I expect that to come down as demand causes manufacturing scale to expand.
Glasses that change prescription on the fly. That's cool!
Thursday, 5 May 2011
I Could Have Had a V8
For the past 10 years, I've kayaked the Charles River several times a week between April and October. Rather than owning a kayak, I've purchased a season pass from Charles River Canoe and Kayak.This year, I found a kayak with the ideal combination of speed, size, weight, stability, and workmanship - the Epic V8 Surfski (pictured above).
In the past, I've considered products from KayakPro, Think, and Epic kayaks such as the V10.
Each was lacking something. The Epic V8 has it all.
*It's fast, enabling me to maintain a 6 mph pace
*It fits in my 19 foot garage, while most other surfskis are longer than 20 feet
*It weighs 30 pounds, so I can easily take it on and off the car myself
*It's stable in rough, windy conditions, even when speeding bass fishermen create 3 foot wakes
*It's a high quality boat with excellent engineering and kevlar/carbon materials at a reasonable price
It's taken a decade of waiting for this perfect design, but I've finally purchased my own kayak. Now I'll never need to make the statement, "I could have had a V8".
Wednesday, 4 May 2011
Breach Fatigue
You've read about the Sony privacy breach, the Epsilon email compromise, and recent high profile privacy breach settlements.
Every day the headlines are filled with so many such security issues that it almost seems like background noise. Just as too much decision support can result in alert fatigue and too many false alarms can result in alarm fatigue, the barrage of security breach news can lead to breach fatigue, causing you to let down your guard. Forewarned is forearmed, so push aside your breach fatigue and plan for the day when you will have to run your own breach notification. Here's a task list to guide you:
Immediate response actions
Report to Police Department
Notify Legal Counsel
Notify Privacy Officer
Notify CEO
Notify Clinical and IT Leadership
Notify Board of Directors
Notify Liability Insurer
Develop action plan
Analysis
Inventory unsecured data
Draft Risk Assessment rules (what data in combination is reportable i.e. name + social security number)
Finalize Risk Assessment rules
Conduct Risk Assessment
Complete Risk Assessment Report
Complete Reporting Requirements Report
Regulatory Reporting and Notifications
Define practice strategy/approach
Initial communication with practices
Notifications
Draft notification to Media
Oral notification to federal/state authorities including approval of notices
Office of Civil Rights
Attorney General
Office of Consumer Affairs
Practice approval of media notification
Distribute notification to media
Complete Practice specific spreadsheets
Choose credit monitoring service
Complete credit monitoring service contract
Prepare Patient Notices
Practice related activities
Initial call
Follow-up visit scheduled
Practice packages complete
Practice packages delivered to practice
Re-identification visits scheduled (to notify patients, you'll need addresses which may not be included in the actual data breached)
Re-identification complete
Patient notifications complete
Patient notifications sent
Attorney General reports filed
Office of Consumer Affairs reports filed
Office of Civil Rights reports filed
Communications
Prepare talking points for various channels
Staff a communication office (approximately 10% of notified patients will call)
Remediation
Cross-Organizational Review of processes and procedures which led to the breach
Remediation of root causes
Security policy updates as needed
Laptop encryption as needed
Additional training as needed
Follow the advice of your privacy officer and your legal counsel completely. Be transparent. Over communicate. Use the event as a teachable moment for your organization and your community. Be humble and apologize. Protect the patients and the providers.
As we continue the journey toward automation of electronic records to enhance safety and quality, we must retain the trust of our patients. Following the plan above will go far to address those events that occur as we all learn how to be better protectors of the data we host.
Every day the headlines are filled with so many such security issues that it almost seems like background noise. Just as too much decision support can result in alert fatigue and too many false alarms can result in alarm fatigue, the barrage of security breach news can lead to breach fatigue, causing you to let down your guard. Forewarned is forearmed, so push aside your breach fatigue and plan for the day when you will have to run your own breach notification. Here's a task list to guide you:
Immediate response actions
Report to Police Department
Notify Legal Counsel
Notify Privacy Officer
Notify CEO
Notify Clinical and IT Leadership
Notify Board of Directors
Notify Liability Insurer
Develop action plan
Analysis
Inventory unsecured data
Draft Risk Assessment rules (what data in combination is reportable i.e. name + social security number)
Finalize Risk Assessment rules
Conduct Risk Assessment
Complete Risk Assessment Report
Complete Reporting Requirements Report
Regulatory Reporting and Notifications
Define practice strategy/approach
Initial communication with practices
Notifications
Draft notification to Media
Oral notification to federal/state authorities including approval of notices
Office of Civil Rights
Attorney General
Office of Consumer Affairs
Practice approval of media notification
Distribute notification to media
Complete Practice specific spreadsheets
Choose credit monitoring service
Complete credit monitoring service contract
Prepare Patient Notices
Practice related activities
Initial call
Follow-up visit scheduled
Practice packages complete
Practice packages delivered to practice
Re-identification visits scheduled (to notify patients, you'll need addresses which may not be included in the actual data breached)
Re-identification complete
Patient notifications complete
Patient notifications sent
Attorney General reports filed
Office of Consumer Affairs reports filed
Office of Civil Rights reports filed
Communications
Prepare talking points for various channels
Staff a communication office (approximately 10% of notified patients will call)
Remediation
Cross-Organizational Review of processes and procedures which led to the breach
Remediation of root causes
Security policy updates as needed
Laptop encryption as needed
Additional training as needed
Follow the advice of your privacy officer and your legal counsel completely. Be transparent. Over communicate. Use the event as a teachable moment for your organization and your community. Be humble and apologize. Protect the patients and the providers.
As we continue the journey toward automation of electronic records to enhance safety and quality, we must retain the trust of our patients. Following the plan above will go far to address those events that occur as we all learn how to be better protectors of the data we host.
Tuesday, 3 May 2011
Meaningful Use Payments
Now that eligible professionals and hospitals are attesting to Meaningful Use, they are asking how and when incentives payments will be made. Here's the answer from CMS:
For eligible professionals (EPs), incentive payments for the Medicare EHR Incentive Program will be made approximately four to eight weeks after an EP successfully attests that they have demonstrated meaningful use of certified EHR technology. However, EPs will not receive incentive payments within that timeframe if they have not yet met the threshold for allowed charges for covered professional services furnished by the EP during the year. Payments will be held until the EP meets the $24,000 threshold in allowed charges for calendar year 2011 in order to maximize the amount of the EHR incentive payment they receive. If the EP has not met the $24,000 threshold in allowed charges by the end of calendar year 2011, CMS expects to issue an incentive payment for the EP in March 2012 (allowing 60 days after the end of the 2011 calendar year for all pending claims to be processed).
Payments to Medicare EPs will be made to the taxpayer identification number (TIN) selected at the time of registration, through the same channels their claims payments are made. The form of payment (electronic funds transfer or check) will be the same as claims payments.
Bonus payments for EPs who practice predominantly in a geographic Health Professional Shortage Area (HPSA) will be made as separate lump-sum payments no later than 120 days after the end of the calendar year for which the EP was eligible for the bonus payment.
Please note that the 90-day reporting period an EP selects does not affect the amount of the EHR incentive payments. The Medicare EHR incentive payments to EPs are based on 75% of the estimated allowed charges for covered professional services furnished by the EP during the entire payment year. If the EP has not met the $24,000 threshold in allowed charges at the time of attestation, CMS will hold the incentive payment until the EP meets the threshold as described above.
Medicare EHR incentive payments to eligible hospitals and critical access hospitals (CAHs) will also be made approximately four to eight weeks after the eligible hospital or CAH successfully attests to having demonstrated meaningful use of certified EHR technology. Eligible hospitals and CAHs will receive an initial payment and a final payment. Eligible hospitals and CAHs that attest in April can receive their initial payment as early as May 2011. Final payment will be determined at the time of settling the hospital cost report.
Please note that the Medicaid incentives will be paid by the States, but the timing will vary according to State. Please contact your State Medicaid Agency for more details about payment.
For more information about the Medicare and Medicaid EHR Incentive Program, visit the website.
For an overview, see the Medicare Learning Network (MLN) Matters Special Edition article (SE1111) – Medicare Electronic Health Record (EHR) Incentive Payment Process.
IMPORTANT NOTE: Medicare Administration Contractors (MACs), carriers, and Fiscal Intermediaries (FIs) will not be making Medicare EHR incentive payments. CMS has contracted with a Payment File Development Contractor to make these payments.
DON'T: Call your MAC/Carrier/FI with questions about your EHR incentive payment.
INSTEAD: Call the EHR Information Center
Hours of Operation: 7:30 a.m. – 6:30 p.m. (Central Time) Monday through Friday, except federal holidays.
1-888-734-6433 (primary number) or 888-734-6563 (TTY number).
For eligible professionals (EPs), incentive payments for the Medicare EHR Incentive Program will be made approximately four to eight weeks after an EP successfully attests that they have demonstrated meaningful use of certified EHR technology. However, EPs will not receive incentive payments within that timeframe if they have not yet met the threshold for allowed charges for covered professional services furnished by the EP during the year. Payments will be held until the EP meets the $24,000 threshold in allowed charges for calendar year 2011 in order to maximize the amount of the EHR incentive payment they receive. If the EP has not met the $24,000 threshold in allowed charges by the end of calendar year 2011, CMS expects to issue an incentive payment for the EP in March 2012 (allowing 60 days after the end of the 2011 calendar year for all pending claims to be processed).
Payments to Medicare EPs will be made to the taxpayer identification number (TIN) selected at the time of registration, through the same channels their claims payments are made. The form of payment (electronic funds transfer or check) will be the same as claims payments.
Bonus payments for EPs who practice predominantly in a geographic Health Professional Shortage Area (HPSA) will be made as separate lump-sum payments no later than 120 days after the end of the calendar year for which the EP was eligible for the bonus payment.
Please note that the 90-day reporting period an EP selects does not affect the amount of the EHR incentive payments. The Medicare EHR incentive payments to EPs are based on 75% of the estimated allowed charges for covered professional services furnished by the EP during the entire payment year. If the EP has not met the $24,000 threshold in allowed charges at the time of attestation, CMS will hold the incentive payment until the EP meets the threshold as described above.
Medicare EHR incentive payments to eligible hospitals and critical access hospitals (CAHs) will also be made approximately four to eight weeks after the eligible hospital or CAH successfully attests to having demonstrated meaningful use of certified EHR technology. Eligible hospitals and CAHs will receive an initial payment and a final payment. Eligible hospitals and CAHs that attest in April can receive their initial payment as early as May 2011. Final payment will be determined at the time of settling the hospital cost report.
Please note that the Medicaid incentives will be paid by the States, but the timing will vary according to State. Please contact your State Medicaid Agency for more details about payment.
For more information about the Medicare and Medicaid EHR Incentive Program, visit the website.
For an overview, see the Medicare Learning Network (MLN) Matters Special Edition article (SE1111) – Medicare Electronic Health Record (EHR) Incentive Payment Process.
IMPORTANT NOTE: Medicare Administration Contractors (MACs), carriers, and Fiscal Intermediaries (FIs) will not be making Medicare EHR incentive payments. CMS has contracted with a Payment File Development Contractor to make these payments.
DON'T: Call your MAC/Carrier/FI with questions about your EHR incentive payment.
INSTEAD: Call the EHR Information Center
Hours of Operation: 7:30 a.m. – 6:30 p.m. (Central Time) Monday through Friday, except federal holidays.
1-888-734-6433 (primary number) or 888-734-6563 (TTY number).
Monday, 2 May 2011
What Keeps Me Up at Night in the Data Center
Last week, I keynoted the Markley Group annual meeting and spoke about the data center issues that keep me up at night.
1. At Harvard Medical School, increasing amounts of research is done in "silicon" instead of wet labs. The growth in demand is unpredictable and bursty. When grants are funded, demand for new equipment is instantaneous. Data centers often have fixed real estate, limited power, and constrained capital budgets for expansion, making unplanned expansion problematic.
2. There is zero tolerance for downtime in the face of constantly changing technologies. We need to continuously innovate, providing the latest technology while maintaining existing systems at high levels of reliability.
3. Power and cooling needs are increasing exponentially. We've already virtualized all our application servers and we're beginning to virtualize database servers. Virtualizing high performance computing nodes does not really help since those nodes require maximal raw processing power. Harvard Medical School's compute cluster has 6000 cores. Our data center infrastructure needs optimal power usage efficiency to minimize energy costs.
4. Storage demand is now multi-petabyte. Drive density is increasing and costs are falling, but backing up and archiving petabytes is still a challenge.
5. Regulatory and compliance requirements now require searching and e-discovery of increasingly complex data stores. Although most healthcare organizations typically do not face Sarbanes-Oxley reporting requirements, other requirements such as HIPAA, ARRA/HITECH, and the Affordable Care Act have their own data retention and analysis implications.
My solution to many of these issues has been to create "elastic data centers" using external hosting facilities such as those provided by the Markley Group. Harvard Medical School has two such floors - a "low density" 5kw/rack 1000 square foot floor with an option to expand to 5000 share feet and a "high density" 30kw/rack floor with unlimited expansion capabilities. This flexibility enables me to shift the burden of power and cooling planning to someone else, while enabling me to serve my customers on demand.
BIDMC's EHR hosting center is another example of an elastic data center. We provide a private cloud with eClinical Works EHR offered via a Software as a Service model. The problem is that we do not know how many clinicians we'll support over time, so we contracted for an outsourced hosting center with easy expandability.
What will the next few years bring in data centers? My prediction is that
• On demand storage and compute cycles from private cloud facilities will become commonplace
• Clusters and Grids will enable communities of collaborators to flexibly share processing power
• Green Data Centers with Power Usage Effectiveness less than 1.50 will reduce the rate of growth of data center energy costs
• HIPAA compliant private clouds will evolve to enables EHRs and other person identified data to be hosted in the cloud
• The amount of storage and compute cycles needed to meet increasing demands will strain existing hospital-owned data centers, resulting in more elastic data centers hosted externally.
It's an exciting time to be in IT!
1. At Harvard Medical School, increasing amounts of research is done in "silicon" instead of wet labs. The growth in demand is unpredictable and bursty. When grants are funded, demand for new equipment is instantaneous. Data centers often have fixed real estate, limited power, and constrained capital budgets for expansion, making unplanned expansion problematic.
2. There is zero tolerance for downtime in the face of constantly changing technologies. We need to continuously innovate, providing the latest technology while maintaining existing systems at high levels of reliability.
3. Power and cooling needs are increasing exponentially. We've already virtualized all our application servers and we're beginning to virtualize database servers. Virtualizing high performance computing nodes does not really help since those nodes require maximal raw processing power. Harvard Medical School's compute cluster has 6000 cores. Our data center infrastructure needs optimal power usage efficiency to minimize energy costs.
4. Storage demand is now multi-petabyte. Drive density is increasing and costs are falling, but backing up and archiving petabytes is still a challenge.
5. Regulatory and compliance requirements now require searching and e-discovery of increasingly complex data stores. Although most healthcare organizations typically do not face Sarbanes-Oxley reporting requirements, other requirements such as HIPAA, ARRA/HITECH, and the Affordable Care Act have their own data retention and analysis implications.
My solution to many of these issues has been to create "elastic data centers" using external hosting facilities such as those provided by the Markley Group. Harvard Medical School has two such floors - a "low density" 5kw/rack 1000 square foot floor with an option to expand to 5000 share feet and a "high density" 30kw/rack floor with unlimited expansion capabilities. This flexibility enables me to shift the burden of power and cooling planning to someone else, while enabling me to serve my customers on demand.
BIDMC's EHR hosting center is another example of an elastic data center. We provide a private cloud with eClinical Works EHR offered via a Software as a Service model. The problem is that we do not know how many clinicians we'll support over time, so we contracted for an outsourced hosting center with easy expandability.
What will the next few years bring in data centers? My prediction is that
• On demand storage and compute cycles from private cloud facilities will become commonplace
• Clusters and Grids will enable communities of collaborators to flexibly share processing power
• Green Data Centers with Power Usage Effectiveness less than 1.50 will reduce the rate of growth of data center energy costs
• HIPAA compliant private clouds will evolve to enables EHRs and other person identified data to be hosted in the cloud
• The amount of storage and compute cycles needed to meet increasing demands will strain existing hospital-owned data centers, resulting in more elastic data centers hosted externally.
It's an exciting time to be in IT!
Subscribe to:
Posts (Atom)
