Free EMR Newsletter Want to receive the latest news on EMR, Meaningful Use, ARRA and Healthcare IT sent straight to your email? Join thousands of healthcare pros who subscribe to EMR and HIPAA for FREE!!

Android Security Risks May Outweigh Benefits

Written by:

Not long ago, my colleague John Lynn made a compelling pitch for the Android platform, arguing that it’s likely to take over healthcare eventually given its flexibility.  That flexibility stands in sharp contrast to Apple phones and tablets, which work quite elegantly but also impose rigid requirements on app developers.

That being said, however, there’s security risks associated with Android that might outweigh its advantages. The major carriers are doing little or nothing to upgrade and patch the Android versions on the phones they sell, leaving them open to security breaches.

The Android security problem is so egregious that the American Civil Liberties Union has filed a complaint with the  Federal Trade Commission, asking the agency to investigate how AT&T, Verizon, Sprint and T-Mobile handle software updates on their phones.

In the complaint, the civil liberties group argues that the carriers have been engaging in “unfair and deceptive business practices” by failing to let customers know about well-known unpatched security flaws in the Android devices that they sell.

What makes things worse, the ACLU suggests, is that the carriers aren’t even offering consumers the option to update their phones.  Though Google has continued to fix flaws in the Android OS, these fixes aren’t being bundled and pushed out to the wireless carriers’ customers.  As the ACLU rightly notes, such behavior is unheard of in the world of desktop operating systems, where consumers regularly get updates from Apple and Microsoft.

In its complaint the ACLU argues that the carriers must either provide security updates to customers or allow them to get refunds on their devices and terminate their contracts without any penalty. It’s asking the FTC to force the carriers’ hand.

In the mean time, with healthcare requiring strict data security under HIPAA, one has to wonder whether hospitals and medical practices should be using Android devices at all (at least for their work).  Of course, clinicians who are accustomed to using their personal Android phones or tablets will be inconvenienced and probably fairly annoyed too.  But as things stand, hospital CIOs better be really careful about how they handle Android phones in the healthcare environment.

April 26, 2013 I Written By

Katherine Rourke is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Patients Want to Share Their Medical Data

Written by:

During the recent Dell Healthcare Think Tank which I took part in, I had an idea that I think is incredibly powerful and not talked about nearly enough. In fact, I think its reasonable to say that if we want to get healthcare costs down, then we have to learn how to do this well.

The idea revolves around how we talk about privacy of health information with patients. Far too often, patients just hear news reports that talk about all of the reasons they should fear their health information getting out in the open. Instead, they almost never hear stories about how having their health information shared with the right people will actually improve their health.

The simple fact is that if you lead with all the bad things that could possibly happen with health information in the wrong hands, then of course no patient is going to want their patient information shared. However, if they know how sharing their health information with the right people will improve their care, then patients are more than willing to share away.

Basically, what I’m saying is that sharing healthcare data has been marketed wrong. The privacy advocates are well organized and have many people fearful for what will happen with their health information. I don’t have any problem with privacy advocates, because they help us to pause to take a reasonable look at the importance of privacy. However, the need for proper privacy controls doesn’t mean that we don’t share healthcare information at all.

The beauty of all of this is that the majority of people think this is how it happens in healthcare today. They don’t realize that quite often their healthcare information isn’t traveling with them to specialists and hospitals. In fact, when patients discover that it doesn’t they’re usually quite surprised and don’t understand why it doesn’t.

I hope we can work on the data sharing message. We can share your data with the people who need it so we can improve your care. If patients hear this message, healthcare data sharing will not be feared but embraced.

March 29, 2013 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 15 blogs containing almost 5000 articles with John having written over 2000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 9.3 million times. John also recently launched two new companies: InfluentialNetworks.com and Physia.com, and is an advisor to docBeat. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit.

HIPAA Omnibus – What Should You Know?

Written by:

I had the great opportunity to sit down with HIPAA expert, Rita Bowen from HealthPort, at HIMSS 2013 and learn more about the changes that came from the recently released HIPAA Omnibus rule. The timing for this video is great, because today is the day the HIPAA Omnibus rule goes into effect. In the video embedded below, Rita talks about what you should know about the new HIPAA changes, the new business associate requirements, and restricting the flow of sequestered health information.

March 26, 2013 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 15 blogs containing almost 5000 articles with John having written over 2000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 9.3 million times. John also recently launched two new companies: InfluentialNetworks.com and Physia.com, and is an advisor to docBeat. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit.

Oracle Brings Health Data Analytics To The Cloud

Written by:

For years now, healthcare providers have been inching toward cloud use, with CIOs still divided as to whether cloud applications are secure enough to meet their standards.

These days, though, the tide seems to be turning in favor of cloud applications. In fact, a recent study by KLAS on hybrid clouds in healthcare found that those who had signed on for cloud apps rated them a 4.5 out of 5 for security.

Given this growing level of trust, it was no surprise to read that Oracle had kicked off a major cloud product for healthcare at HIMSS last week.

At the show, Oracle Health Sciences introduced the Oracle Enterprise Healthcare Analytics Cloud Service, a cloud-based version of the vendor’s data management, warehousing and analytics platform. The new product comes with pre-built analytical applications and also supports third-party healthcare apps.

The existing Enterprise Healthcare Analytics is a big data play which pulls in, validates and loads data from clinical, financial, administrative and even clinical research systems to offer a single enterprise view.

What makes the cloud version interesting, of course, is that if healthcare CIOs are willing to chance the security issues, they can bypass having to spend big on IT infrastructure to bring it on board.

Also interesting is that Oracle has also given  CIOs a few models to deploy Enterprise Healthcare Analytics  available to be deployed” on-site in its “HIPAA-certified” Oracle Health Sciences Cloud, or in a hybrid model leveraging on-premise and traditional cloud.

I have little doubt that even as a cloud-based service, this is a very pricey product that isn’t for all facilities. And there’s still a large contingent of hospitals that aren’t ready to trust all of their mission-critical data to cloud security.

But it’s still worth note to see Oracle extending this kind of tool to the cloud nonetheless. I wonder if  the perceived value of an Oracle app will push more facilities off the fence and into trusting cloud security after all?

March 12, 2013 I Written By

Katherine Rourke is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Achieve Cybersecurity While Complying with HIPAA Standards

Written by:

Tony Jeffs, Cisco
The following is a guest post written by Tony Jeffs, Sr. Director, Product Management & Marketing, Global Government Solutions Group at Cisco.

Within the past 24 months, nine out of 10 hospitals in the U.S. have fallen victim to an attack or data breach, according to a recent report from the Ponemon Institute. The landscape of the healthcare IT industry is transforming rapidly due to significant changes in patient information management and today’s evolving threat landscape. Advancements in technology and government regulations have powered an explosive growth in the creation and storage of protected healthcare information (PHI). To prepare for new attacks targeting sensitive patient data, healthcare organizations need to recognize the risks of noncompliance and how the deployment of certified, secure, and trusted technologies will help ensure compliance with Health Insurance Portability and Accountability Act (HIPAA) standards.

According to the 2012 National Preparedness Report conducted by the Federal Emergency Management Agency, the healthcare industry is already prepared for many types of emergencies and contingencies. However, the same study showed that healthcare organizations are overall still unprepared for most cyber attacks.

The report highlighted that cybersecurity “was the single core capability where states had made the least amount of overall progress.” Of the state officials surveyed, merely 42 percent feel they are adequately prepared. The report also showed that in the last six years, less than two-thirds of all companies in the U.S. have sustained cyberattacks. From 2006 to 2010, the number of reported attacks in the U.S. rose by 650 percent. During the Aspen Security Forum last year, Keith B. Alexander, head of the National Security Agency and the new United States Cyber Command, indicated that the U.S. has seen a 17-fold rise in attacks against its infrastructure from 2009 through 2011.

In such an environment, it is a top priority for healthcare organizations to comply with HIPAA standards. Before the signing of the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009, it was understood industry-wide that HIPAA was not strictly enforced. Under HITECH, healthcare providers could be penalized for “willful neglect” if they failed to demonstrate reasonable compliance with the Act. The penalties could be as high as $250,000 with fines for uncorrected violations costing up to $1.5 million.

In certain instances, HIPAA’s civil and criminal penalties now encompass business associates. While a citizen cannot directly sue their healthcare provider, the state attorney general could bring an action on behalf of state residents. In addition, the U.S. Department of Health and Human Services (HHS) is now required to periodically audit covered entities and business associates. This implies that healthcare providers are required to have systems in place to monitor relationships and business practices to guarantee consistent security for all medical data.

If information systems are left vulnerable to attack, providers face significant risks to their business. These targeted attacks in the healthcare industry can come in a variety of forms. In Bakerfield, CA, the Kern Medical Center was attacked by a virus that crippled its computer systems. The hospital took approximately 10 days to bring the doctors and nurses back online. A Chicago hospital was attacked by a piece of malware that forced the hospital’s computers into a botnet controlled by the hacker. A year later, the hospital was still dealing with the attack’s aftermath. Following the theft of a computer tape containing unencrypted personal health information from an employee’s automobile, the DoD faced a multi-billion-dollar lawsuit. The Veterans Administration (VA) fought a two-year battle against intrusions into wireless networks and medical devices, including picture archiving and communication systems (PACS), glucometers and pharmacy dispensing cabinets.

Patients are protected against identity theft if medical information is encrypted and secured. Simultaneously, information must be kept readily available when necessary, such as for emergency personnel. The subsequent benefits are important in order to keep businesses competitive, including better quality of patient care, improved patient outcomes, increased productivity and workflow efficiency, better information at the point of care and improved and integrated communications between doctors and patients.

The Key to HIPAA Compliance

In order to meet the HITECH Act requirements, encryption must be used on the main service provider network as well as its associated partner networks. Encryption uses an algorithm to convert data in a document or file into an indecipherable format prior to being delivered, and then decrypts the data once received to prevent unauthorized personnel from accessing it. Successful use of encryption depends on the strength of the algorithm and the security of the decryption “key” or process when data is in motion and moving through a network or data is at rest in databases, file systems, or other structured storage methods.

In order to achieve HIPAA compliance, healthcare providers should leverage verified, certified network security products and architectures. Recommended by the HHS and mandated by the U.S. Department of Defense (DoD) for encryption, Federal Information Process Standard (FIPS) 140-2 encryption certified products reliably safeguard healthcare data with reliable and proven security in order to diminish risks without increasing costs.

Technologies that are fully FIPS-140 certified provide organizations a level of security that will remain compliant through at least 2030, unlike legacy cryptographic systems.

A New Degree of Confidence

Today, closed networks are almost nonexistent as most offices have Internet access, at the minimum. With the use of electronic transactions increasing in healthcare, including e-prescriptions and electronic communication, many medical organizations use open systems that necessitate the use of encryption technologies.

Technology providers can easily assert that a system is secure by using the highest level of encryption technologies on the market. With the degree of public visibility of breaches of trust, organizations have no reason to risk exposure with technology systems that fail to meet the FIPS 140-2 standard for data encryption. Without this certification, the cryptography function on the network has demonstrated a less than 50 percent chance of being correctly implemented, which also implies there is a 50 percent chance that the cryptography can be cracked. By purchasing solutions with FIPS validation, healthcare organizations achieve a new degree of reassurance that their critical data is secure, allowing them to minimize risk without an increase in costs.

March 8, 2013 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 15 blogs containing almost 5000 articles with John having written over 2000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 9.3 million times. John also recently launched two new companies: InfluentialNetworks.com and Physia.com, and is an advisor to docBeat. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit.

The Final HIPAA Omnibus Rule: A Sharing of Accountability

Written by:

The following is a guest post by Rita Bowen, MA, RHIA, CHPS, SSGB, SVP of HIM and Chief Privacy Officer, HealthPort. If you’re attending HIMSS, I’ll be doing an interview with Rita at HealthPort’s Booth 6841 at Noon on Tuesday 3/5/13. Come by and learn more about the HIPAA Omnibus Rule and get any questions you have answered.

It seems an eternity ago, four years to be exact, that the HITECH Act introduced changes to HIPAA. After much speculation, rumor, innuendo and anticipation, HHS released the final HIPAA omnibus rule, which significantly amends the original HIPAA Privacy, Security, Breach and Enforcement Rules. HHS Secretary Kathleen Sebelius introduced the new rule by stating:

“The final rule greatly enhances a patient’s privacy protections, provides individuals new rights to their health information, and strengthens the government’s ability to enforce the law.”

Ms. Sebelius conceded that healthcare has changed dramatically since HIPAA was first enacted and that the new rule is necessary to “protect patient privacy and safeguard patients’ health information in an ever expanding digital age.”

The new rule, at 563 pages, is not brief, but covered entities can’t let that inhibit them from becoming intimately acquainted with this document. I’ve made an initial review of the rule and culled what I feel are its key concepts:

  • Business Associates (BAs) of covered entities are now, for the first time, directly liable for compliance with certain requirements of HIPAA Privacy and Security rules, including the cost of remediation of breaches for which they are responsible.
  • The rule goes so far as to revise the definition of a “breach.” This new definition promises to make the occurrence of breaches – and the required notification of breaches — more common.
  • The use and disclosure of protected health information for marketing and fundraising purposes is further limited, as is the sale of protected information without individual authorization.
  • The rule expands patients’ rights to receive electronic copies of their health information and to restrict disclosures to health plans regarding treatment for which they’ve already paid.
  • Covered entities are required to modify and redistribute their notice of privacy practice to reflect the new rule.
  • The new rule modifies Individual authorizations and other requirements to facilitate research, expedite the disclosure of child immunization proof to schools, and enable access to decedent information by family members and others.
  • The additional HITECH Act enhancements to the Enforcement Rule are adopted, including provisions addressing enforcement of noncompliance with HIPAA rules due to willful neglect.

Getting to Compliance

And now comes the challenging part – compliance! The new rule goes into effect on March 26, and covered entities and BAs are expected to comply by September 23, so there is much work to do. Hospitals and clinics need to thoroughly comprehend — and then prepare for — the sweeping changes in BA liability. They’ll need to communicate these changes and new requirements to BAs and update their BA agreements accordingly. And since BAs are now directly liable for breaches, organizations must decide how they’ll enforce their BA agreements with regard to privacy and security. Additionally, comparable agreements must now be shared between BAs and their subcontractors.

What are the keys to successful compliance?  The following tips should ensure your smooth transition into the new rule:

  • Become intimately acquainted with the new rule — and its ramifications for your organization, your BAs, and their subcontractors.
  • Identify a privacy officer within all of your partner organizations.
  • Define a process for the notification of patients in the event of a breach of their protected health information (PHI).
  • Update breach notification materials to reflect the new Rule.
  • Update, repost and redistribute your Notice of Privacy Practices.
  • Document current privacy and security practices, and conduct a risk assessment.
  • Make certain your healthcare security technology solution is flexible, secure, and scalable to handle the growing volume of audit inquiries promised by the RACs.
  • Encrypt all devices that store patient information.
  • Communicate new HIPAA requirements and expectations to BAs.
  • Update business associate agreements (BAAs) to clarify that BAs pay the cost of breach remediation, when the BA is responsible for the breach.
  • Provide a template of a comparable agreement for BAs to use with their subcontractors.
  • Monitor your partners’ efforts to protect patient data.

The new HPAA omnibus rule has arrived and the challenges it presents should not be underestimated. Communication and organization will be your keys to success!

Rita Bowen, MA, RHIA, CHPS, SSGB

Ms. Bowen is a distinguished professional with 20+ years of experience in the health information management industry.  She serves as the Sr. Vice President of HIM and Privacy Officer of HealthPort where she is responsible for acting as an internal customer advocate.  Most recently, Ms. Bowen served as the Enterprise Director of HIM Services for Erlanger Health System for 13 years, where she received commendation from the hospital county authority for outstanding leadership.  Ms. Bowen is the recipient of Mentor FORE Triumph Award and Distinguished Member of AHIMA’s Quality Management Section.  She has served as the AHIMA President and Board Chair in 2010, a member of AHIMA’s Board of Directors (2006-2011), the Council on Certification (2003-2005) and various task groups including CHP exam and AHIMA’s liaison to HIMSS for the CHS exam construction (2002).

Ms. Bowen is an established speaker on diverse HIM topics and an active author on privacy and legal health records.  She served on the CCHIT security and reliability workgroup and as Chair of Regional Committees East-Tennessee HIMSS and co-chair of Tennessee’s e-HIM group.  She is an adjunct faculty member of the Chattanooga State HIM program and UT Memphis HIM Master’s program.  She also serves on the advisory board for Care Communications based in Chicago, Illinois.

February 25, 2013 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 15 blogs containing almost 5000 articles with John having written over 2000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 9.3 million times. John also recently launched two new companies: InfluentialNetworks.com and Physia.com, and is an advisor to docBeat. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit.

Health Data Hacking Likely To Increase

Written by:

Wondering about trends in the various protected health information breaches you seen in the news every now and then? Here’s some hard numbers, courtesy of IT security firm Redspin, which has pulled together data on incidents reported to HHS since breach notification rules went into effect in August 2009.

According to Redspin research, a total of 538 large breaches of PHI, affecting 21.4 million patient records, have been reported to HHS since the notification rule when into effect as part of the HITECH Act.  The largest breach in 2012 resulted in exposure of 780,000 records.

Between 2011 and 2012, there was a 21.5 percent increase in the number of large breaches reported, but interestingly, a 77 percent decrease in the number of patient records impacted, Redspin reports.

More than half of the breaches (57 percent) involved a business associate, and 67 percent were the result of theft or loss. Thirty-eight percent of incidents took place due to data on a laptop or other portable electronic device which wasn’t encrypted.

During 2012, the top five incidents contributed almost two-thirds of the total number of patient records exposed. They each had different causes, however, making it hard to draw any  broad conclusions as to how PHI gets breached.

Meanwhile, if that business associate stat intrigues you, check this out: historically, the firm concludes, breaches at business associates have impacted 5 times as many patient records as those at a covered entity. (It certainly encourages one to take a second look at how skilled their business associates are at maintaining security.)

While all of this is interesting, perhaps the most important info I came away with was that Redspin thinks health data hacking is likely to increase in coming years. From 2009 to the date of the report, hacking has contributed to only 6 percent of breaches, but the biggest breach, an Eastern European-based attack on the State of Utah “should end any complacency,” Redspin advises.

February 15, 2013 I Written By

Katherine Rourke is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Problems EMRs Don’t (Necessarily) Cause

Written by:

In publications like this one, we spend a lot of time and energy clubbing EMRs and EMR vendors for the problems they cause.  That’s all well and good, but it’s also worth remembering that some of the big problems surrounding medical operations may not be due to EMR use:

* HIPAA carelessness:  When someone shouts private medical information across a room, or loses a flash drive or tablet with records on it, or leaves patient records in a public place, you’ve probably got a nasty HIPAA violation. But the EMR almost certainly had nothing to do with it.

* Clumsy office workflow:  Sure, introducing an EMR into a clinical setting can screw up existing workflow. But was it working well in the first place?  For those whose business falls apart post-EMR, I’d argue “no.”  Businesses that don’t do well after an install had jury-rigged processes in place already, I’d argue.

* Patient care slowing down:  As with staff workflow, clinical workflow can be discombobulated — badly — by an EMR installation. Learning to fit practice patterns to the system is a big job for most clinicians, and they may slow down significantly for a while. But if the patient care flow stays “broken” it’s likely that there were aspects of the pre-EMR system that didn’t work.

I realize that I might get flamed for saying this, but I’m pretty confident that a goodly number of problems that are laid at the feet of dysfunctional EMRs don’t belong there.  And that’s not a good thing.

After all, there are enough poorly designed, trouble-ridden EMRs out there to keep us busy critiquing them for a century or two.  Why distract ourselves by adding more to the pile when the real issues may be elsewhere?

January 29, 2013 I Written By

Katherine Rourke is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Mixing Physical, Mental Health Data Lowers Readmissions

Written by:

Ordinarily, it makes sense to treat psychiatric records with particular sensitivity, given how private these issues are for most patients.  Also, one might assume that medical doctors simply don’t need access to psychiatric records — and if so, why increase the risk of a  HIPAA breach by giving them needless data access?

Apparently, however, these assumptions may be working against patients, according to a new study by researchers at Johns Hopkins. A new study by researchers at the university found that in some cases, keeping mental health records separately from physical health records in an EMR as a privacy measure may actually decrease quality of care.

To examine this issue, researchers at Johns Hopkins surveyed the psychiatric departments at 18 of the hospitals ranked most highly by U.S. News & World Report’s Best Hospitals of 2007, according to blogger Melissa Le Furge. The survey concluded that less than 25 percent of the hospitals allowed non-psychiatric physicians to have full access to patients’ mental health EMR data.  Not so surprising, given the current state of practice.

What’s really interesting, though, is that at the hospitals that allowed non-psychiatric clinicians to have access to mental health records, patients were 40 percent less likely to be admitted within a week of discharge than industry baseline.

Melissa notes that there are many reasons why this might be:

Depression and other mental illnesses sometimes make it difficult for patients to follow physicians’ instructions after a heart attack or stroke and are less likely to take proper care of themselves…[Also,] being uninformed about medications prescribed by a psychiatrist can cause the primary care physician to prescribe medications that create adverse reactions.

Segregating mental health records may make sense from a social standpoint, but perhaps it’s not good medicine. At minimum, this issue deserves further study.

January 14, 2013 I Written By

Katherine Rourke is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Health Data: Little White Lie Detector

Written by:

As we bring 2012 to a close and ponder the new year ahead, many of us make resolutions to change something in our lives, and frequently, that something is our health. According to the University of Scranton Journal of Psychology, 47% of Americans make New Years Resolutions. Of those, the #1 New Years Resolution for 2012 is to lose weight. Staying fit and healthy and quitting smoking also appear in the top 10. Each of these health-related resolutions translates into quantifiable healthcare data that is, or can be, captured and measured to assist the resolution-makers in achieving their goals. Our calorie consumption and burn can be calculated, our blood oxygen level monitored, our ratio of fat:lean muscle mass tracked over time. If only we were all a bit more like George Washington, and couldn’t tell a lie, the success rate for annual resolutions would be higher than 8%.

The inclination to tell little white lies to protect ourselves from inconvenient, uncomfortable truths exists in all of us. “Do these jeans make my butt look fat,” meets, “Of course not,” rather than, “Yes, your butt DOES look fat in those jeans – but it’s not the jeans’ fault.” “Can Timmy come play,” warrants, “We already have plans – let’s rain check,” in lieu of, “Your child is a brat who cannot enter my home because I prefer to keep all my hair rooted in my scalp.”

Many, if not most, of us extend these white lies to ourselves. The dress that fit last month but doesn’t today “shrunk at the dry cleaner”. Cigarettes only smoked during cocktail hour don’t really count as “smoking”. You count the time you spend standing to give office presentations as “exercise”. You “usually” eat healthy, except for the tell-tale McDonald’s bags in your garbage showing a once-a-day burger and fries habit.

What if there were a way to identify and hold you accountable for these self-delusions – a health data lie detector? Would you change your behavior? Could you achieve your healthy resolution? And might it have a quantifiable impact on healthcare cost if you did?

I had a partial thyroidectomy a few years ago. A year after my surgery, I found I had gained 7 pounds in 11 days, was feeling lethargic and was having difficulty sleeping. As a very active adult who meticulously maintained body weight for a decade, I was disturbed, and convinced that my symptoms were a result of my remaining thyroid tissue failing. I went to my primary care physician to request a hormone test.

The nurse and doctor both agreed that, in 90% of cases, the root cause of weight gain is diet, and they asked myriad questions, capturing all my answers in the clinical notes of their EMR: had I been eating differently, had I altered my exercise routine, had I been traveling. I was adamant that nothing had drastically changed. Given my fitness and history, they agreed to order the hormone test, and a blood vitamin test, as well.

All lab work came back normal. BETTER than normal. So I retraced every detail of my routine over those 11 days. And I discovered the culprit: office candy.

A bad meeting one day led to grabbing a handful of chocolates from one co-workers bowl, which became grabbing a handful of chocolates from each bowl I encountered on my department’s floor…several times a day. Did you know there are 35 calories in a single Hershey’s kiss? 220 calories in a handful of peanut M&Ms? 96 calories in a mini-Butterfinger bar? Turns out, I was eating between 500-700 calories a day in office candy. And that wasn’t all.

Along with the chocolate snacks, I’d fallen into some poor nutrition habits at meals. I started to consume other starchy carbs regularly: the pre-dinner bread basket at restaurants, pizza, pasta, sandwich bread. I didn’t feel I ate to excess, but I also didn’t take into account the difference in nutrient density between the mass quantities of fruits and vegetables I had been eating for years, and the smaller (yet still plentiful) quantities of processed starches I was currently eating.

The changes in diet likely disturbed my sleeping pattern and led to my lethargy, which in turn made my daily workouts less intense and effective at calorie-burning.

In short, my weight gain was legit, and the two doctor visits and the lab tests could have been avoided had I been completely honest with myself. I cost each actor in the healthcare system money with my self-deluding little white lie: the office administrative staff, the LRNP, the doctor, the medical coder, the lab, the insurance company, myself. There is also a per-transaction cost associated with each HIPAA-covered request that the doctors’ office EMR and lab information system generated. Given that I have only been to the doctor three times this year, and twice was for this weight gain concern, one could accurately conclude that 66% of my annual medical costs could have been avoided in 2012.

The health data exists within Meaningful Use-certified EMR systems to capture and communicate both the absolute data (height, weight, lab results, etc.) and the unstructured notes data (patient comments, doctor notes, responses to questionnaires, etc.). The capability to automatically compare the absolute with the unstructured data already exists. It wouldn’t take an inordinate amount of effort to program a lie detector to call out many of the most common little white lies.

What would happen to medical cost if we stopped lying to ourselves, and to our healthcare providers? And how high a percentage of the nation’s total healthcare bill could be avoided by this type of analysis? Better still, how much would the healthcare industry change if patients not only took responsibility for their own action/inaction, but modified their behaviors accordingly?

I’ll tell you what happened to me. I dropped the candy and starchy carbs, and I lost those 7 pounds. Keeping them off will be 2013′s New Years Resolution.

December 31, 2012 I Written By

Mandi Bishop is a healthcare IT consultant and a hardcore data geek with a Master's in English and a passion for big data analytics, who fell in love with her PCjr at 9 when she learned to program in BASIC. Individual accountability zealot, patient engagement advocate, innovation lover and ceaseless dreamer. Relentless in pursuit of answers to the question: "How do we GET there from here?" More byte-sized commentary on Twitter: @MandiBPro.