Welcome to EMR and HIPAA

Today I came across the HHS Secretary Mike Leavitt’s blog. To be honest, I saw Mike Leavitt’s picture on the blog and I felt like I was meeting an old friend. No, I don’t really know Mike Leavitt from the next person on the street. We have never met before and the closest I’ve been to him is probably when I watched him pass by in numerous 24th of July parades in Utah. However, he was the governor of Utah for many of the years I lived in Utah and so I feel like I kind of know the man.

Reminiscing aside, I find Mike Leavitt’s blog completely captivating. He currently has been writing about his trip to China. For some reason I’ve always had an inner itch whenever I heard about China. I don’t know what it is, but I find the place completely fascinating. So, you can imagine my fascination with the HHS secretary’s interaction with the Chinese government. Plus, these posts about HHS and China give Mike a real personal quality that I find real and interesting.

Of course, I couldn’t begin to read the HHS Secretary’s blog without making sure to find some post about EHR or EMR. I quickly found a post entitled Value-Driven Health Care Interoperability which I think could more aptly be entitled “Electronic Health Records (EHR) Progress Report.” Of course, he is in government so that explains the title.

I’m grateful that the HHS Secretary is willing to engage the public in a discussion about EHR and EHR adoption, but unfortunately the post I found is so filled with political rhetoric. It sounds really good, but really has very little substance.

First, I’ll start with the good.

Three years ago, there were 200 vendors selling electronic health record systems but there was no assurance that the systems would ever be able to share privacy protected data in interoperable formats.

I think the concept of a certification for interoperability is good. It just makes sense that every EMR software vendor should be able to interact with another. Establishing a quality standard for this interoperability is valuable and even worth certifying.

Unfortunately, I think the HHS Secretary has been getting bad information when he says the following:

Since then, we have made remarkable progress.

An EHR standards process is now in place, and we are marching steadily towards interoperability. We created the CCHIT process to certify products using the national standards and it is functioning well. More than 75% of the products being sold today carry the certification.

Where to begin? First, Mike has suggested that there were 200 vendors selling EHR systems 3 years ago (It’s probably a few more than 200 EHR, but we’ll let this one slide). Mike asserts that “75% of the products being sold today carry the certification.” If that’s the case, then simple math tells us that there should be 150 certified EHR software, no?

If you look at the 2006 CCHIT Certified Ambulatory EHR list I count 92 EHR software products. Let’s see, that’s only 46% of EHR products that are certified. Plus, my count of 92 EHR counts some of the software multiple times since a number of the EHR software vendors certified multiple versions of their product. That sounds like less than 75% of EHR products sold to me.

Of course, Mike Leavitt certainly could say that 75% represents a percentage of actual products sold. Certainly the certified eMD’s has a lot more installs than any of the free open source EMR products out there. However, I think it’s a bit deceptive to say 200 EHR and then 75% of products sold if they aren’t the same thing.

I also love how it says 75% of products sold. I think we’re all aware of the outrageous failure rates of so many of the EHR products out there. It’s unfortunate that we don’t have a percentage of products installed. Then, you’d have a much better idea of how many doctor’s offices really have the possibility of interoperability.

Wait a minute! I was being extra generous above when I said that there were 92 Ambulatory EHR CCHIT certified. Why? Because it was 92 EHR certified with the 2006 CCHIT Certification. Correct me if I’m wrong, but I think that interoperability was taken out of the 2006 CCHIT Certification (along with the joke of the pediatric requirements). I’m pretty confident about this, because I work on one of the 2006 CCHIT Certified EHR and I have no way of sending a chart to another clinic other than manually going through the product and printing out the chart.

What does all this mean? That means that instead of 92 interoperable CCHIT certified EHR, there are only 31 EHR CCHIT certified in 2007. That represents 15.5% (not 75%) of the 200 EHR products on the market today are interoperable according to number of certified EHR.

I’m not really blaming Mike Leavitt for this. I’m sure him or his office was given a nice executive report with a bunch of data and they made it look as nice as possible. Reminds me a lot of what I call EMR sales miscommunications. Sometimes the data just gets lost in translation. Let’s just hope my trackback to Mike Leavitt’s blog gets read.

You thought I was done. Nope. Still plenty more to say and I’m just hitting the major points.

In addition, a National Health Information Network will start testing data exchange by the end of the year and go into production with real data transmission the year after.

This concept I really find intriguing. I look forward to seeing this go public and I’m glad it’s on the agenda. However, I fear that this isn’t more than political hyperbole. I’d love to see how they plan to address any of the following: unique identifier, the ultimate hacker’s health information paradise, economic model, motivational model and that’s just the list off the top of my head.

The primary reasons for low adoption rates among small practices are predictable: economics and the burden of change.

I’m glad you pointed out the obvious. If this was so obvious, then why did you support the implementation of a certification that costs so much money that EHR will inevitably raise the cost a small practice pays for an EHR? That doesn’t make much economic sense. Not to mention you missed what I think is the biggest factor in lack of implementation: fear. Not fear of change. Not fear of the expense. Certainly those are two major factors, but I believe that adoption rates by small practices are so low because most doctors have seen too many of their colleagues fail at implementing an EHR.

Let’s start waving the CCHIT certification flag again. Many will be willing to make the case that CCHIT certification helps supplant a doctor’s fear that their EHR implementation will fail. It may even supplant some fear, but what it doesn’t do is decrease the number of failed EHR implementations. It’s a problem I’ve discussed many times on this blog. Certifications don’t certify usability. They never have and never will.

I actually have a thought about what should have been done instead of CCHIT, but I think I’ll save that for a future post.

Thanks Mike for opening up the lines of communication with your blog. Now it will be interesting to see if Mike Leavitt and HHS have really embraced new social media and participate in the discussion they started. I’m certain that Mike’s blog is going to become one of my favorite reads.

This information is a little bit dated, but it was sitting in my draft posts and I think that it’s still very relevant to those interested in HIPAA compliance. Computer World posted an article about Atlanta’s Piedmont hospital being the first organization to have a HIPAA audit by the HHS.

In the report they identified 42 questions that HHS reportedly asked Piedmont hospital during the HIPAA audit. Regardless of how accurate this is, I think that it’s interesting for all those in the healthcare industry to evaluate these questions and how they apply in their environment.

Here’s the list of questions:

1. Establishing and terminating users’ access to systems housing electronic patient health information (ePHI).
2. Emergency access to electronic information systems.
3. Inactive computer sessions (periods of inactivity).
4. Recording and examining activity in information systems that contain or use ePHI.
5. Risk assessments and analyses of relevant information systems that house or process ePHI data.
6. Employee violations (sanctions).
7. Electronically transmitting ePHI.
8. Preventing, detecting, containing and correcting security violations (incident reports).
9. Regularly reviewing records of information system activity, such as audit logs, access reports and security incident tracking reports.
10. Creating, documenting and reviewing exception reports or logs. Please provide a list of examples of security violation logging and monitoring.
11. Monitoring systems and the network, including a listing of all network perimeter devices, i.e. firewalls and routers.
12. Physical access to electronic information systems and the facility in which they are housed.
13. Establishing security access controls; (what types of security access controls are currently implemented or installed in hospitals’ databases that house ePHI data?).
14. Remote access activity i.e. network infrastructure, platform, access servers, authentication, and encryption software.
15. Internet usage.
16. Wireless security (transmission and usage).
17. Firewalls, routers and switches.
18. Maintenance and repairs of hardware, walls, doors, and locks in sensitive areas.
19. Terminating an electronic session and encrypting and decrypting ePHI.
20. Transmitting ePHI.
21. Password and server configurations.
22. Antivirus software.
23. Network remote access.
24. Computer patch management.

HHS also had a slew of other requests:

1. Please provide a list of all information systems that house ePHI data, as well as network diagrams, including all hardware and software that are used to collect, store, process or transmit ePHI.
2. Please provide a list of terminated employees.
3. Please provide a list of all new hires.
4. Please provide a list of encryption mechanisms use for ePHI.
5. Please provide a list of authentication methods used to identify users authorized to access ePHI.
6. Please provide a list of outsourced individuals and contractors with access to ePHI data, if applicable. Please include a copy of the contract for these individuals.
7. Please provide a list of transmission methods used to transmit ePHI over an electronic communications network.
8. Please provide organizational charts that include names and titles for the management information system and information system security departments.
9. Please provide entity wide security program plans (e.g System Security Plan).
10. Please provide a list of all users with access to ePHI data. Please identify each user’s access rights and privileges.
11. Please provide a list of systems administrators, backup operators and users.
12. Please include a list of antivirus servers, installed, including their versions.
13. Please provide a list of software used to manage and control access to the Internet.
14. Please provide the antivirus software used for desktop and other devices, including their versions.
15. Please provide a list of users with remote access capabilities.
16. Please provide a list of database security requirements and settings.
17. Please provide a list of all Primary Domain Controllers (PDC) and servers (including Unix, Apple, Linux and Windows). Please identify whether these servers are used for processing, maintaining, updating, and sorting ePHI.
18. Please provide a list of authentication approaches used to verify a person has been authorized for specific access privileges to information and information systems.

Since most of my interest is in ambulatory care, I wonder if an audit would be this extensive for ambulatory care. Talk about putting a company out of business. This would be an extensive report for a hospital but could be really detrimental to a small doctor’s office. Still interesting to think about.

I expect that no one is fully compliant with this list. Of course, that raises the question of what’s full compliance, but we’ll save that topic for another day.