Monday Morning Update 12/23/24

Top News

Ascension tells Maine’s attorney general that its May 8 ransomware attack exposed the medical and insurance information of 5.6 million people.

The 140-hospital system’s EHR was down for more than a month.

HIStalk Announcements and Requests

Not making the list above from last week’s poll – entering health tracking information, viewing OpenNotes, and using an app that a clinician prescribed or recommended.

New poll to your right or here: Which winter holiday is most important to you?

A Reader’s Notes from the Joint Annual Meeting of The Sequoia Project and Carequality

The meeting was held December 11-12 in Nashville.

Micky Tripathi

• Nothing groundbreaking or new. Mostly rehashed stats and updates that have been shared in other forums.
• HTI-2 final rule published that morning is a very lightweight set of changes related to TEFCA, mainly codifying terminology and procedures.
• Picture shows some TEFCA stats. Unclear why the number of participants per category doesn’t quite add up to the total of 10k.

Panel discussion on what qualifies as treatment

• Lively conversation and one of the most refreshing panels I’ve seen at a conference, if only because everyone didn’t get up there and agree with one another and pat each other on the back.
• Unstated but obvious was that the motivation for the session was the Epic-Particle dispute.
• Panel went through a few nuanced scenarios and debated whether they fit the definition of treatment (specifically, HIPAA treatment…TEFCA treatment has a slightly narrower definition). Example: provider group is part of an ACO and a physician wishes to query an HIE for records on their attributed patients to identify gaps in care, so that the provider can focus on closing those gaps. Deven McGraw (former HHS OCR Deputy Director for Health Information Privacy): once you start asking for patient information in bulk, you shift from a Treatment purpose to an Operations purpose. This led to an interesting debate on whether sending a bulk transaction (e.g., bulk FHIR) would count as Operations but writing a script to send many individual transactions patient-by-patient would count as Treatment.
• Tripathi: key thing to remember is that under HIPAA, the data responder has the prerogative to identify whether the request is for treatment or not.

Interoperability for public health

• Electronic case reporting was still a proof of concept by the end of 2019 but suddenly had to go big bang and scale due to COVID.
• Michelle Meigs (APHL): Public health has a business problem. The funding is piecemeal and focused on specific cases or reportable diseases, so it is challenging to build a comprehensive technology and interoperability framework. The fragmentation doesn’t help. Because public health is mostly handled at the state and local levels, there are 50+ sets of rules to follow.
• Craig Behm (CRISP HIE): data usability and alert fatigue are major issues for providers. They piloted public health data exchange through TEFCA with three provider organizations, .but they didn’t get any responses to their TEFCA queries in the first few months.

The theme of trust came up several times and was the focus of multiple sessions. That said, it would be more accurate to say “verification” as the main changes seem to be HIEs/QHINs introducing tighter guardrails and stronger vetting processes to prevent misuse of data.

Panel on the Carequality dispute process

• Purposefully avoided commenting on the Epic-Particle dispute, though everyone knows that’s the impetus for the discussion.
• Dispute process intentionally errs on the side of “minimum necessary” when it comes to sharing information with the public, to prevent sharing any sensitive info.
• Panelists (members of the Carequality board and steering committee) generally felt the timelines defined for the formal dispute are OK, given the time needed for the responding party to build a defense against the complaint. It also takes time to establish a dispute panel who will hear the arguments from both sides. These are all volunteers at the end of the day. Goal is that formal disputes are rarely or never needed since parties should work things out informally first.

Fireside chat with Daniel Polk (Special Agent, FBI Atlanta field office) on cybersecurity

1. Broke down the various types of malicious actors (picture attached).
2. Discussed common infiltration and deception tactics.
3. 2FA is critically important to good security, but it can be defeated. A common tactic today: hackers send you a phishing email with a malicious link. You click on it and are taken to a fake login page where you enter your username and password. Hacker receives a real-time notification and logins into the real account with your credentials. This triggers a 2FA code or push notification, which you enter or acknowledge, allowing the hacker to access your real account.
4. As soon as you believe you are the victim of ransomware, reach out to the FBI. They generally don’t publicize this, but they may have a decryption key that will work in your situation.
5. Polk highlighted the fines OCR has been leveraging on organizations who do not have good cyber hygiene and who have suffered from unauthorized disclosures.

Webinars

None scheduled soon. Previous webinars are on our YouTube channel. Contact Lorre to present or promote your own.

Acquisitions, Funding, Business, and Stock

Commure acquires Memora Health, which offers a care navigation platform.

Norway-based healthcare software vendor Omda AS acquires Aweria, which offers a best-of-breed emergency department information system.

Streamline Health reports Q3 results: revenue down 28%, EPS –$0.61 versus –$3.15. STRM shares have lost 32% in the past 12 months, valuing the company at $15 million. CEO Ben Stillwel says that the company may need to seek additional non-equity capital resources to fuel growth and that he “needs to live and breathe sales.”

People

Mouneer Odeh, MA (Inova Health System) joins Cedars-Sinai as VP/chief data and AI officer.

Haffty Consulting promotes Erin Mueller to VP of client services.

Announcements and Implementations

The UT Health San Antonio School of Dentistry combines the dental and medical health records of its patients by integrating Epic’s Wisdom dental module with its EHR. Patients can view all their records and make appointments through MyChart. Epic replaces Exan’s AxiUm dental system for academic practices, which is owned by Henry Schein One.

Government and Politics

Epic asks a federal district court to dismiss the antitrust lawsuit that was brought against the company by Particle Health in September. Epic says the lawsuit fails to prove that Epic engaged in anticompetitive behavior. It adds that Particle filed the suit as revenge for Epic’s revelation that some of Particle’s customers were obtaining confidential patient information under false pretenses.

The Department of Justice sues CVS Pharmacy for knowingly filling prescriptions for controlled substances that lacked legitimate medical purpose or were invalid, many of them generated by known pill mill doctors. DOJ says CVS ignored internal data and information from its own pharmacists to keep filling the prescriptions so the company could meet corporate performance metrics that triggered field manager bonuses. CVS is also accused of preventing its pharmacists from warning each other about certain prescribers and setting pharmacist staffing levels so low that they couldn’t perform due diligence or even pay attention to computer safety alerts. One pain management doctor in Hawaii wrote prescriptions for specific patients, then picked them up himself and charged them to his own credit card, generating 60% of the prescriptions that the CVS store filled.

The VA will restart restart Oracle Health go-lives in mid-2026 at its Michigan facilities in Ann Arbor, Battle Creek, Detroit, and Saginaw.

In Canada, a former employee of Alberta Health Services is fined $12,000 for falsifying the COVID-19 records of 200 people in Meditech, which sends data to the province’s immunization system.

US healthcare spending rose 7.5% in 2023 to nearly $5 trillion, with prescription drugs showing the biggest increase due to GLP-1 drugs. Hospital services consumed $1.5 trillion of the total, rising by 10.4% in their highest growth in three decades. The US finished in near last place among 38 OECD countries in infant mortality and life expectancy despite spending four times the average dollars per capita.

Other

Doctors in Scotland voice concerns over the bankruptcy filing of In Practice Systems Limited, the provider of the Vision system widely used by the country’s GP practices, citing potential risks to system availability and access to medical records. The company is owned by Cegedim Group. NHS National Services Scotland has set up an incident response team.

Sponsor Updates

• Healthcare IT Leaders partners with Jackson Health System’s IT group to bring holiday cheer to children.
• CTG announces the retirement of long-time manager and director Christine Blanchard.
• Indiana University Student Health Center successfully uses AI-powered ambient listening solution Sunoh.ai, integrated with eClinicalWorks, to streamline clinical documentation.
• Nordic names Amy Ferro marketing content manager.
• Black Book Research releases the results of a survey highlighting how nations are leveraging advanced digital solutions to revolutionize population health management and address critical healthcare challenges.
• Nordic releases a new episode of its “Designing for Health” podcast, “Interview with Brian Urban.”
• RLDatix releases a new episode of “The Connection” podcast, “Technology + Humanity in Healthcare: Insights from Dan Michelson, CEO of RLDatix.”
• Sectra will provide its platform for medical education, Sectra Education Portal, to the University of Hartford in Connecticut.
• SnapCare co-founder and Chief Strategy Officer Jeff Richards receives the 2024 Georgia Titan 100 award.

Blog Posts

• From Compliance to Care: The Expanding Role of EVV in Personal Care Services (Netsmart)
• 3 top benefits of AI for the IT support desk (Nordic)
• CHIME’s Fall Forum: Shaping the Future of Healthcare with AI and Data Modernization (Prominence Advisors)
• Streamline Clinical Workflows with MEDITECH Expanse 2.2: A How-to Guide (CereCore)
• From Complexity to Simplicity: One Clinic’s Journey to Corepoint (Rhapsody Health)
• How to use QR codes in patient rooms (Sonifi Health)
• On the Same (Sheet of Music) in Healthcare (Surescripts)
• Key Insights From the 10th Annual NGPX Healthcare Experience Conference (Tegria)
• RSNA 2024: Visage’s Top Five (Visage Imaging)
• Year in review: 6 key milestones that advanced Waystar’s mission in 2024 (Waystar)

Contacts

Mr. H, Lorre, Jenn, Dr. Jayne.
Get HIStalk updates.
Send news or rumors.
Follow on X, Bluesky, and LinkedIn.
Contact us.