Readers Write: A Healthcare Tale of Two Continents

A Healthcare Tale of Two Continents
By Ted Reynolds

An interesting byproduct of growing up American is that we tend to view everything from one perspective – our own. That’s not surprising given our standing in the world and the influence our culture seemingly has.

Over the last year, I had the unique opportunity to work on a significant electronic medical record (EMR) implementation in Europe that forced me to look beyond my singular, American view. What a revelation! During my time working on this engagement, I learned to view healthcare differently and gained knowledge that has proven invaluable to my ongoing work stateside.

While there are some similarities, there are also striking differences in how the US and Europeans approach and deliver healthcare. I thought it might be interesting to compare and contrast these approaches so you can benefit as well from my journey across the pond.

Let’s start with the similarities. My main observation is that change is certain and swift in both the US and Europe. The status quo on both sides is giving way to new ways of thinking, partly driven by technology.

We have greater access to larger amounts of data today, and as a result, the unprecedented opportunity to improve care and outcomes while reducing costs. With healthcare costs continuing to climb in the US and economic recovery slow worldwide, we simply cannot afford to continue with the old models of care delivery.

My experience working in Europe gave me a unique “outside looking in” perspective on American healthcare.

For instance, the big US EMR wave has passed. According to the December 2014 HIMSS Level 7 survey, nearly two-thirds of hospitals now have computerized provider order entry (CPOE) and an EMR implemented. In this area, the US is well ahead of our European counterparts, so we have more patient data than ever before.

However, many organizations have yet to recognize the promised results out of these systems despite significant investment. The focus for US healthcare today has turned towards reducing costs, improving quality through performance improvement and optimization efforts, and making better use of the available data through analytics.

Another US trend is increased merger, acquisition, and affiliation activity among providers. I believe this will most probably affect the one-third of organizations that have not yet implemented new EMR technology. They will likely seek to join with (or at least establish an extended EMR relationship with) stable organizations in order to remain competitive and control costs. IT issues surrounding these new arrangements are enormous. Among the top concerns we’ve seen in these arrangements are the initial loss of control and resulting service levels from the hosting organization.

Finally, call it what you will — accountable care, population health, value-based care, pay-for-performance, etc. — rising healthcare premiums and deductibles will continue to drive the migration from fee-for-volume to fee-for-value. This change will have substantial IT implications – some known, others yet to be seen. Some of the most visible are:

• Health information exchanges (HIEs) or other forms of data interchange between disparate systems will no longer be a “nice to have.” The downside of our EMR implementation wave is that we now realize the problems associated with absence of real data interchange. This issue must be addressed if we are to recognize the full potential of electronic data.
• Data analytics become essential. The healthcare industry must unravel the data to information to knowledge to real action transformation in order to demonstrate value. Data analytics will help hospitals and health systems better understand and apply best practices to enable care standardization among providers – a key step necessary to thrive in a landscape heavy on bundled payments and other shared risk plans.
• Revenue cycle technology replacement and optimization will become an increasing priority as many were originally implemented in reaction to Y2K. These outdated systems cannot adapt to the variations and requirements that new risk-based contracts bring and must be upgraded to new, more flexible systems.

Conversely, the EMR wave in Europe has just begun.

Several large American integrated vendors are starting to work their way across the pond and into new markets. It will be interesting to see if they take some of the lessons learned in the US market (especially around interoperability) and apply them there.

Some of these transitions may be eased in a socialized medicine environment, which has one reimbursement model for an entire country – as opposed to the large variety of complex reimbursement models in the US. A single reimbursement model has the opportunity to significantly streamline billing.

Although the revenue cycle and financial applications in Europe vary greatly from those here in the US, the clinical workflows are very similar. On one of the large EMR implementations I worked on in Europe, the hospital used 90 percent of the American vendor’s clinical model workflows as-is.

On the other hand, Europe’s procurement cycle is extremely long, similar to that of US federal and state organizations. Given the rapid pace of change in healthcare today, I would expect to see Europeans accelerate that process over time.

Many European countries are ahead of the US in establishing national health identifiers and national provider registries. This puts them in a much better position to share data about patients across providers. They are also doing a better job of delivering high quality outcomes at lower costs.

Finally, due to the size of the various national markets, you do not see the proliferation of large, homegrown software vendors as observed in the US. This has made these countries targets for established American EMR vendors such as Cerner and Epic.

My takeaway from my time working in the European healthcare market and the opportunity to attain an “outside looking in” perspective on the US market is quiet simple. We both have much to learn and can learn a lot from each other.

Ted Reynolds is senior vice-president of CTG and is responsible for CTG Health Solutions. 

HIStalk Interviews Tim Elliott, CEO, Access

Tim Elliott is CEO of Access of Sulphur Springs, TX.

Tell me about yourself and the company.

We started the company about 15 years ago based on some needs that a customer had. It was with another one of our companies at that time. It grew into what it is today. We deal with enterprise forms management.

I grew up in a family that was in the multifunctional hardware business. The need for forms came out of that.

What’s going on with electronic forms in healthcare?

It has changed a lot. When we first started, everyone needed the ability to get rid of pre-printed forms. So we first started, it was all about output of forms — current forms, forms with barcodes, and that sort of thing. That’s been the legacy piece that we’ve been dealing with for probably the last 10 or 12 years.

About five years ago, we bought another company called Formatta out of Virginia and it changed what we’re able to do. So many of our customers were wanting to go completely paperless. Everything we do now is dealing with paperless, web-based forms.

What are some creative things customers have done outside their core EHR functionality?

We’re gap fillers. A facility buys Epic, Cerner, Siemens or Meditech. Every facility has most of the same needs, but they all have different workflows and processes. The big EMRs are good at addressing all the big stuff. We go in and help deal with the little stuff.

Some systems don’t have great procurement systems. We have the ability to have automated purchasing systems, where you’re signing off on POs and requisitions. We have a customer in Kansas City who runs a lot of their HR — their customer-facing or their employee-facing stuff — directly off our solutions. They’re using some pretty big EMRs and some pretty big HR systems.

Every customer does something a little bit different. Our customers have driven some interesting solutions that we never thought of. A lot of things that we market came from our customers. They didn’t necessarily come from our minds.

That’s really what’s fun about what we do. We go into every healthcare facility with some specific things we know that are issues, but we get a lot of, “Wow, that’s really neat, but wouldn’t it be cool if we could do this?” or, “We’ve been trying to solve this problem for five years and this might do that.” We began discussions around that and the light bulb goes off. They start seeing how something like this could fix some of those things. We fix it electronically instead of with paper or additional processes.

We’ve worked over the three to four years on integration. It’s one thing to have a paperless front end, but what happens to the data? What happens to the forms at the end? We’ve gotten really good at the integration — where do these things reside, where do they go, where do they attach, what records do they go into?

When you’re talking to CIOs, what seems to be worrying them most these days?

Cost. Dollars. Most of them have spent so much on investing in IT solutions or trying to get some of the money coming in. It’s not as much about the solutions that fulfill the daily needs, but how can we get by and how can we get everything in place in order to meet the regulations? 

The people who are working out in the departments are aware of that and that’s important to them as well. But they’re really concerned with, how do I keep this from being a three-day process? How can we make this a one-day process or a one-hour process?

Someone pays many millions for Epic, Cerner, Siemens, Meditech or whatever it may be. About two to three years down the road, they start addressing some of those things. They all think it’s going to be paperless and everything’s going to be great with the world and it’s going to solve all their problems. Then the paper starts seeping through the concrete a little bit to the top. They’re starting to see those gaps and we’re able to address those.

Once your system is installed, do super users create the applications or does IT have to do it?

It depends on the facility. Usually we’ll go in and implement based on a need. They have a particular need or problem they’re trying to fix. We’ll go in and help and implement around that. Our professional services people will help them solve that. But then we’ll train a super user on how to replicate that, or how to fix the problem. 

We have different types of customers. We have some that have incredible admins that are doing an incredible job of understanding what it does. We’ll call them in three months and they will have fixed four other things that we weren’t even aware of when we first started with their work flows. Then we have some users that need our help and we push them a little bit here and there. Then we have some that just say, come in every six months, look what we’ve got, find our gaps, and help us fill those. But most of our clients do a lot of it themselves.

Are you using newer technologies such as web-based forms and smartphone form entry?

We’re doing a lot. In the last year and a half, we’ve done a lot of development on the app side where we can use iPads and iPhones. It’s a question of which is the best platform to do certain things on. How do you do it on the iPad screen or a Surface screen or an iPhone screen or a Samsung Galaxy screen? All those are different. How can you make that experience right for all of them? That’s what we’ve worked on the last two years. 

We’re getting there and we have customers using it now. We have a couple of international customers that are going to do some incredible stuff with it with the iPad. Patient-facing forms, patient-facing stuff on the web or on an iPad or a Surface there in the facility.

As a gap filler, do you worry that other companies will widen their reach and step on your turf?

They do. We’re partners with a couple of EMR vendors. Their goal is to try to fill all the needs of their clients. The reality is that, at the beginning, they can’t. As they build a new version, they push that out to their clients. Those clients see holes and they ask for those to be filled. They can’t fill all those immediately. I takes four, five, or six years before they can meet all of those. That’s where we fill those gaps until their vendors can fill those. By that time, there’s other gaps that we fill.

We’ve been doing that for 15 years. We don’t try to take the place of their EMR. All we try to do is fill those gaps until they can be served by that vendor. We’re usually finding other things around it. Once our customers install our solutions, they keep them there a long time. It’s just not always the same solution at the end that it was at the beginning.

Where do you take the company from here?

We’re looking at a lot of interesting things. We’ve had more change in our customer base in the last two years than we’ve had in the last 15 and that’s good. We’re focusing on is the integration part, integration directly inside of some of the EMRs. With a lot of our web-based solutions, we’ve found some really nice niches. I’m sure that everyone will hear more about this in the next year or two. But really doing some neat things around trying to make the experience better not only for the patients in the facility, but also all the team members inside of the facility, giving them an ability to do things easier, faster, better, and paperless.
What you’re going to see from us in the next year or two is a lot of integration directly with the EMRs, a lot of integration with the data back into multiple places so that it can be analyzed, used, played with, understood, all those things. That’s where our focus has been the last two years and what you’re going to see from us the next two.

Do you have any final thoughts?

Access is a development company. We do a lot of fun things, but our favorite thing is listening to what our customers are saying and filling those gaps they have. They’re the ones that make us better. This healthcare thing that we’re all in is really about users and customers and what they want. We’ve been very, very blessed to be able to have team members on our side who listen well and develop around that. We’re excited to see what the next two or three years have for us.

Morning Headlines 2/13/15

Inovalon (INOV) Stock Rises Today on NASDAQ Debut

Analytics vendor Inovalon ends its first day on the stock market at $29.61, nearly ten percent up on the day.

NPSF convenes panel to set plans for progress

The National Patient Safety Foundation announces plans to convene a panel of patient safety experts that will assess progress made since the publication of IOM’s “To Err Is Human,” and then form patient safety goals and strategies outlining the next 15 years.

Deloitte announces new approach to EHR implementation and support

Deloitte begins marketing an EHR implementation and support approach designed to support smaller hospitals interested in migrating to a value-based reimbursement model.

Patient safety leader named CIO at Brigham & Women’s

David Bates, MD is named as the next CIO of Brigham & Women’s and the executive sponsor of the Brigham Innovation Hub. He was previously the chief quality officer at BWH.

EPtalk by Dr. Jayne 2/12/15

AMIA announces its Third Annual Student Design Challenge. Teams of graduate students are invited to submit “novel and original ways to facilitate engagement between humans and computing data-analytic systems.” Eight finalists will be invited to present posters at the AMIA Annual Symposium, with the top four teams delivering formal presentations. Proposals are due by June 1.

My wish list of things that would immediately better my own human-computer interaction: high-quality real-time voice recognition that could immediately map to discrete data fields in my EHR to facilitate interoperability and E&M coding support; a reporting platform that would let me do clinical queries based on concept associations rather than painstaking identification of specific data fields; and ways to manage constantly-changing clinical recommendations that don’t require a fleet of IT staffers.

This week has been a whirlwind. We’re delivering the first burst of training for ICD-10. Our corporate decision-makers wanted to maximize physician time out of the office, so they have bundled education on readmissions, length of stay, and preventable harms together as well. Although it may have saved providers from making multiple trips to the hospital for training, I’m pretty sure most of their brains stopped absorbing about 45 minutes into the session. Our team was batting cleanup with the ICD-10 content, so we’ll be planning repeat sessions both online and in-person.

I’ve also been busy preparing a lecture for Grand Rounds. It used to be that Grand Rounds was about presenting interesting clinical cases or new advances in treating diseases, but now we spend a lot of time talking about Meaningful Use and other regulatory concerns. I’ve been tapped to talk about the Security Risk Assessment needed for successful Meaningful Use attestation. It’s probably a reasonable topic since it’s been part of the HIPAA requirements for nearly a decade, yet many physicians act as if they haven’t heard of it.

Not only can providers be asked to pay back incentive money, but they can risk other penalties from the Office for Civil Rights. It’s a complex topic because it’s not once-and-done like “implement a certified EHR” or “turn on drug/allergy checking.” It requires physicians to create the assessment and maintain it as a living document, reassessing risk as they purchase new technology or change their information strategies. Given all the recent breaches, I’d think there would be more interest in security and risk. I’m looking forward to it since I do enjoy helping community providers learn how to navigate some of the thorny issues that employed physicians don’t necessarily have to deal with.

There are a lot of free resources available to providers and they’ll be taking home a tool kit to keep them headed in the right direction, whether they decide to try to perform the risk analysis on their own or hire an outside professional to complete it. I’ll also ask them to suggest topics for the next “administrative” Grand Rounds. Reading the comments and suggestions on their evaluation forms is usually good for a laugh or two.

The New Year always brings new vendor contracts. In addition to a new benefits manager for our flexible spending accounts, we also have a new purchasing agreement for office supplies. My assistant ran across this informational popup today. I’m going to have to seriously indulge my office supply habit if I’m going to hit that minimum.

Are you hoping your Valentine brings you a fragrant bouquet of Mr. Sketch markers? Email me.

Email Dr. Jayne.

News 2/13/15

Top News

Shares of analytics vendor Inovalon (renamed from MedAssurant in 2012) started trading on the Nasdaq Thursday with a first-day price increase of just under 10 percent. The Bowie, MD-based company’s market capitalization is $3.3 billion. Chairman and CEO Keith Dunleavy, MD, who founded the company, holds 44 percent of the shares, valuing his stake at nearly $1.5 billion.

Reader Comments

From Rude Boy: “Re: Epic. They are adding OpenNotes capability to their system.” Verified. Epic will not only add OpenNotes capability to its base product and to MyChart, it will turn the capability on by default. Providers can still choose which notes the patient can see. I’m interested in what other EHR vendors are doing to support OpenNotes since I hear a lot about the concept, but not much about how vendors are retooling their products to support it.

From Chill Wills: “Re: Deloitte. MedCity News blew this story.” Indeed they did, and all they had to do was reword the press release to look like real reporting (i.e., practice normal healthcare IT journalism). Not only did they misinterpret a routine Deloitte announcement about a new EHR consulting package in thinking that the company built and released an actual EHR, they also misspelled “Deloitte” in the article body as well the name of Deloitte’s Mitch Morris. MedCity just sold out to another company, so maybe they were over-celebrating.

From Chiaprism: “Re: HIPAA violations. A hospital nurse claimed I couldn’t stay overnight in my inpatient boyfriend’s room because that would be a HIPAA violation.” It is surprising at how often HIPAA is invoked incorrectly in an attempt to bolster an losing argument. A friend recently tried to make a doctor’s appointment for her 90s-age grandmother and was told by the barely-legal receptionist that it’s a HIPAA violation for someone to make an appointment who doesn’t have the patient’s power of attorney, which is clearly ridiculous. They wanted a faxed copy of the document sent to their fax number, which turned out to be disconnected, so my friend just called up pretending to be her grandmother and the receptionist violated HIPAA herself in providing patient details such as her conditions and medications.

From Matthew Holt: “Re: HIStalkapalooza. I was the one who requested you bring the band from Orlando and am ecstatic they’re back. My first and last time influencing anything on HIStalk! Now I just have to hope I get a  party invite!” I was skeptical when Imprivata chose the band as sponsors of last year’s event since I don’t usually like pop cover bands, but Party on the Moon was a big hit and filled the dance floor.  I probably would have misguidedly chosen a Finnish death metal band whose lead singer would have crashed hard to the floor as mosh-averse IT-type audience members scattered away from his stage dive landing zone instead of catching him.

HIStalk Announcements and Requests

Signups are still open to attend HIStalkapalooza on Monday evening of the HIMSS conference. Submit your information if you want to attend – even if you’re a sponsor, long-time supporter, or VIP, I still can’t invite you if I don’t know you want to come. The priority order for invitations is providers in hospitals or physician practices (I generally invite every hospital employee who signs up) and then Platinum-level HIStalk sponsors (they’re guaranteed two tickets each). That still leaves the majority of invitations for other folks who sign up, and if I have enough capacity to invite everyone on the list, I will.

This week on HIStalk Connect: Blueprint Health unveils its newest class of startups. VisualDx rolls out a global emerging diseases tool designed to help doctors diagnose infectious conditions. Noom partners with Viridian Health to advance diabetes care.

This week on HIStalk Practice: DigiSight Technologies raises a new round for ophthalmology. Frontier Behavioral Health goes with CoCentrix EHR. Vermont governor takes VITL to task for its Super Bowl ad. Michigan’s REC achieves MU goals. Azalea Health and Imprivata launch new services. Burgeoning physician social networks highlight healthcare’s fascinating "ick" factor. KiddoEMR CEO Joe Cohen, MD shares frustrations, challenges of private-practice HIT. Brad Boyd offers insight into gauging patient access performance. Thanks for reading.

Welcome to new HIStalk Platinum Sponsor Cureatr. The New York City-based company, founded by a group of physicians, offers the nation’s leading mobile care coordination solution. It provides real-time care transition notifications (including group messaging and photo sharing), cross-platform secure messaging, and clinical workflow tools (including best practice checklists) to eliminate interruptions in care, saving time and money in the process. Providers use an organizational directory to check team member availability and to send urgent messages. One hundred percent of clients report faster response time and improved coordination, with physicians saving an average of 90 minutes per day and nurses saving 60 minutes. Hospitals use it to expedite clinical decision-making and streamline care delivery, specialty care providers benefit from connecting with referring providers and extending their services, and physician groups use it to navigate patient care and influence care decisions. I interviewed founder and CEO Joseph Mayer, MD a year ago, when he said, “The next 12 months is really about what’s coming after messaging. Optimizing the care team mapping side of things, i.e. routing of messages to the right person at the right time, or routing information at the right time beyond messaging, task management.” Thanks to Cureatr for supporting HIStalk.

Webinars

February 13 (Friday) 2:00 ET. Inside Anthem: Dissecting the Breach. Sponsored by HIStalk. Presenter: John Gomez, CEO, Sensato. The latest intelligence about the Anthem breach will be reviewed to provide a deep understanding of the methods used, what healthcare organizations can learn from it, and how to determine if a given organization has come under similar attacks. Attendees will be able to ask questions and put forth their own thoughts. 

February 17 (Tuesday) 1:00 ET. Cloud Computing – Cyber-Security Considerations. Sponsored by Sensato. Presenter: John Gomez, CEO, Sensato. This webinar will examine the security challenges involved when healthcare organizations implement cloud-based services.

Acquisitions, Funding, Business, and Stock

The Advisory Board Company reports Q3 results: revenue up 15 percent, adjusted EPS $0.26 vs. $0.26, beating expectations on earnings and meeting on revenue. Above is the one-year ABCO share price chart (blue, down 13 percent) vs. the Nasdaq (red, up 14 percent). The company’s market capitalization is $2.2 billion.

Advisory Board Chairmen and CEO Robert Musslewhite announces in the company’s earnings call that it has acquired clinically-focused advisory firm Clinovations.  

Vocera reports Q4 results: revenue down 14 percent, adjusted EPS –$0.10 vs. $0.03. Above is the one-year VCRA share price chart (blue, down 46 percent) vs. the Dow (red, up 11 percent). The company’s market capitalization is $234 million.

From the Cerner earnings call:

• Bookings for the quarter hit a record $1.16 billion, with 28 percent coming from outside the Millennium customer base.
• Expenses involved with the $1.37 billion Siemens Health Services acquisition will reduce margins by a few percentage points until 2017.
• The company says early purchasers of niche population health solutions are already kicking those products out just 18-24 months later as they look for tools that can aggregate data from multiple systems and insert real-time information into clinician workflow.
• The company’s Siemens-related work will be focused this year on (a) migrating those customers who want to move to Cerner products, and (b) selling the former Siemens customers services such as process optimization and performance improvement.
• Cerner will continue to sell Soarian Financials as a standalone product, saying surprising demand exists for standalone patient accounting applications.
• Cerner plans to go live with some of its Intermountain work in Q1.

Private equity firm Silver Lake acquires Atlanta-based healthcare marketing technology vendor BrightWhistle, which it will merge with its existing portfolio company Influence Health (the former Medseek).

Sales

Ocean Health Initiatives (NJ) chooses Forward Health Group’s PopulationManager and The Guideline Advantage.

Hospital CIMA San Jose (Costa Rica) chooses Allscripts Sunrise for its 62 beds.

Announcements and Implementations

Epic announces on Open.epic.com that its FHIR testing sandbox is live, with formal FHIR production support planned for a June release.

PerfectServe signed 29 new client contracts and had 260 go-lives in 2014, with 45,000 clinicians using its communications platform.  

Saint Francis Medical Center (MO) begins its Epic implementation, with an expected go-live in July 2016.

Stanford Health Care releases its self-developed iOS 8 mobile app that connects with Epic and Apple’s HealthKit.

Government and Politics

Legislators and providers agreed in a congressional hearing Wednesday that ICD-10 implementation should not be delayed further. Video of the meeting is here. Chairman Fred Upton (R-MI) commented, “The United States is one of the few countries that has yet to adopt this most modern coding system. Australia was the first country to adopt ICD-10 in 1998. Since then, Canada, China, France, Germany, Korea, South Africa, and Thailand – just to name a few – have all also implemented ICD-10. In the United States, Congress, through one vehicle or another, has prevented the adoption of ICD-10 for nearly a decade.”

GAO is accepting nominations through February 27 for openings on the HIT Policy Committee in the areas of consumers, providers, health plans, and quality reporting.

The VA says its Janus viewer, which visually merges a patient’s VA and DoD EHR records on the screen, will be made available to third-party care providers in about a year. The VA will send a service member’s doctor a link rather than attaching full records to an email.

Privacy and Security

A 60-year-old man sends a phony recruiter $4,300, scammed into thinking he was being offered a job with Cerner by email, not finding it unusual that the recruiter demanded that he send money to pay for his company PC before starting work.

Innovation and Research

AHRQ-funded researchers at UCSD roll out a “lab in a box” that uses a camera, microphone, keystroke monitor, and Microsoft Kinect sensors to measure how EHR use affects patient encounters, such as analyzing how much time doctors spend looking at the screen instead of the patient. The researchers plan to compare distraction levels across practice settings, provide data to help EHR vendors write less disruptive software, and possibly even warn doctors in real time that they aren’t paying enough attention to their patient.

Technology

Techcrunch profiles CliniCloud, which has launched a Bluetooth-connected stethoscope and non-contact thermometer kit. Its app is integrated with Doctor On Demand, which provides video chats with doctors to discuss the results. The device will ship in July and can be pre-ordered for $109.

In Chicago, the MedEx ambulance service rolls out 10 ambulances equipped with Google Glass to allow paramedics to live-stream hands-free audio and video to hospitals.

Other

Two Epic technical writers file lawsuits against the company that claim they should have been paid overtime, with both suits seeking class action status. The technical writers say they should have been categorized as hourly rather than salaried employees since their jobs don’t require advanced knowledge or computer expertise. Epic has offered to settle a previous similar suit brought by its quality assurance employees for $5.4 million.

A market research firm says that health IT jobs are harder to fill in New York than anywhere else in the country.

A South Florida “doctor and entrepreneur” launches ClickAClinic, which he says is the state’s only telemedicine services provider that’s licensed as a clinic. I suspected from the use of the title “Dr.” without further explanation that the “doctor” wasn’t an MD, which turned out to be true – he’s a chiropractor. I would never engage any service from someone who uses the title “Dr.” in front of their own name instead of their actual degree since they’re either egotistical or trying to hide something. A lot of MDs (and particularly the wives of male MDs) introduce themselves in purely social situations as “Dr. John Smith” as though the guy at Home Depot or the neighbor down the street really cares.

Facebook rolls out an option that will allow a user to name a “legacy contact” who can explain to breathless followers that the stream of cute videos, quiz results, and click bait “likes” has been sadly interrupted by their faithful curator’s demise.

Sponsor Updates

• Nuance’s Clintegrity 360 Facility Coding topped the “Best in KLAS Awards” in the Medical Coding category that had been dominated by another vendor since 2008. Clintegrity 360 Quality Management Solutions also was named a category leader.
• PatientSafe Solutions President and CEO writes “Prepare for Post-EHR Era with Actionable Data Delivered in Clinical Context.”
• Stella Technology offers “HIE Implementation Tips & Tricks.”
• Healthwise wins international awards for two of its health videos. 
• Lifepoint Informatics opens up registration for its User Conference March 18-19 in San Diego.
• LifeImage’s Mike Murphy writes about “Medical Image Exchange for Cancer Care: More Collaboration and a Better Patient Experience” in the latest company blog.
• Kathleen Aller of InterSystems explains that “You CAN Get There from Here: Navigating Interoperability.”
• Intellect Resources President and CEO Tiffany Crenshaw explains in the latest company blog that “Hiring Top Tech Talent Requires an Investment in People.”
• InstaMed asks healthcare payers to participate in its Healthcare Payments Annual Report survey.
• IngeniousMed’s Brian Vice is featured in a “CBS Evening News” segment on job growth.
• Impact Advisors Principal Robert Faix shares insight into how hospitals are getting hacked.
• Healthgrades sponsors the inaugural Special Olympics dual slalom race at the Winter X Games in Aspen, CO.
• Healthcare Growth Partners advises Keais Records Service on its recapitalization by CapStreet.
• HCS will participate in the February 19 HFMA event – “Emerging Management Challenges in the Physician and Hospital Arena” – in Philadelphia
• The HCI Group is named to the University of Florida’s inaugural 2015 Gator 100.
• Clara Hocker of Hayes Management Consulting offers tips on “Building a Better Billing Office: What You Need to Know” in the latest company blog.
• DocuSign offers digital best practices for digital business success. 
• Erin Michaud asks, “Why is a Project Manager Important to Your Clinical Data Conversion?” in the latest Galen Healthcare Solutions blog.
• Extension Healthcare will exhibit at the Texas Regional HIMSS Conference February 19-20 in Austin.
• Greythorn Managing Director Richard Fischer shares insight into the shortage of “right skills” in IT.

Contacts

Mr. H, Lorre, Jennifer, Dr. Jayne, Dr. Gregg, Lt. Dan.

More news: HIStalk Practice, HIStalk Connect.

Get HIStalk updates.
Contact us online.

Morning Headlines 2/12/15

Lawmakers oppose delaying October rollout for ICD-10

A group of representatives hears testimony on the implementation of ICD-10, including 6 of 7 industry representatives speaking in favor of an on-time transition.

U.S. creates new agency to lead cyberthreat tracking

Following the string of recent high-profile hacker attacks, the US will stand-up a new  intelligence unit called the Cyber Threat Intelligence Integration Center that will be focused on tracking cyberthreats

Government Watchdog Says Veterans Affairs at High Risk for Fraud, Waste

The GAO publishes a report labeling the VA’s health care system a “high-risk” area of the government, citing vulnerability to fraud, waste, abuse and mismanagement.

Readers Write: Patient Discipline, Or is it Simply Willpower?

Patient Discipline, Or is it Simply Willpower?
By Helen Figge

The dust seems to be settling a bit these days, with overwhelming sighs of relief about the redefining of MU2, ICD-10 continuing the saga onward but slower, and the unending chatter about the patient portal and how we need to get patients to use it in order to reap the benefits of the various regulations and mandates in place forcing doctor’s and caregivers alike to make us all healthier. Couple that to our worries that once we have the collected data, we then are able to analyze the data in a way that actually benefits the end user – you and me – the healthcare consumer. Just as worrisome is the safety of the data and its security.

The quandary to all of this at times is that we are still a very sickly society. More than one-third of US adults are obese. Obesity-related conditions include heart disease, stroke, type 2 diabetes, and certain types of cancer, which are some of the leading causes of preventable death. The estimated annual medical cost of obesity in 2008 was $147 billion, while the medical costs for people who are obese is about $1,429 higher than those of normal weight.

Surely we have many of the technologies in place to help counteract these serious statistics — various forms of health information technology solutions that actually can assist clinicians to take better care of their patients. The technology is in place, now we need to best utilize it, right?

One term continues to be said and that is patient engagement — engaging the patient to care, which is deemed as one of the cornerstones for healthcare success in making us healthier than ever before. The baseline theme common to many in the patient engagement framework is managing information and making it available to both the patient and care team in a manner that supports care decisions, improves bi-directional communication, and optimizes outcomes. This is the nirvana we strive to accomplish in healthcare, and we appear to be doing so as we move forward in time.

We are seeing more and more patient engagement opportunities available to the healthcare consumer. These are in the forms of weight loss programs, reminders to eat and exercise, Facebook clubs, and many other forms of enticing the patient to care.

Despite the benefits of patient engagement solutions and the investments currently being made, convincing the patient to care might be the more difficult aspect to all of this and will require innovation. Lack of health literacy in a large portion of the population, fragmented end-user market, poor access to healthcare, and security of patient data again stated are still hindering growth of this market to convince the patient.

These efforts boil down to one common thread: self-motivation or self-discipline by the healthcare consumer. Without the engaged patient, the various interventions prescribed by their caregivers will go unnoticed and fall short of the clinicians’ effort to effectively prescribe. But how do you self-motivate or educate a person on self-discipline and have it, not withstanding lifelong tendencies, become a normal part of one’s life?

I take myself as an example. I don’t know how many times on a cold, dreary day I rather would have laid in bed than get my running shoes on and take a quick two-mile run up and down the road before any of the neighbors saw me, thinking to themselves, “What is she doing out in the dark with a flashlight in this hour?” It’s because I work for a living and I had to fit my run in before work and before life started.

But in the end, I did it, and do so faithfully. I disciplined myself knowing it was good for me. The alternatives are less than appealing. Forget that the doctor that says it is good for your blood pressure and weight and bones or the envy or guilt often times put on us by our peers because they do it. I do it for me and the motivation comes from within, not someone reminding me it is good for me. That is the discipline we need in healthcare as consumers if all of these tactics to entice us to take care of ourselves takes hold.

In order for patient engagement to work and before entities heavily invest in programs and concepts to “educate” the consumer about their health, we need to get to the root cause of self-discipline. Someone needs to understand how we discipline ourselves to take care of our health. That is where sustainable healthcare lies for us now and in future generations — teaching us the discipline, and in turn, the next generation.

Eventually we will not have the ability to be reminded to take care of ourselves by an outside party. Funding may run out, people may tire of the phone call to eat right that day or sustain from a cigarette else you will end up on oxygen and die a slow and painful death. We will need to learn from these efforts via patient engagement tactics, and in turn, use those pieces of information to further our own reasoning of, “Why do I need to do it?”

Whether it is home glucose monitoring, INR readings, blood pressure readings, or any of the other mobile device readings, what we do with the data to infuse the practices into everyday life will determine the long-term outcomes of healthcare success. Determining the outcomes of all of the healthcare reforms, reimbursements, and penalties really come down to one simple fact: will the healthcare consumer heed their doctor’s advice, listen to directions, and follow the protocol to keep them alive, make them well, or to keep them well?

It boils down to discipline. Are you disciplined enough not to be reminded to take care of yourself, or are you like most Americans who need to be cajoled, bribed, and threatened in order to take control of your own health destiny? Only your self-discipline can answer that question.

Helen Figge is SVP of global strategic development for Lumira.

Readers Write: What is a Health Information Handler?

What is a Health Information Handler?
By Lindy Benton

Recently I received a query from a healthcare professional wondering about the definition of a “health information handler” and their benefits. I’ve long desired to do a presentation on the subject so as to discuss their reason for being, their importance. and how they tangibly serve health systems. Given the lack of awareness surrounding the topic, perhaps it’s an appropriate time for a refresher on the subject.

First, a little history. The Center for Medicare & Medicaid Services (CMS) manages the health information handler program. CMS defines a health information handler as “any organization that handles health information on behalf of a provider.”

Providers and hospitals usually engage relationships with health information handlers (as third-party vendors) so they — the providers — are able to electronically submit claims data and health record attachments to payers and Medicare contractors in support of claims adjudication.

These health information handlers also are often called claim clearinghouses, release of information vendors, and health information exchanges. Most also offer electronic submission of medical documentation (esMD) gateway services.

EsMD is still a work in progress, an ongoing experiment spearheaded by CMS to support electronic exchange of information between health systems and Medicare audit contractors. Prior to esMD, providers had just two ways in which to respond to documentation requests from Medicare review audit contractors – mail or fax. EsMD fixed that problem. 

The program has been in effective for more than three years – Phase One went into effect on September 15, 2011. Phase Two will allow providers the ability to receive electronic documentation requests when their claims are selected for review. CMS has yet to launch Phase Two.

To date, tens of thousands of medical records and other health information have been submitted through esMD in response to audit requests. More specifically, though, according to AHIMA, the esMD program directly impacts health information manager professionals. For these folks — who typically pull and send medical records in response to CMS audits — the process can be slow, frustrating, and costly. The esMD program and the health information handler entities that facilitate the record exchange are working to simplify that process, AHIMA states.

The esMD gateway is not set up like a typical website, though. Not everyone who wants to submit information via the gateway can simply jump on, upload files, and press the “send” button. To interact with CMS through esMD, organizations need access to the portal. The gateways are costly to develop and maintain, so hospitals and providers turn to health information handlers to facilitate the exchange process.

Health information handlers build and service an esMD gateway for multiple provider participants and submit electronic documentation on a provider’s behalf. As more providers use health information handlers to simplify their audit processes, electronic health information exchange also will increase in usability.

Documentation requests from Medicare’s audit contractors are the primary requests received by health information professionals. Auditors request additional claims information from hospitals to verify or “ensure” that coding and claims are submitted properly. If claims are coded incorrectly, hospitals must return funds to Medicare. The program was designed to reduce incorrect Medicare payments and to recollect overpayment, identify underpayments by hospitals, and prevent future issues with payments. EsMD supports this effort and enables health information handlers to support the flow of information.

Overall, the recovery program has been a success from the perspective of CMS. Medicare’s recovery auditors returned more than $3 billion to the program in 2013. Providers may disagree, but in the very least they are able to more easily satisfy exchange of crucial information to support their billing practices with Medicare.

From a business and enterprise perspective, the move by CMS to launch the program has meant the growth of a number of health information handler firms that offer a variety of services and skill sets. In addition to providing exchange capabilities, some allow for capture of information, scanning, storage, and transmission in a secure manner. The health information handlers also track data sent and acknowledge and verify that it has been received by auditor through the gateway. Health information handlers are considered business associates of the organizations they serve and are required by CMS to follow HIPAA rules.

According to a Government Health IT piece earlier this year, overall the esMD program is still not streamlined, but there is traction here and despite ongoing setbacks more and more providers are using the program. CMS even reported that more than 500,000 records were sent through esMD in 2013 and more than 30,000 hospitals, physicians, and medical equipment providers use esMD for auditor medical record requests.

Because of the advent of esMD and health information handlers, hospitals and health systems are gaining speed in the processing of their audit documents as well as allow for the exchange of secure information between health system and Medicare auditors. The time saved in responding to the information requests is a huge benefit. There’s also the ability to address sensitive audits rather than sending information through mail or unreliable fax servers. This alone typically cuts down the time required to submit the documents for review and reduce potential penalties.

An example of this can be found at Boca Raton Regional Hospital in Florida. Established in 1967, just five years ago it faced a variety of Medicare audits and penalties. Now the not-for-profit 400-bed hospital is seeing a complete turnaround. 

One significant change is how the hospital now manages responses to Medicare audits. According to hospital officials there, the previous process had been cumbersome and meant printing, sorting, packaging, and mailing documents to Medicare to support claims and to adjudicate their bills. Since one patient record can fill a box or more, hospitals are left paying for all materials, labor, and shipping involved, enormous financial considerations for every organization.

The Medicare audit process has drastically improved because of Boca Raton Regional Hospital being able to submit documents electronically and denials related to untimely submission of records has disappeared entirely. For example, Medicare allows 45 days from the date of request for hospitals to respond, but Medicare still sends documentation requests by paper. Typically, by time the request gets to the proper department in the hospital, more than 10 days has elapsed. Managing the entire process requires a very strict time requirement and hospitals often fail to return records to Medicare on time, which means hospitals can no longer appeal. By automating the process and securely depositing electronic attachments to Medicare’s official information portal, Boca Raton Regional Hospital has prevented the loss of at least $350,000.

There are hurdles to widespread implementation, though, as hospitals resist using the solutions because they’re overwhelmed with current technology. They’re already so invested in other projects that many are unable to see the benefits of bringing on additional solutions and being able to exchange information with CMS. A prevailing thought is that those managing hospital IT departments simply are overwhelmed and growing ever more nonchalant about the idea that technology is going to save them or their employers any more than already has been promised.

In fact, recent reports have begun to surface claiming that CIOs at struggling health systems have little faith that new technologies, on top of recently implemented systems like EHRs, will do much good for them since these other solutions – the EHRs – had such little positive effect on their organizations’ bottom lines. Simply put, they’re sensing a bit of personal doom and are growing tired of all the hype. It’s unfortunate.

Also, for payers, despite the obvious benefits of encouraging health information handler relationships with physicians, esMD and electronic exchange are not a top priority considering all the issues they are managing, not the least of which is the current federal insurance overhaul. Perhaps time will change this, but for the foreseeable future, esMD is likely not going to gain the traction is needs to become an industry standard.

What is fortunate, though, is that service providers like health information handlers are having a positive impact on the healthcare environment and are bringing down some pretty mighty horses while also helping bring about better workflows, improved efficiencies, and increased profitability. Despite the lack of awareness surrounding these healthcare partners and their impact across the sector, many are still unaware of the health information handler’s purpose and the very term by which they are defined.

Lindy Benton is CEO of MEA|NEA.

Readers Write: Innovative Examples of Patient Engagement Programs

Innovative Examples of Patient Engagement Programs
By Zach Watson

For providers looking to increase patient engagement, it can be difficult to distinguish the abstract from the actionable. Patient engagement has become a veritable pillar of new reimbursement models, new government programs, and in some measure, the quality of a physician’s practice.

But will better patient engagement truly reduce the use of medical services? If so, who is finding success, and how?

Patient engagement falls into three broad categories: changing the role of the patient and the patient’s family in the care team, using technology to retrieve information from the patient, and fundamentally altering the environment and manner in which patients receive care.

Let’s examine each of these categories in greater detail.

Patients as Care Managers

At this point, saying the healthcare system is fragmented is a truism. Efforts are underway to improve care coordination through information exchange via electronic health records and other medical software, but many of these initiatives are invisible to patients. Which is to say, they can’t engage with what they can’t use.

Consequently, one of the most effective ways to engage patients is to reposition them as a member of the care team. Instead of the patient playing a passive role in the care she receives, this new model depends on an egalitarian relationship between the providers and patients.

Patients have a large role in the decision making process, and with better information exchange, they can act as the manager of their care plan rather than merely the recipient.

The San Diego-based Sharp Rees-Stealy Medical Centers expertly executed this model in 2013. Following MCG Chronic Care guidelines, the medical group created a multi-disciplinary team that identified high-risk patients for heart failure during their early interactions with the healthcare system and then provided personalized care.

The patients have greater control of the way their care is administered and they don’t have to repeat their diagnosis to different physicians as they move across the continuum of care. The result? A 49 percent reduction in 30-day heart failure readmission rates.

Technology for Collaboration

Patients with chronic diseases consume a disproportionate amount of healthcare resources, but managing these patients can be difficult without adequate technology. That’s why initiatives like the Collaborative Care Network were founded: to help physicians and patients better control the use of acute services.

Founded by a widespread group of pediatric gastroenterologists, the Collaborative Care Network used to be a patient registry where physicians shared treatment strategies and data with patients suffering from rare inflammatory diseases. The network improved remission rates by 25 percent, but the physicians took the program a step further and encouraged patients to contribute ideas for treatment and research they’d like to have done.

Now patients actively share vital sign data and keep their medication doses recorded so physicians can closely monitor outcomes. As of 2012, the CCN boasted roughly a quarter of the US’s pediatric gastroenterologists, and the response rate of patients who received daily messages on their phones was 94 percent.

Care Direct to the Patient

It’s no coincidence that the stress of juggling Meaningful Use and clinical quality measures criteria while keeping a business afloat makes it more difficult for independent physicians to spend the optimal amount of time with their patients. With that in mind, it shouldn’t come as a surprise that a number of physicians — roughly 10 percent — are entertaining a concierge model.

By reserving insurance payments for only acute episodes of care, physicians can charge patients a monthly or annual fee to have access to their services around the clock. What better way to engage patients than by visiting them in their own homes and making sure all their questions are answered before the appointment is over?

The concierge model takes other forms beyond the “doctor at your door” service. The Mayo Clinic recently entered the digital concierge market with its mobile app Better. For about $50 a month, patients have access to video chats with nurses, a symptom-check list that takes into account the patient’s health history, and other healthcare services.

At times patient engagement may seem esoteric, but the truth is that it applies to any instance where the patient can be more empowered in their care. To truly reduce healthcare costs, the system will need to reduce the rate of use. That means trusting patients with greater management of their own care while providing a more unified set of services when patients do need comprehensive medical attention.

Zach Watson is the content manager at TechnologyAdvice.

HIStalk Interviews Jeff Lee, Principal, DCM Ventures

Jeff Lee is a principal with DCM Ventures of Menlo Park, CA.

Tell me about yourself and the company.

DCM is a global venture firm. We manage about $2.5 billion investing in IT-related opportunities in the US with offices in Beijing as well as Tokyo. I’m a trained engineer, a product guy. I spent some time as an investor and then as an entrepreneur and then an investor. I’ve seen both the operating side as well as the investing side and the product-building side of technology companies.

Your world is mostly young, West Coast, and high tech. Is it hard to avoid having that mindset unduly influence your view of companies?

It’s funny you say that. I did my undergrad out here at Stanford and I spent five years at Cisco right in the middle of the boom and bust. I’ve seen both sides of that in the Valley. I intentionally left the Valley for eight years and spent the last eight before moving back up here in LA to see a different perspective on the rest of the country, how companies are started. I’ve intentionally gotten that experience to have a different perspective.

Where are the geographical pockets of innovation and which will be most important?

Around the country, Silicon Valley has always been the capital for technology. With globalization and the represented aspects of that domestically, you see a lot of interesting things coming out of LA, you see a number of interesting things coming out of New York. Boston historically has been a bit of a hub. If you think globally, you’re seeing a lot of stuff coming out of Asia as well, as far as big companies getting built and technology and stuff that’s frankly going cross-border.

Healthcare innovation often comes from the presence of a big vendor in a location like Madison, Wisconsin or Malvern, Pennsylvania. Do those areas spawn their own innovative ecosystems?

I suspect they do. One of the challenges, especially with innovation in the healthcare IT sector, is you really need a balance of healthcare expertise, but you also need the entrepreneurial blood. I think there may be some pieces of those coming out in places like Madison, Wisconsin.

It’s difficult to find the folks that are truly going to create game-changing companies. Not to say that there won’t be, but where you look geographically, some of the places that are hubs of innovation that are growing where there’s an increasing expertise in the healthcare space are where we tend to see some of the big opportunities emerging.

Do you sometimes look at a little company’s pitch and tell them that while they’ve built an interesting and potentially profitable small business, you just don’t see that it can scale to the point that would get you interested?

Definitely. There’s a bunch of statistics around venture capital and companies that hit. There are very few companies where venture makes a lot of sense, or when you look at the broad ecosystem of funding, small business is probably five percent or less.

We see a lot of those things. We are one solution of many for funding early-stage small companies. We tend to be the high-risk, high-return piece of it where there’s a good chance it might go to zero, but there’s a possibility that it could be a large, substantial public company. Those are the opportunities that we go after.

How important is the personality or the outlook of the founder when trying to identify those potential winners?

In my view, it’s the single most important factor. If I were to paint a broader picture around it, you take a great founder and management team in a big market. Those are really the two ingredients you look for and a great opportunity for us.

How do you project the timeline of how far the founder can carry you and then at what point you’re going to bring in a different managerial skill?

They depend on a case-by-case basis. Our ideal situation is a founder who’s the CEO of the company who can go all the way. I think that the passion that a founder has for a company and the desire to see it successful, which frankly sometimes is irrational of sorts, is really what it takes to get some of these companies all the way.

I’ll say that we infrequently will go into a investment thinking or knowing that the founder will only go so far. Usually it causes a lot of turmoil, and more often than not, will in essence sink the company at some point.

That being said, I think understanding that, and if that’s what the founder wants and acknowledges that, then we certainly can help in identifying the right talents or helping them think through the timing or the personnel that they should be looking for. We are active investors, but we will typically take a number two to the founder where’s it’s really their company, it’s not ours. That’s philosophically how we look at it.

How much extra value or extra credibility does a company have when the founders done it before?

It makes a huge difference if somebody’s been able to do it before. It’s the best indicator of future success. Again, every situation is case by case, but especially I would say in the sectors like healthcare where there’s a lot of innate domain knowledge that needs to be hedged, how to operate in it, your having that background is really important.

It’s always big news when a company is sold. What’s it like behind the scenes trying to get a company to that point? How do you find potential buyers? Are the sellers always happy to get a bunch of cash and turn over the keys to someone else?

The best exit opportunities are usually not being sought out and usually are on the backs of the success and high growth of a company. Before we get to that point, what we are focused on is always building a large, scalable, fast-growing business. If inbound interest comes in, we’ll seriously consider it. We typically are swinging for home runs, so more often than not if a company is doing well, we’re going to double down and help support that company to keep on going.

Sometimes to your point an attractive offer comes in. Depending on timing, you might then take it through a process and go talk to other folks and see what exits might be available. Obviously, if it’s an IPO, that’s a slightly different animal.

That’s typically how the best exits happen. Usually the ones where you really need to build a process around it are the ones that aren’t doing nearly as well.

If I’m running a really successful company and I’ve got funding and the growth is there, do I get a lot of calls out of the blue? Who’s calling me and what are they saying?

The calls don’t go to me typically. The calls would go to the CEO and the founder. I think a lot of the times they come from business partners. They might be the development partners, they could be customers. They come from the ecosystem.

I had this experience myself. I had started a company in the small business group buying space. As we are building and we were talking to a number of our distribution partners, one of them asked, "Would you consider a possible acquisition as opposed to just a partnership?" That was the beginning of a conversation that led to our eventual acquisition.

That’s typically how it happens. Usually, it’s not unsolicited. Usually, it’s a ongoing conversation or at least the relationship over six to 12 or even more months before a company is really going to look at writing a hopefully large check to acquire another company.

As an investor, how much influence do you expect to have?

Our typical type investment, which is I think a generally true for most in the venture industry, is we’ll write a large enough check and take probably 20 to 30 percent of a company, typically to warrant a board seat. We will typically not go in and operate the company, but we will help guide the strategy of the company, help guide the fundraising strategy of the company. We will make business development introductions to meaningful partners that could change the trajectory of the company. We’ll spend time recruiting for and qualifying if it’s a CEO or senior executives on the team, folks that really will come in and make a material change on the opportunity of the company.

What’s it like doing what you do?

It’s awesome. I love it. My day is spent predominantly meeting a lot of very interesting people. On the early-stage side, it’s meeting entrepreneurs, hearing about what they’re passionate about, where they think the big opportunity is. It could be in concert with a financing that they’re trying to put together or maybe getting to know people before that.

Part of it is getting to know folks in the ecosystem such as yourself or in the healthcare space. It might be other operating execs, people at large companies who understand what they’re looking at strategically or how we might be able to orchestrate some partnership between some of our portfolio companies and their company.

Then obviously getting to know other investors as well. Once we fund a company, when we look at a next major round of financing, we typically look to get an outsider to add additional value to the company or some of those that in reverse are doing smaller checks than us. They might see the opportunities to us.

Those are the broad pieces of the deal piece of it. Then part of it is working with our companies and our entrepreneurs. Some of that happens in the board room, where there’s usually it’s monthly. Usually there’s an update about the business and a discussion around the critical issues in the business both good and bad. Then we talk about, "What do we need to do to get to the next step? How do we work through the problems that a company is having?"

Frankly, a lot of the work happens outside of the board meeting itself. Coffee with the founder, sharing some of those similar issues or concerns, introducing people that maybe they need a VP of sales and if you can think of somebody who would be great, making that introduction or again business development partnerships where they’re looking for a channel to get to other customers.  We can make those kinds of introductions.

That’s typically how we work with companies. I think a board meeting is really a formalized way of driving that discussion, but those discussions happen offline and hopefully often.

Are there any technology areas that you like really well or that your firm would tend to stay away from?

Broadly, just looking at technology, the world has shifted from the way it was 10 or 20 years ago. This partially and directly answers your question, which is I think a lot of models had moved away from what I’ll call true technology and they’ve gone more to business model innovation.

With globalization, with the advent of outsourcing, it’s a lot easier to find talent to actually develop technology or software than it has been in the past. A big piece of it is, where’s is there empty space that you could leverage technology to create a sustainable business?

That being said, I do think there are a few interesting instances around what I’ll call real technology or hard technology. One that is not in the healthcare space but is a very interesting company that a friend of mine invested in is a company called Planet Labs. It’s literally NASA rocket scientists that have figured out how to build satellites for $20,000 and deploy them for under $50,000 or $60,000. Because of the cost basis and their ability to do this, they’re able to put up all these micro satellites in the space and basically give you almost a real-time picture of what’s happening, literally, on the planet. You can see deforestation, you can see weather patterns, and you have access to something you never had before.

We’re investors in a company called Athos, which developed a shirt with fabric that can measure your muscle twitch response. The product hasn’t been released yet — it’s in beta. What it’s able to do is determine how hard your muscles are firing and determine how to optimize your workouts, determine how to make sure that you don’t get injured. There’s a lot of other applications like that.

We’ve done a number of core technology investments as well. Lithium ion batteries, so your smartphone can last longer.

One company that might be a little bit more relevant is Augmedix. It leverages Google Glass. Attached in the back of the Google Glass is a scribe that might be in India or Bangladesh or some other place. They basically offload for a doctor the hour or two hours that they spend writing up notes every day. Because it’s a live video feed, because they get to know the doctors and what they’re looking for and how to input data, in essence you can take an hour and a half of doctor time that’s wasted into five or 10 minutes. That’s a way of leveraging technology and new business model where there’s a little bit more of a fundamental technology than the business model innovation.

Do you have any final thoughts?

There’s a big opportunity in the healthcare IT space. It’s obviously a large part of GDP and with the introduction of technology through EMR into the business and the pervasiveness of mobile, we spend a decent amount of time looking at where those convergence opportunities are. Augmedix, like I mentioned. We’re in a company called Stride Health, which is centered around providing better insurance solutions to contract workers.

We continue to look at a few things. There’s probably one or two projects that are in the works. We think there’s a big opportunity in the space.

Morning Headlines 2/11/15

Cerner Reports Fourth Quarter and Full Year 2014 Results

Cerner announces Q4 results: revenue up 16 percent to $1.16 billion, adjusted EPS $0.47 vs. $0.39.

Premier, Inc. Reports Fiscal 2015 Second-Quarter Results

Premier, Inc. announces Q2 results: revenue is up 19 percent to to $294 million, EPS $0.36 vs. $0.31.

Is Your Doctor’s Office the Most Dangerous Place for Data?

ABC News cover the rise of hackers migrating toward the healthcare space, an industry that finds itself 10-years behind financial services in terms of protecting consumer information.  

WakeMed posts $3M Q1 income, goes live with electronic records

WakeMed goes live with its $100 million Epic install.

News 2/11/15

Top News

Premier, Inc. announces Q2 results: revenue up 19 percent, adjusted EPS $0.36 vs. $0.31, beating analyst expectations for both. President and CEO Susan DeVore says the company will make more technology acquisitions following its recent buys of TheraDoc, MEMdata, SYMMEDRx, and Aperek, noting an interest in supply chain analytics, alternate site, ambulatory data, and population health.

DeVore adds that HHS’s fee-for-value push will increase the need for the company’s technology related to quality and clinical analytics, labor analytics, infection surveillance, and population health. Above is the one-year share price chart of PINC (blue, up 0.6 percent) vs. the Nasdaq (red, up 14 percent). The company’s market capitalization is $1.32 billion, with DeVore holding shares worth $7.3 million.

Reader Comments

From Smartfood99: “Re: Ohio Valley in Wheeling, WV. Chose to upgrade to Meditech 6.1, beating out other finalist Ohio State University’s farm out of Epic.” Unverified.

From Webejammin: “Re: patent trolls. They’re using ONC’s list of certified EHRs to file suits using old patents that never should have been issued. This will dampen innovation and increase the cost of EMRs.” It’s not hard to get a list of EHR vendors from ONC’s list or elsewhere. Nor is it hard to find an old, intentionally vague patent and use the threat of an expensive legal defense to coerce EHR vendors into paying settlements or licensing arrangements whose cost is intentionally placed at the extortionate sweet spot between “annoying” and “profit-threatening.” Thank your lawyer-heavy Congress for its resistance to embracing the “loser pays” frivolous lawsuit policy that would increase unemployment among our vastly superior US force of ambulance chasers.

From Dingman: “Re: companies in financial trouble. You probably see some of that firsthand when they either are slow to pay their sponsorship or don’t renew because of financial issues.” I could indeed, although I usually lose sponsors instead because (a) they get acquired, or (b) a new marketing person who doesn’t even know what HIStalk is decides to wield their low-level decision-making power in deciding not to renew, which sometimes gets them in trouble down the road with their executives who wanted to support HIStalk in the first place. Sometimes I do hear directly from companies that their budget has been cut or executive upheaval is so extensive that they can’t even figure out who has purchasing authority, which might involve more transparency than customers get.

HIStalk Announcements and Requests

Welcome to new HIStalk Platinum Sponsor Galen Healthcare Solutions. The Grosse Pointe Farms, MI-based professional and technical services consulting firm also offers products for Allscripts TouchWorks  — remote patient monitoring, integrated health calculators, downtime chart review, note form reporting, and reporting. Technical services include EHR conversions, integration, technical consulting, and contract programming, with experience in Epic, eClinicalWorks, Allscripts, Meditech, Orion, Medfusion, and others. Galen helped Citizens Memorial Hospital (home of one of my favorite CIOs, Denni McColm) convert an acquired Allscripts-using practice to its Meditech system, bringing over 1.5 million documents and 3.5 million test results. Galen’s full (and huge) client list is available freely online along with client testimonials. Thanks to Galen for supporting HIStalk.

Sign up now to attend HIStalkapalooza on April 13. The “I want to come” form is still open, but that won’t be true for much longer. Every year I get annoyed at people who email after signups close to insist that they weren’t aware that it had taken place and demand special treatment, which generates little sympathy from me because that tells me they don’t really read HIStalk. On the other hand, I’m amused by some of the creative uses of the comments field on the form from the responses so far:

• On a Cerner life raft in an ocean of Epic. Would love to come and party with the smartest, coolest people on this blue planet.
• Is there a more senior VC in HCIT? What do I gotta do?
• I figured since even you were filling out the "I want to go" form, so should I!
• I went two years ago and loved it!!! I didn’t get an invite last year I hope I am still a cool kid!
• [enter pithy/witty comment that guarantees entry here]
• Often watched the big party bus roll out without me while I searched the conference town for tourist food. I had the HIMSS blues, man.
• Can we get the band from last year? They were brilliant!

I took over running the event myself this year with the support of multiple sponsors so that I could invite more people, and so far it’s looking good for covering the cost of a big guest list. House of Blues is an amazing venue and I will indeed be bringing back last year’s musical entertainment, Party on the Moon, America’s #1 private party band. I’m hoping the winner of the “Healthcare IT Lifetime Achievement Award” will accept the award on stage. I’m also contemplating whether the individual named as “Industry Figure in Whose Face You’d Most Like to Throw a Pie” would be willing to receive delivery of said pie in public, possibly delivered by the second-place vote-getter (I might be able to mount a charitable fundraising campaign rivaling the Ice Bucket Challenge to shame both parties into participating).

One more HIMSS-related event item: we’ve emailed HIStalk sponsors about our networking reception on Sunday, April 12. Email Lorre if you’re a sponsor and you want to come because sometimes we don’t have good company contacts.

I could use some help from folks willing to critique the recorded rehearsals of our webinars, suggesting to the presenter what they might change for the live event. Provider CIOs, CMIOs, or other hospital IT types are ideal given the topics often covered. I’ll send a $50 Amazon gift card in return for the 45 minutes or so it takes to watch the video and fill out the eval sheet. Email me if you’re interested.

Webinars

February 13 (Friday) 2:00 ET. Inside Anthem: Dissecting the Breach. Sponsored by HIStalk. Presenter: John Gomez, CEO, Sensato. The latest intelligence about the Anthem breach will be reviewed to provide a deep understanding of the methods used, what healthcare organizations can learn from it, and how to determine if a given organization has come under similar attacks. Attendees will be able to ask questions and put forth their own thoughts. 

Acquisitions, Funding, Business, and Stock

Hitachi Data Systems will acquire Orlando-based business analytics tools vendor Pentaho, which has some healthcare-related customers and partners, for $500 to $600 million.

Aventura raises $14 million in an oversubscribed Series C funding round and will use the proceeds to expand its awareness computing services and product development.

Image-sharing cloud vendor LifeImage raises $2.6 million in funding, increasing its total to $68 million.

Shares of Merge Healthcare jumped substantially in the past week in hitting a 52-week high Monday, doubling in price since October. Above is the one-year share price chart for MRGE (blue, up 101 percent) vs. the Nasdaq (red, up 14 percent).

Cerner announces Q4 results: revenue up 16 percent, adjusted EPS $0.47 vs. $0.39, meeting earnings expectations and beating on revenue.

Sales

Frontier Behavioral Health (WA) chooses the CoCentrix Coordinated Care Platform as its EHR and care management tool.

Quintiles signs a five-year contract with the National Football League to track player injuries using the league’s EHR data.

People

AMC Health names Jonathan Leviss, MD (WiserCare) as SVP/medical director.

HIMSS names Michelle Troseth, MSN, RN, chief professional practice officer of Elsevier Clinical Solutions, as  the recipient of its Nursing Informatics Leadership Award.

Joe Miccio (ESD) joins Impact Advisors as VP.

Brigham and Women’s Hospital promotes David Bates, MD to SVP/chief innovation officer.

Adam Wright, PhD, who leads a biomedical informatics team at Harvard Medical School, is promoted to associate professor of medicine.

Kaiser Permanente names interim CIO Dick Daniels to the permanent position. He was previously SVP of enterprise shared services.

Personalized medicine analytics vendor Kyron names Jacob Reider, MD (ONC) as chief strategy officer.

Cumberland Consulting Group names board member Brian Cahill (LifeImage) as CEO. His predecessor, founder Jim Lewis, moves into the board chair role.

Surgical Information Systems names John Spiller (Origin Healthcare Solutions) as CFO.

Announcements and Implementations

WakeMed (NC) goes live with Epic.

Imprivata launches Confirm ID, which supports DEA-mandated policies for electronic prescribing of controlled substances.

The US Patent and Trademark Office awards DR Systems seven imaging-related technology patents.

Divurgent and Sensato will jointly offer healthcare cybersecurity and privacy services and will host Hacking Healthcare 2015 in March.

Cone Health (NC) issues easy-to-read patient bills using Patientco’s PatientWallet.

PatientSafe Solutions expands its clinical communications tool and renames it PatientTouch Clinical Communications.

Government and Politics

A GAO report seems satisfied that CMS is ready for the ICD-10 implementation date of October 1, 2015, although it seems to have looked more at CMS’s responsiveness to suggestions than its actual technical readiness.

The New York Times calls out little-noticed White House budget language that urges Congress to eliminate the financial incentive for hospitals to buy physician practices so they can charge more for delivering the same services to patients.

Privacy and Security

The largest insurer of the Lloyd’s of London insurance marketplace says that breaches — such as the one just experienced by Anthem — involve financial risks that are too large for insurance companies to cover, suggesting that only governments have the resources to manage those liabilities. Insurance companies worry that multiple cybersecurity insurance customers could be hit by the same exploit simultaneously.

ABC News asks, “Is Your Doctor’s Office the Most Dangerous Place for Data?” citing the FBI’s warning that healthcare organizations are being targeted and quoting a security expert who says healthcare is 10 years behind the financial services sector in protecting consumer information such as Social Security numbers.

A Swedish biohacking group offers to replace the security key fobs used by a high-tech building’s employees with a palm-embedded RFID chip that allows them to wave their hand to unlock doors, activate the photocopier, and pay their cafeteria bill. The group says the chips could be used to make payments and replace fitness trackers.

Reporters are trying to create a story around whether Anthem was irresponsible in not encrypting its customer records. I’m not an expert, but my minimal exposure to encryption involves three types: (a) encrypting a secure online session connection such as with SSL; (b) encrypting a storage device so that nobody can dig into its contents without logging on with the appropriate credentials; and (c) encrypting individual database elements so that they can’t be queried without logging on with the appropriate credentials. The only relevant form in Anthem’s case would seem to be (c) and that wouldn’t have helped since the attackers stole a database administrator’s credentials via a phishing attack. Encrypting data at rest is great for physical protection (a stolen disk drive or a physically breached data center) but otherwise the system doesn’t know that the correct login was used by an unauthorized person, short of using biometrics or privileges tied to IP address. I think the story is misleading, but I’ll defer to any experts who care to respond.

Anthem’s hackers knew that database credentials would give them access to everything, so perhaps the immediate health system to-dos would be (a) review users who possesses DBA credentials; (b) monitor the use of those credentials for irregularities, such as large queries that are run off hours or that involve outside that individual’s normal job scope; (c) monitor for large data transfers outside the firewall; (d) enlist DBAs to help watch for problems since they were the ones who detected the Anthem breach; and (e) put efforts into anti-phishing technology and user education rather than worrying about encrypting databases on the off chance that someone will physically steal a server. I really don’t understand in this day and age why we haven’t moved to biometric security instead of the easily pilfered “what you know” password – our data center doors are more technically secure than the systems they house.

Several Atlanta-area businesses fall victim to ransomware, where malware encrypts the files on a user’s PC and demand anonymous payment to restore access. A Secret Service representative says that physician offices are targets since their often-unsecured wireless networks can be hacked from their parking lots, although I would have assumed the method of infection would be via other methods.

Technology

Google will incorporate Mayo Clinic-curated information into its medically related search results, providing symptoms and treatments via its Knowledge Graph and Now personal assistant (which I’ve never heard of).

Medical device manufacturer DexCom will release an app that will display readings from its implanted continuous glucose monitor on the Apple Watch when the latter goes on sale in April. Dexcom already offers such monitoring on its own hardware with Bluetooth-powered iPhone data sharing.

Merge Healthcare announces that users of its iConnect Network will be able to transmit and receive imaging orders and results to Emdeon Clinical Exchange users.

Other

The local newspaper covers the migration to Epic by two Lehigh Valley, PA competitors, Lehigh Valley Health Network and St. Luke’s University Health Network. Epic replaces GE Healthcare at LVHN and McKesson and Allscripts at St. Luke’s.

Health system consolidation continues: Emory Healthcare and WellStar Health System are discussing merging into a single Atlanta-area system, while in New York, North Shore-LIJ is talking to Maimonides Medical Center about a “partnership” that sounds more like the former acquiring the latter.

Why do reporters feel qualified to interpret scientific information and render related opinion without consulting experts? The Toronto Star runs a self-proclaimed investigative article on the dangers of HPV vaccine Gardasil, dramatizing the 60 potential cases of side effects out of 800,000 doses administered. Expert physicians called out the poor reporting, to which one of the paper’s otherwise uninvolved left-leaning, American-hating columnists (best known for calling Sarah Palin a “toned-down porn actress” and insisting that male conservatives make bad decisions because of impotence) responded with a bizarre rebuttal that invokes government secrecy, Twitter, the US Tea Party, and her own self-study of statistics. The physician author of a book the columnist cited immediately blasted out a series of tweets calling out the paper’s “appalling, ignorant, irresponsible journalism” in running a “scare story.” The exchanges were summarized and brilliantly titled as “When ‘Teaching Yourself Statistics’ is No Match for Being a Doctor.”

Sponsor Updates

• Craneware enhances its Supplies Assistant solution to make it easier for hospitals to add new devices and supplies to their chargemaster.
• Dental software vendor Curve Dental incorporates DrFirst’s e-prescribing technology into its product, which will allow users to comply with New York’s I-STOP mandatory e-prescribing regulation that takes effect March 27, 2015.
• Meditech will add more products from Truven Health Analytics’ Micromedex Patient Connect Suite to its EHR platforms.
• Clockwise.MD announces that nearly 1 million patients have been seen through its Web-based appointment reservation tool.
• Clinical Architecture offers the third installment of its blog series on “The Road to Precision Medicine.”
• Certify Data Systems validates the interoperability of its HealthLogix solution at the IHE North American Connectathon.
• Anthelio renews its contract with Saint Mary’s Health System (CT).
• Besler Consulting latest blog post covers “Optimizing Communications to Reduce Readmissions.”

Contacts

Mr. H, Lorre, Jennifer, Dr. Jayne, Dr. Gregg, Lt. Dan.

More news: HIStalk Practice, HIStalk Connect.

Get HIStalk updates.
Contact us online.

Morning Headlines 2/10/15

CMS’s Efforts to Prepare for the New Version of the Disease and Procedure Codes

A GAO report finds that CMS is adequately prepared to migrate to ICD-10 coding in October 2015.

WellStar, Emory explore merger in Atlanta area

Emory University Healthcare  is in discussions with WellStar Health System to merge, forming an 11-hospital integrated delivery network in the Atlanta area.

Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices

The FDA issued two final guidance documents on the regulatory stance it will take over mHealth apps and software systems that send and receive, but do not alter, medical data.

Curbside Consult with Dr. Jayne 2/9/15

One of the most fun things about being part of the HIStalk team is the ability to interact with readers. I asked last week if the “Fireside Chat” at the ONC annual meeting (with former Senate Majority Leaders Tom Daschle and Bill Frist) actually had a fire. A reader quickly replied with his summary: “Well attended, interesting, some controversy, but an informative and enjoyable event.” But alas, no fire.

Another reader sent this sweet little bit of shoe love. It arrived in the middle of a crazy, crazy week and I enjoyed the smile it put on my face. I probably would have enjoyed the smile a little better if I hadn’t been caught multitasking in a meeting, when my grin made it clear I wasn’t paying attention to the ridiculous discussion around patient satisfaction scores that was going on at the time. I bet if we gave patients one of these treats at checkout, we’d get better scores. I’m not being flippant, but it’s at least as good as some of the plans I heard thrown out by the 24-year-old MBAs who seem to be running the place.

From the practicing physician side, many of us are at a point in our careers where the daily grind of dealing with insurance, regulators, and government entities seems to outweigh the satisfaction we get from actually caring for patients. I was inspired to hear from a young IT consultant who answered my question about, “If you could be anything you wanted, what would you be?”

I asked myself this very question last fall and decided without a doubt that I wanted to be a doctor. I have a liberal arts degree, almost zero science background, and have never taken the MCAT but am in the process of applying to post-baccalaureate pre-medical programs. Seeing firsthand how people approach healthcare convinced me that this was something I needed to do. Thanks for contributing to a great site and being part of the industry driving me towards my dream.

I sent back some words of encouragement and hope he will stay in touch. I don’t think many would argue with the idea that being part of the healing professions is a calling. Given all the pressures associated with healthcare today, I think it may be even more so than it has been in the past. My medical school class had a large number of people without science degrees and I know many medical schools are looking for non-traditional students, so I wish him the best of luck.

Another reader who has worked his way up through the industry over a lengthy career offered some options for what he would do if he had the choice to do something different:

• Start over. Go back to school and learn something new. Concentrate on helping people help themselves in this messed up world of healthcare.
• Change. Do something you love and you won’t work a day in your life. So maybe cooking or entertaining. Thoughts of starting a coffee shop or something very new and very social come to mind.
• Hang in there. Continue to fight the good fight and go down with the ship when the time comes – a comfortable option because I make good money and my schedule is mine (for the most part).
• Give up. Find some way to make a bunch of money so I don’t have to think about a career. Suing a doctor over something has interest!

I hope he was kidding about the last item, but some of the others do resonate. Right now I’m leaning towards his third bullet – hanging in there. At times my work is crazy, but there’s something to be said about the devil you know vs. the alternative. Option #2 definitely resonates. We used to tease one of our residency colleagues about her hobby of raising goats until the organic movement really took off. Now her income in the niche dairy business allows her to volunteer at a free clinic, which has been greatly satisfying.

In the same vein, one reader would become a professional volunteer. “I do my share of volunteering and giving back, but I always think I could do so much more.” Watching my parents volunteer during their retirement has been great and I’m glad they remain healthy enough to do so. My favorite answer to the “what would you do” question is from a long-time reader. I had to change a few of his answers to protect his anonymity, but I hope you have as much fun reading them as I did:

I would continue to battle the politics and personalities of a non-profit health system. I would work tirelessly for days on end for the same amount of money I could make delivering for FedEx or tending bar. I would get dressed up so that I can sit in a poorly-lit work area in a chair that has celebrated its own retirement working on a computer that can only be classified as “retro” to anyone else familiar with technology.

I would learn the names of the faceless consultants who roam the halls with shined shoes, sharp ties, and opinions on everything. I would let individuals that have no stake in the community or organization play Russian Roulette with our financial and social futures. I would wake up and be the butt of every motivational poster. I would be the buzzword people are looking for. I would wake up and do mock Joint Commission audits every day because it is fun and everyone loves the villain. I would “operationalize” bad ideas more. Since that is the new word, I would need to be great at it, because the consultants said so.

Although he paints a bleak future, it’s a good reminder to some of us about why we went into this in the first place. If I wanted to make more money than the night team at Taco Bell did, I would have quit during residency. (Yes, I did the math, and it wasn’t pretty). If I wanted glamour and a windowed corner office, I would have gone to business school or law school. If I wanted shiny shoes and sharp ties, I could have gone into pharma. 

I chose healthcare, not for the saggy scrubs and rubberized clogs, but because I wanted to make things better. In the immortal words of Dr. Mark Greene, “Helping them is more important than how we feel.” Whether it’s a sick patient or an ailing hospital, I’m here to stay.

Email Dr. Jayne.

Readers Write: Fact and Fiction About Anthem’s Breach

Fact and Fiction About Anthem’s Breach
By John Gomez

Anthem has quickly created a surge of inquires across the wire, leaving many CIOs wondering how they can keep ahead of the cyber-security challenges that continue to evolve. I suspect no one is surprised to learn about the existence and extent of the attack on Anthem. More than likely, many in our industry continue to wait for the “big one.” That in and of itself is a rather scary state of affairs. Most of us are not surprised and we don’t collectively believe this is as bad as it will get.

The Anthem breach is an ongoing criminal investigation led by the FBI with the assistance of FireEye and Mandiant, so nobody knows all of the details. As was the case with the Sony Pictures breach, sources will make statements without the evidence that only the FBI possesses. Here’s what we know today.

Anthem reported the breach publicly within eight days of discovery. Approximately 80 million customer and employee records may have been stolen, but the common thinking is that the actual number may be higher and that there is a high probability that other critical data was also compromised by the attackers.

The customer and employee data stolen was complete — name, home address, email address, date of birth, medical history, employer information, family relationships, and much more. That valuable information allows attacks to continue against the individuals whose information was compromised.

The concern with Anthem is that this is a move by a foreign state to amass profiles on individuals and use that information in future operations. That’s one theory, but equally likely is that the breach was profit driven since complete records are worth well over $100 on black markets.

Attribution — figuring out who did it — is one of the most difficult things to do in the world of cyber-forensics. Companies specialize in attribution, but their success rate is low, often less than 50 percent. The amount of computing power, resources, and advanced algorithms required to perform attribution at a higher level of success is mind boggling. While a theory exists as to who carried out the Anthem attack, it could be proved wrong as the evidence unfolds.

Current intelligence points to one of two groups with ties to China — Deep Panda and Axiom. Both groups have previously carried out verified attacks that had sophisticated intelligence-gathering objectives.

Deep Panda has developed a five-year strategic attack plan that includes objectives specifically focused on healthcare targets. Axiom has a specific and focused attack plan that includes government agencies, electronics and integrated circuit manufacturers, Internet-based services companies, software vendors, journalism and media organizations, NGOs, healthcare providers, biomedical device manufacturers, pharmaceutical companies, and academic institutions.

It appears that Anthem may have been compromised by parallel attacks. The first focused on employees with phishing attacks that allowed the attackers to deploy malware via their corporate email accounts. The second attack appears to have been via DNS compromises used to deposit malware.

Credible cyber-security operators rarely call an attack “sophisticated” or “advanced” unless they are trying to make headlines. Anthem’s attackers had a plan, were extremely patient, and were focused on their victim. Their attack was sophisticated and advanced, but due to tactics and practices, not because they used a new generation of attack technology. Anthem was mostly likely beaten by off-the-shelf technology and practices, the same techniques that attackers would use in penetrating any healthcare organization.

The preliminary investigation suggests that Anthem’s attackers used malware known as Poison Ivy or HiKit or some combination or derivative of those tools. Both malware applications are attributed to Chinese developers. Steps can be taken to determine whether an organization has been compromised by those tools, and if found, a cyber incident response team should be contacted immediately.

Anthem was tested for exploits by attackers over months or even years. Its employees fell for a phishing attack that compromised their machines. In parallel, perimeter systems were also compromised. Malware allowed the attackers to monitor network traffic, take over webcams, and capture confidential date over a long period. Some believe that Anthem was an attack pivot from which its clients or vendors could be compromised.

I suspect that we will learn that Anthem also had weak passwords (fewer than 15 characters), didn’t use dual-factor authentication, relied on third parties for DNS, and very possibly had its supply chain compromised.

Company executives can miss a few quarterly financial goals, run late on a few initiatives, and even run over budget a couple of times. But if they have a major breach, their career is over. Target’s CEO resigned after its breach and just last week the top film executive at Sony Pictures stepped down. I suspect we will see something similar at Anthem.

There is a saying in special operations: don’t be that guy. Don’t be the person who takes the easy road or embraces mediocrity. Get  mad and assertive about cyber-security. Rethink vulnerabilities, test systems, learn what you don’t know, share information with the community, and become vocal.  We have a choice — we can either wait to be attacked or we can decide that enough is enough.

John Gomez is CEO of Sensato of Asbury Park, NJ. Intelligence Analyst Laura Walker contributed to this article.

John will host a free, HIStalk-sponsored Q&A webinar on the Anthem breach on Friday, February 13 at 2:00 p.m. Eastern. 

HIStalk Interviews David Ting, CTO, Imprivata

David Ting is founder and CTO of Imprivata of Lexington, MA.

Tell me about yourself and the company.

I’m the CTO and founder of Imprivata. We focus on healthcare IT security and streamlining clinical access to computer systems.

What are the technology trends in positively identifying users and patients?

Government regulations are increasingly tightening up from both a privacy perspective to meet HIPAA requirements as well as the new requirement, which is how you tie a prescriber’s identity to an electronic prescription, or in fact, any other transaction. This started years ago with Ohio’s positive ID program, where every electronic prescription has to be confirmed by a provider who is authenticated using some form of two-factor authentication. 

More recently, the DEA has allowed controlled substances to be electronically prescribed, again provided there is a means for the e-prescribing systems to confirm that prescribers are using two-factor authentication. The DEA’s requirements are much more rigorous. They consulted with NIST — National Institute of Standards and Technology — to provide the recommended procedures for not only the second-factor authentication, but also identity proofing. NIST is very prescriptive in terms of the methods that are allowed. It has to be a combination of well-known authentication modalities that we all know – something you know, something you have, or it could be a token or something biometric.

We have done a fair amount of work over the past few years making sure that two-factor authentication is integrated into the clinician’s work flow. Our Confirm ID product packages a lot of the compliance requirements of the two-factor authentication capabilities into one product that a number of EMR vendors are using. Today, it’s something that you know like a strong password, a fingerprint that has to meet specific NIST requirements in terms of both of accuracy of the match as well as the imaging capabilities of the scanner, and something that you have, which could be a token, something that generates a passcode, or a cryptographic smart card.

The trend clearly today is on wireless authentication and the ability to leverage the mobile phone, and in the future, secure wearable devices that can all vouch for your identity and serve as one of the “what you have” tokens or components of the authentication process. That is a trend that we are very actively working on and see a lot of promise in — simplifying that task for the clinicians so they don’t have to remember something and don’t have to take a one-time passcode out and transcribe that eight-character code into a form.

Those are the technologies that we believe will become dominant as policies get tighter and government regulations become more prescriptive.

Is the age of passwords just about over?

Passwords have been around as long as computers have been around because it was the simplest form of authentication. In today’s world, we have too many passwords and passwords are too easily compromised. Anything from shoulder-surfing to keyboard-sniffing technology can easily lift them. Increasingly, the new phishing attacks that are being launched in a wholesale manner are much more sophisticated. It’s very, very hard for the average employee to distinguish between a legitimate request from the IT staff and a malware attack.

The only way you’re going to defend against that is to use “something you have” or “something you are.” Something that can’t be electronically stolen — it has to be physically stolen. Apple has done a great job with the Touch ID on the phone. Unfortunately, it doesn’t meet the DEA requirements of “something you have,” but it is a step in the right direction. 

I believe the phone, together with Bluetooth technology, will become a very powerful mechanism for eliminating the need for password. That together with some form of simple but DEA-approved biometric medication could become very useful. Increasingly, facial recognition is being used, as is palm vein scanning, for a lot of patient identification.

The technology will improve. With the advent of the 3D cameras that Intel and other vendors are building, you can start to see how that technology can potentially play into much more active facial recognition. Passwords will hopefully become something you use only in case of emergency as opposed to something that you need all the time.

Another seemingly obsolete technology is pagers. Will hospitals get rid of them completely any time soon?

Pagers have been around since 1950. It was initially used in some critical industries to alert people to use the phone as a means of communication. Pagers have morphed over the last 60 years from an alerting mechanism to now providing very simple textual output with the opportunity to respond from some pagers bi-directionally.

Those capabilities are rapidly being surpassed or provided by the smart phone and even simple flip phones. Technology, certainly in healthcare, is moving towards the increasing use of secure electronic messaging using smart phones. As Wi-Fi coverage and Wi-Fi reliability is improved within the hospital and certainly outside the hospital with 4G technology, the ability for smartphones to serve as a reliable communications mechanism will eventually displace many of the uses for pagers. It’s more cost effective and there’s much more informational content that you can share.

Our Cortext product is a secure messaging product that allows a clinician to send textual data or photos. In the future, we can see sending all kinds of complex PHI in a secure fashion and also to have that receipt mechanism that indicates when the receiver actually saw it, whether they received it, whether they saw it, whether they can respond to it. That will eventually become the predominant communication mechanism.

Your have a lot of experience with document management and other systems. Are we missing opportunities by worrying too much about text field entry instead of other forms of media?

Text fields are only relevant because that’s the way computers originally were built. We had keyboards. We added a pointing device with the mouse.

A physician with a smart phone is carrying a microphone, an accelerometer, and a camera with them. That will allow more media-rich content to be integrated into the EMR record. We have lots of clinicians who want to take photos of their patients’ wounds or their gait and then incorporate that into the EMR as opposed to textually describing it. 

More complex sensors  will become available. A lot of personal fitness devices and vitals devices will become easily accessible through the smart phone. That will become the means by which a lot of the data that we enter today manually, like your vitals, will be electronically captured and passed into the EMR systems.

Morning Headlines 2/9/15

Anthem hack: Personal data stolen sells for 10X price of stolen credit card numbers

Security analysts report that the Anthem hackers should be able to sell the stolen health records for as much as $1,000 each, making them ten times more valuable than stolen credit card data.

Defense Health shoring up IT ahead of EHR move

The Defense Health Agency reports that it will spend 2015 updating its IT infrastructure in preparation for its upcoming EHR implementation.

VITL Launches Marketing Push With Super Bowl Ad

The Vermont Health Information Exchange spent $13,000 to run a 30-second regional commercial during the Super Bowl in an effort to increase patient consent rates and boost physician utilization.