Category Archives: Clinical Informatics

How the codes versus clinical story ended up…

Posted on by

The big topic on the Health IT blogosphere was Dave deBronkart’s misleading administrative data in Google Health.  One of the really nice things about Web 2.0 – and responsive organizations – is that learning can be rapid, and lessons quickly applied. Here’s a post by John Halamka, the CIO of Beth Israel Deaconess, Dave’s hospital, outlining the changes they’ve made to their Google Health integration:

Life as a Healthcare CIO: Lessons Learned from e-Patient Dave.

Should some of this stuff have been figured out earlier? Probably yes, but virtually everybody in the PHR industry has been using claims data for years, since it’s all that most organizations have access to. So there’s not much point in singling out Beth Israel for having included it.

The upshot is that there’s been a change in how at least one hospital is dealing with this data, and there’s been some useful discussion about how difficult this whole data liquidity project actually is. More broadly, the use of claims data for consumer-level health records has taken a hit, although not a fatal one. Claims are often very useful for broad, population level analysis – not in the least because inaccuracies and inconsistencies tend to come out in the wash. As various commentators have noted, they were never intended as an instrument to actually provide healthcare.

The FTC and PHR Breach Disclosure

Posted on by

The Federal Trade Commission has issued a draft rule that outlines how PHR providers must notify consumers in the event of security breaches (warning, PDF!). The rule includes platforms like HealthVault and Google Health along with individual PHR vendors like WebMD and ActiveHealth.  Comments can be submitted here, and are due by June 1st. This does NOT affect HIPAA covered entities such as hospitals and insurance companies, although the Department of Health and Human Services will be issuing one soon, and the content is expected to be quite similar.

The Recovery Act contained temporary requirements, which will remain in effect until Congress passes new legislation based on a report currently in development by HHS and the FTC. The report is due in a year, and legislation takes a long time, so these “interim” requirements will almost certainly be in force until 2010, and possibly longer. Interim rules that hang around long enough tend to be the basis of permanent rules.

Here’s a summary of who is affected and under what circumstances:

  • A “breach of security” is defined as the acquisition of identifiable health information of an individual, from a PHR, without authorization.
  • The rule also contains the word “unsecured.” This means encryption – if a laptop containing appropriately encrypted data is stolen, that doesn’t count as a breach for notification purposes.  HHS is responsible for issuing a guidance on acceptable security policies, to be updated annually.
  • Access is not the same as acquisition. Employees looking up records about friends and celebrities is a breach. An employee inadvertently loading the wrong record in the EHR is not.
  • The “fact of having an account with a vendor of personal health records” is itself considered sensitive information. The obvious example (used in the notice) would be releasing a list of names by a company that provides PHR services for AIDS patients.
  • De-identified information, according to the existing HIPAA de-identification rules, fall outside the scope of the rule.
  • “PHR related entities”  are what the platform vendors call “Personal Health Applications”. It’s a broad net, and the examples include websites offering medication management applications and bricks-and-mortar companies advertising dietary supplements online, as long as the interaction with these companies is through a PHR or PHR platform.  The definition also includes organizations that “access information in a personal health record or send information to a personal health record.”

The breach notification requirement itself has a few components:

  • Third party service providers must notify their customers (vendors of PHRs and PHAs) following the discovery of a breach. The individuals affected must be explicitly identified.
  • Notice must be received by a “senior official” of the PHR vendor or PHR related entity.
  • There is a “reasonably should have known” clause that sets an expectation of reasonable security measures. You can be in violation of the rule if you didn’t detect the breach in time. But since some breaches are hard to detect, you’re not always in violation if you discover something belatedly.
  • Notifications to individuals must be made “without unreasonable delay” and always within 60 days.
  • Notice must be by first-class mail, or by email if the individual consents (which must be “affirmative” consent, not something buried in an end user license agreement).  There is no obligation to provide notification by mail (although if the customer doesn’t consent to email notifications, you can’t provide them with service otherwise).
  • If ten or more individuals can’t be reached, a substitute notice must be posted – a large link on the home page for six months, or through a media campaign.
  • The FTC must be notified in five business days if 500 or more people are involved. If fewer than 500 people are involved, reports may be submitted annually.

That’s not all there is to it – the rule also describes the content of breach notices and the supporting document includes an economic impact assessment. I wrote some similar impact analysis documents when I was at CMS – it’s always a challenge to get it right.

My quick reaction: it’s not bad. We’ll see every PHR vendor race to add that “email notification” permission to their products. The cost of compliance shouldn’t be that burdensome, although it’s certainly non-zero, and that’s really the point – organizations need to take security seriously, and making breaches costly and embarrassing is a good way to do that.

Better care through empathy

Posted on by

Steve Portigal at Core77 mentions last Monday’s article in the New York Times about a new study from Israel that shows radiologists write more thorough reports when a file includes the patient’s photograph.  Sequestered in dark rooms, surrounded by computers, radiologists rarely meet their patients — being able to see even a glimpse of humanity among x-rays, CT scans, and MRIs seems to create a beneficial connection between doctor and patient that otherwise wouldn’t exist.

This new study opens up additional areas of research: do photographs improve distance medicine? What about surgical procedures when the patient’s face is blocked by a curtain? Or online pharmacies that never meet face-to-face with their customers?

Can PCHRs provide the data to personalize a medical encounter?

Back in 2006, when we redesigned the personal health data model for Indivo 3, I successfully lobbied to include a photo element in the patient’s contact information document.  At the time, I just thought it was logical to have a picture of the patient in the patient’s record.  Unfortunately, other development tasks took priority over integrating the photo feature into the reference UI.  The idea languished until I did some designing exercises for a next-generation PCHR user interface several months ago. My approach was to learn from the success of social networking systems to make a PCHR interface more human-centered and engaging. In our earlier work, we had been thinking so much about making PCHRs secure — it was fun to think solely about making them usable.

Including a photo in a PCHR patient profile

Including a photo in a PCHR patient profile

A list of family members with identifying photos

A list of family members with identifying photos

Now here’s where things could get interesting. Our interaction design process relies heavily on personas — composite visualizations of key users built with the ethnographic data we collect in our field research (interviews, surveys, etc.). It helps our team rally around our users as we design and build software.  Every design decision gets filtered through our personas.  “How would David build his research team? Does he think about roles, or does he already have collaborators in mind?”

An example of a persona from our grant collaboration project

An example of a persona from our grant collaboration project

Could a medical “persona” have the same impact in the delivery of healthcare?  Patient summaries as they exist today (and to the extent I’ve seen them) stick to core data like procedures, problems, lab tests, and immunizations. Primary care physicians, who we expect to develop a fuller, more human view of their patients, have increasingly less time to devote to social interaction. In our design personas we include sections for motivations, behaviors, and obstacles — might such information help caregivers move beyond the minutia of clinical “tasks” to, dare I say, “goal-directed” medicine?

PHR Package & Reconcile

Posted on by

A quick followup to yesterday’s post on PHRs and Claims Data. Sean Nolan, the architect of HealthVault, has a nice comment on John Moore’s post on the Boston Globe article that does a nice job of explaining their “package and reconcile” model for importing data into HealthVault. For those wondering how PHR platforms map to document standards like the Continuity of Care Record, this is a nice clean explanation.

Bad Data & PHR Adoption « Chilmark Research.

Claims Data and PHRs

Posted on by

The Boston Globe ran a piece this morning about the challenges of using insurance claims data to populate PHRs. It’s nicely done, and highlights what a shame it is that the Boston Globe is teetering on the verge of bankruptcy.

Electronic health records raise doubt – The Boston Globe.

Dave deBronkart, the patient involved, has been an active blogger for several years at e-Patient Dave.

Claims data is very challenging – it’s messy and not particularly precise.  I always envisioned claims information as being useful primarily as a directory, rather than a source of actual content for PHRs. The insurance company knows where you’ve gotten treatment, and that information can be used by a PHR platform to seek out information from clinical systems. Of course, that requires a lot more interoperability in the entire system than we have today.

Another approach is to work backwards – rather than including every claim from an insurance company in the PHR, only include the unambigous subset. A flu shot is a flu shot. But some data is just ambigous – like the cancer in the story, which seems tohave used a broad billing code. And some, of course, is intentional – physicians who file a misleading diagnosis so that a patient can be reimbursed for an off-label use of an expensive drug.  So for these cases – give the user an interface that allows them to review potentially problematic data, and explain clearly that some of it might not be entirely accurate, and there’s a good reason for that.

Finally, consumer controlled health records require very clear statements of data provenance. This was something our group paid a lot of attention to back when we were working on active development in the area, and Microsoft does a pretty nice job in HealthVault as well. I don’t know what Google’s design rationale was in not choosing to surface this information more prominently, but to my mind it was a mistake. Ten years from now we may have clinical data flowing so effortlessly that we can simply sit back and trust in the validity of any automatically sourced data. But that day is not today.

Checklists aren’t just for pilots

Posted on by

My father runs a flight school, and over the years I’ve met more than my share of private pilots.  A lot of them fly aerobatics, which involves taking a perfectly good airplane, flipping it upside-down, and performing feats that are not intended to make my mother particularly calm. It’s a fascinating little subculture, and a few years ago I spent a weekend at an aerobatic competition in upstate New York, hanging out with the pilots and generally poking around. What struck most was how safety conscious all of these pilots were. For one thing, nobody took off without going through a simple checklist of key flight safety operations.  They were all expert pilots – one had flown with Chuck Yeager in the Air Force in the 1950s – and had taken off thousands of times. And they did the checklist every time.

More recently, checklists have become a big deal in medicine. The best layman’s introduction is Atul Gawande’s 2007 New Yorker article on the subject. The short version is that by making a list of simple steps, and following those steps every time, you can eliminate “never events” (like taking out the wrong kidney), and dramatically cut a lot of other risks as well. It sounds like a no-brainer, and it probably is. But checklists have met with a surprising amount of resistance, which are nicely summarized by the following two clips from the penultimate episode of NBC’s “ER”:

And the punchline:

It’s network television, and so it’s a bit over the top – but my surgeon and medical resident friends tell that the attitude of the lead surgeon is pretty typical – and that without a champion in the room, the checklist won’t get used. I’ve observed this myself when visiting ORs – checklists were completed, but they were completed after the procedure was over, when the nurse had a few minutes to spare (so my colleagues don’t go after me, I should say that this was not at a Harvard teaching hospital).

So they’re good for pilots, and good for doctors and nurses. And, of course, they’re good for just about everyone else. They’re definitely good for EHR deployments, and for decisions about personal health planning. And they’re good for software development, too. Over the last few months I’ve written several checklists to govern different aspects of our software design, review and deployment policies. We’re all smart people, but we’re not going to remember everything. Over the next few weeks I’m going to share some of the software development checklists we’ve developed, and I hope readers will pitch in with their own ideas.

Google Health integrates with CVS

Posted on by

Ok, back to Health IT and PHRs. This is something I’d hoped to see:

CVS-Google Health pact now includes drugstores – BusinessWeek.

Medication lists are the most important part of a Personal Health Record. Over the last four years I’ve spent a lot of time talking with physicians about this, and it’s almost the only point of complete unanimity. “Give me the medication list,” they say, “and all else is forgiven.” A physician can infer quite a bit of very useful information from a the drugs a patient is taking.

I’m looking forward to trying this out. Unfortunately (for this very specific task) I’m not on any chronic medications. But I do fill all my prescriptions at CVS, since I’ve spent the last five years in Boston and Washington, both cities with extreme CVS penetration. So they have data on me – we’ll see how easy it is to get it out without having a new prescription filled.

The next step is for other pharmacy chains to follow suit (I think they’ll have to – WalMart and Walgreens, in particular). The CVS announcement demonstrates that the security and identity issues are manageable. This is a lot simpler than building a Health Information Exchange, where you have to identify patients at one or more degrees of remove. Determining that Patient A, visiting Hospital B, is the same Patient A that visited Hospital C three weeks ago is a hard problem, particular when Patient A isn’t involved in the determination. Figuring out how to release pharmacy data to Patient A is a lot simpler – because all that CVS really has to do is prove that they’re turning over the data to the Google Health account associated with the person who physically walked into the store and picked up the pills. All the necessary identity proofing is already in place, and if the patient used a fake name and paid cash – so what? It’s still not a HIPAA violation.

Widespread pharmacy adoption is going to blow PHR adoption wide open, and Google just took the high ground. I expect to see a similar announcement around integration with HealthVault shortly. CVS Caremark and Microsoft did a webinar together a few weeks ago, and Dr. Troy Brennan, CVS’ Executive Vice President and Chief Medical Officer, was previously at Aetna where he was a major supporter of the ActiveHealth PHR platform. He gets it – and CVS certainly understands that a single PHR platform partner is not in their best interest. My prediction for the future is that we’ll see all of the major chains linked up with both Google Health and HealthVault within the next year.

Meaningful Use

Posted on by

The first thing I missed by not going to HIMSS this year was a session where several legislators discussed the economic stimulus package.  The essential point: it’s important to define “meaningful use” of EHRs as soon as possible, and nobody entirely agrees how to do it. Legislators discussed how bad the Federal government’s track record of identifying value has become, and  Senator Sheldon Whitehouse told an audience that coming up with the definition will be “difficult and complicated.”

I briefly touched on this last week, and my opinion of the options hasn’t changed. Seeing this kind of discussion is important (and post-worthy) because it makes it crystal clear that nobody in Congress has any particular idea what was meant. And so the lobbying will continue. Write your Congressman.

Hadoop & Amazon: Informatics in the Cloud

Posted on by

When I checked my email this morning, I saw an announcement for Amazon Elastic MapReduce.  This is built on an open-source project called Hadoop, which I’ve been following off an on for the last couple of years. It recently made the New York Times, and there’s a nice picture of the relevant geeks on the front of the article.

Hadoop provides an implementation of a simple distributed computing algorithm called Map/Reduce. What Map/Reduce does is allow a user to split a computation job up into smaller units that can be distributed across a large number of servers to speed computation.  Google pioneered the technique to build, well, Google. The Hadoop project also includes a distributed file system (allowing management of large quantities of data), and a distributed database system. The latter is similar to the Google’s BigTable system, which underlies most of Google’s applications, including (to my understanding) Google Health.

What’s new today is ease of access. People have been running Hadoop on Amazon for a while, and Amazon has just taken some of the configuration hassles away, including integrating Hadoop into the AWS Console. That’s an interesting decision in and of itself, since Amazon hasn’t gotten around to implementing management for S3 (their storage product, the first cloud offering they made) or some of their other, more established, features. I think it means they’re signaling to third party developers that they’re trying hard not to stomp on external innovation.

In the informatics world, Hadoop means scale. Genetic analysis algorithms are susceptible to the Map/Reduce framework. So is number crunching for claims analysis and public health reporting, and data management for large personal health applications.  Right now I’m working with a couple of very innovative projects as part of a Translational Informatics on the Cloud “palaver” organized by Professors Peter Tonellato and Dennis Wall at Harvard Medical School. Peter and Dennis, in particular, are doing some very interesting projects, and you can watch along on the weekly web casts. We haven’t talked about how their work would change with these algorithms and this infrastructure, but if the problems are amenable a lot of the purely logistical problems they’ve been grappling with will go away.

All of this blends into a larger theme – tools that put researchers and developers closer to solving a problem, with less time spent on plumbing. Hadoop was vaguely scary technology to get running, particularly for people whose primary interest isn’t infrastructure. Now it isn’t.

HealthCamp Boston – April 21

Posted on by

David Harlow of HealthBlawg, along with some friends, is organizing an “unconference” on healthcare called HealthCampBoston, to be held on Tuesday, April 21st, from 8:30 to 4:30 at Microsoft’s New England Research Center. Since  it’s right across from our office in Kendall Square, and I’m too cheap to pay to attend the Health 2.0 conference the next day, I’ll be there.

Unconferences, for those who aren’t familiar, are conferences where the agenda is determined by the attendees.  In this case, planning begins on the BarCamp wiki beforehand. I haven’t been to an unconference pulled together by this team before, so I’m looking forward to it.

HealthBlawg: HealthCamp Boston – April 21.