Patient Portals

With Stage II meaningful use on the horizon, having a patient portal is required.  However, buying and setting up a portal is one thing.  Getting patients to use it, it clearly another issue.  The whole idea behind patient portals it to "engage the patient and their families" in the healthcare decision making process.  To provide more education and increase their understanding of their condition and the recommended treatment options.  The real challenge comes from registering and supporting a huge patient population.  Where do they call when they have problems, who assists them with their computer issues? What if there is something incorrect or inaccuracies with their medical records?  How do they securely view, download and transmit their records with ease?

There are many very good opportunities to engage patients in their care, however, there are just as many challenges in supporting this new way of doing business.

Patient Portals are our future, learn to master them now!

HIPAA Compliance

HIPAA compliance is always a challenge for every Hospital.  Securing every bit of Protected Health Information (PHI) in the new world of mobile data and BYOD (Bring Your Own Device) to work, is making it nearly impossible.  There are new approaches and new security technologies emerging everyday to try to address these issues. However, what is the right solution for the size, costs and complexity of our organization?  It is not easy to wade through all the solutions that exist and decide what is the right one for us.  I recently completed an interview with Patrick Ouellette at Health IT Security.com to express my concerns with security and HIPAA compliance.

HealthITSecurity Interview

 

HIPAA is here to stay and we all need to find creative ways to secure every aspect of PHI.

 

 

The push for full Integration

Everyday I face issues that are related to the underlying workflows that breakdown because of a lack of a fully integrated Electronic Medical Record.  There are too many challenges associated with the "best of breed" or "best of suite" application mix not working together.  There are different operating systems, databases, data dictionaries and user interfaces that drive the applications.  Simply creating a standard based interface, like HL7 2.x, creates a interpreter between the two systems, but there is a lot lost in translation.  I worry that interfaces have the potential to cause more harm than good if there is a misinterpretation that creates a bad outcome as a result.  The context in which the information is captured is critical to the understanding of the full meaning of the data that is being transmitted.  Without a fully integrated EMR where all the applications are defined and delivered out of the same database, there is a risk of this happening.

Health Information Exchanges (HIE) and standards organizations, like the Health Level 7, have made some progress is improving this situation with semantic interoperability.  This concept is based around capturing the meta data surrounding the data to create the "context" and as a result, improve the integrity and reliability of the data.  This is a time costly and resource intensive way to accomplish only part of what a fully integrated EMR can do.

We are on a path towards a fully integrated EMR.  I just wish we could get there sooner!

Security is Top of Mind

Lately all I have been thinking about is Security, Security and more Security.  It seems that everything I have read lately has some mention about the need for more security.  I have to agree, we could all benefit from more security.  However, I don't just want security for the sake of it.  It needs to be balanced with operational efficiency, costs and customer service.  It really needs to be thought through very carefully trying to balance these critical items.  I have worked on security policies for weeks only to find out that I didn't truly understand the full complexity that exists in our workflows today.  It is really easy to take things too far in the spirit of "good security" or "best practice" only to find out that it is very, very difficult to implement and support.   Drafting a good security policy needs to be collaborative, in that, all key stake holders need to have a voice in the process and product that is created.  It has to be sponsored and communicated from the top down and have the support to manage, audit and enforce it procedures.

The need for IT security and all security is growing daily.  Therefore, today's leaders need to educate themselves on the complexity of managing the security of this new world of HIE, EMR, ACO, etc. 

The year of Compliance

Everything that I am reading is telling me to prepare and prepare more for increased regulatory audits, investigations, surveys, inquiries and inspections.  Here is a short list of regulatory bodies that could come knocking on our doors any day.  

DOH (Department of Health)
JCAHO (The Joint Commission Accreditation for Healthcare Organizations)
OCR (Office of Civil Rights) aka the HIPAA police
CMS (Center for Medicare and Medicaid Services)
OIG (Office of the Inspector General)
RAC (Recovery Audit Contractors)

It seems logical for this to follow the billions of dollars that have been invested by the government to incentivize providers to adopt electronic medical records systems.  This was all done with the idea of increasing quality and lowering costs.  I think we have seen some of the former but not much on the latter, save for some ACO's (Accountable Care Organizations) maybe.  Regardless, there is so much information that is now available, in discrete data format and fully accessible to the government, payors, providers and patients alike, that someone is going to notice if they are getting value or not.  Everyone is going to try to use this data to their advantage, i.e. to pay less and demand more.  Furthermore,  patient privacy and security, or lack there of,  has been at the forefront of the issue and is the driving force behind much of the scrutiny, especially by the OCR whose job it is to enforce the HIPAA provisions.

Yes, this is the year of compliance, I just hope that everyone is in compliance.

Cerner's CareAware iBus Interview

Continuing the theme of interviews, here is a YouTube video interview named Cerner CHC iBus Interview.  I participated in this interview at the Fall Cerner Health Conference in 2012.  We are a big user of Cerner's applications and have leveraged their iBus solution to connect many of our key physiological devices throughout the entire medical center to our EMR.  The iBus is a full integration engine that connects to just about anything that can send and receive data. 

Recent Interview with HealthSystemCIO.com

Interviews are part of my job as a CIO and thought leader.   People in the field want to know what you are doing and where you think things are heading.  I recently had the privilege of being interviewed by Kate Gamble at HealthSystemCIO.com about our current projects and future direction.  Kate did a great job capturing the essence of our one hour conversion.  She broke the interview up into 4 chapters for easy navigation and also recorded our call in a Podcast for easy listening.  Thanks Kate.

Tom Johnson, CIO, 11/28/12 Interview

HAPPY NEW YEAR!