Good doctors are patient-centered regardless of what tools they use.....

Nowhere to hide

My wife came back from a physical therapist appointment the other day somewhat disconcerted that the PT had access to her entire medical record, most of which contains absolutely nothing relevant to her need for physical therapy.  The reason for this is that the health system where she gets care is an integrated behemoth offering services across the entire continuum of care, and all of those services are documented in a single ginormous electronic medical record.  

I was reminded of a similar issue that made it's way into the press a few years ago when a patient complained about her psychiatric records being available to other providers who were all part of a larger system and used the same electronic medical record.

There was nothing illegal about my wife's situation, since the PT is part of the same clinical entity as my wife's other providers.  And sharing records across the continuum of care is what the system is supposed to be striving for, isn't it?  Yet, it bugged my wife that the PT had unfettered access to all of her private health information without any clear medical reason for needing all of it.  Did the PT really need to see her problem list?  And all of her lab results?  I suspect that it would be more than just an irritant if she had sensitive information in her record.

To date the public discourse on privacy and interoperability has focused on exchange of records across legal entities, with much less attention given to record-sharing within a legal entity.  This issue is soon going to loom larger in the conversation, though, because consolidation in the provider market is rapidly accelerating, as noted in a recent Wall Street Journal article.  Which means that more and more patients will find themselves in integrated health delivery systems that give them more providers under one corporate roof but less ability to control what parts of their record get shared among those providers.

In a world of fragmented providers, the friction of interoperability has the benefit of protecting privacy; the "minimum necessary" approach of HIPAA, coupled with the limitations of systems to exchange more than just a CCDA snapshot, imposes inherent limits on the breadth, depth, and frequency of information exchange.  Consolidate all of those providers under one roof, however, and everyone pretty much has access to almost everything.  EHR systems do have role-based access, but with limited ability to "tag" and segregate data, and with fluidity of role definitions from one provider to another, most EHR systems have very limited ability to fine-tune which providers can see which information except in the most basic cases (e.g., psychotherapy notes).

As my wife and I discussed her concerns, we started to think about voting with our feet -- selectively seeking care outside of the health care system when we don't want a particular provider to have access to all medical record information.  We're lucky that we live in a medical mecca that is rich with high quality, competitive health care service choices.  Most people aren't so fortunate, however, and may increasingly find that all the work that's being done on "meaningful consent" will be outpaced by market forces.

What's next for EHRs

On Nov 14, the HIT Policy Committee sent recommendations to the HIT Standards Committee on three key areas for future EHR capability:  query for a patient record, provider directory management, and data portability and migration.  An article on the recommendations can be found here.

These recommendations were the result of many months of deliberation by the Information Exchange Working Group, of which I have the privilege of being Chair.  These three functional capabilities are very important because they address key needs important to health care delivery but that won't be adequately met by the market on its own.

query for a patient record
Meaningful use has approached interoperability in a deliberate and methodical fashion.  Stage 1 focused on adoption of EHRs, and routinizing use of HIE capabilities that already existed in the market (primarily eprescribing and lab results delivery).  Stage 2 took it one step further to move the market to adoption of "push" capabilities among providers and between providers and patients.  The new recommendation on "query" takes the final step to enabling "pull" or "query" functions among providers.  While it will still take many years for the market to create business practices and infrastructure to support seamless inter-connectivity among all providers and patients, the "query" requirement will make EHRs finally fully capable of being the building blocks of that larger interoperability vision.

provider directories
This is mostly a "clean-up" recommendation from Stage 2.  As the HISP market starts to take shape based on the Direct requirements of Stage 2 MU, a clear obstacle to more seamless integration of HISPs is the lack of standards for provider directory transactions -- being able to look up a provider and his/her security credentials from one system to another.  This recommendation will enable one EHR system to discover a provider, their routing address, and their security credentials, and will also enable EHR systems (or standalone provider directories) to respond to such electronic provider directory searches.

data portability and migration
I personally know of someone whose doctor changed EHR systems only to find that the medical records got matched to the wrong patients during the migration.  Imagine the disastrous consequences that could result from such errors!  Current market predictions are that 20-30% of providers will be changing their EHR systems in the next few years, for a variety of reasons.  Data migration -- the ability to transfer data from one EHR to another -- will thus become an increasingly important issue in the market.  As EHR systems and EHR users enhance their ability to apply quality and decision support tools to clinical data, there are important safety and quality risks to having incomplete and/or error-filled data migrations from one system to another.  Data portability refers to the transfer of data from one EHR system to another to support a patient's desire to change physicians, for example.  It is similar in many ways to the data migration need which is why we included this use case in our recommendation.

There is a balance that needs to be struck between the scope and specificity of government regulation, on the one hand, and the strong desire and need for market flexibility and innovation.  We already have examples of where this can go awry.  I believe that these recommendations are judicious in covering only areas that are important to society and that also won't get fixed by the market on its own.

More tales of health care cost and quality

An interesting article in the Wall Street Journal goes through the pros and cons of concierge medicine.  I’ll admit, my view of concierge medicine has been largely negative up until now.  Probably having to do with my being as confused as society is about whether we should treat physicians as if they have a special calling (saint-like) or as if they are business people with special skills (pro athlete-like).  Anyway, this article does convincingly make the case that concierge medicine isn’t just rent-seeking behavior but is actually value-creating in the economist’s sense for some people.  And ironically ObamaCare may have actually shored up the business case for concierge medicine.

The more interesting piece of the article was actually a tangential reference they made to a study from the North Carolina State University.  The study apparently reviewed the expenditures of the patients of a particular concierge practice and found that the longer office visits allowed by the concierge business model led to health improvements which ultimately decreased out-of-pocket payments (presumably through lower utilization of something – office visits?  medications?)!

Now, I realize that there is plenty of literature out there on PCMH savings, but the evidence still seems to be spotty and it’s still unclear from most of the studies whether the savings are net or gross savings, which is important because PCMH requires considerable investment to make the model tick.  And of course there’s the ground-breaking work of the Alternative Quality Contract in Massachusetts, which showed small but significant savings compared with controls, but again, the savings clearly are gross savings, not net of investments by Blue Cross and/or the participating providers.

The intriguing point about the WSJ reference is that the result suggests net value to both patient and provider.  Concierge practices are supposed to improve the quality of care – that’s why people join them.  In terms of who gains what, the common wisdom is that patients benefit through higher quality of care, and providers benefit from higher income.  In this case, both patients and providers seem to have gotten a financial gain -- the patient saved 12% out-of-pocket, and the provider has a profitable business and so is presumably better off than before.  It also seems that not only did quality of care improve, it improved by a lot because it resulted in lower utilization of some type of medical service.  I don’t think the WSJ reporter even had a clue that such a finding would be somewhat of a blockbuster if confirmed.  

I’ve contacted NC State to get a copy of the study – hopefully they’ll respond.

The double-edged sword of losing our privacy

Today's New York Times had a fascinating pair of articles that nicely, but seemingly without the intention of the editors, shows some of the pros and cons of applying data mining to publicly available private information.

"I was discovered by an algorithm", the lead story in the business section, is about a headhunter start-up company that aggregates information from a variety of public sources to identify high-end programming and development talent.  They use this data to supplement the standard information that an employer would receive (eg, degrees, schools, awards, work history, etc) and identify high potential candidates whose talents don't always come through in a typical resume or CV.  The article describes how "big data" techniques allow employers to utilize a richer array of variables to identify and evaluate prospective job candidates, and highlights the case of an individual who received a lucrative programming job but who would otherwise not have even passed a standard recruiting screen due to poor high school performance and lack of a college degree.  Would prospective recruits feel violated by this black-box search and evaluation process conducted without their permission or awareness?  Both the individual and his employer say no.  Score one for lack of privacy being a good thing.

"When your data wanders to places you've never been", buried inside the business section, tells the tale of a woman who gets targeted by pharma direct marketers who have mistakenly identified her as a multiple sclerosis patient based on "big data" searches of publicly available information on the web.  She ends up feeling both violated, and worse, too daunted by the complex chain of data brokers and marketing companies behind the error to do anything about it.  Score one for lack of privacy being a bad thing.

It's interesting that neither of these articles really dealt with the obvious flip sides of each situation.  Information gleaned from outside of a traditional recruiting process can be used to discriminate just as easily as it can be used to create new job opportunities.  And my health and demographic information can just as easily lead me to valuable treatments and support communities as it can to subject me to unwanted marketing and possible discrimination.

A common thread in each of these articles is that neither was a case of collection or use of illicitly gotten data (such as SSN, DOB, etc), rather, the data mining leveraged information that was voluntarily provided by the individuals in question, albeit for other purposes.  Though the information was available in the clear on the internet and was not illegally gotten, the individuals probably thought of it as perhaps not private but at least shielded or too isolated to be useful through random or targeted public searches.  In both cases they were wrong, one pleasantly and the other not so pleasantly.

The "big data" privacy issue is not so much about what a bad actor would do if they could get rare data gems like my SSN or my bank account, it's about the inferential mosaic that could be assembled by good, neutral, and bad actors alike from the many small pebbles of information that I myself have strewn across the web, such as what I say on an affinity user site or a web-based survey or an Amazon review or a Yelp comment (or a public blog).

I'm reminded of the story of an app called "Girls Around Me" that matched location data from Foursquare with profile data from Facebook to pinpoint women in a particular location and automatically stalk their Facebook pages to get pictures, background information, and messaging capability.  Not what either the women or Foursquare or Facebook had intended when they opened up their data and their APIs.

What's scary is not that there are unintended consequences, it's that there are unintended AND unpredictable consequences.  In health care, Latanya Sweeney has launched an interesting project to show how individual health information routinely and legally diffuses through a broad array of companies and websites.  Patients probably know bits and pieces of it, but probably not the scale and scope of it, as shown below.

 

This chart is most interesting for what it doesn't show, rather than what it shows:  It doesn't include the patient-generated data behind the NYT articles noted above.  As big data advances in scale and scope, it is the information that we voluntarily share -- like on PatientsLikeMe and CureTogether and SmartPatients -- that will eventually get fed into "big data" black-boxes and used in ways both good and bad that we are unable to foresee right now.

iHealthBeat Perspectives piece on over-architected HIEs

Many thanks to everyone for the comments on my iHealthBeat piece on "The Dangers of Too Much Ambition in Health Information Exchange". 

Wes Rishel was also kind enough to comment on it on his blog.

Maybe MAeHC can help teach the New York Times a thing or two.....

Today's New York Times has an article on a recent security incident that we experienced at MAeHC.  The reporter, Nicole Perlroth, does a pretty good job of bringing together different pieces of the story.  Even tries to give it some Bourne-like suspense -- I guess I'd allow Matt Damon to play me in the film version (though I would have to insist that he get in better shape first).

No story is perfect though, and this one had its share of limitations:

It didn't cite the blog post or the HISTalk Practice website that inspired the story and that accounted for much of the article's content.  OK, so I'm not a journalist, but this seems like a pretty shaky practice.  The storyline comes from the blog, not from the very short interview that I had with the reporter.  Furthermore, if my blog account had been an article in, say, Health Affairs, they would have cited both the article and the journal.  [Update Note:  I forwarded a link to this post to the New York Times and they have now added a link to my HISTalk blog post in the on-line version of their article.  Thank you NY Times for your responsiveness!]

The article notes that electronic breach reports have increased in recent years and while that is true, a closer look at the numbers reveals that that doesn't necessarily mean that there are more breaches.  There are 2 important subtleties behind this.  First, reporting requirements have increased so people have to report more now than they have in the past.  In addition, electronic systems have generally better ability to detect breaches in the first place.  This is not only due to technologies such as intrusion detection, user-based activity logging, etc etc, but also because physical devices are easier to track and manage than paper systems -- it may be easy to gloss over a few misplaced paper charts, but you can't hide the fact that you lost a laptop.  So, the fact that breach reports are up may just reflect better detection and reporting and not necessarily more breaches.

Second, the article suggests that electronic systems increase the risk of breaches.  As I explained to the reporter, I believe that electronic systems are more secure than paper/fax, but there is a trade-off in the type of risk that they introduce.  I liken this to the difference between auto accidents and plane accidents.  Auto accidents happen very frequently but with fairly contained consequences, whereas plane crashes are rare but can be disastrous.  The latest OCR report to Congress on breaches reports something like 25K small breaches (fewer than 500), a very large fraction of which are paper/fax incidents. 

Finally, I found it a little ironic, that while the NYT article itself is an important step toward educating the public about the real issues surrounding the loss of electronic patient information, it glossed over the steps we've taken to educate the industry – like writing the post that lead the Times to the story in the first place.  I think it was a bit of a missed opportunity to encourage organizations that have similar experiences to follow the path of full disclosure that we did.

Meeting halfway

Those of us focused on health IT are spending a lot of time and energy on bringing the technology to where the patients are. Interoperability is crucial because patients get care in so many different places, and through Regional Extension Centers and other programs we're trying to get EHRs into the hands of small and independent practices at the far reaches of the health care delivery system, again, because that's where the patients are. Something like 80% of practices are small practices, and 90% of outpatient encounters are in those small practices.

I've been wondering recently about whether we're going through a Copernican revolution where the patients come to the IT rather than having us bring the IT to the patients. My own personal experience started my thinking on this. I used to get my care from a small practice primary care physician in Wellesley MA -- great guy, good doctor, gives 110% every day. But he didn't have an EHR (still doesn't) and it was basically my responsibility to get specialist records back to him to make sure that he had the whole picture of my care. I switched to Harvard Vanguard not only because they have an excellent EHR but because they are multi-specialty as well. When I need a specialist I no longer scour all of Boston for the best specialist -- I only look within the Harvard Vanguard system because I want to make sure that my records are kept on the same EHR. What I might be sacrificing on the quality of an individual specialist I'm more than gaining back in having all of my physicians reading from the same page (literally).

Since my Wellesley doctor couldn't solve the interoperability issue, I solved it myself by eliminating it. My wife gets her care at the Brigham, and I've increasingly seen her focus her decision-making in the same way -- she has eliminated the need for interoperability by limiting her choice of specialists to those who are on the Brigham's EHR.

Maybe this is just a family thing. But I started thinking otherwise after I heard a very interesting story yesterday on NPR and Kaiser Health News on consolidation of the health care delivery market, and in particular, the increasing share of outpatient physicians employed by hospitals. As the story reports, almost 20% of physicians work for hospitals today, but 50% of new physicians are taking jobs with hospitals. The looming prospect of Accountable Care Organizations' becoming the operational unit of health care delivery will put increasing pressure on hospitals and physicians to keep patients within their care delivery network. Changes in health plans that limit patient choice will also drive patients to stay in closed networks. All of these trends will increasingly funnel patients into health care delivery networks that also happen to be connected on IT networks.

There could certainly be many bad affects from such consolidation, such as higher oligopolistic prices, less customer choice, the demise of solo practices that are an iconic part of the American fabric, etc etc. But from a health information exchange perspective, it's only to the good if we can get more patients to meet us halfway on the road to interoperability.

Provider Directories

The Information Exchange Working Group of the Health IT Policy Committee had a public hearing today on the topic of Provider Directories. The FACA Blog has some background on the issues that we covered today. We have a lot of information to process regarding some very complex issues and unfortunately on a very compressed timeline. Some of the major themes that came out of today's hearing are:

• We've got to get rid of the "yellow pages" and "white pages" analogies to Provider Directories. It's fraught with all of the general flaws of analogies, but more important, as my co-chair David Lansky said, "no one under 30 will know what we're talking about."

• That said, it is useful to distinguish directories that support machine-to-machine routing from those that have more of a lookup role that might be focused more on use cases involving person-in-the-loop functions. Arien Malec noted that while the latter might initially be used more by humans, there would be interesting applications for machine-to-machine transactions as well, such as identifying providers involved in "post-exchange" continuity of care. Keith Boone suggested that we use the terms "service discovery directory" and "provider discovery directory" to more appropriately describe how technology works today. Abby Sears described the need for provider directory functions, however defined, to be embedded within EHRs to make them useful to end-users.
  

• There are many well-developed directories out there already, so whatever we recommend needs to provide help to enable approaches that have barriers to moving forward while at the same time not stifling forward progress for approaches that are moving ahead. JP Little noted that a number of national directories already exist today, with some degree of interoperability. Charles Kennedy noted that there are is a lot of administrative infrastructure in the market already today, but very little clinical, so we should be thinking of ways to leverage the administrative infrastructure to lower the cost of developing and maintaining clinical infrastructure. Syd Thornton offered that though InterMountain Healthcare maintains its own directory of external providers, they would be interested consuming it from a higher-level aggregator that might offer better economies of scale. Robb Chapman described how the CDC leverages medical registration data from the Federation of State Medical Boards for its Physician Registry Project, but Martin Laventure noted that public health directories are not dynamically linked with any outside systems so updating them is difficult. Karen Trudel described that there are no "one-and-done" solutions in the market today, and even large, nationwide directories such as the NPI and PECOS have significant limitations with respect to the clinical exchange transactions being contemplated today.
  

• Directories are the means for performing value-generating business functions, they are not the end. Tom Morrison said it most clearly when he stated that "data is a by-product of a business process." Sorin Davis recommended provider accountability for entering and maintaining their data. Anita Sarnoff noted that Axolotl recommended NOT having providers be responsible for maintaining their data and leveraging existing accreditation and credentialing information instead. Linda Syth described that it cost $3M to create the provider registry used by the Wisconsin Medical Society, and about $700K per year to maintain it. Carladenise Edwards recommended mandating the use of specified provider directories to better support their sustainability. Putting all of these together suggests that we need to create or leverage directories that enable services that providers have high interest in consuming so that they themselves will feel the need to assure that their information is timely and complete.
  

• If we do nothing else, creating a framework and taxonomy for key concepts would be helpful in and of itself. Greg Debor noted that though we refer to "provider" directories, there are other health care participants (such as public health and health plans) that would be important to future value. Hunt Blair pointed to the need for a common ontology of terms such as "provider", "practice", "entity", etc.

• As states move to implementation of their HIE Strategic and Operational Plans, there is an urgent need for some type of guidance or coordination to capture any possible synergies across these efforts and to ensure future interoperability. Goerge Oestreich noted that the pressing need for immediate solutions limited how much central orchestration could be expected and suggested that the focus should therefore be on developing standard interfaces and data formats to support a federated architecture which would allow states and private actors to continue with their own development but with some level of alignment. Steve Waldren cautioned against "over-designing" too early to remain flexible to the many changes that technology change and health reform might bring. Jeff Barnett recommended the need for standards to be able to uniquely identify individuals and organizations. While there seemed to be a general consensus that "a federated approach" was preferable to any other, we did not have enough time today to define the parameters of federation in this context and what requirements would be needed to make it feasible.
  

• There seemed to be rough consensus that while both were important, the "routing directory" should be a priority. Dan Nigrin noted that they know who they need to send information to, but they often don't know how.
  

These are just some of the many thoughts that emerged from our hearing today. There are more comments posted on the FACA Blog, and additional comments will be collected through October 4.

What's in a name?

So what's in a name? The full quote of course is: "What's in a name. That which we call a rose by any other name would smell as sweet."

On September 28, the Office of the National Coordinator awarded the New Hampshire Regional Extension Center to the Massachusetts eHealth Collaborative. Is it odd that an organization with Massachusetts in our name is running the New Hampshire Regional Extension Center? I suppose so, on the face of it, but the reality is that we provide professional services in many states outside of Massachusetts. For example, we're already doing work with the regional extension centers in New York and Rhode Island, as well as Massachusetts. And we're currently working on a project with New Hampshire stakeholders on their Health Information Exchange Strategic and Operational Plan.

All companies have to be based somewhere, and we happen to based in Massachusetts. Granted, most companies don't have their home state in their name. That is a reflection of our non-profit, collaborative roots. We were founded in 2004 by 34 non-profit Massachusetts-based health care organizations. Our mission then and now is to improve the quality, safety, efficiency, and affordability of care through effective adoption of health information technology. Since our founding we've developed a national reputation for being operationally effective, mission-oriented, and consensus-driven.

We have the name collaborative because we work as partners -- we share what we've learned, and we look to learn more things that we can share. We try to develop deep ties with each new engagement, and we could not have gotten this federal award without the endorsement and backing of the State of New Hampshire -- we're grateful for the confidence they've shown in us.

My father is a family physician and surgeon who has practiced his entire career from his office in Pelham, New Hampshire. We're based in the Massachusetts Medical Society, which reflects our strong affiliation with clinicians -- we have deep ties to the physician community and we make it our business to understand the needs of physician practices.

We feel genuinely privileged to have the opportunity to help the clinicians of New Hampshire achieve their meaningful use objectives, and we look forward to deepening the ties that we already have with health care stakeholders across the Granite State. If you're a priority primary care provider in New Hampshire, we're going to be looking for you!

Guy with a good voice......and A LOT of time on his hands

For those who haven't seen it, Ross Martin's video "An Interoperetta in in Three Acts" is amusing (see below). Though I've got to say, if I had that kind of musical talent, I definitely would not be singing about health IT.....

NCVHS Meaningful Use

Thanks to John Halamka for featuring my NCVHS testimony on his blog! For those who aren't tracking this closely, all of the testimony is now posted on the NCVHS website. The transcript of the first day's testimony is also posted, which is long but a little easier to follow and also includes Q&A from the panel. There's a wide array of perspectives here, and who knows how it's going to be used to shape the definition of "meaningful use". As I describe in my testimony, I don't think there are as many degrees of freedom here than we might think, because there's not enough money or infrastructure to support a very high bar on meaningful use. I hope I'm wrong.

MAeHC launches subsidiary

Today we're announcing the launching of MAeHC Professional Services Corporation (PSC), a for-profit, wholly owned subsidiary of the Massachusetts eHealth Collaborative. Our press release is here. PSC will provide a broad range of fee-based consulting services related to EHR deployment, health information exchange, and quality data warehousing. PSC will provide these services—including strategic planning, project management, and project execution services—to both nonprofit and for-profit clients throughout the United States who are involved in a variety of health IT activities.

Today's Boston Globe gave our launch some nice coverage (New eHealth subsidiary will fund expansion), and we greatly appreciate their interest in the story. One thing from the story that I'd like to clear up is that it suggests that we don't work with so-called "web-based" applications such as athenahealth. In fact, both MAeHC and MAeHC-PSC are vendor- and platform-agnostic, and we ourselves have deployed both web-based and client/server-based applications. And, of course, we're happy to work with athenahealth.....

Darn, I'm a breach victim......

I just got the following email.

Important Message from Pentagon Federal Credit Union
Ref. Card Number
Ending In: XXXX

Dear Member,
Visa Fraud Control has recently notified us that your Pentagon Federal Credit Union Visa credit card account number, name, expiration date, and CVV (a three-digit verification value on the magnetic stripe of the plastic) may have been compromised in a processor level breach at Heartland Payment Systems, Inc. Heartland Payment Systems, Inc. is one of the nation's largest payment processors delivering credit/debit/prepaid card processing, payroll, check management and payments solutions. Heartland has dedicated a website, www.2008breach.com to provide additional information on the breach.

Information pertaining to your other Pentagon Federal Credit Union account(s) has not been associated with this event or compromised in any way. The compromise did not occur at Pentagon Federal Credit Union nor did it involve any of our systems. All of your Pentagon Federal Credit Union account information remains absolutely secure.

We continue to take all necessary precautions to safeguard and monitor your Pentagon Federal Credit Union accounts to protect against unauthorized activity. We have provided a series of frequently asked questions below that provide additional details and tips.

Please review them and if you would like to receive a new card with a new account number, please use the instructions provided below. You may reach us toll free at 800-247-5626 or online at PenFed.org.

If you have recently closed the referenced card, please disregard this correspondence. We apologize for any inconvenience this may cause. We appreciate the continued trust you have placed in Pentagon Federal Credit Union. Thank you for remaining a valued member.

Sincerely,
Vincent Gay
Director, Security
Pentagon Federal Credit Union

In this simple email we see the complexity of breach notification. Let me say for the record that I love PFCU -- I've been a member of PFCU for many years and will continue to be for many more.

On the negative side of this notification is the ambiguity. My information "may have been compromised" -- not sure if it actually was, so I'm not sure what the actual risk is. They're fulfilling a legal and/or ethical obligation to tell me the nature of the breach, but are they really helping me by telling me that it's a "processor level breach", without further explanation? And how am I as a consumer supposed to assess my level of exposure? Does this mean that there was an actual intrusion of Heartland's environment, or that they discovered a security hole that could have been entered without their knowledge but they really have no idea whether it was.

On the positive side, I'm alerted, so I myself can keep my eyes open for suspicious activity.

This notification was for a relatively simple incident in a disciplined corporate setting, and it still raises more questions than it answers. Makes me wonder about how we're going to strike the right balance as we move to stricter breach notification regimes in health care.....

Grassroots

Farzad Mostashari and I wrote a short white paper urging a more direct link between Federal HIT incentive funds and regional HIT extension centers (Farzad deserves the lion's share of credit for taking this idea and running with it). Pretty straight-forward idea, really -- rather than just handing out $18 billion in cash to providers, funnel those funds through an infrastructure that will protect the government's investment by ensuring that adoption happens efficiently, effectively, and with public benefit in mind. You'd think this would be a no-brainer after our recent experience with the $350 billion bank give-away, but so far, the concept hasn't made it's way into the stimulus package.

The letter has gotten almost 60 signatures from individuals and groups across 26 states, including some prominent national organizations such as the eHealth Initiative, NCQA, National Partnership for Women & Families, and Pacific Business Group on Health. It's also gotten a fair amount of attention. It was featured on iHealthBeat, John Halamka wrote about it in his blog, and it was also picked up by the New York Times. Thanks to everyone who co-signed it......hopefully somebody up there is listening!

How the other half lives

It's good every once in awhile to rise above the surface of the health care market and see how the real economy does things. Today the Times had an article about the barriers to adoption of near field communication (NFC) technology, which would allow you to swipe your phone over a reader to make credit card transactions. The technology is already in use today in Japan and in the UK, but it's facing many obstacles in the US market.

As described in the article, the issue is not technology. By 2012, most phones are expected to have the technology built-in, yet the availability of the "wave-and-pay" function could take much longer. As an industry expert explained:

For that to happen, all the players will have to work together to define standards, determine revenue-sharing, expand the network of electronic readers and think through the other parts of what he calls "this 2,000-piece puzzle."

The expectation is that a trade association, the NFC Forum, which represents 150 stakeholders in this field, will forge the way to a solution. Yet, the same industry expert warns:

...it is completely possible that nothing will happen in mobile phones in the next five years if everybody keeps thinking only about their own piece of puzzle.

I have no doubt that they're going to figure this out and we'll be waving our phones all over the place relatively soon. Reflecting on the somewhat similar dilemma we face with respect to healthcare IT, I'm struck by two big differences that make health care harder.

First, we'd be lucky if we had only 150 stakeholders. Part of our dilemma in healthcare IT is that the demand- and supply-sides of the industry aren't just fragmented, they're atomized. On the demand-side, there are over 1000 health insurers in the US, and on the supply-side, almost 8,000 hospitals and 170,000 office-based physician practices. HITSP and CCHIT have done a nice job bringing together the technology suppliers (in the latter case, probably too good a job....), but they're only addressing the technical side of this issue. NeHC is supposed to be a forum to forge consensus on market-blocking issues, but they're a top-down creation of the federal government, not the result of the burgeoning demands of underlying grassroots contituencies.

Second, the benefits of health IT aren't as crisp and clear as easier credit card transactions, so our customers (ie, patients) aren't exactly clamboring for what health IT has to offer. Most of us use credit cards very often (all right, probably too often), so little tiny convenience benefits accrue in an obvious way. Most of us don't use the health care system that often, however, so the convenience factor isn't all that meaningful to a lot of us, and so the appeal has to be on less immediate benefits (safety, quality, etc) that are harder to grasp (and believe).

Like the "wave and pay" issue, the obstacle in health care IT is decidedly not the technology. If we can't get "wave and pay" into the market by 2012, what hope do we have of achieving the President's goal of universal EHR adoption by 2014? It's clearly going to take a much larger "forcing function" than the health care market will be able to muster on its own. The Congress' watered down version of the President's health IT vision clearly isn't going to provide that "forcing function", however, so it looks like we're going to have to place our hopes on health care reform.

Piety in the House of Representatives

The House versions of the economic stimulus related to health IT are working their way through the Ways & Means and Energy and Commerce Committees. Then, it's on to the Senate. The House bills delay release of 90% of HIT funds until 2011, ostensibly on the grounds that the technology isn't ready for immediate investment. Paradoxically, the House approach works only if physicians start investing in systems right away, and it completely ignores the reality that the problem isn't the technology, it's the lack of a business imperative. The very same technology that they criticize is now expected to solve the mind-numbing flaws that currently plague our health care delivery system.

The House approach takes $20B and gives $2B to a government agency now, and $18B to physicians in the form of phased incentives starting in 2011. However, in order to get these incentives, physicians have to be already using these EHRs and HIE in "meaningful" ways (ie, electronical clinical quality reporting and care coordination) by 2011. Which would mean that for most physicians, they would need to start implementing within the next 18 months, because it takes that long to get up and running on these systems.

In taking this approach, the legislation assumes that each physician will make a roughly $50K investment now on the promise of being repaid for this by Medicare over a period of 5 years beginning in 2011. Assuming, of course, that they can pass Medicare's test on "meaningful" use, even though that hasn't been defined and at present there's little to no infrastructure to allow such meaningful use anyway.

Seems like a tough sell to me. There are very very few places in the country that have regional health information networks, and there are no places that have real infrastructure for electronic reporting of clinical quality data, so Medicare will have a hard time defining what meaningful use is, let alone certifying that physicians have successfully done it. They already tried to launch electronic quality reporting a few years ago in the DOQ-IT program, and it was an unmitigated disaster.

Then there's the problem of implementation. According to Medicare, 30-40% of EHR implementations fail. And the vast majority of the ones that don't fail aren't implemented to inter-operate with other systems or generate good clinical quality data.

The House approach glosses all of this over, however. It underinvests in a technological and organizational infrastructure to guide this massive makeover of 15% of our economy, and overinvests in a misplaced faith that IOUs to physicians will drive individual purchases of EHRs, and this, in turn, will induce demand for the network and implementation infrastructure needed for success. And according to success criteria that we're unable to define at present. And in time to meet the President's goal of ubiquitious adoption by 2014.

It reveals an almost religious belief in the power of incentives, however diffuse, and technology, however complicated, and markets, however dysfunctional, to solve the problems that have left 96% of physicians without a fully functional EHR up until now. Almost touching, really, this kind of faith, misplaced though it may be.

I'm speechless...

"In reaffirming the greatness of our nation,
we understand that greatness is never a given.
It must be earned."

Message to Congress: It takes a village to implement an EHR

Well, the health IT legislation is starting to take shape, and it's a little more sobering than the initial speculations of tens of billions of HIT dollars being unleashed on state governments in the next few months. In many ways the recent turn of events is an about-face from the early speculations. The House Appropriations and House Ways & Means Committees approaches have the following policy underpinnings:

1. Separates HIT spending from the economic stimulus
2. Focuses first on creating a framework for how to handle billions of dollars of HIT funding
3. Drives the vast majority of money (90%) through Medicare/Medicaid reimbursement channels
4. Focuses the role of state governments on areas that require local coordination, tailoring, and governance
5. Moves ONC beyond "coordinator" to actual owner of administrative infrastructure, with all of the programmatic and fiduciary responsibilities that such functions imply
6. Makes the Federal government the decision-maker on issues such as technical standards, with input from advisory committees on policy and HIT

I'll admit that I was among those who was getting a little dreamy and even woozy at the thought of billions of dollars flowing into health IT over the next year. Compared to that somewhat heady vision, the House language is surely a disappointment. Yet, like most compromises, it represents progress in certain key areas.

Things I like about the approach are:

• Balance of state-led and federally-led approaches. I like the idea of a network of regional HIT Extension Centers that work directly with ONC rather than through states. State governments have a role as well, but mostly in the areas of coordination, galvanizing health information exchange, promoting quality improvement and public health, and making sure that under-served communities don't get left behind. I like this approach because EHR adoption is not nearly as state- or local-specific as is HIE, which really does need to be tailored to local markets and conditions. Thus, it makes sense to let the Feds drive EHR adoption through regional organizations, and have states focus on state- and local-level HIE concerns.
• Incentives for doing stuff, not just for buying stuff. Focus on incentives that require participants to use the technology, rather than just having systems that are "certified". I like that the incentives are tied to quality reporting and health information exchange because I don't believe that inter-operability standards are enforceable without having activing monitoring by certified HIEs, public health entities, and quality data aggregation entities.
• Resources and authority to ONC to get on with it. Gives the clear message that the federal government has to take a stand on key policy decisions in order for us to move forward. This is not ideal, particularly for standards in a fast-moving, decentralized technology space, but it's not clear to me that other approaches are obviously better. The Federal government needs to set standards for Medicare and Medicaid, so that much makes sense regardless of how standards get determined generally.

Things that I think would improve the House language are:

• Develop a programmatic overlay to the EHR implementations. Inter-operability and robust reporting don't just happen, they get done. And they won't get done if there isn't an implementation program behind the effort, because the systems are too complicated for individual physicians to do this on their own. There's also too much coordination required with other entities, which can only be coordinated by a formalized program. Therefore, we should cement the link between EHR incentives and the HIT Extension Centers. EHR implementations should be executed through or certified by the HIT Extension Centers, otherwise we'll end up with a lot of really bad retail implementations, just like we have today, because we'll only find out about them ex post (ie, after they've failed and can't deliver on their quality and HIE requirements).
• More HIT funding should be made available before 2011. Not necessarily the whole $18B, but there are some parts of the country that are ready to meet the new requirements right away, and we should make funds available to them to build on their momentum while the overall program catches up.
• We should try to go "wholesale" rather than "retail". The current approach to the incentives is to go "retail", meaning physician-by-physician, but there's much more value to be had by going "wholesale", meaning market-by-market. Retail implementations will only mimic, or worse, amplify, the existing entropy of care delivery. Putting a programmatic overlay to "communities" or "markets", such as New York and Massachusetts are doing, creates more effective and efficient vehicles for getting providers to work together, which they do too little of today, and ease the path for them to focus on how to best use technology to improve care across the system, not just in their individual offices.

So, concrete ways to accomplish these goals might be:

• Designate a couple of HIT Extension Centers right away
• Formalize the role of HIT Extension Centers so we get more proactive interventions in government-funded EHR implementations to get better assurance that they get done right the first time, rather than trying to rescue them after they've failed
• Provide additional funding to these HIT Extension Centers for them to provide implementation services to physicians up-front
• Accelerate Medicare and Medicaid incentives to the markets that these HIT Extension Centers cover
• Allow aggregation of incentives by community according to a formula that allows providers who share the same patients to implement in a coordinated way, and perhaps provide a "sweetener" to those who organize themselves this way

One thing we should recognize is that by putting most of this into Medicare/Medicaid incentives, and by delaying most of the money until 2011, HIT could be on a collision course with health care reform. In some ways that's good, because we shouldn't be using technology to try to solve the intractable problems of the current system, we should use technology to enable and enhance a better system. Yet, the reality is that we could get to a point where we push off the 2011 date to align it with health care reform. That would get us even further away from the President-elect's goal of ubiquitious EHRs by 2014.

The National eHealth Collaborative

The AHIC successor organization is now the National eHealth Collaborative. As a friend reminded me, imitation is the sincerest form of flattery. We at the Massachusetts eHealth Collaborative thus couldn't be more flattered. And we'll get over the name thing. Really. We will.

In all seriousness, congratulations to NeHC -- we wish you every success!