In the past, I’ve written volumes about hospital attempts to lock in doctors by offering them access to a free or deeply-discounted EMR. I haven’t heard much about this strategy of late — either the approach was dropped or it’s gone underground — but it seems that other players are still giving it a shot.

This time, in what seems to be a fairly logical step, Quest Diagnostics has kicked off a program offering medical practices a steep 85 percent discount off of the retail price of its Care360 EMR and practice management bundle.  The announcement follows up on its 2011 regional giveaway program, which Quest says attracted thousands of physicians.

The deal, which reduces the physicians’ out of pocket cost to less than $100 per month,  also includes training, hosting, maintenance and 24/7 support for Care360. The lab giant says physicians can get Care360 up and running in about 45 days.

I can’t think of a reason why this wouldn’t make great sense for Quest; if my contacts are to be believed, it has no better reputation than its key competitors when it comes to customer service and follow-through on clinical testing.

On the other hand, if I were a doctor I’d think long and hard before agreeing to a deal like this, even though the software is just about free. There’s simply too much at stake to plunge in.

Yes, Care360 is CCHIT certified and, intriguingly, has incorporated the Direct Project specs allowing doctors to share information with patients and hospitals. And yes, it seems to have made efforts to support EMR access via mobile devices. This is all good. And of course, the price is right.

On the other hand, I’m not sure I’d want to make this big of a commitment to any particular service provider, be it a reference lab, a radiology provider or the people who stock my vending machines with sodas.

I’d argue that the more important the service is, the less you want to be beholden to the vendor. After all,what if Care360 isn’t your cup of tea?  Do you really want to disrupt your relationship with a critical provider like Quest?

Not only that, it’s risky to lock in an EMR just because it’s cheap. If Care360 takes 45 days to get installed, it’s not going to be possible to uninstall it in a day or two, and that could mean misery on wheels if the product doesn’t work for you.

Besides, it’s possible to get Web-based, easy to adopt or drop EMRs for only a couple hundred dollars a month more. It wouldn’t make sense to go for an EMR that might not work just to save that little. (If your margin is tight enough that a savings of $200 or $300 a month is critical, you have worse problems than finding the right EMR!)

I guess I’m saying that even if the EMR is nearly free, caveat emptor. You don’t want to get saddled with an albatross system just because the price was right.

While there’s a number of  large, publicly-traded EMR vendors out there — General Electric (NASDAQ: GE) and Cerner (NASDAQ: CERN) immediately come to mind — to date we haven’t seen many mid-sized or small companies kick off an initial public offering. But one medium-sized EMR/practice management vendor has broken the mold.

Today, Greenway Medical Technologies (NASDAQ: GWAY) took the plunge , pulling in $67 million to fund its operations. While the company had hoped to raise $100 million, its take is nothing to sneeze at. Health IT is a tricky investment, even for pros like yourselves, readers, and institutional investors in particular are a conservative bunch. The fact that they’re spending on a risky business means a lot.

Greenway, whose EMR is bundled with practice management software, had one heck of a ride today, with its stock climbing 30 percent during its first day of trading. The company sold 6.7 million shares at prices below its expected $11 to $13 range, diluting its intake somewhat, but the stock closed at a promising $13 per share.

The Carrollton, Ga.-based vendor has certainly done well in recent times. According to insider Wall Street blog Seeking Alpha, Greenway revenues shot up 55 percent, to $25.7 million, during the last quarter of operations. Operating margins went from negative to a positive 2 percent, which is at least a start.  Its biggest cash generator during the quarter was licensing revenue, which climbed 49 percent.

What’s interesting about this IPO isn’t just the fact that it ended well for Greenway. After all, it did take in less than planned, and the Wall Street crowd justifiably wonders how it will fare in a mind-boggling competitive market.  But it’s worth asking whether Greenway did better because it bundles both an EMR and practice management tools. Did the fact that Greenway wasn’t relying solely on EMR revenue contribute to its growth and financial success?  It would be interesting to find out, as that might help predict whether the bundled model is especially popular with physicians.

As for those who’d seek to imitate Greenway, they may have a chance if they move soon. Seeking Alpha editors think HITECH will still pump enough money into the EMR market to make these companies a reasonable investment. And given how many doctors and hospitals are still struggling to put EMRs in place, I have to agree.  In fact, given that an amazing number of hospitals and medical practices junk their first EMR, there may be a whole second wave of opportunity within three to five years.

All told, if the market’s response to a smallish IPO is any indication, you can expect a bunch of other EMR players to follow in its footsteps.  I’m thinking it will be companies in the $100m to $200m range, as they’re small enough to need capital (much cheaper capital than banks offer these days!) and nimble enough to benefit from the cash influx. Stay tuned and in coming months, I’ll tell you which other EMR and HIT companies I’m betting will climb onto the launch pad.

One foggy morning last week, I made my way to the Georgia State Capitol for a Technology Association of Georgia (TAG) Health event relating to the intersection of healthcare IT and state legislation. Little did I know that the state’s government is somewhat unaware of the benefits HIT can bring, both to the patient in terms of more coordinated care and improved quality outcomes, and to the state in terms of job creation and revenue.

I also was not aware that, when it comes to moving from paper to electronic health records, some doctors take a bit more convincing than others. And when I say “a bit,” I really mean they may need to be gently dragged kicking and screaming into the digital age. At least that’s the impression I got at the TAG event after speaking with Sherri Mesquita, an EMR/EHR Consultant – Project Manager, at Community Health Systems Inc. She works with ambulatory clinics and hospitals to help them establish strategy around meeting Meaningful Use deadlines, and has developed a keen sense of when doctors may need an extra “bit” of convincing.

What do you think the biggest challenge is for doctors when it comes to accepting that it’s time to change – to make the move from paper to electronic health records?
I believe the biggest challenge is that in order for them to understand how the EHR experience will be beneficial, you have to get them to actually buy into the idea of an EHR. Doctors want to know that the ROI on their investment is going to bring increased revenue to the practice/hospital, provide more efficiency in the practice, and above all provide the best possible quality of care while keeping costs down.

Physicians talk to other physicians about these newer technologies. If they see their cohorts are doing well, and consistently discuss the positive attributes of the EHR software, other physicians are more likely to follow them in adoption – depending on how much money, time and staff resources are currently available.

In addition, some physicians have already implemented an EHR system in the past and, unfortunately, did not get the right information or customer support, or the vendors were not trained in how and which system works best for that specific clinic. Therefore, those doctors have not had a positive experience in the past, and even went back to using paper after spending thousands of dollars on a system that either was not customizable or did not integrate well with the other practice management or billing programs.

In your experience, when does the light bulb go off in a doctor’s mind – when do they realize that it will truly be to the benefit of their practice, their bottom-line and, ultimately, their patients?
There needs to be a lot of hand holding in the beginning stages, and education is key to them seeing what benefits to the practice an EHR can be. Other doctors again are a very important and vital aspect to implementing an EHR. They bring actual experience and important testimony for the process of going electronic.

Last year, I worked on a program with the Rockdale Chamber of Commerce in Georgia to provide a “transfer of knowledge to doctors” by educating them on the important benefits of implementing an EHR, as well as adopting “Lean” and “Continuous Improvement” in their practices. The purpose of the CI/Lean techniques is to achieve unity of purpose to identify and sustain improvements to patient critical needs.

How do you help them reach this point? What examples do you typically give to show them the value of an EHR?
Though the initial costs and implementation challenges are considerable, delaying implementation today may create additional resource drains tomorrow. The availability of an EHR may soon be a minimum standard for new physicians, public and private payers, and patients.

• EHRs are an essential component of reform-related efforts such as the Patient-Centered Medical Home (PCMH).
• Practices that do not meet Meaningful Use criteria will face Medicare penalties in 2015.
• A certified, operating EHR will be essential to participation in both public and private pay-for-performance programs expected in the future.
• According to the Deloitte Center for Health Solutions, 42 percent of consumers are interested in establishing an online connection to their physicians through a personal health record and 55 percent of consumers want the ability to communicate online with physicians.

Can you give any specific examples of EHR implementation success stories? Or perhaps from the other viewpoint – an example of a doctor or practice that absolutely refused to make the transition, and why?
Most recently, I have worked with ambulatory practices in Toledo, Ohio – Catholic Health Partners. The doctors and nurses fought it every step of the way, and even threatened to leave the practices. It was a very hard adjustment in the beginning, and for me as a consultant to come in and change the workflow processes and implement new software rollouts was such a challenge.

I was able to work one on one with the clinical staff and help them to understand they had someone there to guide them through the entire process. They definitely demonstrated gratitude when they could see the end result after two weeks of being live with the software. The practices needed to make sure they scheduled their patients at a 50-percent reduction rate to accommodate the change in software for the first two weeks.

The practices gradually implemented the EHR software of Epic, which resulted in maintaining positive patient-physician relationships and fostering the sharing of medical information. After demonstrating proficiencies, the physicians and other clinical staff were comfortable with the new EHR systems and even say they could then see the potential benefits of the new changes.

Here’s an EMR adoption study which interested me largely because it runs counter to what I would have predicted.  The study, which surveyed physicians pre- and post- EMR implementation, found that doctors who owned a stake in their practice found their rollout to be tougher than physicians who didn’t have a stake.

I don’t know about you, but I would have assumed that the folks with more control — the owners — would have found it easier than those who have to adapt to the decisions others make.  But it seems that physician-owners simply feel the pain of change more acutely.

To conduct the study, which was published last week in the Journal of the American Medical Informatics Association,  researchers surveyed 156 physicians working with the Massachusetts eHealth Collaborative.  The surveys included a pre-implementation questionnaire  in 2005 and a post-implementation questionnaire in 2009.

Thirty-five percent of doctors who responded reported that implementation was very difficult, 54 percent said it was somewhat difficult and 12 percent not difficult. Those numbers square pretty well with what I’ve seen elsewhere. The twist here was that 38 percent of physicians with full or partial ownership stakes in their practices voted “very difficult,” versus 27 percent of non-owners. That surprised me. After all, aren’t most of the complaints coming from doctors who try to use the new systems?

According to Marshall Fleurant, MD, one of the study’s authors, the owners “probably experienced more underlying challenges associated with EHR implementation and workflow transformation” given their broader operational responsibilities.

While this study is interesting, it’s hardly the last word. Teasing out just which factors predict how doctors will react to EMR implementation, much less what it takes to support them, is still a new science.  But it never hurts to bear in mind that physicians making critical management decisions get support, too.

Right now,  healthcare organizations have to go through some pretty tricky maneuvers to link patient data across varied systems and settings.  It’s possible to connect patient info electronically through database hacks, but more often than not, matching patients to clinical data gets done by hand.

Given the insane complexity of the existing system, would it make sense to create a national patient identification number for every U.S. patient?  The question is worth revisiting, given the immense level of error and wasted time generated by the existing system. After all, not only would putting an NPI in place make it easier to track patients within a hospital or health system, it would simplify the rollout of HIEs dramatically, wouldn’t it?

Dr. Robert Rowley of EMR vendor Practice Fusion notes that the biggest enemies of establishing a National Patient Identifier are privacy advocates who feel that an NPI would expose patients to greater risk of breaches or misuse of data.

But is that a realistic concern? Probably not. I agree with Dr. Rowley, who asserts that it’s hard to imagine that PHI would be at greater risk simply because of how it’s indexed.  As he notes, PHI breaches are nearly always often haphazard affairs in which a laptop is stolen than Big Government or corporate conspiracies. (If you’re afraid the government is covertly siphoning your health data off to study it, not having an NPI won’t protect you, anyway.)

No, the real barrier to this kind of administrative simplification measure is time, money and resources, the same barriers that hold back any other proposed HIT project.  It’s hard to imagine the resources that would be involved in instituting such a system — the idea makes my head hurt — and I have to assume it’d be several years before it was anything like mature.

Still, it’s good to bear in mind that at least some members of the public are afraid that creating an NPI would compromise their privacy. If the only barrier to improving patient matching in our EMRs is technical, that’s one thing — but if it’s patient fears, that’s another thing entirely. Sometimes, it’s good to remember that most of the world doesn’t think like a health IT exec.

For quite some time now, I’ve nursed my own doubts about:
- how effective EMRs are (disastrous in the short term, long term they’re supposed to make life easier, but we haven’t seen any evidence of that yet)
- why physicians are being paid to implement something that makes logical sense (you need something to nudge people out of status quo. And probably in the government’s thinking, what better use for taxpayer dollars, right?)

I came upon this blogpost, provocatively titled Why EMR is a four-letter word to most physicians. Adam Sharp, Par8o (“pareto”, not “par 80″) founder references this post from the Healthcare Blog. The discrepancy in the rates between adoption of any EMR is mind-boggling. It was projected to be close to 56.9% in 2010, vs. adoption of a fully functional EMR (projected to be close to 10.1% in 2010). (I’m not using the 2011 rates because the rates for fully functional EMR adoption in 2011 are not listed).

A reason Sharp gives for incentives and threats of decreased payment are “the industry and physicians have known for years that EMRs do not improve productivity and that it is highly questionable that EMRs lead to better patient outcomes”. While I would agree that in the short term, there is decreased productivity, I’m not so sure you can dismiss there is no productivity increase over the long term. This report about a UC Davis study for example, shows that the loss of productivity was just one month for internal medicine, and that productivity increased to pre-EMR implementation levels in the next six months. The not-so-good news is that productivity levels declined for pediatricians and family practices.

I interpret these findings like this: for specialties where there is loss of productivity, sure, the whole exercise needs a rethink. But in cases where your productivity is at par with your pre-EHR levels, I think there is a hidden benefit that detractors are more than willing to gloss over – the availability of patient data. Data is the holy grail – it’s up to us to figure out whether and how we use it.

Sharp also imagines some doomsday scenarios – of EMR vendors with uncanny abilities to do as they please.

“The goal of EMRs is to wrestle control of healthcare away from the doctor-patient relationship into the hands of third parties who can then implement their policies….by simply removing a button or an option in the EMR.”

Maybe I’m turning turncoat here and letting you guys in on the best kept secret of the IT industry, but every vendor I’ve worked for, past and present, figuratively quakes in his IT boots when it comes to contract renewal. Even for COTS products, vendors actually customize things here and there for customers, till you have 25 versions of the same code, all just to keep their customers happy and paying. While I’m pretty sure there are rogue vendors who can give you the best EMR nightmares money can buy, I also do think customers can, and do, help rein in errant ideas. In other words, vendors can’t simply remove buttons and options or randomly start charging you for stuff, not unless you let it happen. And you, the customer, hold the purse strings, ergo YOU, not the vendor, call the shots.

I don’t quite find myself agreeing with the cynical conclusion of the post which is that the point of EMRs is to wrest control away from doctors and patients into the hands of third parties who wish to regulate choice and eligibility. But there’s plenty there that’s food for thought. Go check it out.

One thing that I love about this industry is its willingness to collaborate, and I’m not just talking about collaborative care. I’m talking about healthcare IT’s propensity to brainstorm new ideas as the drop of a hat. Put two HIT folks – be they physician, vendor or blogger – in a room, and 20 minutes later you’re going to have a new idea related to care delivery, product development or possible partnership on your hands. It gets even more prolific when editorially minded marketing folks like me are added to the mix.

I’ve been pleasantly surprised at how even blogs can foster this sort of collaboration. Last month in “Finding an EMR Job Champion,” I chatted with Rich Wicker, HIMS Director at Shore Memorial Hospital in New Jersey, about how this industry can best align recent graduates of HIT certification programs with training and jobs. Some of you may have noticed several comments left on that post by Sean McPhillips, a man of many hats. He is currently an adjunct instructor at Cincinnati State – a community college in the HITECH College Consortia; project manager at the Kentucky Regional Extension Center; and creator of the HITECHWorkforce.com, a free resource to help students enter the HIT work environment.

In his comments, he advocates for a mentor-protégé program: “Students still need some more help finding jobs. What I think needs to happen is a “Mentor/Protégé” model. That is, pairing students with industry professionals who can mentor them into the industry. I’ve passively done that…to success. I think that will work.” He later followed up with the news that he hopes to work with HIMSS, which is developing a similar program, to get this model off the ground.

I recently had the opportunity to speak with McPhillips a bit more about his idea. I was eager to find out just how he plans to jumpstart it:

It seems as if you’ve been kicking this idea around for a while. How did it come about?
Being with the extension center, I’ve mentored a handful of people along the way, and I think there needs to be a more structured process so that students coming out of these [HITECH College Consortia] programs who want to be mentored have a place to go, they know how to get and stay engaged in the process. I think that there is with HIMSS, but I don’t think it’s really been tightly coupled with the workforce development program.

When I spoke with Helen Figge, Senior Director of Career Services at HIMSS, she was really excited to talk with me, and pointed me to HIMSS’ career development page to look around and see what they have out there. I’m thinking of how we can connect [what they’re already doing] into the workforce development program within the overall HITECH project structure, so that we can connect students who come out of these programs with their local HIMSS chapter, which could then pair them up with a mentor that’s in their region. That’s what’s really missing. That’s what’s really necessary to get people plugged into this profession – especially if they’re coming from outside of this profession.

HIMSS does not already have some sort of relationship with the college consortia?
They kind of do, but I don’t think it’s really tightly coupled. I think HIMSS recognizes this, so they’ve been developing their career development program. They’re near completion of a new, entry-level certification called the CSHIMS certification. That is something where you don’t need to have a whole lot of experience in health information technology, but you need to demonstrate some degree of knowledge in subject matter to obtain that certification. That might be a good way to help these students take the next step into the profession, when they’re looking to get a job. That could be part of the whole mentorship program concept.

Isn’t there a double-edged sword to it financially? Wouldn’t students have to become paying members of HIMSS, and then would they have to pay for certification? If they’re looking for jobs, finances might be tighter than usual.
That’s a great point. The question is, what are the costs associated with certification and becoming a member. There is a student membership discount. There’s a cost to certification, obviously, so these are things that are to be considered. That has not escaped me, so that’s going to be part of my brainstorming session. I’m going to meet up with them in Vegas when I go out to HIMSS.

One of the things I want to be able to do is make this attractive for people, particularly students, and if they have to lay out $500 or $1,000, and they’re already unemployed or they’re financially strapped, it becomes not just a double-edged sword, it becomes a disincentive.

I wonder if the vendors couldn’t get involved and offer scholarships.
It’s funny that you mention scholarships because that might be something the local HIMSS chapters can do. I know the Ohio HIMSS chapter used to do a $1,000 scholarship every year for students. So this might be something that the boards or the individual chapters could subsidize.

If you’re in the HITECH workforce development program, maybe HIMSS would be willing to waive membership for one year. That might be something they may be interested in doing.

This is part of the whole brainstorming session that I’m going to try to have over the next month or so. I’ll vet this through HIMSS over the next couple of weeks and hopefully we’ll come up with a good strategy by the end of February. And then we’ll start piloting it in the March timeframe.

I hope to run into McPhillips in Vegas to see how his chat with the HIMSS career development folks is coming along. It’s nice to know that one industry insider’s idea, and subsequent blog comments, might actually create job opportunity in the industry.

I’m not a big fan of reality shows, especially those that involve contestants singing, telling jokes, dancing, or anything else that could potentially result in public humiliation. I’m in the minority, of course, as this style of television programming shows no sign of abating anytime soon. It’s a worldwide epidemic, in my opinion.

I am a fan of creative marketing – applying concepts traditionally associated with one particular medium (like television) to something entirely different (like healthcare). Needless to say, the Big Break job recruitment program – you could also call them auditions – intrigued me.

In a nutshell, pre-screened candidates take part in a one-day audition process put on by recruitment firm Intellect Resources and participating hospitals. Candidates then compete to become trainers and instruct staff on the use of the sponsoring hospital’s electronic medical record system or related healthcare IT system.

Seems like a slam-dunk concept, in my opinion. Those who are unemployed get a job within their community, and also get a taste of what that popular 15 minutes of fame is like. Did I mention that candidates go through video interviews and public presentations during the daylong process?

I recently chatted with Tiffany Crenshaw, President and CEO of sponsoring organization Intellect Resources, about how the program came about and the impact it has had on its participants’ lives (and go-lives).

How did the Big Break come about?
Tiffany Crenshaw: The Big Break spawned out of a project we were working on at Mt. Sinai Hospital last year. Last fall, they were getting ready for their Epic training and called me in a panic. They were expecting to get 90 to 100 trainers, and were going to use nurses, but realized at the last minute that wasn’t a viable idea. So they called us and said, “We have to do something now – we have no budget and we have no time. And we want to do some sort of done-in-a-day type audition. What can you do?”

So we said this is right up our alley. We created a really cool event – it was at the big Marriott Marquis in Times Square. We had around 500 contestants, and they all went through a timed audition process – stressful for them, but it was still fun.

They had to go through seed interviews and get in front of cameras. They had to get in front of a boardroom of judges and do presentations. At the end of the day, we ended up with 100 trainers that worked at Mt. Sinai to help roll out the hospital’s Epic training and go-live.

So that’s really the model of Big Break. We created it as a solution for Mt. Sinai, and now other folks are getting the word about it. Ochsner Health System is our next one. We’ve got the Big Break event for them in just a couple of weeks (January 21).

Did they reach out to you?
A consultant and dear friend of mine that was actually helping them with their system selection and project planning for their Epic implementation recommended this business model, and brought us in as the vendor to run this product for them. So yes, they did reach out to us, but it was really a consultant that made it happen.

Are you an all-Epic recruiting firm?
At the moment, that’s just about all we’re doing. Through the years, we’ve worked with many other products – with McKesson, Cerner, Siemens. The demand right now is Epic, so by default we’re doing all Epic. That’s just where the demand is, and so that’s where we’re spending our time.

How have you seen this type of program impact sponsoring hospitals and surrounding communities?
We think it’s a business model that works very well for hospitals. It’s a very low-cost way to get good resources. It’s also a good marketing opportunity for them to promote the fact they’re installing an electronic health record to the benefit of their patients, and it’s a great way for them to reinvest in their own community.

At Ochsner, the idea is that this is really for the New Orleans community. They don’t like to hire outside consultants. They really want to empower and revitalize their own community.

Many of the folks that we worked with at Mt. Sinai have gone on to work at other places. Big Break was really their footprint in the door. The end result is that the consultants that come through with really good experiences.  Over 50 percent of them are now working in the industry. Mt. Sinai actually hired four full-time employees. There was a big project up in Rochester, N.Y., that a lot of the people went to after that first project. We redeployed probably 20 of them on several go-lives.

Is there an opportunity for this to work in other cities?
At our very first meeting with Ochsner’s project executive, we talked about the fact that there are several area hospitals in and around New Orleans gearing up for Epic implementations. Our original thought was, let’s do this together, but the go-live timeframes didn’t work.

It would make perfect sense if there were multiple hospitals that could do the event together, do the credentialing together, and then take people from a generic credentialing and deploy them to the individual hospitals to learn the individual builds. I think it’s a model that could be a really good collaboration.

I think one of the neatest things about Big Break is that this industry is so thin on the amount of really good resources that are out there. It’s a great way to breed new talent

You may have noticed several big businesses in the news recently capitulating to customer outrage over new and unnecessary (or completely gratuitous) fees. Bank of America made news in late 2011 when it tried to institute a $5 fee for any customer that wanted to use a debit card. Verizon made a similar move when it tried to put in place a $2 fee for payment made by phone or Web. (Really? You’re going to charge me to pay you?)

I’d even go so far as to lump Netflix’s blunderings in 2011 in with this group. First the price increase, and then the ultimately jettisoned decision to split the business into two product lines – one for DVDs and one for streaming. Though customer outrage wasn’t enough to derail the price increase, I can only assume the backlash had something to do with the decision to ultimately stay with one brand for both services.

As Erika Morphy wrote in a recent Forbes.com article, “It doesn’t take much to enrage consumers these days and while Verizon doesn’t fall in the ignominious category of [a] Wall Street bank, it doesn’t exactly engender fierce customer loyalty or devotion either, the way, for example, Apple does.”

She hit the nail on the head, in my opinion. No matter what your opinion of the Occupy Wall Street movement, I believe it has made the average US consumer more confident in their dealings with Big Business, more apt to cry foul when companies like Bank of America and Verizon try to pull more money out of people’s pockets just because they can. (I know I’m oversimplifying things here, and that these companies have seemingly valid reasons for these fees.) As any healthcare vendor will tell you, being in business is ultimately about the bottom line. So it stands to reason that Big Business will always want to get bigger.

To bring it back around to healthcare, I firmly believe that the customer’s newfound voice of “We’re not going to take it anymore” should be applied to healthcare. Consumers are patients and vice versa. At the end of the day, we all want the best care possible for the least amount of money and inconvenience. Let’s take these lessons learned in the traditionally consumer world and apply them to the patient experience.

Are you looking for a new family practitioner? Choose one that has high quality outcomes, has effectively been using an electronic medical record, is willing to explain the benefits of a homegrown personal health record, and is happy to coordinate care with your specialist two counties away. For that matter, you could make similar demands of your health insurance provider.

I know interoperability isn’t always at the top of our to do lists when it comes time to go to the doctor – often a sudden and unplanned event. If you find yourself being cared for by a doc that’s getting by with paper, become an advocate for change within that practice when the time is right.

It doesn’t hurt to start a dialogue. And as Big Business has shown us, using your voice can actually bring about better outcomes for all.

You’ve no doubt heard it. The healthcare industry has the dubious distinction of having had the three of the top six IT related security breaches this year. This article in the Healthcare Finance News quotes figures published by the Ponemon Institute, a research organization. According to the article, there’s been a 32 percent increase in frequency of data breaches, in other words, the frequency has increased by almost a third.And it has cost the industry $6.5 billion.

But a similar story in the NY Times shows us how woefully inadequate our existing data protection laws are (This story also quotes the numbers from the same Ponemon Institute study). An employee from a Massachussetts eHealth Collaborative lost a laptop containing 13,687 records. Each of those records contained some combination of a patient’s name, SSN, birthdate and other identifying information. Now, by law, healthcare organizations are required to report breaches involving 500 or more patients and the Department of Health and Human Services.

However, says NYT, Micky Tripathi, the non-profit’s president and CEO, soon figured out “just how many ways there were to count to 500. The law requires disclosure only in cases that “pose a significant risk of financial, reputational or other harm to the individual affected. His team spent hours poring over a backup of the stolen laptop files. Of the nearly 14,000 patient records on the stolen laptop, most records did not warrant disclosure. In 2,777 cases, for instance, a record listed only a patient’s name.”

The NYT story also points out another strange loophole that came to the aid of the non-profit – the entities responsible for protecting patient health are the providers, not contractors such as Mass. eHealth.

“In the eyes of the law, Mr. Tripathi’s nonprofit is a contractor that acts on behalf of health providers. The legal burden of protecting patient data actually falls on his clients: the physicians and hospitals who entrusted his nonprofit with their files.”The laws create a perverse outcome,” he says. “It was our fault, but from a federal perspective, it wasn’t our breach.”"

So of the 14,000 or so patients affected, Micky Tripathi’s non-profit only needed to notify 998 people. Of these, only one organization had patients more than 500 in number, requiring a mugshot report on the HHS wall of shame, and an offer of free credit monitoring from Mass eHealth.

In the end, the cost of credit monitoring services to Mass eHealth was a mere $6000 though the article says the non-profit ended up spending close to $300,000 in the aftermath. I wonder if this includes the cost of the necessary sleuthing involved and so on. If this is the case, the numbers are incidental expenses; the money spent directly on the breach itself was a fraction of that.

Compare this to the $1 million fine incurred by Mass. General Hospital for the loss of 192 patient records left by a negligent employee on a subway train.

With these numbers in mind, here are my takeaways from these stories:
- Who is responsible for what breach is not clear enough. I had to re-read the definition for covered entities to make sure that Mass eHealth doesn’t fall under it. If the law takes such a lax attitude to IT contractors – who BTW provide the bulk of the IT infrastructure at many hospitals – where’s the incentive for anyone to do things differently?
- There’s a crazy penalty structure in place. A hospital losing 192 records resulted in a million dollar fine. A non-profit losing 998 records incurred $6000 in expenses. So if you’re a hospital, you’re better off with contractor negligence than your employees/equipment being the responsible party.
- Rules can be creatively interpreted.
- There’s not enough negative fallout for data breaches for healthcare/HIT organizations to do things differently. Say, if in addition to the notice on the HHS wall of shame and fines, there were other repercussions like, I don’t know, a digital time-out of sorts for both contractors and healthcare organizations, maybe healthcare and IT would begin to care more.

John’s Comment: This is definitely an interesting case. With the new HITECH laws I can’t imagine how this doesn’t fall under the Business Associate agreement which would require that they follow the HIPAA laws just like any provider. The article does say that contractors aren’t responsible, but that seems like bad legal advice given by the contractor’s lawyer. I’m not a lawyer, but I’ll have to email a healthcare lawyer friend of mine to have him comment on this case as well.

It’s also worth noting that all of the breaches mentioned above have been through laptops or other devices left behind. None of the major breaches have been a hacker getting into an EMR or EHR system. Everyone likes to blame the EHR software for privacy issues, but so far they haven’t happened. They will one day, but the bigger privacy issue is still unsecured devices and human breaches (ie. staff looking at inappropriate records).