Free EMR Newsletter Want to receive the latest news on EMR, Meaningful Use, ARRA and Healthcare IT sent straight to your email? Join thousands of healthcare pros who subscribe to EMR and EHR for FREE!

Is Interoperability Worth Paying For?

Posted on August 18, 2016 I Written By

When Carl Bergman isn't rooting for the Washington Nationals or searching for a Steeler bar, he’s Managing Partner of, a free service for matching users and EHRs. For the last dozen years, he’s concentrated on EHR consulting and writing. He spent the 80s and 90s as an itinerant project manger doing his small part for the dot com bubble. Prior to that, Bergman served a ten year stretch in the District of Columbia government as a policy and fiscal analyst.

A member of our extended family is a nurse practitioner. Recently, we talked about her practice providing care for several homebound, older patients. She tracks their health with her employer’s proprietary EHR, which she quickly compared to a half-dozen others she’s used. If you want a good, quick EHR eval, ask a nurse.

What concerned her most, beyond usability, etc., was piecing together their medical records. She didn’t have an interoperability problem, she had several of them. Most of her patients had moved from their old home to Florida leaving a mixed trail of practioners, hospitals, and clinics, etc. She has to plow through paper and electronic files to put together a working record. She worries about being blindsided by important omissions or doctors who hold onto records for fear of losing patients.

Interop Problems: Not Just Your Doc and Hospital

She is not alone. Our remarkably decentralized healthcare system generates these glitches, omissions, ironies and hang ups with amazing speed. However, when we talk about interoperability, we focus on mainly on hospital to hospital or PCP to PCP relations. Doing so, doesn’t fully cover the subject. For example, others who provide care include:

  • College Health Systems
  • Pharmacy and Lab Systems
  • Public Health Clinics
  • Travel and other Specialty Clinics
  • Urgent Care Clinics
  • Visiting Nurses
  • Walk in Clinics, etc., etc.

They may or may not pass their records back to a main provider, if there is one. When they do it’s usually by FAX making the recipient key in the data. None of this is particularly a new story. Indeed, the AHA did a study of interoperability that nails interoperability’s barriers:

Hospitals have tried to overcome interoperability barriers through the use of interfaces and HIEs but they are, at best, costly workarounds and, at worst, mechanisms that will never get the country to true interoperability. While standards are part of the solution, they are still not specified enough to make them truly work. Clearly, much work remains, including steps by the federal government to support advances in interoperability. Until that happens, patients across the country will be shortchanged from the benefits of truly connected care.

We’ve Tried Standards, We’ve Tried Matching, Now, Let’s Try Money

So, what do we do? Do we hope for some technical panacea that makes these problems seem like dial-up modems? Perhaps. We could also put our hopes in the industry suddenly adopting an interop standard. Again, Perhaps.

I think the answer lies not in technology or standards, but by paying for interop successes. For a long time, I’ve mulled over a conversation I had with Chandresh Shah at John’s first conference. I’d lamented to him that buying a Coke at a Las Vegas CVS, brought up my DC buying record. Why couldn’t we have EHR systems like that? Chandresh instantly answered that CVS had an economic incentive to follow me, but my medical records didn’t. He was right. There’s no money to follow, as it were.

That leads to this question, why not redirect some MU funds and pay for interoperability? Would providers make interop, that is data exchange, CCDs, etc., work if they were paid? For example, what if we paid them $50 for their first 500 transfers and $25 for their first 500 receptions? This, of course, would need rules. I’m well aware of the human ability to game just about anything from soda machines to state lotteries.

If pay incentives were tried, they’d have to start slowly and in several different settings, but start they should. Progress, such as it is, is far too slow and isn’t getting us much of anywhere. My nurse practitioner’s patients can’t wait forever.

Patients and Their Medical Data

Posted on April 4, 2016 I Written By

John Lynn is the Founder of the blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of and John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

Sometimes they say a picture is worth a thousand words. That’s what I thought when I saw this image from
Patient Health Data Sharing and Big Healthcare Data

It’s great to see talking about healthcare data. The authors are two people you likely know: Leonard Kish and Eric Topol.

This graphic shows the ideal. It’s interesting to think about what the reality would actually look like. Sadly, it would be much more complex, disconnected, and would lack the fluid sharing that this graphic shows.

It’s good to know what the idea for data sharing and understanding data would look like. Shows the potential of what’s possible and that’s exciting.

OpenUMA: New Privacy Tools for Health Care Data

Posted on August 10, 2015 I Written By

Andy Oram is an editor at O'Reilly Media, a highly respected book publisher and technology information provider. An employee of the company since 1992, Andy currently specializes in open source, software engineering, and health IT, but his editorial output has ranged from a legal guide covering intellectual property to a graphic novel about teenage hackers. His articles have appeared often on EMR & EHR and other blogs in the health IT space. Andy also writes often for O'Reilly's Radar site ( and other publications on policy issues related to the Internet and on trends affecting technical innovation and its effects on society. Print publications where his work has appeared include The Economist, Communications of the ACM, Copyright World, the Journal of Information Technology & Politics, Vanguardia Dossier, and Internet Law and Business. Conferences where he has presented talks include O'Reilly's Open Source Convention, FISL (Brazil), FOSDEM, and DebConf.

The health care field, becoming more computer-savvy, is starting to take advantage of conveniences and flexibilities that were developed over the past decade for the Web and mobile platforms. A couple weeks ago, a new open source project was announced to increase options for offering data over the Internet with proper controls–options with particular relevance for patient control over health data.

The User-Managed Access (UMA) standard supports privacy through a combination of encryption and network protocols that have a thirty-year history. UMA reached a stable release, 1.0 in April of this year. A number of implementations are being developed, some of them open source.

Before I try to navigate the complexities of privacy protocols and standards, let’s look at a few use cases (currently still hypothetical) for UMA:

  • A parent wants to show the child’s school records from the doctor’s office just long enough for the school nurse to verify that the child has received the necessary vaccinations.

  • A traveler taking a temporary job in a foreign city wants to grant a local clinic access to the health records stored by her primary care physician for the six months during which the job lasts.

The open source implementation I’ll highlight in this article is OpenUMA from a company named ForgeRock. ForgeRock specializes in identity management online and creates a number of open source projects that can be found on their web page. They are also a leading participant in the non-profit Kantara Initiative, where they helped develop UMA as part of the UMA Developer Resources Work Group.

The advantage of open source libraries and tools for UMA is that the standard involves many different pieces of software run by different parts of the system: anyone with data to share, and anyone who wants access to it. The technology is not aimed at any one field, but health IT experts are among its greatest enthusiasts.

The fundamental technology behind UMA is OAuth, a well-tested means of authorizing people on web sites. When you want to leave a comment on a news article and see a button that says, “Log in using Facebook” or some other popular site, OAuth is in use.

OAuth is an enabling technology, by which I mean that it opens up huge possibilities for more complex and feature-rich tools to be built on top. It provides hooks for such tools through its notion of profiles–new standards that anyone can create to work with it. UMA is one such profile.

What UMA contributes over and above OAuth was described to me by Eve Maler, a leading member of the UMA working group who wrote their work up in the specification I cited earlier, and who currently works for ForgeRock. OAuth lets you manage different services for yourself. When you run an app that posts to Twitter on your behalf, or log in to a new site through your Facebook account, OAuth lets your account on one service do something for your account on another service.

UMA, in contrast, lets you grant access to other people. It’s not your account at a doctor’s office that is accessing data, but the doctor himself.

UMA can take on some nitty-gritty real-life situations that are hard to handle with OAuth alone. OAuth provides a single yes/no decision: is a person authorized or not? It’s UMA that can handle the wide variety of conditions that affect whether you want information released. These vary from field to field, but the conditions of time and credentials mentioned earlier are important examples in health care. I covered one project using UMA in an earlier article.

With OAuth, you can grant access to an account and then revoke it later (with some technical dexterity). But UMA allows you to build a time limit into the original access. Of course, the recipient does not lose the data to which you granted access, but when the time expires he cannot return to get new data.

UMA also allows you to define resource sets to segment data. You could put vaccinations in a resource set that you share with others, withholding other kinds of data.

OpenUMA contains two crucial elements of a UMA implementation:

The authorization server

This server accepts a list of restrictions from the site holding the data and the credentials submitted by the person requesting access to the data. The server is a very generic function: any UMA request can use any authorization server, and the server can run anywhere. Theoretically, you could run your own. But it would be more practical for a site that hosts data–Microsoft HealthVault, for instance, or some general cloud provider–to run an authorization server. In any case, the site publicizes a URL where it can be contacted by people with data or people requesting data.

The resource server

These submit requests to the authorization server from applications and servers that hold people’s data. The resource server handles the complex interactions with the authorization server so that application developers can focus on their core business.

Instead of the OpenUMA resource server, apps can link in libraries that provide the same functions. These libraries are being developed by the Kantara Initiative.

So before we can safely share and withhold data, what’s missing?

The UMA standard doesn’t offer any way to specify a condition, such as “Release my data only this week.” This gap is filled by policy languages, which standards groups will have to develop and code up in a compatible manner. A few exist already.

Maler points out that developers could also benefit from tools for editing and testing code, along with other supporting software that projects build up over time. The UMA resource working group is still at the beginning of their efforts, but we can look forward to a time when fine-grained patient control over access to data becomes as simple as using any of the other RESTful APIs that have filled the programmer’s toolbox.