The first pertains to HITECH Act language regarding extension of HIPAA compliance to Google and Microsoft where he states:

It extends the privacy and security regulations of the Health Insurance Portability and Accountability Act to health information vendors not previously covered by the law, including businesses such as Google and Microsoft, when they partner with health care providers to create personal health records for patients.

At this time, neither Google or Microsoft provide the PHR to a hospital who then provides it to their customers.  Rather, the current model that both Google and Microsoft are using is one that supports portability of the consumer’s health record allowing the consumer to invoke an export of their records from the hospital to one of these Personal Health Systems (PHS), of course provided the hospital establishes a link to a PHS.  Our interpretation is that in this scenario, HIPAA does not extend to Google or Microsoft, as the consumer drives the transaction of data flow.  Hopefully, others in HHS will convince Blumenthal of this as well as otherwise, such HIPAA extensions may thwart portability and subsequently consumer engagement and ultimately control of their records.

The second Blumenthal comment that caught us off-guard pertained to the term “certified EHR” where he states:

ONCHIT currently contracts with a private organization, the Certification Commission for Health Information Technology, to certify EHRs as having the basic capabilities the federal government believes they need. But many certified EHRs are neither user-friendly nor designed to meet HITECH’s ambitious goal of improving quality and efficiency in the health care system. Tightening the certification process is a critical early challenge for ONCHIT.

While we certainly agree with Blumenthal that defining the critical terms of “certified EHR” and “meaningful use” is paramount and must be done quickly, yet judiciously, his views on certified EHR, as defined above are downright frightening for two reasons.

First, he condones the work of CCHIT as certifying the minimum capabilities for EHR.   Minimum capabilities?  If anything, those minimum capabilities are already restrictive in defining use of specific standards and models that do not provide the flexibility for true innovation.

What is even worse though, is that Blumenthal appears to want to extend certification requirements to “user-friendly” and defining how “quality and efficiency” will be embedded within an EHR.

User-friendly? There is simply no way you can certify such – end of story.  Let the market define what is user-friendly by what a doctor or hospital chooses to purchase.

Quality? Maybe, just maybe you can ask for the simplest of quality metrics to be recorded within the EHR, but highly doubt that is something you want to certify.  Would it not be better to simply verify quality actions supported as part of meaningful use reimbursement?

Efficiency? That is certainly not something you can certify and falls in the realm of implementation (process mapping/workflow) and training.  You can’t certify that!

Suggesting that we tighten the certification process is heading in the wrong direction.  Instead, we need to actually relax the certification process to encourage innovation in the HIT market allowing developers to create solutions that will truly provide value to their users while concurrently meeting the broader objectives of delivering better care and better outcomes.  Creating light certification criteria and focusing more on what outcomes we wish to see occur as a result of broad HIT adoption is where Blumenthal and his staff need to focus their energies.  To do otherwise will lead to a stifling of innovation, stalled HIT adoption among physicians and ultimately a poor investment of the tax payers’ dollars, which we can ill-afford.

We’ve downloaded the massive bill, which combined (it’s currently broken into two parts, Division A and Division B) comes in at about a 20MB PDF.  Once we’ve had an opportunity to extract the HITECH Act portion of the Bill, we’ll be providing a more detailed analysis on where that $19B is headed and how.  Not expecting much change as the original Senate and House versions were quite similar with largest divergence appearing to be with the Privacy provisions of the Act.

Update: Finally got the files downloaded.  To make it easier for you that are only interested in HIT, need only download Conference Report Division A – HITECH language begins on page 286.

And if that is not enough, you can always read the Opinion piece from the WSJ’s Feb 11th edition (Health-Tech Monopoly) which, oddly enough, shares some of our opinions on the HITECH Act.

Despite the rounds of applause from virtually all sectors of the healthcare establishment (AHA, HIMSS, AllScripts’ customers, etc.) the HITECH Act, as currently drafted in the Stimulus Bill (both House and Senate versions of HITECH are quite similar), will ossify healthcare IT (HIT) completely stagnating innovation in HIT.  It is also questionable as to how much the HITECH Act will actually contribute to the ulitmate objective; simply delivering better, more cost effective care.

That is not to say that the use of HIT can not improve outcomes, that it cannot improve health, far from it.  What we argue is that this legislation is extremely problematic for it has created an incentive structure that is not conducive to innovation.

Where did the legislature make a wrong turn?

As we mentioned in our previous post on the passage of HR 1, HITECH legislation is providing incentives for physicians to be reimbursed for the adoption of “certified EHRs”.  Certification, by its very nature, is a time consuming (some might say time wasting) exercise. Certification to standards is even worse (ever been a part of a Standards making body – they move at a glacial pace).  Stating that physicians will only be reimbursed for adopting certified EMRs basically puts the death nail into any innovative ideas that break from the cumbersome certification process or don’t adhere to some archaic standard like CCD.

Let us not also forget that the very word “certified” strikes fear into the heart of any Venture Capitalist (VC).  Honestly, who in their right mind would ever invest in a start-up that need to go through some arduous certification process to enter a market, a certification process established by players in a given market?  No, certification is good at creating moats and castle walls and not greenfields that foster opportunities for innovation.

A second key point and maybe even more important one is that if the purpose of HITECH is to deliver better, more effective healthcare than the incentives are completely misaligned.  Just because we reimburse a physician for purchasing a certified EHR, doesn’t automatically equate to their using the solution to deliver effective care. We are providing incentives for actions, not behaviors.

And what’s the alternative?

To truly foster an open market, open innovation and subsequently open adoption of HIT, it is necessary to create a legislative framework of incentives that focus on what behaviors we wish to see adopted by physicians and not which technologies we wish to see them use.

For example, if we were to develop an incentive program that simply asks physicians to do a quick review of a patient’s current medication list prior to writing a prescription for a new medication and include checking for possible interactions, (prof that they checked might be easily monitored through the major eRx clearing house SureScripts) we would see a likely decrease in adverse drug events (ADE).  This could easily be tied to the current eRx push by CMS.

In this example, we are not incenting the physician to use a certain technology, but adopt a certain behavior (check before prescribing).  Imagine the impact if we saw but a 15% drop in ADEs as a result in such change in behavior. Now that’s savings, that’s better healthcare and it is a greenfield of opportunity.  Similar behavioral incentives can be created in numerous other areas.

It is clear that the legislature took the easy path as it is far simpler (and politically more expedient) to create incentives for the adoption of a technology, certified EHRs, rather than the more strenuous task of creating incentives to encourage behavioral change.  Unfortunately, if the current legislation ends up with Obama’s signature, we will be pouring wet concrete into a market with woefully low HIT adoption.  When that concrete sets, it will be nearly impossible to chip-out and we will be left with an edifice of good intentions gone horribly wrong.

Halamka put up a very good post yesterday on what he foresees the ideal Electronic Health Record  (EHR) would look like.   Really a soup to nuts review going from clinical notes to images to labs to data  management and everything in between.  Well worth the read.

The only issue I had with the post was in the definition of EHR.  I go under the assumption that EHR=EMR + PHR.  So, while Halamka talks about a future EHR, looking more closely, he seems to be really talking about a clinician focused EMR system for there is no discussion of consumer input, or folding in of PHR information, (just pushing information out into a PHR).  This is a serious flaw, unless of course he replaces the EHR acronym with EMR in his post.

The future will have a consumer that is far more engaged in managing their health and probably a bit more demanding on the doctor.  The engaged consumer will want a greater say in the EHR, via their PHR.  Not accounting for such in the “Ideal EHR” results in an EHR that is paternal and will ultimately fail.

But really, does anyone in the right mind truly believe this is the problem with HIT adoption? There are a myriad of issues that are stunting the adoption of HIT that range from poor software to poor implementation of good software, to lack of training and the list goes on and on. Consensus on the definitions of five acronyms (EHR, EMR, HIE, PHR, RHIO) will solve NOTHING as it pertains to actual adoption of IT in the healthcare sector!

Maybe its just sour grapes on my part for I did not win the contract. One of the Beltway Bandits did and for a princely sum of $500,000. Hey HHS, I would have done it for you for a tenth of that amount and you would have the report by now. Better yet, maybe HHS can get its money back and instead go out and buy a box-car load of “Diffusion of Innovations“ by Everett Rogers, the undisputed Bible of how technology is adopted and diffused. Distribute the book to all HHS employees involve in HIT promotion efforts, study it closely and apply the concepts. Guarantee the results will be more productive than this definition effort which you are currently funding. (Note: Moore basically plagiarized Rogers’ work for his own Crossing the Chasm. Diffusion of Innovations is more academic and far more thorough than Chasing the Chasm).

But I digress.

This is one glaring example and quite possibly the most egregious of what is wrong with government efforts to date to drive adoption of HIT (actually gave it a “Golden Fleece Award” when I first heard about it). I have nothing against the many dedicated federal employees that are really trying to do the right thing, in fact, I have enormous respect for them for they really are taking on a herculean task. I just wish some of them would think more and do less.

Some of the key findings:

• 23% rely on their doctors to maintain their personal electronic medical record  and 3% maintain their own personal health record (PHR).
• 91% believe they have a right to the electronic medical records maintained by their physician.
• 77% want ability to schedule appointments by email/electronically.
• 75% want to communicate to their doctor by email (but the majority are unwilling to pay for such email consultations.
• Consumers are about 20% more confident that their doctor has an accurate medical history of them if the doctor/care provider is using an electronic medical record keeping system.
• And probably one of the most significant findings is that consumers realize that electronic records do increase the risk of breach of privacy (61%), they do believe by a 3 to 1 margin that allowing care givers and researchers to use electronic records can improve overall healthcare.

Apparently, at least based on these results, the consumer may not be as concerned about privacy has some may claim.  Yes, privacy is important, but consumers are willing to take some risks, provided thee rewards are better healthcare delivery, ease of interactions with healthcare providers and the potential for better treatments in the future.

You’ll find the WSJ story is here.

For example, they completely miss Microsoft’s HealthVault Connection Center capabilities yet conclude the article saying how the future may bring PHRs together with devices. Hey guys, the future’s already here! And like many before them, they refer to HealthVault as a PHR, but it is not. HealthVault is a PHP (personal health platform) on which other apps will sit, including PHRs.

The author also completely misses the multitude of PHRs now being sponsored by payers (Aetna, various BC/BS organizations, etc.), provider portals and even employers such as the big Dossia initiative and instead spend far too much time on Microsoft and Google (and Google doesn’t even have a product!).

These shortcomings are unfortunate, as the article does sincerely try to provide a comprehensive view but ultimately is misleading with gaps that are inexcusable.

Just as important as who is on the list are those who are not. Microsoft is the only leading software company, there are no insurance companies, no major hospitals, no major employers (e.g., Dossia’s sponsors), no AMA (though there is the American Chiropractors Association, American Association of Psychiatrists and American Psychoanalytic Association). Why these others not signing on to such a petition strikes me as a bit odd.

This is an important issue though that needs national (i.e., Congressional) action.

While attending the AHRQ event last month, I sat in on a session that focused on security and privacy, their current state across the country and potential impact to Regional Health Information Organizations (RHIO) or Health Information Exchanges (HIE). RTI International presented the results of their recent research on privacy and security policies and laws across the US. They found a very convoluted system with little if any consistency nationwide.

RTI’s research included a survey of nearly 4000 respondents in 38 states. They found broad variation of opinions on what actually constitutes privacy and the means by which they insure such for the patient. In some states with little if any privacy laws, HIPAA is the the ceiling. In other states, HIPAA is the floor and these states have passed laws that go well beyond HIPAA to protect a patient’s privacy. To only makes matters worse, what they also found is that in many states, privacy laws are scattered across any number of statutes that have been passed over the years making it extremely difficult for providers to know what they may be liable for, thus further hindering any form of consistent approach to patient privacy.

Yes, it is time for Congress to go back to the drawing boards and develop a clear and consistent set of statutes and policies for the nation to insure patient privacy. Until that is done, all this talk about an NHIN (National Health Information Network) is wasted breath.

Indivo has been one of those academic exercises where some interesting technology (a completely Open Source PHR) has been developed, tested and refined over the years (13 years and counting). The overall purpose has not been to create a product for the market per se, but to develop a platform that can be used to better understand the possible role of a PHR system in healthcare to improve outcomes. Over the years CHIP has addressed a whole host of platform development issues for Indivo from usability to interoperability, privacy, security and finally, consumer and physician adoption. But this has all been very much in an academic setting. Consequently, little real world testing has been done to date on Indivo platform and by real world I mean large-scale deployments and use. Note, they have done limited deployments at both Children’s Hospital, MA-SHARE, a regional RHIO, at MIT where they have a couple of hundred subscribers and in Canada where there are several hundred subscribers as well. They are also currently rolling it out at several other locations.

That is all about to change.

On Sept. 17th, Dossia announced that they had chosen Indivo as the platform for the 5 million plus employees, retirees and dependents, that Dossia’s employers represent. That is a massive leap forward and a huge vote of confidence for the folks at CHIP and their Indivo PHR. But a lot of questions have been raised as to how independent CHIP and Indivo will remain now that they have such a large client and even more importantly, there is a ton of cynicism regarding what the true motivations are of the employers that are sponsoring Dossia.

Will and Ken wanted to set the record straight. Following are a few highlights from our conversation (Note, these are NOT verbatim, but based on my quick notes):

Ques: How independent will Indivo Health remain? Does the agreement with Dossia put any restrictions on Indivo?

Ans: CHIP remains an independent non-profit entity directly responsible for Indivo. The Indivo platform will remain an Open Source platform and adhere to the conditions of the open source community for enhancements, distribution and use. There are no restrictions on CHIP’s ability to establish future partnerships/relationships with others. In fact CHIP maintains complete autonomy and can exit this agreement at any point in time.

One area that Dossia did insist on was for CHIP to establish a stronger governance model for developing and enhancing the Indivo PHR. This governance model will formalize the process by which enhancements are chosen for development, acceptance, QA/QC testing protocols and how such enhancements will be formally supported upon their release. (Ed. This makes good sense for as an academic exercise, this issue was not high on the priority list. Dossia’s insistence on this point will lead to a better product for the broader market.)

Ques: Who will actually operate and maintain the Dossia/Indivo PHR once it is live? When is go live date?

Ans: CHIP will be directly responsible for day-to-day operation of the Dossia PHR. They will be contracting with an outside hosting service to physically host the PHR. Data transmitted to and from the hosting service is completely encrypted, end to end, to insure security and privacy of employee records. They will roll-out Indivo to a small group of early adopters within the Dossia community later this year.

Ques: Will Dossia employers have access to employee data?

Ans: Employers will have absolutely no access whatsoever to employee data that is resident on the Indivo platform. Important to point out that according to Ken and Will, the employers insisted on this as well. (Ed. Enlightened employers are more concerned with helping their employees stay healthy, which provides a much greater contribution to their bottom line, than trying to weed-out those that may have health issues by digging into their records.)

Ques: What is the biggest challenge going forward?

Ans: This is just hard to do. It requires an in-depth examination of existing systems, addressing interoperability, developing mechanisms that autonomously and automatically update records (they’re experimenting with bots), enhancing the user experience and most importantly insuring privacy and security of the platform. A core operating belief at CHIP is to focus on the end user, the consumer/patient. This is reflected in what they prefer to call their PHR, a PCHR for Personally Controlled Health Record system with an emphasis on personal control. CHIP believes that if they can make Indivo work for the consumer, it will have a corresponding and positive impact on other healthcare stakeholders, chief among them, physicians.

Having worked in academia and in industry I have seen my fair share of such partnerships disintegrate due to diametrically opposing views on what the priorities should be. Academics typically want to pursue their research and get published (trust me, you don’t get published and receive the accolades of your peers by commercializing a product), while companies such as those associated with Dossia are interested in the product and not another paper for JAMIA.

But overcoming such differences will be relatively trivial compared to getting all stakeholders (providers, employees and payers) on-board the Dossia initiative adopting and using Indivo to produce better outcomes and health for the consortium’s massive employee base. But Dossia does represent massive buying power in the healthcare market and can use that to their advantage.

CHIP and Dossia are really breaking new ground here as this will be the first large scale deployment in the US of a multi-data sourced PHR serving such a large community nationwide. If they can move beyond some fundamental motivational differences there is a lot of potential here to really move the ball forward on consumer adoption and use of PHRs. But no doubt about it, we still have quite a ways to go and it will be hard work. Closely tracking this initiative will offer some important insights into the future of this evolving technology and the broader theme of consumer directed healthcare. Stay tuned.