Senate bill expands the use of telehealth services, remote patient monitoring for Medicare Beneficiaries

6 senators of U.S. have launched legislation seeking to remove hurdles to the use of telehealth services and remote patient monitoring for Medicare beneficiaries.

Sens. Brian Schatz (D-Hawaii), John Thune (R-S.D.), Roger Wicker (R-Miss.), Benjamin Cardin (D-Maryland), Thad Cochran (R-Miss.), and Mark Warner (D-Va.) launched the bipartisan Creating Opportunities Now for Necessary and Effective Care Technologies (CONNECT) for Health Act of 2017.

“Telehealth is the future of healthcare. It expands access to care, lowers charges and assists more people stay healthy,” stated Schatz. “Our bipartisan bill will assist change the way sufferers get the care they need, improving the healthcare system for both patients and healthcare providers.”

The CONNECT for Health Act builds on the provisions of another recently launched Senate bill—the CHRONIC Care Act—which targets to improve health outcomes for Medicare beneficiaries living with chronic ailments by, among other provisions, expanding access to telehealth services.

For its part, the CONNECT for Health Act calls for:

• Expansion of telehealth services in accountable care organizations (ACOs) and Medicare Advantage, as well as for home dialysis and telestroke services for purposes of evaluating acute stroke


• Broadening the utilization of remote patient monitoring for certain high-risk, high-cost sufferers


• Bolstering telehealth services and remote patient monitoring services in rural health clinics, federally qualified health centers, Native American sites, and permitting global and bundled payments


• Developing direct authority for the Secretary of the Department of Health and Human Services to lift existing restrictions on telehealth when certain quality and cost-effectiveness criteria are met


• Expanding the utilization of telemental health by providing the HHS secretary the authority to lift restrictions for few mental health services

The legislation has been endorsed by more than 50 agencies, involving ACT|The App Association, American Telemedicine Association (ATA), College of Healthcare Information Management Executives and the Healthcare Information and Management Systems Society (HIMSS).

“The CONNECT for Health Act gives a carefully crafted approach to star assisting countless American Medicare recipients realize the benefits of connected health technology,” claimed Morgan Reed, executive director of The App Association. “By lifting arduous limitations on the use of telehealth and motivating Medicare physicians to use creative remote monitoring technologies, responsible and secure connected health solutions might be introduced more broadly throughout the continuum of care to make better the patient health outcomes.”

“Medicare beneficiaries deserve access to telehealth services already available within nearly every other health program involving Medicaid, Veterans Health, private insurance policies and most recently TRICARE,” stated Jonathan Linkous, CEO of the ATA. “This bill might be their best hope for this Congress.”

Likewise, HIMSS appreciated the bill and pledged their support for its reforms.

“We consider that the CONNECT for Health Act will modernize healthcare delivery for Medicare beneficiaries by removing obstacles to the use of telehealth and other healthcare technologies like remote patient monitoring, resulting in higher access to high-quality care, improved continuity of care and better value for sufferers and the Medicare program,” stated HIMSS in a written statement.

 

Use cases will indicate development in data exchange

Data exchange among healthcare agencies has acquired increased significance as many in the regulatory sphere now recognize the significance of ensuring the free flow of information among all constituents.

Pressure is rising to make sure that the industry isn’t engaged in blocking information, either due to the competitive pressure or technical issues.

This year’s progress in acquiring interoperability will be on display at HIMSS17, where 34,000 square feet of floor space will be utilized to show industry progress in exchanging data or information among several partners in healthcare.

In the Interoperability Showcase, HIMSS gives an immersive experience that indicates the use of data and its exchange or data exchange, through several profiles and standards with live products that are presently in the marketplace.

“Because of the shift from fee-for-service to value-based models, the new showcase moves from beyond concentrating on the EHR as the sole data source for electronic health information, to a wide range of health information technologies utilized by individuals, providers and researchers,” HIMSS claims.

The emphasis at HIMSS17 will go beyond just indicating interoperability in transactions to more complex information exchanges. The showcase has been redesigned to show how interoperability will be fleshed out in a variety of use cases.

Several tours in the interoperability showcase will follow the exchange of information in the following areas:

• Accountable care


• Public health reporting


• Commonwell care transitions


• Community health


• Diabetes management


• Surgery and recovery


• Patient data reconciliation

The showcase is the outcome of collaborative effort between public and private sector vendors and represents months of work to develop standards-based demonstrations of interoperability from the perspective of an individual like a clinician, caregiver, administrator or patient.

The Interoperability showcase is open February 20 through 22 anytime during exhibit hours in booth 9000 in the exhibit hall.

Basic information about the Interoperability showcase can be found here.

 

HIMSS guidance investigates latest malware, ransom threats

A recent cybersecurity environmental scan report from the Healthcare Information and Management Systems Society (HIMSS) investigates new malware and ransom threats, provides new guidance from various sources and involves few new services from vendors.

For example, The United States Computer Emergency Readiness Team has issued an alert on the Avalanche botnet that distributes malware to victims and provides remediation measures. Information from the Internal Revenue Service can assist healthcare agencies targeted by tax fraud schemes.

Newer ransom threats involve GoldenEye, which is similar to Petya and Mischa malware and encrypts files while also locking the hard drive of computer. And then there is Popcorn Time, which is ransomware that doesn’t need a payment from its victims if they attempt to infect a couple friends, HIMSS reports.

Another innovation: To decrease credit card fraud with “card not present” transactions, OberThur Technologies makes a credit card with a security code that refreshes automatically and randomly each hour.

The HIMSS guidance further involves a link to Nova Labs, which provides a virtual cybersecurity lab to raise awareness within agencies. The lab is a game where players defend a company increasingly under attack by making better the defenses, cracking passwords and creating code.

The report of cybersecurity environmental scan is available here.

 

 

We require national cyber leader, says HIMSS

The Healthcare Information and Management Systems Society (HIMSS) are calling on the Department of Health and Human Services to elect a national cyber leader who would facilitate in an elevated chief information security officer position.

In specific, a latest HIMSS policy paper touts an expanded position for the HHS chief information security officer, with responsibilities inside the organization but also working with outside healthcare stakeholders to instruct cyber security attempts. Leo Scanlon is the present CISO at HHS. In accordance to HIMSS, they need a national cyber leader.

To become less of a target, HIMSS calls on entire stakeholders to exchange data on cyber risks, threat actors, susceptibilities and mitigation attempts. This level of collaboration, which Scanlon or another CISO could assist with, could eliminate policy, cultural and financial roadblocks that inhibit establishment of latest cyber security solutions.

The association also is pitching for adoption of a universal privacy and security framework across the company. Particularly, it suggests the NIST Cybersecurity Framework.

HIMSS doesn’t find a mandate for use of the NIST Cybersecurity Security Framework, as its members have made it obvious that they are overwhelmed with plans and do not need new rules or laws, claims Lee Kim, director of privacy and security at HIMSS.

Moreover, setting a mandated security framework in law wouldn’t be practical, Kim further adds. “We’ve observed how steadily regulations and laws get written and put into force. By that period, the threat landscape will have completely changed.”

The policy statement, Kim points out, is aspirational with a message that the industry requires getting better and increase its cyber protection capabilities.

Any framework should involve model cybersecurity architectures, risk assessments, business associate agreements, support of individual privacy/security rights, and a national strategy for patient identification and matching.

Particular aims for national cyber leader to target involve expanding the pool of qualified cyber personnel, making sure the adequate risk and asset response, advancing education, accepting lessons from HITECH-funded Regional Extension Centers to impress small providers and timely sharing of threat data, among others. The HIMSS position statement is present here.

Latest Avaya Technology Deals Healthcare Industry's 34% Record Number of Security Violations

Healthcare technology leaders visiting HIMSS 16 next week will have a 1^st -hand look at a distinctive network solution that enables information technology to simply connect, secure and manage the increasing number of medical devices deployed throughout healthcare services. Established by Avaya, a global leader in business communications, with important input from a leading healthcare organization, SDN Fx Healthcare is the 1^st industry solution to deal the management and security of the Internet of Things for healthcare that can assist to reduce exposure in light of a growing number of security breaches.

Digital healthcare is driven by 3 requirements: security, patient experience, and reducing skyrocketing costs. A 2015 report cited by Government Health IT shows more than 34 percent of healthcare records have already been breached -- the greatest figure of any industry. The top 10 breaches alone impacted more than 111 million records. Industry analysts at IDC Health Insights predict that one in 3 health care recipients will be the victim of a healthcare data breach in the year 2016.

Legislation's policy for HIT rating network gets thumbs down

An intended rating methodology to assess the abilities of EHR systems is getting mixed opinions from stakeholders.

If the Senate health committee has its path, the federal government soon will develop a star-rating system for EHRs deployed on 3 critical criteria—security, usability and interoperability.

Although, the policy is not getting great marks from industry groups like the EHR Association and Healthcare Information and Management Systems Society. In fact, many in the industry claims the private sector is better complimented to make those types of assessments.

Micky Tripathi, president and CEO of the Massachusetts eHealth Collaborative, is blunt about it—it deserves 2 enthusiastic thumbs down.

The intended legislative policy for a HIT rating network is a “terrible and misguided” concept, Tripathi states.

“The market is already doing this, and it is a much great place to do it,” he claims. “Every comment I have observed from industry is that it is a bad concept. The government is merely not equipped to do it with the type of complication and nuance that is going to be needed. For me, the problem is they will not do it well enough, and it has the potential to have insidious impacts on innovation.”

On the day of February 9, the Senate committee unanimously passed the Improving Health Information Technology Act (S. 2511), which involves provisions for a government-sponsored HIT rating network.

Those who established the legislation claims the intent is to assist contributors make more informed purchasing decisions in choosing EHR products and vendors. Under the proposal, the Office of the National Coordinator for Health IT will serve as the designated agency for publishing the criteria and methodology that will be utilized to determine the rating network.

The rating system, to be handled by a “development council” that will be composed of representatives from accredited certifying bodies, testing laboratories and ONC, would provide systems a 1-, 2-, or 3-star rating.

Additionally, the legislation provides the Secretary of Health and Human Services the authority to decertify vendors’ HIT products if they acquire a 1-star rating and do not make better their score; these vendors will have an opportunity to establish a corrective action policy, but will require acting on it and making better their rating.

Under the measure, EHR vendors are needed to report on the performance of their products every 2 years. Those that fail to report their performance would be termed to fines and potential decertification. The fines accumulated would be utilized to create a “revolving user compensation fund” to assist the offset costs of purchasing latest certified HIT for consumers whose products were decertified.

“I cannot conisder a government agency making yelp ratings for EHRs."

“Overall, we seek the proposed rating system to be duplicative—EHR assessment information is already presently available from private firms, as well as through the Office of the National Coordinator for the certification program of Health IT,” claims Leigh Burchell, chair of EHRA and vice president of government affairs for Allscripts. “We recommend instead that it would be more effective to utilize programs and resources already in place—like ACB surveillance, the Open CHPL and funding relevant research through AHRQ—to make certain that the market has the data required to make smart buying decisions.”

John Halamka, MD, CIO of Boston’s Beth Israel Deaconess Medical Center claims that the EHR rating system is the mere provision of the Senate’s Improving Health IT Act to which he objects. “I can’t consider a government agency making Yelp ratings for EHRs. The Health IT Standards Committee particularly pointed out that this is not a suitable role for government,” contends Halamka, who serves as vice chair of the HIT Standards Committee.

In accordance to Eric Helsher, vice president of client success for Epic, the EHR vendor gave feedback to the Senate committee that a government-led rating network would be “duplicative, more expensive and less effective” than what private firms such as KLAS and HIMSS Analytics presently provide.

“We recommended they look to making that kind of private data more available to the contributor community and also make CMS’s existing information on Meaningful Use and EHR certification more intuitive,” Helsher offers. “The latter is publicly present now but not easily utilized.”

Similarly, HIMSS discusses that such a rating system is not essential because private sector groups are already evaluating EHRs. “Instead of establishing a new rating system, consideration should be provided to leveraging these private sector attempts,” the group told the committee in a letter it submitted previous month.

The HIMSS letter also stated that a rating system deployed on user feedback would “introduce excess subjectivity, if not suitably weighted in the star rating methodology.” As the group points out, EHR consumers “don’t always have thorough understanding of what is executed by the product as opposed to the atmosphere in which the product is being utilized.” The rating system “should be highly deployed on objective measures with few grounding in existing certification criteria,” HIMSS emphasizes.

Nevertheless, the Senate is moving forward with a government-sponsored HIT rating network—the brainchild of Sens. Bill Cassidy, MD (R-La.) and Sheldon Whitehouse (D-R.I.), who in the month of October 2015 launched the idea in the Transparent Ratings on Usability and Security to Transform Information Technology (TRUST IT) Act, which has now been incorporated into the Improving Health Information Technology Act bill.

Calling it “an unbiased rating system” for HIT products, Cassidy stated that the TRUST IT Act provisions would “help strengthen accountability and improve transparency” in EHR networks. “This bill aids to make interoperability by preventing data blocking, and making a business incentive through the rating program to make sure that all networks work together to seamlessly share data for patient care,” claims Cassidy in a statement he released after the unanimous approval of the act by the committee.

Healthcare connectivity all sets to merge with value-based care

When it comes to nationwide seamless health data inseparability, persons may disagree on the actual definition, but they can surely agree on 1 thing: We do not have it now.

There is been important growth on few applications, like Direct secure messaging, exchanging of continuity of care documents and e-prescribing. And in some geographic places, health data exchanges have great participation and advanced capabilities that have been established over decades.

Vendor-based attempts such as Epic Systems Care Everywhere and the multivendor network CommonWell Health Alliance are famous with their consumers, however neither claims universality. CommonWell rolled out nationwide in the year 2015 and claims 5,000 contributors in its network, while Epic’s Care Everywhere claims more than 300 participating customers, each representing numerous contributors. In the month of April 2015, both networks dropped few of their charges to contributors for sharing data, in part a reaction to a report from the Office of the National Coordinator for Health IT condemning industry practices that result in “data blocking.”

But for the most part, data sharing among unrelated contributors—however increasingly necessary in a world moving toward value-based care —is erratic, clunky, inconvenient and not just ready to have the promised influence on decreasing costs and making better the quality of care.

“I need to be capable to look at a unified diabetes flowsheet with data from everywhere the care was done,” states Danny Sands, MD, a medical informatics expert who also practices internal medicine at Beth Israel Deaconess Medical Center in Boston. “Merely flipping screens and looking at data from other places does not solve my issue. If it is too difficult to look at the data, it becomes easier to reorder the tests.” He is chronically annoyed by the inability of unrelated institutions—even those right across the street from each other in Boston’s hospital-dense Longwood Medical Area—to integrate their data.

“It is all about the workflow,” claims Chuck Christian, vice president of technology and engagement for the Indiana Health Information Exchange. “If you desires to have a bad day with physicians, mess up their workflow or make them learn a latest one that they consider is less effective.”

From a physician’s perspective, analyzing at a [Consolidated Care Document] is like rummaging through a “junk drawer” in search of that one elusive item. “They do not need to hunt for what they want,” Christian states. “They do not even want to open the drawer.”

However overall growth has been slow so far, it is not for deficiency of time, energy or thought. Multiple public and private entities are chipping away at each of the many hurdles to interoperability.

In the month of November, ONCHIT issued the final version of “Connecting Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap,” an agency strategy that lays out an ambitious objective of acquiring a fully interoperable national “learning health system” by the year 2024, and identifies 4 places that must be dealt to achieve that objective:

1. Standards: Make better the technical standards and implementation guidance for priority data domains and connected elements.


2. Financial Incentives: Quickly shift and align federal, state and commercial payment plans from fee-for-service to value-based models to stimulate the needs and demands for interoperability.


3. Privacy and Security: Clarify and align federal and state privacy and protection needs that ensure interoperability.


4. Consistent Business Practices: Cooperate among stakeholders to promote and align consistent plans and business practices that motivate interoperability and deal those that impede interoperability.

Since the report was issued, a variety of tasks in the industry illustrate the interest in and movement making interoperability a true reality. They involve:

• In the month of January, the College of Health Information Management Executives (CHIME) began its National Patient ID Challenge, with $1 million to the 1^st individual who figures out how to precisely match sufferers with all their information without resorting to the clearest solution, a national patient ID, which federal entities are officially forbidden by Congress from creating. Entries are due by the month of April 8.


• A survey issued in the month of January by Premier, a healthcare alliance of nearly 3,600 U.S. hospitals and 120,000 other contributors disclosed that integrating information from out-of-network contributors—a key objective for interoperability attempts—is the top HIT challenge for 80% of  ACOs (accountable care organizations).


• Also in the month of January, DirectTrust (an alliance of participants in the exchange of secure health messages using the Direct protocol) declared that 44 million messages were exchanged among its members in the year 2015. DirectTrust observes that this year’s message volume will top 200 million, and 2017’s could quadruple to more than 800 million, if present trends sustains. The network now involves more than a million trusted addresses.


• In the month of December, ONCHIT issued its 2016 Interoperability Standards Advisory, which not merely catalogs existing and emerging standards to meet particular interoperability requirements, but also gives implementation specifications so that vendors and agencies can incorporate the standards into their networks in a consistent way. “It is a great contribution, because before, vendors could make their own choices and contributors were stuck,” claims Joyce Sensmeier, vice president of informatics for HIMSS. “If 2 vendors have executed a standard in the similar way, the odds [of interoperability] are better.”


• Also in the month of December, Carequality (a public-private collaboration of vendors, contributors, health data exchanges and other interested parties) issued its Interoperability Framework, a set of guidelines for establishing the business agreements to enable trusted data exchange. In late January, 5 major HIT vendors were the 1^st to commit to using the framework.


• HIMSS’s interoperability certification program, ConCERT, initiated about a year ago, will declare its 1^st group of certified products at the upcoming HIMSS meeting in Las Vegas. It will be indicating its abilities at the Interoperability Showcase on the exhibit floor. The products must motivate both Direct secure messaging and query-based exchanges.

“I consider a tremendous amount of growth has been made, but it is been from the bottom up,” states Micky Tripathi, chief executive of the Massachusetts e-Health Collaborative, which assists agencies implement electronic health records and health data exchanges. MAeHC is serving as project manager for The Argonaut Project, a joint attempt by vendors and contributors to establish FHIR-based application programming interfaces (see sidebar).

Tripathi analyzes that various great interoperability projects, like the phone system and the ATM network, grew in regional pockets, instigated by market forces that propelled the essential technological innovations, until the market forces and the technology both reached the critical mass essential to link everyone. He appreciates that the complications of healthcare pose distinctive barriers—for starters, there are fifty different state privacy laws.

The interoperability conversation is going to flip pretty rapidly when compensation is based on value. 

“FHIR is not going to solve that issue,” he claims. “The query is what ecosystem you require to motivate these APIs. A good developer can write a complete functional app within a week, but then they try to plug it in and the system claims, “Sorry, we will not let you in!’ “

HIMSS’ Sensmeier hopes the remaining obstacles to fall soon. “The interoperability conversation is going to flip pretty rapidly when compensation is based on value,” she states. “That is going to need clinical integration like nothing we have today. If you have to indicate results from your sufferer population and show you are improving them with the care you offer, you have to have interoperability in place.”

While the technological hurdles to interoperability are being knocked over one by one, the non-technological hurdles are proving more stubborn. Until now, the business case for contributors to share data was much less attractive than the business case for not sharing.

“If we require progress in one place, it should be the incentive and motivation side,” states Julia Adler-Milstein, assistant professor in the School of Information at the University of Michigan, who recently served on an interoperability activity force assembled by the ONC’s Health IT Policy Committee.” We require a group of stakeholders saying we require solving these issues.”

Getting contributors to pay for health data exchanges has been one of those issues, but new compensation models may nudge contributors toward identifying their value. “The market has been ambivalent about HIE services, so clients have not been excited to pay for them,” Adler-Milstein states. Her recent research indicates that health data exchanges are seeking ways to offer extra value to their clients, in the form of analytics services and ways to integrate information to support value-based care.

Sometimes the simplest solution is the place to begin, and Adler-Milstein analyzes much near-term promise in vendor-based networks like Epic’s Care Everywhere. “They made it quite convenient for anyone who has Epic to turn on this functionality, and they had a take-it-or-leave-it access to governance,” she states. “Everyone who is had the option has said yes.”

Although, proprietary solutions will not solve the long-term issue, and she would like to see the vendor community try to acquire something close to plug-and-play interoperability. “We could push a lot harder on EHR vendors to work among themselves, if we truly needed to make some quick growth,” she states.

The market has been ambivalent about HIE services, so clients have not been excited to pay for them. 

The Michigan Health Information Network (MiHIN), a consortium of Michigan HIEs, has appointed to prove its value “one use case at a time,” states executive director Tim Pletcher, MD. “We consider that persons actually only do what they are paid to do or punished for not doing,” he states. To that end, the agency has chosen particular tasks, such as reporting immunization data to the state, which is needed by the government’s meaningful use incentive program, and made them convenient to do through the HIE. It is also helping contributors share admission, discharge and transfer [ADT] data, and Pletcher claims 98% of the state’s admissions can be accessed on the network.

Erica Galvez recently left her post as ONC’s interoperability portfolio manager to become the director of health data exchange at Aledade, a company headed by former National Coordinator Farzad Mostashari. Aledade serves the establishment of physician-led accountable care organizations and is presently active in 11 states. In her latest capacity, she analyzes even more clearly the business-related hurdles to full and easy information sharing. She is presently focused on making certain ADT data flows from hospitals to physicians, so they can manage care transitions.

“The difficult thing is brokering the agreement: the terms and conditions, the pricing, and how we will get the data up and running,” she states. “Once we can agree, receiving the technical nuts and bolts in place is pretty easy. It is that up-front negotiation around ‘Here is why you should let your information go, and here is how you can do it in a HIPAA-compliant manner, and here is the economical value of that data.’”

Sufferer matching, necessary for making certain contributors are retrieving data on the correct sufferer, remains a formidable issue, as CHIME has identified with its $1 million prize. IHIE’s Chuck Christian, who is also chairman of the CHIME Foundation board, recently got a personal look at the issue when he and his wife made a visit to the island of St. Lucia to celebrate their 40^th wedding anniversary.

They were staying at a famous resort where guests sign for all their on-site purchases and then settle up when they leave. When he was fed up to make a purchase in the gift shop, to his astonishment, the salesperson inquired him to verify his identity with his passport. “Turns out there were more than 1 Charles Christian at the resort that week,” he states. “In a resort with merely 700 persons.”

Every day, 10,000 persons in the U.S. turn 65, and few of them inevitably have the similar name, analyzes Dean Sittig, professor of biomedical informatics at the University of Texas Health Science Center at Houston. He has done extensive research on how to stop errors in medical data, and claims misidentification of sufferers is one of the most usual and dangerous mistakes.

Most identifiers are not distinctive, or even permanent, he states. Most females change their names at least once in their lives, and one in 4 persons change their address in any given year. “Even gender is not as permanent as we thought,” he states. “We cannot have interoperability if we cannot match your information when we shift it from 1 place to another.”

Hospitals coming under growing hack threats

Phishing created huge news in healthcare previous year – the really bad type.

This access for acquiring nefarious approach to network credentials was reported to be the cause of 2 of the greatest attacks reported in the healthcare industry previous year – the hack of 78.8 million identities from Anthem, and an additional 11 million identities hacked in a violation or breach at Premera.

Hacking or IT tragedies resulted in the release of protected health data of approximately 112 million individuals, over 65 times the number of such tragedies last year.

While the hacks reported at Anthem and Premera accounted for the lion’s share of those numbers previous year, hackers are utilizing phishing gambits more immensely, raising the requirement for healthcare organizations to make certain that workers and staff are aware of the threats.

In a basic phishing attack, hackers utilize urgent emails or phone calls to trick a person into revealing data network credentials. When workers unintentionally share sensitive network access information with a hacker, it can be the start of a cyber attack that can compromise great amounts of protected health data. Due to the ease of entry and deficiency of detectability, hackers may be capable to roam around a network for weeks without raising any red flags.

Phishing is not merely targeted at the greatest healthcare organizations; a latest survey by the Healthcare Information Management and Systems Society discovered that 69% of respondents have experienced a phishing attack.

Security incidents including those from outside the organization caused significant issues for some of the agencies responding to the HIMSS survey. Of all respondents affected by a breach, 21% reported the loss of information, and a total of 16% reported either primary disruption or actual damage to their IT networks.

Attacks at Anthem and Primera were frighteningly easy, in accordance to the annual report on healthcare security breaches, by Bitglass, a security solutions vendor. In the Anthem and Premera breaches, hackers utilized an approach called domain spoofing; in which hackers register variations on the real domain name, such as “prennera.com” or “we11point.com” in the Anthem breach.

Phishing emails were sent to workers to bait them to use the spoofed sites, and workers then logged into the fake sites, offering hackers the credentials. From there, workers then are diverted back onto their companies’ sites, so they are totally unaware that they have been the subject of a phishing threat or attack, Bitglass reports.

While the approaches of the hackers now seem obvious in retrospect, it is not simple for workers or staff to recognize such trickery. They are busy in their jobs, may be flooded with emails as section of their jobs, and they may not have the technical acumen to spot misleading emails or spoofed URL addresses.

Beyond that, many healthcare agencies have not trained workers on how to spot phishing attempts and thwart them. Although, even those agencies that have conducted this training have seen workers get lax and fall victim to a phishing email.

For training to be effective and influence long-term behavior, training requires being comprehensive, and reminders must be in place over time so that workers do not get complacent afterward, claims William Woodward, a research associate at Aite Group, a consulting and research firm.

One-off training events or memos do not give enough long-lasting protection, specifically in healthcare atmospheres, where the threats of successful intrusion can be catastrophic. “You cannot carry on like you did before,” he emphasizes. “The costs of cyber attacks are so high that you have to contribute in deeper training.”

Agencies should be conducting simulations of attacks so workers can identify the signs that something is not right; that helps to sustain the training so they identify an email that should not be opened or a phone call that should be considered suspicious.

Then, agencies should follow up by conducting penetration testing by expert firms that are ethically hacking workers to assess awareness levels, Woodward states. If testing finds most workers are still clicking on phishing emails, then training should be done more on daily basis. Twice-a-year training sessions would be the most effective, but that may not be cost effective for small agencies, he claims.

Attacks are getting growingly sophisticated, Woodward warns. A worker may click on a link that has the agency’s URL and not notice other data in the URL that should raise suspicions. Or a worker may get an email or chat message from a purported IT technician at the agency, saying he will call soon. Such a message should previously be treated with skepticism, because while an email address can be verified, that is generally not possible with a phone call, Woodward states. “These are things that should not be transmitted by email or provided over the phone.”

Excellent cyber security boils down to general awareness, Woodward states. “Treat it like any other training, with evaluation sheets and systematic reviews. Bring in external expertise to be more aware of the risky landscape. They will be up to speed on latest tactics and offer you external eyes to analyze what you are doing.”

What is the actual worth of EHRs?

Acceptance of electronic health records since the year 2009 has been quick and pervasive in the healthcare industry. Utilizing meaningful use as a barometer, 95% of all eligible hospitals and 54% of office-deployed physicians have installed the networks to an extent enough to qualify for incentive funding under the federal EHR Incentive Program.

But there is mixed views on whether those networks have delivered actual value. Much depends on the measuring stick that researchers hold against electronic health records.

For instance, the capability to derive value from the networks has been restricted by ease of use problems, contends the American Medical Association. The national professional association for physicians is becoming more vocal in its message that the very incentives proposed to drive widespread acceptance of EHRs have exacerbated and, in some examples, straightly caused usability challenges.

Meanwhile, a survey of healthcare agencies with a track record of EHR contribution and expertise report that their executives are agreed that they are acquiring a return on their electronic investment. Still, those similar executives report deficiency of satisfaction with the networks among nurses and physicians, which restricts the value the EHRs could deliver to their agencies.

Answering the query of value will become even more crucial, as healthcare agencies sustain to invest time, effort and finances in installing and optimizing their utilization of clinical systems. Acquiring value, in terms of return on investment, will be necessary in coping with value-based care models.

The survey of hospitals with “greatly sophisticated EHR systems” by the Healthcare Information and Management Systems Society (HIMSS) discovered that the profits of using EHRs for these institutions far outweigh any of the perceived pitfalls, researchers summarized.

The 2016 HIMSS Value of Health IT Survey discovered that 88% of healthcare agencies with advanced EHR settings identified at least 1 positive outcome from their utilization of an EHR. Some 83% reported increased efficiencies in their respective clinical staff’s quality performance. Additionally, 81% demonstrated that their agency documented at least 1 positive influence in acquiring savings.

Still, challenges exist. Only 44% of respondents from these agencies reported that the EHR systems increased nurses’ satisfaction, and only 29% reported increased satisfaction among physicians. Researchers attributed the staff satisfaction outcomes to the “important disruptiveness the EHR has for clinicians.”

Because the 52 executives surveyed by HIMSS depict an elite group of healthcare agencies—entire HIMSS Analytics EMRAM Stage 6, Stage 7 and Davies Award winning hospitals—the outcomes are not surprising, in accordance to Sarah Corley, chief medical officer of vendor NextGen Healthcare and vice chair of the Electronic Health Records Association.

“One would hope these findings, since entire respondents are high-performing organizations,” Corley states. “We find the survey is a valid depiction of the experiences of this subset of users. Although, this is not going to represent the broad experience of the market, because most agencies are not at this level of sophistication. It does, however, indicate that with concentration and attention to optimizing health IT deployment, agencies should hope to see value, as experienced by this cohort.”

But the experience of some high-performing agencies in the HIMSS survey does not depict the fact that most contributors are struggling to acquire value from costly IT investments, critics argue. The AMA has raised its posture nationally to express members’ requirements for more usable networks that give value in their clinical practices.

“Most electronic health record systems fail to support efficient and effective clinical work," argues AMA President Steven J. Stack, MD. “This has resulted in physicians feeling increasingly demoralized by technology that interferes with their ability to provide first-rate medical care to their patients.”

At the similar time, while the utilization of EHRs in healthcare is near ubiquitous, the industry still suffers from a deficiency of interoperability between these networks. For instance, merely about 40% of hospitals nationwide routinely have electronic approach to essential clinical data from outside contributors or sources when treating a sufferer, in accordance to the Office of the National Coordinator for Health IT.

And, however EHRs have the potential to decrease medical errors and adverse events, contributors have observed a range of unintended consequences that actually launch new areas of risk, involving the misidentification of patient records.

“Sufferers receive care in various different healthcare settings, and these settings are often unconnected,” states Tejal Gandhi, MD, president and CEO of the National Patient Safety Foundation. “Our system is presently too fragmented to make certain that all of the data gathered in each setting gets reported, recorded, and dealt where it should.”

Still, HIMSS researchers and the advanced EHR agencies that engaged in the recent survey say their experiences should motivate others in the industry to persevere and anticipate acquiring eventual value for their attempts.

Lorren Pettit, vice president of research for HIMSS, calls these comtributors the EHR “pioneers” who are “seeing what the land ahead looks like for others and are reporting back.” These leading agencies are documenting the profits of EHRs in clinical settings, he considers, and there is much that can be learned from them.

Case in point: HealthNet, Indiana’s greatest federally qualified health center, which was named a 2015 HIMSS Ambulatory Davies Award recipient. With the help of an EHR and a variation of IT interventions, HealthNet has decreased low birthweights, make better care outcomes for pediatric patients, and importantly increased patient satisfaction. Additionally, the utilization of the EHR system from eClinicalWorks improved sufferer management and billing, which has produced a 230% return on investment since the year 2009.

“We never had the capability before to track these types of data elements,” asserts Donald Trainor, MD, chief medical officer at HealthNet, who has led the agency through its EHR execution across nearly 40 locations. “We can really run reports that look at our complete universe of 60,000 active sufferers and measure quality results.”

Most EHR systems fail to support efficient and effective clinical work. 

HealthNet’s experience speaks straightly to the value discussion, states Eric Helsher, vice president of client success for Epic, one of the country’s greatest EHR vendors. Optimized use of such networks enable health systems to continually pick particular clinical improvement or cost-reduction objectives and acquire them. “Health systems we work with have decreased infections, averted diabetes-related amputations, increased depression screening, and gave better and less costly care by remotely monitoring sufferers in the hospital or at home,” Helsher claims.

Centura Health, which manages sixteen hospitals in Colorado and Kansas, has derived value from its implementation by acquiring an important reduction in medication errors through using its hospital and ambulatory EHR system from MEDITECH. Additionally, the 2015 HIMSS Enterprise Davies Award winner used its systems to lessen hospital readmissions for sufferers with chronic conditions.

"Spread out as we are with sixteen hospitals, trying to do this without EHR technology would be impossible,” states Dana Moore, senior vice president of information technology at Centura. “What having a better EHR does is it offers a foundation to construct upon to find those problem areas and to initiate solving them.”

Although, Pettit appreciates there is a “learning curve” for realizing these types of clinical efficiencies. “It is not a slam dunk. You do not just slap in the EHR and then tomorrow you see profits,” he summarizes.

Learn more about Stage 2 of Meaningful Use at HIMSS 2013

Attending HIMSS? Join CMS for an Educational Session on Stage 2 of Meaningful Use in the EHR Incentive Programs

 

CMS is participating at the 2013 Healthcare Information and Management Systems Society (HIMSS) Annual Conference & Exhibition in New Orleans from March 3 – 7.

 

Representatives from CMS are located at booth #2868 from 9:30 a.m. – 1:00 p.m. and 2:30 – 6:00 p.m. CT today to discuss the Medicare and Medicaid EHR Incentive Programs.

March 5 Educational Session

If you are attending HIMSS, please join CMS' educational session #62, Stage 2: EHR Incentive Programs, held today in New Orleans Theater C from 9:45 – 10:45 a.m. CT.

 The session will discuss:

• An overview of the Stage 2 final rule


• Stage 2 CQMs


• Medicare payment adjustments and hardship exceptions

Join the Twitter Conversation!

CMS is tweeting from HIMSS13 about the EHR Incentive Programs and other HIMSS13 news. Join the discussion by following the @CMSGov Twitter handle, and look for tweets with the hashtags #HIMSS13 and #CMSeHealth.

Want more information about the EHR Incentive Programs?

Make sure to visit the EHR Incentive Programs website for the latest news and updates on the EHR Incentive Programs.

CMS is at the HIMSS 2012 Conference!

Visit the CMS Booth and Attend CMS Presentations at HIMSS 2012

CMS is participating in this year’s Healthcare Information and Management Systems Society (HIMSS) Annual Conference & Exhibition in Las Vegas, Nevada from February 21-24. Representatives from the Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs will be at Booth #14624 during exhibit hall hours to discuss all of your questions about the programs. There will also be computers available at the booth so attendees can work with a CMS representative to register for the programs on site.

Today’s CMS Booth Session

If you are at HIMSS, you can attend today’s CMS presentation “Medicaid Patient Volume” held at the CMS booth. The presentation will be held today from 3:00 to 3:30 pm PT.

Today’s CMS Educational Sessions (Not Held at the Booth)

CMS will be presenting at the following educational sessions today, which will be held in the meeting rooms listed below:

• Session #17 - CMS Townhall - Lando 4303 (9:45-10:45 am PT) 


• Session #33 - Focus on Meaningful Use Stage 1- San Polo 3503 (11:00 am-12:00 pm PT)

Join the Twitter Conversation!

CMS will be tweeting from HIMSS12 about CMS’ EHR presentations and other HIMSS12 news. Make sure to join the discussion by following the @CMSGov Twitter handle, and look for tweets with the hashtags #CMSEvent and #HIMSS12.

Want more information about the EHR Incentive Programs?

Make sure to visit the EHR Incentive Programs website at http://www.cms.gov/EHRIncentivePrograms for the latest news and updates on the EHR Incentive Programs.