7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK
278.6K views | +18 today
7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK
#survey #report #ebook #studies #ehealth #mhealth #healthcare
Your new post is loading...
Your new post is loading...
Rescooped by Lionel Reichardt / le Pharmageek from Healthcare in India
Scoop.it!

An overview of NDHM's Technology

An overview of NDHM's Technology | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

NDHM Architecture

NDHM is employing a federated architecture for its ecosystem. That means that management and data access occurs in a federated manner where different entities or systems will manage the health data.
There is no central data storage controlling and storing data.

Using the Federated Health Records Framework (FHR), patients can access and view their health records, and provide consent to any HIPs and HIUs to access their data.

To ensure smooth consented data sharing and time-bound data access, it is necessary to make the data traceable and auditable. Therefore the FHR Framework architecture leverages MeitY's Data Empowerment and Protection Architecture (DEPA) electronic consent framework, which is already being used in the financial sector.

Here are some interesting technical features of the NDHM ecosystem

FHIR for all Medical Data

Asynchronous APIs

Patient Privacy & Security Features of NDHM

- HIPs can only create data if authorized by the Patient:

- An HIU(Health Information User) can only get past health records of other HIPs if consented by Patient

- Peer to Peer Data Transfer Between HIP & HIU

 

Final Thoughts

It is one thing to have a concept and another thing to implement and execute it. So far NDHM seems to be going in the right direction. And there is hope that it will continue to do so.


Technology is being given equal importance to gain the trust of all players involved in this industry.

 

Privacy and Security have been a prime priority in the project as you can see from the above article, this is an oft-ignored aspect in old projects. Hope it continues to stay this way.

 

read the whole article at http://technology4doctors.blogspot.com/2021/05/an-overview-of-ndhms-technology.html

 

 

 


Lire l'article complet sur : technology4doctors.blogspot.com


Via nrip
No comment yet.
Scooped by Lionel Reichardt / le Pharmageek
Scoop.it!

Stanford Launches App That Connects to Epic EHR & Healthkit #esante #hcsmeufr #digitalhealth

Stanford Launches App That Connects to Epic EHR & Healthkit #esante #hcsmeufr #digitalhealth | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

tanford Health Care today announced its new iOS 8 MyHealth mobile health app for patients. Developed in-house by Stanford Health Care (SHC) engineers, MyHealth connects directly with Epic’s EHR, Apple’s HealthKit and cloud services for consumer health data monitoring.

The SHC MyHealth mobile app is designed to make it quick and simple for patients to manage their care right from their iPhones, including:

• Make appointments

• Get test results – your lab results are automatically made available in the palm of your hand

 

Communicate with your care team through a secure messaging system where your information is always kept confidential

• Have a video visit with your doctor through the new ClickWell Care clinic which gives you the convenient option of a “virtual” appointment

 

• Manage your prescriptions and medications

• View your health summary

• Access and pay your bills

• Share your vitals with your doctor via HealthKit integration

Secure Messaging


With the new MyHealth app, patients can communicate directly with their care team through a confidential and secure messaging system. In addition, the app automatically syncs with wearable and wireless products, allowing patients to take vital signs at home or on the go. That data is automatically and securely added to the patient’s chart in Epic for their physician to review remotely.

“The SHC MyHealth app allows patients to connect their lives with their health care,” said Pravene Nath, MD, Chief Information Officer, Stanford Health Care. “By integrating with companies like Withings, our physicians have access to meaningful patient data right in Epic, without having to ask the patient come in for an appointment. We believe this is the future of how care will be delivered for many types of chronic conditions.”

 

No comment yet.
Rescooped by Lionel Reichardt / le Pharmageek from healthcare technology
Scoop.it!

Exploring the Effect of Data on Precision Medicine Research #esante #hcsmeufr #digitalhealth

Exploring the Effect of Data on Precision Medicine Research #esante #hcsmeufr #digitalhealth | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

In a study published in the AMA Journal of Ethics, researchers explored the role of social and behavioral data in precision medicine research.

 

Electronic health records (EHRs) can offer information on social and behavioral data, which can aid research investigating genetic and social factors across health disparities; for example, factors such as substance use and eating habits inform some of the risk associated with preventable premature deaths in the United States. Brittany Hollister, PhD, and Vence L. Bonham, JD, from the National Human Genome Research Institute at the National Institutes of Health, discussed potential biases in collecting, using, and interpreting EHR-based data in precision medicine research.

 

Current collection of behavioral and social data by precision medicine researchers is increasingly done using EHR data, as opposed to self-report methods such as surveys. However, extraction and use of EHR data poses challenges of inconsistencies or inaccuracies. Another challenge is determining what data are included or excluded from EHRs, and the consequences of using data collected through biased methodologies. The National Academy of Medicine addressed some of this in recommendations for the systematic capture of behavioral and social measures.2 They recommended intentional collection of structured social environment data, as well as the development of a plan by the National Institutes of Health to include social and behavioral data in EHRs. The current inconsistencies in collecting social and behavioral data pose difficulties to use in precision medicine research, but with improved collection methods these difficulties could be amended.

 

more at https://www.medicalbag.com/ethics/precision-medicine-research-ehr-data/article/808747/

 

 


Via nrip
Rescooped by Lionel Reichardt / le Pharmageek from healthcare technology
Scoop.it!

EHR Communication and Diabetes Patient Outcomes

EHR Communication and Diabetes Patient Outcomes | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

A study to correlate EHR Communication with patient outcomes for diabetes patients reported that "EHR team communication flow patterns may be an important avenue to explore in raising quality of care and lowering costs for patients with diabetes in primary care." The study found that Primary care teams whose EHR communication reached more team members indirectly (ie, via message forwarding) had worse outcomes and higher medical costs for their patients with diabetes.

 

The study was carried out to determine how changes in electronic health record (EHR) communication patterns in primary care teams relate to quality of care and costs for patients with diabetes.

The Study Design: EHR-extracted longitudinal observational study.

A total of 83 health professionals in 19 care teams at 4 primary care clinics associated with a large Midwestern university participated in the study.

 

Counts of messages routed between any 2 team members in the EHR in the past 18 months were extracted. Flow-betweenness, defined as the proportion of information passed indirectly within the team, was calculated.

 

The analysis related changes in team flow-betweenness to changes in emergency department visits, hospital stays, and associated medical costs for the teams’ patients with diabetes, while adjusting for team face-to-face communication, patient-level covariates, comorbidities, team size, and clinic fixed effects.

Results: Patient hospital visits increased by 13% (standard error [SE] = 6%) for every increase of 1 percentage point in team EHR message forwarding (ie, higher team flow-betweenness). Medical costs increased by $223 (SE = $105) per patient with diabetes in the past 6 months for every increase of 1 percentage point in team flow-betweenness.

Conclusions: Primary care teams whose EHR communication reached more team members indirectly (ie, via message forwarding) had worse outcomes and higher medical costs for their patients with diabetes.

 

EHR team communication flow patterns may be an important avenue to explore in raising quality of care and lowering costs for patients with diabetes in primary care.

 

read the whole study details at  https://www.ajmc.com/journals/issue/2018/2018-vol24-n10/putting-the-pieces-together-ehr-communication-and-diabetes-patient-outcomes 


Via nrip
No comment yet.
Scooped by Lionel Reichardt / le Pharmageek
Scoop.it!

Who Owns The Data In Your EHR ?

Who Owns The Data In Your EHR ? | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

The concept of healthcare and EHR data ownership carries many implications for patients, providers, and medical practices. While experts agree that EHR vendors do not own the data, this has not prevented vendors from winning court disputes that resulted in serious financial losses for medical providers.

 

These considerations make the discussion of data ownership critical for any physician or medical practice that utilizes electronic health records.

 

Defining Data and Data Ownership

 

Healthcare data comes from a variety of sources. One is the patient themselves, who individually provide data to platforms such as patient portals. Another is the physician or healthcare team in the form of examination findings and clinical observations. Results from laboratory studies or radiology, along with data from other external healthcare providers or practices, also contribute to EHRs.

 

The number of parties who lay claim to healthcare data makes grappling with EHR data ownership even more complicated. Patients, providers, vendors, and the medical practice itself all have aninvestment in healthcare data, and there is often uncertainty over EHR data ownership. Amazingly both of these groups report that 20% simply don’t know who owns the data.

 

Establishing Data Ownership

 

The best method of minimizing disputes over EHR data ownership is prevention. Measures such as establishing data ownership early, defining terms, and enforcing guidelines are critical to minimizing trouble down the road. With EHR vendors, defining conditions of data exportation in the event the practice wishes to end a business relationship is critical.

 

For all parties, the concept of access must also be clearly defined. Terms include practice or provider access to data from the vendor’s servers, as well as patient access to healthcare data via portals or other mechanisms. The most common source of disputes is when a party wishes to leave the relationship; either the practice decides to select a different EHR vendor, or a patient wishes to port their data to a new provider.

 

Vendor Red Flags

 

For a medical practice, establishing terms of EHR data ownership must begin at the time of vendor selection. Identifying warning signs during this process can help providers avoid much larger issues in the future.

 

When choosing an EHR, keep an eye out for red flags such as unstructured data formatting (i.e. PDF instead of CCDA), an inability to meet the National Coordinator for Health Information Technology’s certification requirements,or restrictive contracts thatdemand exorbitant financial charges to port data in the event of a vendor switch.

 

Establishingproductive EHR data ownership for a healthcare organization takes careful planning.

 

The ZH Healthcare HITaaS (Health IT as a Service) architecture is designed with the needs of medical professionals and their patients in mind, meaning, among other things, that you own your data, and have complete administrative control.

 

 

No comment yet.
Rescooped by Lionel Reichardt / le Pharmageek from Health3.0- Migration towards Health as a Service
Scoop.it!

EHR Analysis More Effective, Cost Efficient Than Clinical Trials

The use of electronic health records to identify the best treatment option for patients is more efficient and less costly than the current clinical trial process, according to a study published in the journal Health Technology Assessment

Study Details

For the study, which was funded in part by the National Institute for Health Research and the Welcome Trust, researchers from several universities in the United Kingdom, used a new computer program in 23 approved general practitioners across England and Scotland.

 

The first part of the study used 300 patients' electronic health records, which are stored in the Clinical Practice Research Datalink and updated during routine medical visits, to monitor the effects of their prescribed treatments.

 

A second part of the study, which involved 31 participants, looked at the use of antibiotics among patients with chronic obstructive pulmonary disease.

 Study Findings

The researchers determined that they were able to understand health patterns related to specific prescribed medications and determine which treatments were more effective by analyzing EHRs.

 

They added that the EHR analysis offers a larger and more diverse overview of the general population than current clinical trial methods.

The researchers also noted that using EHRs allows the analysis to be conducted with minimal effects on the lives of the patients, whose involvement in the process stops after their initial consent.

 

According to the researchers, 26 out of 27 general practitioners who participated in the study expressed strong support for the use of patients' EHRs for research purposes. In addition, 10 patients who were interviewed by the researchers all said that their involvement in trial was an acceptable practice


Via nrip, Gilles Jourquin
No comment yet.
Scooped by Lionel Reichardt / le Pharmageek
Scoop.it!

'Dirty' data in EHRs could cause unnecessary expenses

'Dirty' data in EHRs could cause unnecessary expenses | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

The health IT landscape is changing at a rapid pace, and with this change there is critical work to be done to enhance data integrity and prevent unnecessary expense.

 

With the urgent need for telemedicine some vendors have had to change their course abruptly; some stayed the course but are working faster and harder to get their product to market.

 

Prior to the COVID-19 outbreak, there were physician practices in the middle of implementing new EHR systems.

 

These projects slowed down during the stay at home mandates, and hopefully project managers took that time to rethink implementation strategies and reengineer system configuration for the physicians’ upcoming workflow changes.

 

Researchers and data scientists, while still aggregating clinical data, have been forced to learn how to improve data accuracy and ultimately patient outcomes in a production environment.

 

No matter where you are in the health IT ecosystem during this birth of the new normal, there is one thing that everyone should be doing right now: It is absolutely imperative to clean up registration procedures.

 

Data that is stored in EHR, registration system, and ancillary systems is most likely dirty – and could well have a financial impact on health systems and physician practices.

 

A large group of physicians most likely uses different EHRs and registration systems across the healthcare system.

 

One registration system could have one field for "Street Address" where another could have "Address 1" and "Address 2" for "Street Address." This can cause an inconsistency in the address data and has caused mail to go to the wrong address.

 

Likewise, "Primary Care Physician" should be labeled correctly in the registration system. Data from the doctor table should be verified and adjusted as many times it is incorrect. Even if it is only the suite number that is incorrect, it still will cause snail mail to go to the wrong person.

 

This is where the expense begins:

  • One of the more common HIPAA violations is sending PHI to the wrong patient/address. This includes snail mail, email, and faxing and it can be information regarding a patient sent to the wrong patient address or sending patient information to the wrong physician address, fax number, or email address. While this is considered an accidental HIPAA violation, there is a defined course of action which must be followed or there will be fines. There also could be fines if this violation is repeated. 
  • The second area negatively impacted by the wrong address is patient billing. If the information is sent to the wrong address the out-of-pocket fees will not get paid on time, if at all. The billing companies may fix the error in their system after the payment becomes overdue and goes into collections. Now, the problem is compounded: there is also a patient who is getting calls from collections and they did not receive the bill in the first place. The next time the patient visits the physician it is quite likely that the registration system will send the same bad address data and it will overwrite the billing company changes, causing mail to once again be sent to the wrong address.

 

When working with big data, small inconsistencies in data entry matter.

 

Leaving the task of cleaning up your registration or demographic data to your data scientists or IT staff will be expensive. This is most likely what is happening now prior to and during research projects.

 

The first step to fix this downward spiral of dirty data and financial drain is to take an export from each registration system the practice uses.

 

Each systems export should contain a large list of patients, addresses, and demographic data to expose the most frequent and most disruptive data entry errors.

 

Based on the output, education should be given, and educational materials should be documented and distributed making sure to leave a cheat sheet at each registration desk.

 

The last and most difficult step is monitoring the data after registration to ensure the new procedures are being adopted.

 

If data is intended for improvement activities or research, and if an IT team is available, it may be helpful to have a separate database at the core of the healthcare system or larger practice to take in, electronically scrub, and store a clean copy of data. Just remember: garbage in, garbage out.

No comment yet.
Scooped by Lionel Reichardt / le Pharmageek
Scoop.it!

Healthcare providers to control all clinical content of the patient record #hcsmeufr #esante

Healthcare providers to control all clinical content of the patient record #hcsmeufr #esante | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

Turn health data into actionable, cost-saving strategies

oday’s healthcare challenges are no mystery. Hospitals and health systems are navigating the transition to value-based care while continuing to rely on traditional fee-for-service reimbursement models. Uncertainty about the future of health care in the United States is making this shift even more complex as organizations seek a path forward that conquers both known (and unknown) challenges ahead.

 

The standard advice heard across the industry is to “leverage data,” but how does a health system do this? Every healthcare delivery network in the country is rich with data, but how can this resource be applied for each of your care settings, clinicians and provider groups, payers and reimbursement models, and shifting populations?

 

Ensuring high quality patient care and outcomes while balancing financial realities in an evolving market requires a robust data analytics solution—one that can handle the breadth and complexity of health care today without an army of data analysts to make it work.


The 3M Performance Matrix Platform is a data analytics and performance management solution that combines 3M Health Information Systems’ decades of coding and risk-adjustment experience with the data processing power of Verily, an Alphabet company. The platform simultaneously analyzes performance in managing populations throughout your network across all visits, episodes of care and disease cohorts to:

 

  • Automatically identify the root causes of quality issues and excess costs to strengthen performance
  • Prioritize system-wide problem areas using advanced intelligent data processing power
    Work with experienced professionals to drive sustainable behavior change and process improvement

With Verily’s big data computing power, the Performance Matrix platform applies 3M’s risk adjustment methodologies and performance measures to all available data. It then mines this enriched data to identify and prioritize key problem areas. Rather than deploying teams of data analysts, the technology does the work for you.

 

Using Verily’s analytics engine and 3M’s real-world, proven methodologies, the platform helps improve performance by focusing on areas and interdependencies of preventable clinical and financial issues that stem from:

  • Under- and over-utilization of services or care settings
  • Avoidable care, such as readmissions and complications
  • Unnecessary costs
  • Post-acute services

 

3M Performance Matrix analyzes aggregated data against dozens of performance measures to identify and describe the most impactful problem areas. This combination of problem prioritization and analysis helps you focus on what can be fixed, and done differently, going forward. 3M Health Information Systems

Hyland Healthcare’s enterprise imaging

Hyland Healthcare’s suite of enterprise imaging solutions allow healthcare providers to control all clinical image content—including images from specialty departments. When integrated with a clinical imaging system or EHR, clinicians and staff can view medical images in the context of the patient record from within those familiar systems.

 

Eliminating departmental imaging silos improves clinical workflows, strengthens security of protected health information (PHI), enhances disaster recovery, and eases the burden of building and supporting multiple clinical imaging interfaces to the EHR. The following are core components of Hyland Healthcare’s enterprise imaging portfolio.

Acuo VNA

The Acuo Vendor Neutral Archive (VNA) provides standards-based enterprise access to medical images regardless of viewing application, offering independence from proprietary archives, and streamlining clinical workflows.

 

The solution leverages technologies to support the management and sharing of medical images across the enterprise and beyond, allowing providers to assemble a comprehensive image-enabled patient record.

 

With on-site, cloud, and hybrid deployment options, Acuo VNA supports business continuity and disaster recovery strategies while providing a platform for clinical content integration, interoperability, and exchange.

NilRead

NilRead, a multi-specialty, zero-footprint enterprise viewer, provides a universal vendor-independent platform for accessing a full range of DICOM and non-DICOM image data. Integrating seamlessly with most EHR, PACS, or VNA, NilRead identifies and ingests images from virtually any departmental archiving solution—whether dermatology JPEGs, data-intensive virtual pathology slides, or radiology DICOM files.

 

This scalable solution is based on a zero footprint, web-based architecture, meaning only a browser is needed to launch the application. There is no software or plug-ins and images never reside on the workstation. NilRead runs on any web-enabled mobile device, tablet, or PC, providing clinicians with constant access to medical images and remarkable tools to enable collaboration across the enterprise.

PACSgear

PACSgear solutions complete the enterprise imaging framework by allowing providers to capture a variety of documents, film, photos, video, and other media and integrate them with any EHR, VNA, or PACS. Hyland Healthcare’s ModLink software uses DICOM Structured Report or HL7 measurement data from ultrasound, DEXA, and CT devices to auto-populate reports in voice recognition systems. Meanwhile, ImageLink worklist solution manages HL7 to DICOM MWL mappings, facilitating Integrating the Healthcare Enterprise (IHE) workflow for interoperability with existing PACS.

PACSgear connectivity offerings:

PACS Scan, PACS Scan Mobile, PACS Scan Film, PACS Scan Web, EHR Gateway, ModLink, Media Writer, Gear View QC, MDR Video – Touch, ScopeCap, DICOM Box, and Image Link.
Hyland Healthcare

Alliance Community Hospital first MEDITECH customer to deploy CommonWell Services

MEDITECH, an Enterprise Health Record (EHR) vendor and Contributor Member of CommonWell Health Alliance, has deployed CommonWell interoperability services at Alliance Community Hospital (ACH). The capabilities will enable ACH, a non-profit hospital serving the residents of Alliance, OH, to exchange patient information seamlessly for improved patient care and quality outcomes.

 

MEDITECH is the first EHR vendor in CommonWell to deploy the Argonaut Project’s FHIR specifications to customers for the purpose of document exchange, providing near real-time access to a participating patient’s data. Embedded directly into the MEDITECH EHR, these CommonWell services include patient enrollment capabilities and C-CDA exchange, opening the door for more comprehensive sharing of discrete segments of data in the future, such as medication and allergy data.

 

Today, more than 9,300 provider sites are Live on CommonWell services across the nation, and more than 30 million individuals are enrolled..

 

Accelerate and improve patient care anytime, anywhere with secure mobile app AlertView

AlertView, the mobile application developed by Novarad Healthcare Enterprise Imaging, was created to accelerate healthcare by notifying physicians via text message that reports and findings are ready for review.

 

AlertView makes healthcare more efficient by eliminating unnecessary delays in the review of imaging reports. The AlertView app instantly sends a text message to referring physicians, radiologists, or cardiologists alerting them that a report is ready for review. No matter where they are, they can review with one click on the text message, and have this instantly shared with other medical care professionals. This type of mobile communication and collaboration improves patient outcomes while minimizing disruptions for primary care physicians and hospital staff.

 

The app’s features include secure login with TouchID, a dynamic patient list to enable quick searches, extensive filtering including modality and time filters, a convenient basic report view along with an in-depth full report view, display of all key images in the study, and enhanced data security through deep linking

NeXus Portal Solutions's curator insight, April 2, 2019 4:19 PM

Health Cost Saving Strategies

Rescooped by Lionel Reichardt / le Pharmageek from healthcare technology
Scoop.it!

Persuasive EHR Workflow Design Increased Same-Day Data Entry by 10% #esante #hcsmeufr #digitalhealth

Persuasive EHR Workflow Design Increased Same-Day Data Entry by 10% #esante #hcsmeufr #digitalhealth | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

Incorporating persuasive design concepts into primary care electronic health records (EHRs) increased same-day data entry by 10 percent per physician, demonstrating the potential for persuasive design to change data entry behavior, a study published in JMIR Human Factors revealed.

 

Persuasive design is a way of developing technology to influence behavior by leveraging social processes. Healthcare stakeholders have primarily focused on using persuasive design in consumer-facing mobile apps to improve outcomes, but there are few examples of using persuasive design to influence clinician behavior.

 

In primary care settings, providers often face barriers to entering data into EHRs in a timely manner.  Data entry tasks often take a long time, and users may feel as if completing documentation is a lower priority than seeing patients or finishing other tasks.

 

“Persuasive design is a viable approach for designing and encouraging behavior change and could support effective data capture in the field of medical informatics. There may be opportunities to continue improving this approach, and further work is required to perfect and test additional designs,” the team concluded.

 

read the original unedited article at https://healthitanalytics.com/news/persuasive-ehr-workflow-design-increased-same-day-data-entry-by-10

 

 


Via nrip
Rescooped by Lionel Reichardt / le Pharmageek from healthcare technology
Scoop.it!

Enhancing Patient Care with Clinical Documentation Improvement #hcsmeufr #esante #digitalhealth

Enhancing Patient Care with Clinical Documentation Improvement #hcsmeufr #esante #digitalhealth | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

Clinical documentation improvement (CDI) ensures that health services are accurately documented and helps healthcare coders and physicians work toward improved patient care while also streamlining productivity.

 

When meaningful clinical data is captured, organizations can ensure improved quality reporting, clinician productivity, and even better clinical information delivered at the point of care.

 

Phoenix Children’s Hospital recently opted for CDI at its outpatient clinics with Medicomp Systems.

 

It’s important to help physicians make patient care faster, safer, and more efficient.

 

Every single symptom, sign, medication, surgery, drug, operation procedure, almost a repository of more than 360,000 terms, they have structured and coded with every possible common coding schema, such as ICD-10,” he continued.

 

Having 360,000 terms can be overwhelming, but they were built along disease patterns. If a physician entered that a patient had asthma, or tried to research asthma in the database, it went out to all related items that were related to asthma and it brought them together in a manner of an automatic template that was a quick, rapid initial draft.

 

There is no magic formula with clinical documentation and finding an applicable system for an organization.

“You cannot take shortcuts. You cannot not capture things that are critical and essential,”

 


Via nrip
ScientificAnimations's comment, May 22, 2018 8:46 AM
Blockchain is a system that makes health information accessible to doctors from anywhere, anytime, and on any electronic medical system. http://sco.lt/5yVeuP
Scooped by Lionel Reichardt / le Pharmageek
Scoop.it!

Will 2016 be Another Year of Healthcare Breaches?

Will 2016 be Another Year of Healthcare Breaches? | 7- DATA, DATA,& MORE DATA IN HEALTHCARE by PHARMAGEEK | Scoop.it

As I listened to a healthcare data security webinar from a leading security vendor, I had to ask: “Are we now experiencing a ‘New Normal’ of complacency with healthcare breaches?” The speaker’s reply: “The only time we hear from healthcare stakeholders isAFTER they have been compromised.”

 

This did not surprise me. I have seen this trend across the board throughout the healthcare industry. The growing number of cyberattacks and breaches are further evidence there is a ‘New Normal’ of security acceptance — a culture of ‘it-is-what-it-is.’ After eye-popping headlines reveal household names were compromised, one would think security controls would be on the forefront of every healthcare action list. Why then are we seeing more reports on healthcare breaches, year after year? 

 

This idea comes from the fact that, due to a lack of enforcement, acceptable penalties, and a culture of risk mitigation, more breaches are to be expected in the healthcare industry. Until stricter enforcements and penalties are implemented, a continuation of breaches will occur throughout the industry.

 

The Office of Civil Rights (OCR), the agency overseeing HIPAA for Health and Human Services, originally scheduled security audits for HIPAA to begin in October 2014. Unfortunately, very few audits have occurred due to the agency being woefully understaffed for their mandate covering the healthcare industry, which accounts for more than 17 percent of the U.S. economy.

 

Why Sweat a Breach?

Last September, newly appointed OCR deputy director of health information privacy, Deven McGraw, announced the launching of random HIPAA audits. In 2016, it is expected 200 to 300 covered entities will experience a HIPAA audit, with at least 24 on-site audits anticipated. However, this anticipated figure only accounts for less than one percent of all covered entities —not much of an incentive for a CIO/CISO to request additional resources dedicated to cybersecurity.

 

Organizations within the industry are approaching cybersecurity from a cost/benefit perspective, rather than how this potentially affects the individual patients. For payers who have been compromised, where will their larger customers go anyway? Is it really worth a customer’s effort to lift-and-shift 30,000, 60,000 or 100,000 employee health plans to another payer in the state? This issue is similar to the financial services industry’s protocol when an individual’s credit card has been compromised and then replaced, or when individual’s want to close down a bank account due to poor service: Does anyone really want to go through the frustration with an unknown company?

 

For some of the more well-known breaches, class-action lawsuits can take years to adjudicate. By then, an individual’s protected health information (PHI) and personally identifiable information (PII) has already been shared on the cybercriminal underground market. In the meantime, customers receive their free two-year’s worth of personal security monitoring and protection. Problem solved. Right?

 

The Cost of Doing Business?

When violations occur, the penalties can sting, but it’s just considered part of the cost of doing business. In March 2012, Triple-S of Puerto Rico and the U.S. Virgin Islands, an independent licensee of the Blue Cross Blue Shield Association, agreed to a $3.5 million HIPAA settlement with HHS. In 2012, Blue Cross Blue Shield of Tennessee paid a $1.5 million fine to turn around and have another HIPAA violation in January 2015..

As of December 2015, the total number of data breaches for the year was 690, exposing 120 million records. However, organizations are unlikely to be penalized unless they fail to prove they have steps in place to prevent attacks. If an organization does not have a plan to respond to a lost or stolen laptop, OCR will possibly discover areas for fines, but this can be a difficult process. Essentially, accruing a fine after a cyberattack or breach is relative.

 

A more recent $750,000 fine in September 2015 with Cancer Care group was settled, but the occurrence happened in August of 2012 — nearly three years later. A 2010 breach reported by New York-Presbyterian Hospital and Columbia University wasn’t settled until 2014 for $4.8 million. Lahey Hospital and Medical Center’s 2011 violation was only settled in November 2015 for $850,000. With settlements taking place several years after an event, settling may appear to be a legitimate risk assessment, further reinforcing the ‘New Normal’ of cybersecurity acceptance.

 

At one HIMSS conference, the speaker emphasized to a Florida hospital the need to enforce security controls. They replied with, “If we had to put in to place the expected security controls, we would be out of business.”

 

Simply put: The risks of a breach and a related fine do not outweigh the perceived costs of enhancing security controls. For now, cybersecurity professionals may want to keep their cell phones next to the nightstand.

Guillaume Ivaldi's curator insight, April 2, 2016 10:18 AM
Simply amazing: cost of providing a decent security is clearly not aligned with the business outcomes, and therefore it is economically better to endure the fine than being fully compliant to the regulation ...
Elisa's curator insight, April 2, 2016 5:47 PM
Simply amazing: cost of providing a decent security is clearly not aligned with the business outcomes, and therefore it is economically better to endure the fine than being fully compliant to the regulation ...