Enabling EHRs to Improve Care

In last month’s Archives of Internal Medicine, researchers at Stanford University released results of a three-year study that found EHRs in the ambulatory setting did not improve the quality of care [Reference]. There are, however, a number of limitations to the study, including the use of process measures (what was done) instead of outcome measures (the results of care) to measure care quality, the use of data that was collected around five years ago, and the fact that the doctors’ ability to use the EHRs properly were not assessed. Nevertheless, the study’s results do raise serious concerns.

To me, these findings are no surprise. I wonder why anyone would assume that today’s minimalistic and immature EHRs (in which I include EMRs)—along with a healthcare system largely based on pay-for-procedure/fee-for-service economic models—would boost care quality or efficiency. I’m not saying EHRs can’t help improve care dramatically; instead, I’m asserting that EHRs must be greatly enhanced—in both their usefulness and usability—before significant benefits can be realized.

The core issues, as I see them, are (a) EHRs’ failure to provide patient centered cognitive support and (b) our economic model in which financial incentives, such as pay-for-performance, fail to promote better quality [Reference].

One thing that’s needed is much better clinical decision support (CDS) from next-generation EHRs. The EHRs should provide CDS based on ever-evolving, individualized, evidence-based guidelines and pathways that focus on increasing value to the patient. In addition, the EHRs should deliver to researchers comprehensive (de-identified) data collected from everyday clinical practice. The researchers would use these data, along with controlled clinical trials, to develop and continually improve personalized CDS guidelines/pathways supporting diagnostic and treatment decisions for physical and psychological sick-care and well-care (prevention).
The other thing needed is to incentivize providers who deliver high value (cost-effective) care to the patient. Data from the EHRs would be used to calculate such incentives.

Constructing the Ultimate EHR

I just started a discussion on LinkedIn that focuses on answering the questions: How can the EHR be transformed into the cornerstone of a comprehensive health IT system that fosters continually increasing care value (cost-effectiveness)? This “Ultimate EHR” discussion follows a discussion at LinkedIn in which reasons for EHR failures have been examined thoroughly. The purpose of the current discussion is to use the knowledge of such failures to guide the construction of a blueprint of an EHR that helps providers achieve the best possible outcomes at the least possible cost. The link to the discussion is: http://linkd.in/hUPJqf

Here's the introduction

In addition to discussing conventional methods, participants in this discussion are encouraged to present their innovations, creative ideas, and novel strategies. We will examine and critique these technologies, concepts and approaches in order to define a next-generation EHR that helps transform clinical data into actionable information and evidence-based knowledge aimed at increasing healthcare value (quality and efficiency) ; e.g., see http://bit.ly/eal8CS and http://bit.ly/hoQKTG.

We will seek creative solutions to daunting challenges such as determining the best ways for EHRs to:

• Evaluate data integrity to help assure the data contained are valid
• Securely exchange patient data between disparate “silos”
• Build lifetime medical records that provide the specific information tailored to the need of clinicians from every type of specialty/discipline, and in every healthcare setting, through use of different models that adapt the clinical terminologies, data sets, analytics/rules, forms, reports/views and overall UI to the end-users particular requirements
• Promote a strong and productive link between scientific research and clinical practice (“bench to bedside”) by (a) delivering de-identified patient data from everyday clinical practice to central repositories where researchers use them in developing evolving evidence-based personalized guidelines (http://bit.ly/giw1kF) and (b) propagating those guidelines—using clinical decision support functionality—without fostering “cookbook” medicine or stifling innovation
• Improve decision-making by providing patient-centered cognitive support (http://bit.ly/EzWgF)
• Manage expansive and every-changing clinical data standards, including terminologies, care processes and outcome measures
• Support the delivery of “whole-person integrated care” (http://bit.ly/7BVuA5)
• Handle images of all kinds (http://bit.ly/hu3NCH)
• Interoperate with other health IT tools
• Accommodate ALL meaningful use requirements, now and forever?

 All questions, comments and ideas are welcomed.

Healthcare Reform Models Focusing on Value to Consumers – Part 3

My two previous posts (starting at this link) and this one discuss on how to bring high value to the healthcare consumer. I examined the two important models of healthcare delivery--the Patient Centered Medical Homes (PCMHs) and Accountable Care Organizations (ACOs)--and explored meaningful financial incentives models. In this post, I discuss issues concerning health information technology (HIT).

I defined high-value healthcare as cost-effective products and services that keep people well and improve the health & wellbeing of people who are ill. Providers (clinicians and healthcare organizations) who want to deliver such high-value healthcare require more than a desire to give their patients top quality affordable care. They also need a wealth of knowledge about the best way to prevent, diagnose and treat a wide range of health problems. This not only means continually learning, but also having access to latest evidence-based research and the guidance needed to use one’s knowledge in a way that fosters the best diagnostic and treatment decisions.

The only way to achieve high-value healthcare is to reform our current healthcare system, so it focuses on these two goals:

• Enabling all clinicians to continually learn how to make (and keep) their patients healthiest and happiest for longest, using the most cost-effective methods of treatment and prevention, and encourage/reward them for doing so.
• Enabling all consumers/patients to continually learn how to make (and keep) themselves healthiest and happiest for longest, using the most cost-effective methods of self-care and self-maintenance, and encourage/reward them for doing so.

Such a high-value healthcare system presents daunting challenges, however. One is being overload with overwhelming amounts of new information appearing daily. Another is the limited capacity of the unaided human brain to acquire, retain, recall and apply complex information about the human body and mind. See, for example, this link about the knowledge gap. Add to this the fact that we have a broken healthcare system full of perverse incentives (e.g., pay for procedure/volume rather than for delivering value), and there’s little wonder why healthcare in America is lower quality and much more expensive than in many other countries.

One crucial element of a high-value healthcare system it the sensible use of advanced HIT. That’s because HIT has the potential to bridge the knowledge gap and foster providers’ ability to deliver higher value care. The HIT industry, however, is having difficulty understanding what has to do; it has largely failed to develop the tools providers and patients need to increase healthcare’s value.

Consider this: The cornerstone of HIT—the electronic health record (EHR)/electronic medical record (EMR)—has been around for about 30 years. One would think, therefore, that today’s EHR/EMRs are successful. Well, knowledgeable experts have been having a great discussion at the HIMSS Linked-In group about this topic, with well over a thousand comments posted thus far. While some of the commenters believe that EHR/EMRs have been successful, most do not. The group gave many reasons for their failure, which focused primarily on technology, people and money.

From an HIT perspective, I indicated that before we can discuss EHR/EMR success or failure, we should first describe its primary goals. We could then determine whether the tools are achieving those goals. I therefore created a chart that defines three levels of EHR/EMR capabilities (weak, moderate and strong), the requirements for achieving success at each level, and the degree of usefulness of each level.

=====================================

Healthcare Reform Models Focusing on Value to Consumers – Part 2

This post follows up on my previous one about Patient Centered Medical Homes (PCMHs), Accountable Care Organizations (ACOs), and Meaningful financial incentives models. In this post I focus on the issue of how to incentivize healthcare providers in PMCH-ACOs who render high value care to their patients.

According to a recent article by the New England Journal of Medicine:

The challenges to implementation of the PCMH model include two issues that lie beyond the direct control of the primary care practice. First, although the model calls for primary care practices to take responsibility for providing, coordinating, and integrating care across the health care continuum, it provides no direct incentives to other providers to work collaboratively with primary care providers in achieving these goals and optimizing health outcomes. Second, although evidence suggests that increased investment in primary care can result in savings from several types of reductions…most primary care practices do not…share in these savings…and under the…fee-for-service payment system it is unlikely that other providers will respond to reductions in the number of referrals or admissions by allowing their incomes to fall [Reference 1] .

These issues can be resolved if the PCMH model were implemented in the context of an ACO, which is:

…a provider-led organization whose mission is to manage the full continuum of care and be accountable for the overall costs and quality of care for a defined population. Multiple forms of ACOs are possible, including large integrated delivery systems, physician–hospital organizations, multispecialty practice groups with or without hospital ownership, independent practice associations, and virtual interdependent networks of physician practices.

Regardless of the organizational structure, an ACO will not succeed without a strong foundation of high-performance primary care…investment in the PCMH model could accelerate the development of high-performing ACOs…Performance measurement for determining the amount of shared savings or other financial incentives for ACOs must weight primary care measures heavily rather than focus narrowly on metrics related to hospital care…[And] the payment mechanisms used must align the incentives of the two models to increase accountability for total costs across the continuum of care while ensuring that a sufficient investment is made in primary care capacity. [Reference 1]

Payment models to support such PCMH-ACOs could include:

…fee-for-service payment and share in any cost savings achieved relative to a risk-adjusted projected spending target for their patient population; alternatively, payment could be partially or fully capitated, with risks and gains both being shared by all providers. Performance measurement to evaluate the quality of care and to prevent potential overuse (in fee-for-service organizations) and underuse (in capitated ones) is a cornerstone of the model. [Reference 1]

[For a PCMH]…a primary care fee for all primary care or a blended payment of part fee-for-service and part monthly medical home fees, is beginning to take hold…But the most complex case is when a single global fee (or risk-adjusted capitation payment) is made for all of the care a patient needs—including preventive care, basic primary care, specialty care, emergency care, hospitalization, and post-acute care that is provided by numerous independent providers over a period of time. In that case, where should the payment go? If savings across the entire continuum of care are to be shared with providers, how should those savings be distributed?

[If the PCMH were also an ACO (PCMH-ACO), then]…physicians and other providers…agree to be accountable for the total care of patients, their outcomes, and the resources used in providing it. This solves the basic question of "to whom should I write the check" and leaves it up to the organization to decide how best to compensate providers for their contribution. [Reference 2]

In other words, providers collaborating in a PCHM-ACO work together to prevent and treat patients' health problems by focusing on delivering higher quality and lower cost care through use of cost-effective evidence-based guidelines, along with more efficient and coordinated workflow processes. Instead of paying each provider a separate fee for tests and services rendered, the PCHM-ACO team approach can adopt a combination of the following payments models:

• The primary care physician (PCP) could receive fee-for-service payments plus additional fees for running the PCMH.
• The PCP and specialists treating the patient could receive a flat fee for each patient to cover the entire episode of care, with the amount based on the severity of the patient's health problems; if they deliver high quality care at a cost lower than projected for similar patients, they would share the savings as well.

And as with any performance-based accountability system, it is important to determine the best ways to measure important aspects of care quality, minimize the cost of delivering such care, and reward those who accomplish these objectives, including:

• Mak[ing] the performance rewards large enough to matter, but not larger than the actual benefit of the improved performance.
• Creat[ing] measures that people can influence. Do not hold people accountable for problems outside of their control. [Reference 3]

Note that various types of performance measures have been endorsed by different organizations, including Physicians Quality Reporting Initiative (PQRI) process guidelines [Reference 5] and ones that:

…can be calculated using longitudinal administrative data…but it should be possible to get even richer data more widely available…One 'gaping hole' where more experimentation is needed…risk adjustment…We don't know how to case-mix adjust for episodes of care. We can't even agree on the definition of episode of care. [Reference 6]

The "richer data" mentioned above should include comprehensive clinical biopsychosocial data … [wellness wiki Reference 6].

And finally, a PCMH-ACO ought to have these four characteristics, which shared by all ACOs:

1. …an evidence-based approach to medical care; using the body of medical evidence
   
2. …heavy investments in information technology to organize data so that caregivers have the most accurate information available
   
3. …quality and cost reporting—the ability to actually report on costs and how quality is affected
   
4. …To be successful…the purchasers of healthcare [must] distinguish between the highest value of all the ACOs in that market and direct their people to those organizations…Price…or premium controls…[should be] based on quality and cost reductions…demonstr[able] through data on a defined population. [Reference 7]

In my next post, I'll discuss the health IT requirements for a sustainable PCHM-ACO.

References

[1] Primary Care and Accountable Care — Two Essential Elements of Delivery-System Reform http://healthcarereform.nejm.org/?p=2205

[2] Coherent and Transparent Health Care Payment: Sending the Right Signals in the Marketplacehttp://www.commonwealthfund.org/Content/Blog/Aug/Coherent-and-Transparent-Health-Care-Payment.aspx

[3] Financial Incentives Can Improve Public Sector Performance http://www.rand.org/news/press/2010/08/09/index1.html

[4] Building A Path To Integrated-Care Payment Systems http://healthaffairs.org/blog/2010/02/12/building-a-path-to-integrated-care-payment-systems/

[5] Physician Quality Reporting Initiative (PQRI) http://www.cms.gov/PQRI/

[6] Wellness Wiki http://wellness.wikispaces.com/Using+Claims+Data and http://wellness.wikispaces.com/Tactic+-+Deliver+Biopsychosocial+Healthcare

[7] Making Healthcare Accountable http://texasceomagazine.com/?p=418

Healthcare Reform Models Focusing on Value to Consumers - Part 1

Many important things have been happening in the healthcare industry. What I found most exciting is the recent focus on establishing and supporting:

1. Patient Centered Medical Homes (PCMHs)
2. Accountable Care Organizations (ACOs)
3. Meaningful financial incentives models for clinicians and organizations demonstrating care quality improvement and cost control (i.e., cost-effective healthcare delivery bringing value to patients/consumers).

PCHM

I've written about the PCMH model several times over the past four years (see this link). A PCMH is, in essence, a physician practice headed by a primary care physician, which provides coordinated care through collaborating interdisciplinary teams. These groups of sick-care and well-care practitioners focused on delivering high-quality preventive care and effective chronic disease management focused on demonstrating positive patient outcomes.

ACO

An ACO, which goes hand-in-hand with the PCMH, is a related model that focuses on "…the alignment of incentives and accountability for providers across the continuum of care" [Reference]. Together, the PCMH and ACO "…are helping organizations to create systems where care delivery is performed by a team of professionals led by the primary care physician and are held accountable for the care they provide…[T]he patient and the family are the major focus of the program. Engaging them into the process is key to the success. The programs that have been successful have [been] identifying patients at risk and developing a coordinated plan with the help of a multidisciplinary team" [Reference].

Financial Incentives: Pay for Value

Financial incentives used in performance-based accountability systems (such as the PCMH/ACOs) have been found to help improve performance, resulting in better outcomes (more effective and efficient care). "…But creating an effective performance-based accountability system requires careful attention to choosing the right design for the system, which must be monitored, evaluated and adjusted as needed to meet performance goals" [Reference]. And, I'd add, the incentives must be great enough to matter.

For example, "pay for performance" (P4P) programs that give small financial incentives result in only modest care quality improvements since the potential financial reward represents only a small percentage of the overall physician pay and thus do not serve as a strong incentive. This doesn't surprise me. As I wrote three years ago at this link, we ought to be focusing on transforming from P4P to a "pay for value" (P4V) approach that rewards providers who deliver high-value care to patients/consumers that promotes the cost-effective prevention and treatment of illness, dysfunction and distress. Dealing with such a complex and controversial issue is certainly a challenge.

In any case, the three inter-related transformational models discussed above hold great promise! They provide useful approaches for improving our dysfunctional healthcare system. These strategies and processes are consistent with the Patient Centered Value Chain I wrote about three years ago at this link.

A key question remaining is: How should P4V be implemented so it fosters and supports PCMH/ACOs through adequate incentives and meaningful use of health IT?

Affordable Care Act

The Federal government's Affordable Care Act offers answers to this question, although finding a solution is made more difficult--as stated eloquently by Karen Davis of the Commonwealth Fund--because the healthcare industry:

…is not like markets for other goods and services. Information on prices is not typically available, decisions…are often made in an emergency, and patients lack knowledge about the value of diagnostic and treatment services…or where to go for the best care with the best prospects for full recovery, functioning, and quality of life.

Nevertheless, the Affordable Care Act offers a solution by presenting:

...important provisions to increase access to information on the quality of physician and hospital care and establish multi-payer databases that will provide a more comprehensive picture of patterns of care across providers. It also begins to address the imbalance between primary and specialty care by increasing primary care payment rates under Medicare and Medicaid. [It seeks]…new ways of paying for and delivering health care, including 'bundled' methods of payment to encourage providers to work together across health care settings…[and] rewarding those who offer appropriate, high-quality, and efficient care.

These initiatives represent a move away from the current fee-for-service system…[and] can help improve transitions in care from one provider to another and one care setting to another. Many errors occur during these hand-offs and patients often experience frustrations due to inadequate communication among providers involved in their care. These initiatives are one important step in the evolution of a new payment system that will provide incentives to achieve the best results…and in doing so achieve savings from the elimination of wasteful, duplicative, or avoidable treatment.

[In addition to changing payment methods]…new health care organizations that are accountable for both patient outcomes and the resources devoted to care will need to be formed …[and supported with] better information, tools, and technical assistance to ensure that essential services are provided efficiently while quality, innovation, productivity, and prevention are enhanced. Safeguards will also be needed against potential under-provision of care or exercise of undue market power [Reference].

In my next post (part 2), I examine various financing models for paying for the kind of coordinated, high quality, affordable care PCMH/ACOs can deliver.

The Potential of Personal Health Records (PHRs) - Part 3 of 3

In my previous two posts, I summarized a deep conversation with a group of knowledgeable people about PHRs. I then offered an innovative, low cost, uncomplicated solution to deal with the concerns others raised. Following is a continuation of the discussion.
One commenter wrote:

…In reading about PHRs (or EMRs) I often end up wondering if the underlying premise is faulty. Many existing electronic records seem more like simple the health record equivalent of "brochureware;" putting the paper record up in a pretty online version, perpetuating rather than re-imagining the concept. [As I see it,] there are three key pieces to a PHR/EMR: the source data, how the data is authored/generated/input, and which data gets presented when to whom. (I suppose the analytics that act on the data are a fourth crucial piece). The third piece is truly a CRM [(customer relationship management] question, and the solution does not need to be a monolithic structure that tries to have all answers to all questions presented at once. It may be a bundle of solutions, looking and acting completely different for different users or even for the same user at different times. [We need] PHR solutions that break the existing paradigm.

I replied:

I'd add a fifth key piece, i.e., how to exchange/share the data securely and efficiently between disparate applications without busting silos. Also, when it comes to presenting the data, in addition to tailoring data sets to user needs, there should be a focus on how the same data get presented differently to different users (e.g., mapping terminologies to user roles, such as providing explanations for technical terms to patients). And I like the analytics to be tied to evidence based guidelines the provide decision support and instruction.

This requires a paradigm busting PHR solution in which bundles of solutions are made available. So, what we need is a flexible, affordable, modular solution that enables many different applications to work together (interoperate), which is the very kind of system I've been advocating using a pub/sub node-to-node architecture for exchanging encrypted data files, and using template-based PHRs to consume those data files, as well as to connect to most any third-party software programs and data stores.

Another commenter then wrote:

We need to keep in mind that, not until the focus of healthcare and wellness is changed one from being reactive & curative [to one focusing on] preventive healthcare strategies [for both] physical & mental health.

I agreed, stating that it is crucial to integrate sick-care with prevention/well-care from a mind (psychological) and body (biomedical) perspective.
I then responded to an earlier comment about PHRs in public clouds, PHR functionaliy, and consumers' willingness to enter data into PHRs:

Using public clouds using a centralized database for PHRs poses a security risk that has not been adequately addressed, although private clouds—e.g., behind a provider's firewall—appear more secure. And I still contend that local storage of encrypted data files makes the most sense in terms of security, accessibility and portability.

I also think that the best way to provide multifaceted ever-evolving PHR functionality is through PHR add-ons, i.e., applications that can be used in conjunction with any PHR to fill its function/feature gaps.

With regard to the willingness of consumers to enter data into a PHR, I suggest another factor has to do with the usefulness of the data being entered. If people believe it will help them (and their providers) deal more effectively with a health risk or problem, and for less cost, the more likely the person will spend the time doing it. If it's just a glorified medical record that mirrors what's in EMRs/EHRs, then there less incentive to do so.

Another commenter wrote about problems with PHRs from a practitioner's point of view, to which I replied:

The incentive to divulge "proprietary data and methods of the individual practitioner and/or the institution providing care," imo, depends on who gets the data and how it is used. Let's say, for example, that a primary purpose of HIEs (Health Information Exchange) is to be warehouses/repositories that accumulate and aggregate extensive data sets of biomedical, psychological and environmental patient PHI in de-identified form, along with the associated plans of care (both sick-care and well-care/prevention data http://wellness.wikispaces.com/Tactic+-+Well-Care+Sick-Care+Integration ).

Such an HIE would include disease registries, biosurveillance and treatment outcomes databases. Analyzing these data would provide key information helping to protect public health and enabling comprehensive treatment cost-effectiveness research that focuses on identifying and refining the evidence-based guidelines (protocols, pathways, treatments/procedures) most likely to be of greatest value to each patient/consumer dealing with a particular condition or risk factor. In this case, both patient and provider data are necessary, and, as such, the providers' identification could also be hidden (i.e., by de-identifying the treatment-related data). An HIE should not, on the other hand, be a centralized database of identifiable PHI since that would be silo-busting, which has many negatives as I've previously discussed. In any case, the kind of incentive you suggested (payment token) could help facilitate it.

And I responded to comments about the lack of usefulness of PHRs this way"

If a PHR actually helps a person handle their physical, mental, emotional and spiritual lives in a way that improves their health and quality of life, then it's useful. That's because there would be a significant difference in the data the PHR contains and the feedback & guidance the PHR provides. For example, in addition to the typical biomedical data and observations of daily living (ODL), the PHR would include substantial PHI regarding a person's emotional state, beliefs systems, interpersonal relationships, behavioral tendencies, etc., which are not part of any EMR/EHR, and some of which the person may not want to share with a physician (and which the physician may not need or want to know). So, it has to do with one's vision of what a PHR should/could be.

Bottom line: We've got to think in a whole different way about what PHRs should be!

The Potential of Personal Health Records (PHRs) - Part 2 of 3

In my previous post, I summarized a deep conversation I've been having with a group of knowledgeable people about PHRs. I then offered an innovative, low cost, uncomplicated solution to deal with the concerns others raised.

The solution I offered led to several questions and concerns about (a) security, privacy, access privileges; (b) getting hospitals, clinics, radiology centers, labs and physicians to send an electronic copy of patients personal health information (PHI) to a location where the patient has control over it; and (c) having the PHI be portable, accurate and complete. I answer these questions and address the concerns in this post.

First, here's a basic diagram of the architecture I proposed (a prototype of which we have demonstrated):

* Database Management Systems are software programs that manage databases. In healthcare, these databases are used by EMRs and EHRs and other health IT systems.

** In addition to providing send (publisher) & receive (subscriber), encryption & decryption, and authentication/authorization functionality, each pub/sub node connects with automated data processing templates for querying any databases, parsing any files, manually inputting data, transforming & translating the data, and presenting (rendering) the data.

*** Each data file (DF) is encrypted end-to-end (at rest and in transport) and can be in any data format (CSV, XML, XLS, HTML, etc.). They are stored locally, can be (a) composited (combined/integrated) when multiple publishing nodes send DFs to the same subscribing node, and (b) decomposited (broken apart) when a pub node is authorized to send only a subset of the DF's contents to a particular sub node.
Now to the technical concerns mentioned…

Security: End-to-end encryption of the DFs (including PKI methods). It is also possible to store the personal identifiers in a different DF (which could even be stored at a different location).

Privacy: "Granular level" data control by patient through PHR (see this link).

Access privileges (confidentiality): The human owner of a node can access and render a DF only with user name and password (or, preferably, with a biometric indicator). And the DFs contain only the PHI for which the person is authorized.

Sending an electronic copy of PHI from multiple sources/repositories to a location that the patient controls: Each publisher (provider, lab, etc.) node can do this by (a) querying a database to which it has rights, (b) storing the query results in DF with the transformations and translations required by each of its sub (i.e., patient) nodes, and (c) transmitting the DF to the sub nodes as an encrypted e-mail attachment (or other methods).

Portability: The node software and data processing templates are all modular object oriented applications, and the DFs are individual electronic files, so everything is very portable.

Accuracy and completeness (data integrity): Examples include data validation routines (assessing whether each data element is within predefined parameters), cross-checking data values from different sources, and identifying missing values.

Availability: Since the DFs and processing templates are stored locally on different computerized and storage devices, and since the DFs can be updated automatically via low-bandwidth and briefly connected means (such as e-mail), a recent version of PHI is available anywhere/anytime.

I do not claim to have all the answers, but do come to the table with 30 years of knowledge and R&D. We are seeking to expand our network of collaborators and are very open to creative ideas. Anyone interested in joining our team are welcome to join my company's LinkeIn group—Crafting the Future of Health IT with Novel Solutions—at this link (requires registration).

Other questions were also raised, including: (1) How best to share PHI among disparate systems; (2) How to increase PHR adoption; and (3) What makes a PHR truly useful to the patient and his/her providers in terms of improving care, self-maintenance, quality of life and, of course, controlling one's PHI to maximize privacy. In addition, I was asked if I ever considered Open Source and if we've tried to connect with the big online PHRs. Following were my replies.

Open Source. We have dipped a toe into the open source "waters," but got "stepped on" by the FOSS folks who claim that there is no such thing as a truly valid software patent, and that all software patent holders are greedy, manipulative frauds. After months of debate trying to seek an amicable solution, I left with a bad taste in my mouth (see this link). Nevertheless, I believe open source has a place—especially with commoditized (non-novel) programs—and we have offered an OS app at this link for converting XML to CSV.

Connectivity. MS HealthVault, Google Health and (I believe) Dossia are all public cloud PHRs. With all the security concerns over public cloud computing (see this link), we are shying away from them. We've made attempts, however, to get MS and Google interested in our novel node-to-node system (issue #1 above), but to no avail.

We have not yet written the interfaces you mentioned (also issue #1), although we have interfaces to legacy (X12) and relational databases, as well as XML and other document parsing routines. And although querying remote/external databases is the one method, we've found that having the DBMS run a query and generate an output stored in a CSV (or other delimited text file) is a simple alternative.

Adoption drivers/impediments. I agree that the lack of financial benefit to the database owners has been an impediment to PHR adoption (issue #2), and our crazy provider reimbursement model (pay for quantity, not for value) makes matters worse. It is one reason that we're currently focusing on using our technology in an application that supports information exchange of referral data between PCPs and specialists in patient-centered medical homes while (b) continuing to field test and enhance our PHR application in preparation of its commercialization through workplace wellness programs and other venues.

For the first time in my 30 years as a provider and software inventor/developer, the need to control costs and improve quality is becoming more widely recognized, in part because of the recent healthcare reform debates and the number of people suffering inadequate care. They say that true (disruptive/discontinuous) innovation—one that saves money, reduces complication, and improves overall value—is more likely to be accepted when an economy is in trouble. So, maybe the time is finally right!

PHR usefulness. As far as what makes a PHR useful (issue #3), I would say it's the ability to help the patient & providers (a) increase/improve knowledge and awareness of the patient's health risks and problems, (b) make valid decisions about how to deal with the patient's particular health risks/problems in the most cost effective ways, and (c) become increasingly competence (through education) in implementing the appropriate steps to avoid the risks from becoming problems and ameliorate the severity of existing health problems for a better quality of life. This should include a focus on biomedical & genetic, psychological/psychosocial, and environmental factors. And it should avoid information overload (see this link), while providing complete and accurate data.

[Come back later for part 3]

The Potential of Personal Health Records (PHRs) - Part 1 of 3

I've been involved recently in an interesting virtual discussion (at this link on LinkedIn) that focuses on personal health records (PHRs). This begins a multi-post thread about key issue concerning PHRs that we've been examining.

1. Quite a few comments referred to the need for PHRs to have real value for the patient (or a loved one) that provide value add by:

• Providing data collection, analysis, feedback , instruction, follow-up care, decision-support tools, and patient-provider communications (e.g., instant chat, recorded voice, email/message, etc.) that:
  
  • Help individuals and their loved ones deal efficiently and effectively with their personal problems, including medical conditions, physical pain and psychosocial issues in order to improve a patient/consumer's health status (outcomes), save him/her money & time, and cut down on medical errors, omissions and unnecessary or ineffective treatments
  • Supply clinical data consist with Continuity of Care Documents/Records (e.g., diagnoses, medication lists/medication reconciliation data, allergies, problem lists etc.
  • Focus on prevention and self-maintenance (i.e., wellness) for even healthy people by including personally managed custom health/wellness programs, targeted incentives, health education, point of care updating and risk analysis, compliance and adherence motivations, and assistance in dealing with other personally (dis)stressful problems
  • Create empowerment and engaging experience for one's health management
  • Enable baby-boomer to help their aging parents and children who are in college through the healthcare process as needed.
• Using social media to connect people and promote digital collaboration with their entire care team (primary, specialists, nurses, mental health, holistic med) and personal support network (friends, family, and those that are similar to them/social network) in order to nurture support/encouragement and to educate
• Assisting with appointment preparation & scheduling, pharmacy, and insurance claims processes
• Being interactional and easy and convenient to use (so simple to use "a caveman could do it").

2. PHRs must be flexible and evolving, connect/integrated with EHRs/EMRs, and accommodate any relevant standards by:

• Being customizable and modular and used on an "agile" platform that enables it to connect with most other applications
• Automatically sharing data with providers' EHRs (i.e., PHR-EHR integration):
  
  • One possible solution is providing database synchronization where there is a big central database on the server side (e.g., an HIE) and a large number of small databases each residing on a device; the central database contains data for all the devices while each device's local database only contains the device's private data and some shared data
  • Another is having the PHR contain actual data or pointers to that data that the patient could either hand to a provider on a flash drive, deliver via an e-mail attachment or URL, or download directly into the provider's EHR from a secure, authenticated site; the PHR could then become the individual's HIE
  • And the problem will continue as long as EHR companies are still building silos—no one has stepped forward to create a truly interoperable network and each continues to build its respective silo and wants control of the patient data.
  • Able to use HL7 and all other data exchange standards.

3. PHRs data must be controlled by the patient: The patient should be able to control what types of information go to which source; this should be automated so that only the only portions shared are those required for the appropriate level of the transaction with patient in control [note that this is a disputed point]

4. PHRs must have provider tie-in:

• PHR adoption has to be driven from the provider side or we don't have complete solution; we need to provide for a environment that allows for that interaction and communication because patients do not have true access to their own medical information
• Certain information in a PHR must be truly useful to the provider (clinician/practitioner), e.g., showing the longitudinal trend is important
• Should not interfere with providers' workflows and be minimally intrusive

5. PHRs need payer tie-in:

• Scalability to these solutions needs to come from payers support; enrollment in insured program would easily support the informational requirements of an initial PHR.
• Most payers offer tethered PHR's, which are not really PHR's but histories of claim data
• PHR's are a difficult value-added service for a health IT vendor to roll out because they are high risk with little to know revenue generation, so payers could fund their development and deployment [note that this is a disputed point]

There were also several mentions of "data silos" in this discussion. I noted that on another LinkedIn discussion (at this link) we've had a deep conversation about that issue and most have come to the conclusion that silos are important to keep, but crossing them in a controlled manner is essential. I present a brief summary of the discussion on my blog at this link), which includes a link to a simple and low-cost way to cross the silos.

I discussed why I have a problem with creating monolithic centralized databases that contain individually identifiable patient health information obtained by combining data from disparate local databases/repositories (silos). I argued that health information exchanges (HIEs) should only contain (a) pointers to the silos where the data are stored, (b) aggregated deidentified data for biosurveillance and research purposes and/or (c) identifiable data stored in individual encrypted data files.

I agreed that PHRs should contain data automatically retrieved from providers' EHRs, and the EHRs should contain data automatically retrieved from patient's PHRs.

I asserted that the patient should determine the data sets that can be shared between the EHRs and between the EHRs and PHR. These authorizations would be contained in a Trusted Partner Agreement (TPA) created when the patient and PCP first meet, and would be updated as necessary.

In a pub/sub node-to-node (app to app) "forward and store" communications environment, the publishing nodes would automatically select the data sets to be exchanged with their subscribing nodes based on roles rules reflecting in the TPA's authorizations. This low cost, uncomplicated solution would deal with the concerns others raised.

I then explained that I've been working on a very different type of PHR for several decades, which we're calling a personal health profile. It addresses most of the requirements we've been discussing for a useful PHR. See this link for a three-part post about it.

Continued at this link.

Should Personal Health Information Reside in Silos-Continued?

There have been several replies to my previous post about data silos.

They questioned my definition of "silo" as a "repository" and made the point that the existence of silos are not only caused to technological issues, but also to constraints involving:

• Legal factors, such HIPPA, state regulations, contractual agreements  
• Human factors, which are things that affect the input and output of the data, such as control issues, distrust, tradition, if it ain't broke don't fix it mentality, etc. 

I responded by saying that, to me, “repository” simply means “storehouse” (a place where data are stored). When a repository has constraints that prevent the data it contains from being shared with other repositories, then each of those repositories is a silo with respect to the other repositories. At the same time, however, any of those repositories that do share data are not respective silos. That is, a repository may be a silo with regard to one respository, but not another.

In any case, my previous post focuses primarily on the technological constraints of silo’ing with regard to incompatible software, databases, etc.

That means that a repository may be silo’ed from other repositories for:

• Technical reasons, such as lack of software/database interoperability; this is a vendor/developer-related issue. However, if data are exchanged between repositories using paper, fax, voice, or other non-software/database methods—then the repositories would NOT be silos, imo, since data are being exchanged.

• Nontechnical reasons, which include legal and human factors. In this case, even if the software/databases are able to exchange data between repositories, the repositories would not do so, which means that they continue to be silo’ed from each other.

Should Personal Health Information Reside in Silos?

Over the past few weeks, I've been engaged in a conversation with an intelligent group of people about whether personal health information (PHI) should reside in disparate "silos" (repositories) that do not communicate with one another, or whether standards should be adopted that "bust" the silos by merging the information into a common warehouse (centralized database) that spans multiple unrelated healthcare organizations, agencies and practices.

Some argued that silo-busting centralization has benefits that include narrowing the number of places the data reside, improved auditability, and the ability trace and report access attempts and actual reads (i.e., "access/read tracing") more effectively than individual computers.

Others (including me) argued that silos have real value, as long at the PHI they contain can be readily and securely shared among "trusted partners," a model which I call "controlled silo-crossing." I proposed a novel and cost-effective way to do this through a federated, node-to-node, publisher/subscriber model we've developed, which is described at this link and elsewhere on this blog. Using this method for controlled silo-crossing provides major benefits, including the following:

• Minimizes information loss. Busting silos leads to the loss of important information—i.e., data details and terminology/semantic nuances—because "local" data standards unique to different silos are destroyed in favor of "global" data standards required by monolithic centralized systems, as I discuss at this link.

• Gives PHI control to the owners of that information. Both providers and patients should have their own silos and have control over who is allowed to cross them. That is, patients ought to authorize the individuals and organizations that have the right to obtain their PHI from their own PHRs and from their providers' EHR/EMRs. The authorized parties should: (a) get only information that meaningful/useful to them, (b) have that information delivered to them from any silos in which they reside, and (c) receive that information after it has been translated and transformed for use in their own respective silos. Also, if silos were busted, it presents the thorny issue of who should be in charge (be the boss) of the merged data?

• Provides strong information security. Personally identifiable PHI in the physical possession of the parties owning and controlling it is inherently more secure than allowing third-party vendors to manage that information in centralized databases residing off-premises. This relates to the issue of "public cloud" security as I discuss at this link.

• Enables auditing and access/read tracing. Auditing and tracing are handled effectively using node-based software residing in individual computers.

This all raises other questions: Who currently wants to cross silos and why?

Two entities are public health agencies and research (academic) organizations. Two others are Health Information Exchanges (HIEs) and the National Health Information Network (NHIN). They all require PHI from multiple silos to, for example, identify public health emergencies through biosurveillance (e.g., dangerous medications and medical devices, pandemics, bioterrorism, etc.), as well as to develop evidence based practice guidelines.

Another entity that wants to cross silos is healthcare providers who want to give their patients the best possible care by, for example, sharing PHI through patient centered medical homes, which I discuss at this link.

In addition, patients who understand the problems in healthcare would also support silo crossing. For example, anyone knowledgeable about the serious knowledge gap in healthcare—which I discuss at this link—would realize how important it is to have interdisciplinary teams of clinicians, their patients and researchers share information and collaborate to promote ever-better (higher-value, more cost-effective) care, and by having payers offer financial incentives to practices running certified medical homes.

To help realize this vision of controlled silo crossing, we ought to focus on revamping our culture into one in which value (cost-effectiveness) to the consumer is the upmost importance, and in which delivery of such value is a collaborative effort that is highly rewarded. The results, over time, would include:

• Ever-better personalized evidence-based guidelines for prevention and care that patients and their providers use to improve results and lower costs by reducing waste, fraud, abuse, errors, omissions, ineffectiveness and inefficiencies would be dramatically reduced.
• Providers would be more effective in diagnosing/testing, treating and preventing health problems in their patients, and would gain financially by doing so.
• Providers would not have to worry about malpractice suits by following the evidence-based guidelines and offering sound justification for rendering alternate plans of care; this would also lower malpractice insurance premiums and the pressure for wasteful "defensive medicine."
• Patients/consumers would be better able to manage their own health.
• Payers would not have to pay for low value (expensive, unbeneficial) procedures and tests.

Bottom line: While centralized databases have their place, controlled silo-crossing is a key strategy for improving our healthcare system.

Discussion continued at this link

Data Silos, Core Measures, Performance Metrics, Outcomes, and Evidence-Based Guidelines

There has been a great deal of discussion about the need to exchange patient health information securely across disparate data silos while protecting patient privacy. I agree that this is an essential ingredient for transforming healthcare and have offered a solution in prior posts. But that's only one part of the big picture. We must also focus on the need for (and failure to) funnel comprehensive clinical outcomes measures to researchers who translate them into evidence-based guidelines reflecting cost-effective care. Health IT tools, therefore, should be competent in obtaining these data, delivering them to researchers, and then presenting the resulting guidelines to patients and providers as a means to improve and reward high-value care.

Case in point: The vast majority of "performance metrics" I've seen are based on "process measures" that evaluate care quality based on what was done instead of the outcomes/results of care. Unless this situation changes, care value (cost-effectiveness) is not likely to improve much. I've written about this situation years ago at http://curinghealthcare.blogspot.com/2007/05/knowledge-standards-and-healthcare_12.html. And interestingly enough, a recent article at http://www.modernhealthcare.com/apps/pbcs.dll/article?AID=/20100219/NEWS/302199990/1029# discusses the tension surrounding the use of "core measures" by the Office of the National Coordinator for Health Information Technology (ONC) and how they want to put more emphasis on outcome measures over process measures.

Bottom line: Sharing patient data is important, but using those data to improve care value systematically is a process that is largely overlooked. Today. This is a serious problem that must be addressed seriously.

What is the Most Sensible way to Diagnose, Treat and Prevent Health Problems?

What is the most sensible—i.e., the least costly and most effective—process by which to:

• Diagnose a particular patient's health problems
• Treat those problems in order to increase the likelihood of getting the best clinical outcomes (symptom alleviation, blood text normalization, disease elimination, etc.)
• Help people help themselves (e.g., prevent illness, manage chronic conditions, and deal effectively with psychological distress).

In some situations, this is common knowledge because the problem and remedy are both obvious (e.g., filling a tooth cavity, putting a cast on a broken arm or ice on a sprained ankle, removing a wart, testing a growth for skin cancer, etc.). But in very many situations:

• A set of symptoms reflect a multitude of possible underlying problems
• Comorbidity (two or more health problems exist at the same time, especially in persons with chronic conditions) complicate matters greatly
• There are conflicting (no clear-cut agreed-upon) or inadequate guidelines/protocols/approaches for testing and treating certain conditions (see this link)
• A person's mental/psychological state is affecting one's physical health (e.g., emotional stress affecting one's immune system) and visa versa (e.g., certain diseases affect one's emotions, thinking and behavior)
• Medication side-effects and drug-drug interactions may be causing certain symptoms)
• There is a significant influence of genetic as well as environmental factors
• …and so on.

The unaided human mind typically cannot make useful sense of this incredible complexity, which is why we have a serious knowledge gap in healthcare (see this link).

What's needed is much more focus on better coordinated research—using both controlled studies and lessons learned from the field in everyday clinical practice—along with much greater use of EHRs and PHRs coupled with advanced decision-support tools. The goal ought to be the development of ever-evolving evidence-based guidelines focused on cost-effectiveness that are presented along a timeline of workflows (do A then B then C…) and/or using validated rules/algorithms based on mathematics and logic, which clinicians use to augment their experience and education.

If the healthcare industry move forward steadfastly in this rational direction, and rewarded providers for delivering high-value care, we'd be transforming our healthcare system in one that truly works.

A Novel Way to Share Personal Health Information

Patient health data are stored in disparate silos—separate islands of information residing in often incompatible EMR/EHR and PHR databases controlled by different hospitals, clinics and public health agencies, as well different group and solo practices. The question is: What is the best way for this personal health information to be shared securely between the people who need it to provide quality care to individual patients, protect populations, and perform research leading to valid evidence-based guidelines?

There's actually a simple, inexpensive and secure way to exchange data between any PHRs, EHRs, EMRs and public health/research/biosurveillance databases. As I've discussed in previous posts, it requires a paradigm shift from...

• Monolithic, centralized, pull, synchronous systems—an architecture that's good behind an organization's firewall

to...

• Distributed federation of asynchronous pub/sub nodes that push data from publishing to subscribing nodes—an architecture that's good for the kind of loosely coupled P2P networks crossing organizational boundaries that comprise the NHIN (National Health Information Network).

The latter architecture uses a node-to-node transport method, which is similar to the way the telephone system works. It enables everyone everywhere to exchange data with little cost and complexity, even when bandwidth is low and Internet access is intermittent. It enables massive interoperability. With it, scalability is a non-issue. It provides composite reports containing information from many disparate sources. And it allows data views to be changed instantaneously (even when offline), which increases understanding by, for example:

• Data slicing, dicing and drilling down (i.e., breaking a body of information down into smaller parts, examining it from different viewpoints and dividing an information area up into finer and finer layers)
• Switching from lists and tables to graphs
• Answering ad hoc "what if" questions
• etc.

In order to implement the above solution, you would connect pub/sub node software to every application in a mesh node network. And you would enable each node to do whatever data translations and transformations are needed to assure the right data gets to the right place in the right format. Then transmit the data to subscribing nodes in PKI encrypted delimited text files (such as CSV) via FTP, e-mail attachments, MMS, or whatever protocol desired. Upon receipt, the subscribing nodes can import the data into their local databases and/or render the data locally using customized templates that can operate interactively offline.

I discuss this solution in detail at this at my company's LinkedIn group at http://www.linkedin.com/groups?home=&gid=2697006&trk=anet_ug_hm&goback=%2Eanh_2697006. You're welcomed to join.

Is President Obama to Blame?

I recently received an anti-Obama e-mail with a link to a video that blamed the President for our country's current and future problems. This faulty/irrational way of thinking is a gross distortion of reality because no individual is responsible for our problems, not Obama, not Bush…no one!

Instead, our problems stem from a malfunctioning political-economic system and a misdirected culture. At its very core, our society is built on a foundation of beliefs and values that promote much of the negative side of human nature. The consequence is a political-economic system that, for example:

• Allows money from special interests to dictate the actions of Congress
• Repeatedly fails to fix our severely broken and unsustainable healthcare system (see this link)
• Has created an overly lop-sided wealth and power distribution—with the wealthiest 10 percent of Americans having a larger share (about 50%) of total income than ever before (reference)—made worse by a lack of fiscal rules and regulations required to constrain irresponsibility and greed
• Has enabled certain banks to become "to big to fail"
• Engages in wars we can't possibly win by force (including military engagements and the war on drugs)
• Created an education system in which American students performed worse in science and math than many other industrialized countries (reference)
• …and so on.

Bottom line is that American political-economic system just doesn't work well for the vast majority of our citizens.

What we ought to be doing to fix our problems is focusing sincerely on reforming our political-economic system into one that:

• Forces widespread transparency
• Aligns the ought-tos with the can-dos
• Provides an environment where all individuals are enabled to develop their positive potential
• Is driven by empathy and compassion (e.g., living by the "Golden Rule" ethics)
• Stops equating personal value (the inherent "worth" of one's self/ego) with personal wealth and power over others
• Takes a long-term, big-picture view
• Isn't fearful of fundamental change
• Inhibits individuals from going into politics who are focused primarily on their own personal gains (e.g., by minimizing the money-politics connection through better campaign contribution reform and limiting politicians upon leaving office from becoming well-paid lobbyists for corporations they've helped)
• Embraces both science and spirituality. 

Also, see this link for a discussion of convergence of 3 core healthcare reform issues: American values, personal responsibility, and pragmatic solutions.

So, what's standing in the way of such reform?

I contend that the answer, in large part, comes from analyzing this quote by Howard Zinn in a recent Bill Moyer's interview (at this link): "Democracy doesn't come from the top. It comes from the bottom. Democracy is not what governments do. It's what people do… whenever the government has done anything to bring about change, it's done so only because it's been pushed and prodded by social movements, by ordinary people organizing." And this quote takes from one of Zinn's books: "If democracy were to be given any meaning, if it were to go beyond the limits of capitalism and nationalism, this would not come, if history were any guide, from the top. It would come through citizen's movements, educating, organizing, agitating, striking, boycotting, demonstrating, threatening those in power with disruption of the stability they needed."

So, if things are so bas for so many, why don't "we the people" demand meaningful (aka radical) change?

Well, it takes certain ways of thinking and a good deal of motivation for people to pull themselves out of despair. They must transform their life views from being overwhelmed with a sense of hopelessness and helplessness to feeling hopeful, capable and having a clear direction by which they can actualize/realize their potential. This is possible, but not easy.

On the one hand, we all have the inherent capacity to change the way we think about ourselves, others, our current life situation and our futures. We can gain new knowledge and skills. We have the ability to become inspired and to act in constructive ways that enable us to develop their minds and bodies, and to attain a better quality of life.

On the other hand, the negative influences of our culture tend to foster the negative side of human nature to become dominant, which inhibit such positive thinking, learning and action. These negative influences include such things as:

• Poor education, an unsafe living environment, racial prejudice, generations of poverty, propaganda and "spin"
• Normal human thinking limitations (e.g., short-sightedness, over-generalization, low frustration tolerance, poor attention span, wishful thinking, close-mindedness, gullibility, misdirected focus, ignorance, influence of negative emotions, etc.)
• Corporations who hire lobbyists to get laws passed that benefit them—i.e., creating the rules in their favor by "tilting the playfield"—which is often at the expense/detriment of the general public
• Cultural attitudes in which "money makes the man," "winning the game is what matters" and "buyer beware" trump attitudes such as "leading a virtuous life matters," "how you play the game is what's important" and "focus on giving the consumer high value." 

And instead of supporting a "give me more of the pie" philosophy (i.e., "I deserve to be given more by the government as entitlements"), our culture should be promoting a "create your own pie" philosophy by:

• Making available quality "ingredients," e.g., access to good education/training, availability of jobs, decent and affordable healthcare, safe neighborhoods and realistic reason for hope.
• Promoting acceptance that the best pie a person has the potential to create will not necessarily be as "tasty" as other people's pies. That is, helping people realize that it's OK for some individuals to gain greater material rewards and power than others, as long as it's acquired in a virtuous manner (i.e., through honesty, integrity, value-creation, etc.), and as long as everyone's essential needs are satisfied (e.g., good food, healthcare, education and protection). 

It's my hope that grass-roots movements around the country focused on positive change will become powerful enough to exert the force needed to counteract the political, economic and psychological pressures preventing meaningful systemic reform. This appears to be the only reasonable way to avoid the meltdown of American Democracy.

Curing Healthcare named a top 50 blog to learn about healthcare IT

According to the ratings, the blogs selected are updated on a regular basis to deal with an ever-changing field and present "relevant information along with a good following and a well-written and easy-to-comprehend blog." For the other blogs on the list, see this link -- http://mastersinhealthcare.org/2010/top-50-healthcare-it-blogs/

Crafting the Future of Health IT with Novel Solutions

I just started a Linkein group--Crafting the Future of Health IT with Novel Solutions--located at http://www.linkedin.com/groups?home=&gid=2697006&trk=anet_ug_hm&goback=%2Eanh_2697006. You are welcomed to join!

The primary purpose of this group is to build and deploy novel health IT solutions that continually raise the bar of possibility and meaningful use. To help achieve this goal in a win-win manner, we are focused on combining group members’ products with my company’s novel architectural platform and supplemental (add-on) applications.

I started this group because I believe a good business strategy for small HIT companies in this economic climate focuses on collaboration and networking. As such, we are eager to form close business relationships with the individuals and companies that join this group.

To implement this strategy, we will share the details of our patented technology; provide very fair licensing agreements; support beta groups; and enable the cost-efficient interoperability between members EHRs, PHRs and any other clinical and business tools that provide added value.

My goal is to assist others in understanding what we have to offer in order form close collaborative business relationships that BENEFIT EVERYONE INVOLVED. After all, something as complex as improving the healthcare system in meaningful ways is a global effort requiring the voices, ideas, innovations and work of many (across multiple disciplines and nations), as well as the integration of many different technological approaches, both conventional and disruptive.

I encourage probing questions, challenges to my claims, business and technical suggestions, exploration of how third-party health IT products can interoperate using our architecture, etc. This kind of honest, critical, direct discussion and relationship-building is the purpose of our group.

I contend that though our combined knowledge, creativity and efforts we will develop an affordable, secure, ever-evolving and all-encompassing HIT system that will be envied by others and will never become obsolete.

Four Interlocking Issues about Fixing American Healthcare

Here are four interlocking issues that must be addressed if we Americans are ever to fix healthcare:

1. Meaningful use of health IT vs. Minimally acceptable usefulness. I contend that health IT is used "meaningfully" only if it helps increase the effectiveness and efficiency of care (i.e., increases care value to the consumer). Although the Federal government is focusing on this value proposition, pressure from the healthcare industry may end up watering down the meaningful use definition to one of "minimally acceptable usefulness." And to be TRULY meaningfully used, EHRs ought to provide data and functions that support the following three value-enhancing models & processes...
   
2. Patient-Centered Medical Homes (PCMH) vs. Uncoordinated care. The PCMH model, which provides oversight and coordination in the delivery of care is, thankfully, gradually gaining acceptance.
   
3. Patient-Centered Cognitive Support (PCCS) vs. Inadequate information (ignorance), Information overload, and Lack of computerized decision support. PCCS, which consists of advanced software systems that help clinicians make informed decisions without information overload, is slowly gaining traction.
   
4. Pay-for-Value (P4V) vs. Fee-for-Service (FFS). P4V, which focuses on the delivery of cost-effective care (i.e., high value to consumers) is being endorsed by some, but it has a long way to go before crowding out the FFS model in which "pay for volume" or "pay more for doing more" is actually a disincentive for cost-effective care (i.e, cost-effectiveness means less provider income/revenue under FFS).

Unfortunately, current day EHRs are not designed to support all those things, which means we ought to re-think the future of health IT design and capabilities. So, while it's important to have EHRs used widely across all healthcare facilities and disciplines/specialties--and while meaningful use criteria cannot be overly demanding considering their very early stage of today's EHR applications--there ought to be assurance by vendors that their products are flexible/adaptable enough to accomodate TRUE meaningful use.

The push for ‘push’ technology for the NHIN

At this link, an article titled "New technology a 'push' toward EHR future" discusses how "…push messaging, a likely first step in rolling out a proposed national health information network in time for healthcare organizations to use electronic health-record systems in a 'meaningful manner' and qualify for federal EHR subsidy payments under the American Recovery and Reinvestment Act of 2009."

The article discusses how:

David Blumenthal, head of the Office of the National Coordinator for Health Information Technology at HHS called for pause in the planning of the NHIN…[as the government wait for an] outline of a "lighter" NHIN than has been the focus of much planning and development work in the past.

…[T]he new emphasis on so-called 'push technologies"—for example, the movement of a care summary "pushed" from a primary-care physician's EHR to a specialist—could come to the fore. The tools and techniques needed for these sorts of messages are less complex and will be far more readily available to a broader range of providers than so-called "pull" technologies, an example of which would be the system required for an emergency room physician to search for and pull copies of a patient's medical records scattered across many provider organizations via a query placed to through a regional health information organization.

It goes on to explain how a health internet of …

"health nodes" [reference]…would create a platform for basic messaging between its registered users, but would allow for growth, such as accommodating e-mail attachments, which "opens up the opportunity for health e-mail messages to be used for intersystem communications, such as receiving structured lab results, transmitting CCDs [continuity of care documents] from one practice to another and transmitting information to vaccination or chronic care registries."

And although it's not meant to close out pull technology…

it's hard to foresee what this new federal push toward push technology will mean or how it eventually will fit into a broader national healthcare communications scheme…"the drive to an alternate pathway is because docs need to by 2011 to be able to talk to one another to satisfy meaningful use"…[because it] is just sending a report or a document to another physician via e-mail and fax, only it will be more secure."

This is wonderful news!!! We've been promoting a peer-to-peer publish/subscribe node network architecture since 2002, which operates securely, inexpensively, durably, and conveniently using push technology (such as encrypted e-mail attachments). Unfortunately, few took us seriously. Instead, the mainstream focus has been on developing complex, expensive, monolithic, centralized, pull-based architectures that have serious security, scalability and interoperability concerns (e.g., see this link. While such centralized systems have a useful place within large organizations, they are simply not a sensible way to connect all parties via the NHIN (National Health Information Network)! It does my heart good to see a rational, open-minded dialogue finally taking place!

Related posts:

• Combining Cloud Computing, Client-Server and Novel P2P Pub/Sub Mesh Node Network Architectures (Part 1 of 2)
• Combining Cloud Computing, Client-Server and Novel P2P Pub/Sub Mesh Node Network Architectures (Part 2 of 2)
• A Novel Way for Everyone in the Nation to Exchange Health Data Simply, Inexpensively and Securely
• Simple, Low-Cost, Secure Health Data Exchange
• Who should Own a Patient’s Health Data, Where should they be Stored, and How should they be Exchanged (Part 1 of 2)
• Who should Own a Patient’s Health Data, Where should they be Stored, and How should they be Exchanged (Part 2 of 2)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 1)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 2)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 3)
• Dueling Data Formats
• Knowledge, Standards and the Healthcare Crisis: Part 6  
• Introducing our disruptive CP Split technology

Combining Cloud Computing, Client-Server and Novel Pub/Sub Mesh Node Network Architectures (Part 2 of 2)

In my previous post, I described three key architectures for deploying health IT software programs and exchanging patient information in a national health information network (NHIN). They are:

1. Cloud computing
2. Client server
3. Publish/subscribe mesh node networks.

In this post I describe the use cases of each, as well as cautions to be taken in their implementation.

Cloud Computing Architecture Use Cases

The cloud is most useful in use cases where (a) Internet bandwidth is high and connectivity is constant and consistent; (b) data and technology standards are well-established; and (c) there is concrete assurance that if a web service provider goes out of business, the healthcare organization will have ample opportunity to recover all the data stored there. A primary benefit of cloud computing is lower upfront cost compared to client-server architectures. That is, if your local computer doesn't have the resources necessary to run a software program, it may be cheaper, faster, or more convenient to run the program in the cloud than through traditional client-server architecture.

Cloud Computing Security Concerns

When cloud computing is used, however, caution should be taken to protect sensitive patient data in a cloud through end-to-end encryption or by storing only de-identified patient data. Because it is so important, I've included the following quotes from several sources about cloud security issues:

• "[Trend Micro, the] security company, in its in its predictions for 2010 predictions report for 2010, identified cloud computing as a trend that will amplify threats to companies over-reliant on cloud computing vendors. It… warned the nature of the cloud makes it an attractive target to hackers, who are drawn to the ease of going after a single cloud serving various customers and taking down 'multiple systems secured the same way'…The increased amounts of data handed over to cloud providers will also pose risks in terms of availability and data privacy, it said. Companies open themselves to the possibility of service providers going out of business, or having physical and internal breaches…It highlighted the importance of avoiding cloud lock-in and being able to switch providers "at will or in line with business needs", so as to retain control over the company's IT processes…Beyond the data center, threats lie in connectivity to the cloud…Web protocol technologies such as SSL (Secure Sockets Layer), DNS (Domain Name System) and BGP (Border Gateway Protocol) are still works in progress, being 'developed before security was a consideration'. Security researchers have been identifying flaws in these technologies--last year, a BGP vulnerability was revealed to have been known in the industry for over a decade, but remained an inherent problem…'The question is whether any cloud vendor could reasonably ensure that unauthorized access is not possible, that a hacker will never be able to copy millions of user records, login credentials, online banking information, billing information, transaction records and the like." [Reference]
• "DATA PROTECTION: cloud computing poses several data protection risks for cloud customers and providers. In some cases, it may be difficult for the cloud customer (in its role as data controller) to effectively check the data handling practices of the cloud provider and thus to be sure that the data is handled in a lawful way. This problem is exacerbated in cases of multiple transfers of data, e.g., between federated clouds…INSECURE OR INCOMPLETE DATA DELETION: when a request to delete a cloud resource is made, as with most operating systems, this may not result in true wiping of the data. Adequate or timely data deletion may also be impossible (or undesirable from a customer perspective), either because extra copies of data are stored but are not available, or because the disk to be destroyed also stores data from other clients. In the case of multiple tenancy and the reuse of hardware resources, this represents a higher risk to the customer than with dedicated hardware…MALICIOUS INSIDER: while usually less likely, the damage which may be caused by malicious insiders is often far greater. Cloud architectures necessitate certain roles which are extremely high-risk. Examples include CP system administrators and managed security service providers." [Reference]
• "…[B]usiness technology pros what worries them about cloud computing, security concerns…[may] end up sinking any move to the cloud… IT departments…aren't as confident of where pain points such as security flaws may be. What new intrusion points are introduced? How can a company be sure that its data sitting in the vendor's data center is safe? When should information be encrypted?...[S]ecurity defects in the technology…[is] a top concern with cloud computing …One of the biggest risks of cloud computing is that of the unknown… One can't assume that encryption is available in all cloud services…Encryption creates a lot of overhead, and suppliers don't want to degrade application performance or absorb the cost if customers don't put a premium on it…[C]ompanies need to think of their networks now extending beyond their own physical environments and into the supplier's data center. As companies stitch more cloud services together, that challenge multiplies. A related complication comes from the fact that cloud services have been designed in vacuums, with each vendor securing its own connections but not the others…[T]he more data that goes into the cloud, and the more valuable that data, the more appealing it becomes as an attack target…That's why companies, once they've worked their way through the network security issues of transferring data to and from a cloud provider, need to probe the vendor's data center operations…[C]ompanies must determine how comfortable they feel putting data and applications in the cloud…Only a brave few dive in…completely…Vendors acknowledge the fear…[and a] lack of trust about cloud service security." [Reference]
• Not only do security concerns exist outside the cloud, but as discussed below, privacy concerns exist inside the cloud since cloud vendors are able to look at your database. “'Cloud computing is a trap, warns GNU founder Richard Stallman…It’s stupidity. It’s worse than stupidity: it’s a marketing hype campaign'…Somebody is saying [that cloud computing] is inevitable – and whenever you hear somebody saying that, it’s very likely to be a set of businesses campaigning to make it true…Amazon’s marketing of a ‘VPN to the cloud’…as the solution to a company’s security concerns…[but] Amazon just doesn’t get it…’It’s them against us…thousands of hackers attacking and we just don’t have the resources.’…We can easily guesstimate that at any given point in time we’d have at least 1,000,000 hackers willing to compromise any mega corporation...Amazon’s response appears to be focused on creating a moat in front of their cloud, and while that’s not a bad idea, in no way does this alleviate the threats inside of the cloud itself not to mention an array of other reasons…’Computer security researchers had previously shown that when two programs are running simultaneously on the same operating system, an attacker can steal data by using an eavesdropping program to analyze the way those programs share memory space. They posited that the same kinds of attacks might also work in clouds when different virtual machines run on the same server…The bottom line is, how can you defend the outside of your cloud when you might not even be able to trust the inside of your cloud...Is a cloud provider willing to allow you to perform an in-depth penetration test to ensure you meet compliance? For now, can even forget about the outside threat to your cloud, those threats will always exist, what can you do to defend the insider? Seriously…So when a provider states that: ‘We reserve the right to invade your privacy at any given point in time,’ it just doesn’t sound so appealing, especially when companies are looking to potentially store customer data in the cloud. Do you honestly want a third party viewing your customer database?...[When Amazon states that] ‘It’s important to note that we take the privacy of our customers very seriously, and don’t inspect the contents of instances’…[and] ‘Abusers who choose to run their software in an environment like Amazon EC2, make it easier for us to access and disable their software’…how would Amazon know whether something is a rogue or a misconfigured application, without taking a look?...they’d HAVE TO look at it.” [Reference]
• "…[Y]ou can transfer risk but never responsibility…no cloud provider will give you the security you need. There can never be a cloud computing provider who can give you the kind of security protections that an in-house security team can and the logic behind this statement is a simple and factual one: a cloud provider won't lose as much as you would at the end of the day. Therefore the incentives to go 'above and beyond' can never and will never exist…Cloud computing providers can only cover so much ground when it comes to security and what they will cover is often a baseline based on often obsolete guidelines. Even if they could cover all the necessary bases, the virtualized environment itself would forever be at odds with forensics…When a machine is virtualized, its states change rapidly and the possibilities of doing forensics is out of one's hands and out of your company's control and in fact, even outside of the cloud providers' control. A cloud provider will not…take dozens if not hundreds of other virtualized machines offline to make a forensic replica should the need arise…Cloud services are especially difficult to investigate, because logging and data for multiple customers may be co-located and may also be spread across an ever-changing set of hosts and data centers. If you cannot get a contractual commitment to support specific forms of investigation, along with evidence that the vendor has already successfully supported such activities…[you're] worse off [with the cloud] than keeping things in house from a forensics point of view and an incident response point of view." [Reference]
• "There are always risks involved when dealing with working online, regardless of how secure a host might say a web application is, that fact of the matter stands that the security risk of running an application of the Internet is more significant than when running an application on a standalone desktop computer. Some applications require more security than others, playing Sudoku on a web application would cause little concern, but dealing with sensitive corporate formulas or accounting details in a web environment might be determined risky." [Reference]
• "Web applications are exposed to more security risks than desktop applications. You can have a total control over the standalone applications and protect it from various vulnerabilities. This may not be the case with web applications as they are open to a large number of users in the Internet community thus widening the threat." [Reference]
• "Working online has its own set of risks like hacking and virus threats. The risk is higher compared to a desktop computer, since a malfunction of the desktop can result in loss of partial data. The crash of a web server can result in consequences beyond the control of a business." [Reference]
• "Local applications installed on your computer give you better security and do not require a connection to the web. Also, in many cases, local applications provide better integration with the operating system." [Reference]
• "The Internet abounds with security threats; some users have reported automatically losing accounts and data with Google or other web services after hacker break-ins; cross-site scripts which install key logging software are especially problematic because passwords can be recorded and stolen as they are being typed; hackers routinely break into accounts with simple passwords (names, personal data, words from the dictionary, or anything less than 10 characters)." [Reference]
•  Clouds at Amazon, Google, Microsoft, AT&T, Paypal, Sony, the CIA, Citibank and Twitter have all been hacked [Reference1], [Reference2], [Reference3].
• "The hack into a Gizmodo writer’s Amazon and Apple accounts over the [first] weekend [of Aug 2012] is being used as a cautionary tale for consumers, a call to action for cloud providers regarding security policies and a sounding board for concerns about the rush to the cloud...an attacker quickly found his way into [a user's] iCloud account and wiped everything from his Mac, iPhone and iPad, all of which were linked to Apple’s cloud service. The attacker also hacked into his Twitter and Gmail accounts...larger concern was how quickly and easily the attacker...was able to get gain control of [the] account through just a couple of phones calls to Amazon and Apple [using] social engineering" [Reference] and [important comments].
  

Cloud Computing Use Cases

Taking security into account, use cases for the cloud computing architecture include:

• Providing access to browser-based EHRs and EMRs with end-to-end encryption in either:
• Tightly controlled private clouds
• Non-private clouds only if the patient identifiers are stored in encrypted data files (in the cloud or in local storage).
• Storing de-identified patient data in centralized databases for public access or for restricted access by authorized persons (e.g., for research purposes).
• Storing practice guidelines in public clouds.
• Home monitoring, whereby data from measurement devices (e.g., a glucometer) are streamed to a provider's private cloud with end-to-end encryption.
• CRM, business intelligence, content management and research-based applications in private clouds with end-to-end encryption.
• Hosting Web conferences to dispersed audiences.
• Enabling real-time collaboration in private clouds with patient data encrypted end-to-end or in public clouds with de-identified patient data only.

Client-Server Architecture Use Cases

The client-server model is most useful in use cases where the data remains within an organization's boundaries (i.e., behind the firewall) and subject to strong central control (authorizations, etc.); such use cases include:

• Managing patient data in a provider organization's EMRs and EHRs
• Running an enterprise health information management system (HIMS), including both clinical and financial applications
• Running business intelligence (analytical) applications within an organization
• Running protocol/medication adherence management and post discharge software programs, e.g., having text messages trigger alert that are sent to case managers informing them to contact certain patients under certain circumstances based on an organization's rules (algorithms).

Novel Pub/Sub Node Network Architecture Use Cases

The pub/sub node network model is most useful when:

• Exchanging sensitive patient data beyond organizational boundaries (i.e., beyond the firewall)
• The cost of infrastructural build-out for centralized systems is prohibitive
• At least some end-users must access data at times when bandwidth is low, connectivity is intermittent, or network latency is high
• Exchanging data between disparate databases
• Individuals prefer to have complete control over their own data
• Large scale emergencies disrupt communication networks relying on the Internet.

Use cases for such a node network architecture include:

• Exchanging patient data across organizational boundaries, including sending data between disparate data stores (e.g., exchanging data between incompatible EMRs, EHRs and PHRs).
• Sending de-identified patient data from PHRs and EHR/EMRs to data centers in HIEs/RHIOs and an NHIN repository.
• Connecting multiple cloud, client-server and desktop-based systems by providing nodes to able to access the applications and data sources in each system.
• Locally storing data collected through cloud-based applications in encrypted CPS data files, and enabling those data to be sent back to the cloud-based system as necessary. The same goes for client-server applications.
• Exchanging patient data in emergency disaster situations in which command & control units and first responders (fire fighters, police, EMTs, trauma center staff, etc.) must communicate quickly and effectively even when they each have different data needs and when the Internet is unreliable. This includes overcoming the "last mile problem"—which refers to the challenge to provide connectivity to all end-users' devices at all locations due to bandwidth mismatches and other connectivity constraints—by providing multifaceted asynchronous communications capability that includes radio, land line, and satellite communication options.
• Preventing any single point of failure problem of centralized systems by mimicking the landline telephone system, which always has a dial tone even when power goes out.
• Supporting an automated decision-support system in which the nodes host a "loosely-coupled decision network" of people from multiple locations and with different roles who sometimes work together to make decisions beyond the knowledge or skills of any individual. The nodes use their data transformation and universal translation capabilities to accommodate the diverse information needs and preferences of the participants in a way that reduces misunderstandings due to regional, departmental or cultural differences.
• Doing eligibility checking, i.e., when a patients go to their healthcare providers, the nodes send data back and forth between the nodes connected to insurance company databases to exchange eligibility data.
• Exchanging data between nodes connected to labs, providers and patients.
• Automatically sending certain data concerning communicable diseases and other biosurveillance data to and from the Center for Disease Control (CDC) via nodes connected to providers' EHRs/EMRs, patients' PHRs and the CDC's databases.
• Providing remote access to imaging data stored locally.

For more use case scenarios, see these links on our Wellness Wiki:

• Scenario - Emergency Department Care
• Scenario - Avoiding Adverse Event in a Hospital
• Scenario - Outpatient Psychotherapy
• Scenario - First Responders
• Scenario - Using Personal Health Records
• Blueprint for an Integrated HIT system - The Patient Life-Cycle Wellness System
• Evidence-based HealthCare Decision Support System

Conclusion

All three architectures have important use cases. The novel node-based architecture I've been promoting enables all three to work together in order to receive the benefits of each.

Related posts:

• Combining Cloud Computing, Client-Server and Novel Pub/Sub Mesh Node Network Architectures (Part 1 of 2)
• The push for ‘push’ technology for the NHIN
• A Novel Way for Everyone in the Nation to Exchange Health Data Simply, Inexpensively and Securely
• Simple, Low-Cost, Secure Health Data Exchange
• Who should Own a Patient’s Health Data, Where should they be Stored, and How should they be Exchanged (Part 1 of 2)
• Who should Own a Patient’s Health Data, Where should they be Stored, and How should they be Exchanged (Part 2 of 2)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 1)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 2)
• Health IT: Comparing Cloud Computing and Desktop Applications (Part 3)
• Dueling Data Formats
• Knowledge, Standards and the Healthcare Crisis: Part 6  
• Introducing our disruptive CP Split technology