Digitized Medicine

Progress being made to splice information technology into the healthcare industry's genome in Texas

It's amazing-the progress being made to splice information technology into the health care industry's genome.   When I first dove into health IT a decade ago the use of electronic health records (EHRs) was dismal and healthcare stakeholders rarely sat at the same table with mutually beneficial, collaborative objectives in mind.   Even within the same healthcare organization it was not uncommon for individual department leaders to disrupt an integrated health IT effort in order to protect some of their department's self-interests.   Less than 5% of hospitals had implemented fully functional computerized provider order management (CPOM) systems; less than 1 in 5 physicians were using an ambulatory EHR; and less than 5% of those were fully functional EHRs.    Today the percentage of physicians and hospitals using robust EHRs is rising at a rate that was unthinkable back then.  

This progress parallels the launch of health IT initiatives established through the federal HITECH funds such as the EHR Incentive Program.   In the past two years these funds have been a catalyst here in Texas to engage diverse groups of healthcare stakeholders  to use health IT to improve quality of care.   As a result:  

• Increasing numbers of Texas physicians are using EHRs (approaching 50%)
• More and more hospitals are using CPOM
• Over a dozen of community-wide health information exchanges (HIEs) are up and running
• New health IT workforce training programs are established
• Four regional extension centers were formed covering all geographic areas of the state and are doing a phenomenal job assisting thousands of physicians with EHR selection, implementation and meaningful use
• Texas became the first state to have it’s HIE plan approved by ONC
• Texas was one of the first states to stand up the Medicaid EHR incentive program making our program a model for other states
• Texas was one of four to receive a SHARP grant
• And Texas leads the way with the number of physicians attesting to meaningful use; Texas physicians and hospitals have received over $270 Million in EHR incentives

This rate of progress is only possible when individuals with diverse backgrounds and from different healthcare stakeholder groups are able to collaborate.  In Texas these stakeholders have demonstrated an ability to park their self-interests in order to drive forward with a common vision to improve the quality and delivery of patient care in our communities.

Snapshot of EHRs Used in Texas to Achieve Meaningful Use Gives Glimpse of Regional EHR Market Consolidation

Over 400 electronic health record (EHR) vendor products are certified by the Office of the National Coordinator of Health IT (ONC), but only a handful of them are used by a majority of the physicians in Texas who have been awarded EHR incentive payments by the Centers for Medicare and Medicaid Services (CMS) according to an ONC database released last week.

Physicians who successfully meet CMS criteria that demonstrate their “meaningful use” of an ONC-certified EHR become eligible for incentive payments up to $44,000 over 5 years under the Medicare program or $21,500 over 6 years under the Medicaid program. The ONC database includes the records of 21,697 physicians who have received EHR incentive payments so far, de-identified by physician but including the physician’s EHR product name, the physician’s state and whether payment was received through the Medicare or Medicaid programs. There are 217 EHR vendors listed as having products that had been used successfully by at least one eligible physician.

In Texas 1,585 physicians have received EHR incentive payments according to the database. Although 75 different ambulatory EHRs were used by at least one physician, only six of them were used by more than 100 physicians. These six EHRs account for 69% of the EHRs used in Texas to achieve meaningful use.    They are listed here with the number and percent of physicians using each to achieve meaningful use:

• Epic 277 (17%)
• eClinicalWorks 249 (15%)
• e-MDs 177 (11%)
• Allscripts 170 (11%)
• Athenahealth 128 (8%)
• NextGen 114 (7%)

The following graph displays the 25 EHRs that at least 10 Texas physicians have used to achieve meaningful use payments (click to enlarge):

There are 50 other EHRs used by less than 10 physicians in Texas who have successfully attested for meaningful use incentive payments.   These are listed at the end of this blog.

Across the nation Epic is the early leader with over 25% of physicians using it to achieve meaningful use. The top five EHRs nationally–Epic, eClinicalWorks, Allscripts, athenahealth and Community Computer Services–are used by nearly 49% of the physicians.    The top 13 EHR vendors nationally are used by more than 75% (see list below).   There are variations in regions across the nation, though, as seen with the Texas data.

It is interesting to note in Texas that the first three of the top six EHRs used to achieve meaningful use–Epic, eClinicalWorks and e-MDs–are all private companies.   The other three are public companies–Allscripts, NextGen and athenahealth.  They all all generally have positive reputations and perennially receive a variety of “Best in KLAS” rankings.    Epic’s ambulatory EHR is used primarily by physicians affiliated with large health centers and is not currently a feasible option for many small practices in rural Texas.    Athenahealth is marketed as a web-based EHR, but the others can be web-based as well.   Although e-MDs is popular nationally, their market share in Texas benefits from their headquarters being located locally in Austin.    

In the past decade many speculated that CCHIT certification of EHRs, which is more comprehensive than the ONC-certification for meaningful use, would spur a consolidation of what is currently a disperse EHR market with hundreds of vendors supplying products.  Others felt that free market forces, with physicians in the center creating demand for EHRs that worked well, would eventually swing the pendulum toward consolidation.   It is still early, but the data set in the ONC database gives a provocative glimpse at the EHR market forces in play today.  There is clearly some consolidation around a small number of EHR products after the first year of the CMS EHR Incentive Program.    I suspect physician demand for EHRs that simplify their ability to receive incentive payments will continue to play a significant role in swinging the EHR market pendulum towards consolidation over the next decade. 

 

Additional data:

The top 13 EHRs used by physicians nationally for EHR incentive payments were:

#Providers         Vendor Name

6330                     Epic Systems Corporation

1847                    eClinicalWorks LLC

1502                    Allscripts

1158                    athenahealth, Inc

999                      Community Computer Service, Inc.

921                       GE Healthcare

899                      NextGen Healthcare

770                      e-MDs, Inc.

712                     Greenway Medical Technologies, Inc.

567                     Cerner Corporation

565                     Sage

397                     BioMedix Vascular Solutions

252                     AmazingCharts.com, Inc.

 

The following 50 vendors had less than ten physicians in Texas using them to achieve meaningful use incentive payments:

Meditab Software, Inc.

HealthFusion

Pulse Systems

Altos Solutions, Inc.

Integrated Health Care Solutions

MED3000, Inc

Waiting Room Solutions

BizMatics Inc

Compulink

Crystal Practice Management

digiChart, Inc.

NexTech Systems Inc.

American Medical Software

ICANotes, LLC

MicroFour, Inc.

Prime Clinical Systems, Inc.

ADP AdvancedMD

Altapoint Data Systems, LLC

Ingenix

Intivia, Inc.

MedPlus, A Quest Diagnostics Company

MTBC (Medical Transcription Billing Corporation)

Nuesoft Technologies, Inc.

Spring Medical Systems, Inc.

SuiteMed

UnisonCare Corporation

AllegianceMD Software, Inc.

Cerner Corporation

CodoniX

CureMD Corporation

Data Strategies, Inc.

DoctorsPartner, LLC.

DrChrono.com Inc.

DrFirst

EMRlogic Systems

Encite, Inc.

Exemplo Medical LLC

E-Z BIS, Inc.

gMed, Inc.

Health IT Services Group

Insight Software, LLC

Medical Office Online, Inc.

MedInformatix, Inc

MedLink International, Inc

Medrium Inc.

Midwest Software, LLC

MPN Software Systems, Inc.

Net Health Systems, Inc.

Sammy Systems

WellCentive

Health Information Exchanges and Physicians Share Accountability for Safe Patient Care

The $800 billion 2009 American Recovery and Reinvestment Act (ARRA) set aside $36 billion toward health information technology (health IT) initiatives, including over $500 million for the State HIE Cooperative Program.  This federal program provides funds to each state for the successful planning and development of infrastructure that supports the exchange of electronic health data between physician electronic health records (EHRs), hospital EHRs, lab systems, radiology centers and other clinical IT systems.    For example, in Texas we are using these funds to support the development of local health information exchange entities, called HIEs, across the state and to concurrently develop the policies, standards and infrastructure needed to safely/securely connect these HIEs to each other.     The statewide HIE network will also be built to be compatible with national standards and efforts.      

Each state's effort to develop a network of community HIEs and/or a statewide HIE will be more successful with physicians involved upfront with governance and policy development.   When working with local HIEs most physicians will generally understand and appreciate the importance of protecting the privacy and security of electronic patient health information.  Their inherent knowledge on this issue will help guide policies in the right direction.   A more complex issue for physicians to understand is the relationship between HIEs and patient care.   A heightened awareness of this issue will allow physicians to properly inform HIE policymakers about the need to establish an environment where local HIEs, HIE networks and physicians share accountability for safe patient care.   

To deepen physician's understanding of this issue I encourage them and others to think about an HIE as a tool physicians use as a part of patient care, similar to a surgical tool.   If a patient is harmed by a surgical tool that broke because the physician used it incorrectly, the physician is negligent.  If the physician used the tool correctly but it still broke, but it has only broken 8 times in over 10,000 surgeries and the patient consent explains this remote risk of breakage, then no one is negligent.  However, if it broke and the issue had been reported to the vendor by many physicians on a repetitive basis, but the vendor failed to investigate the issue and fix the problem, or failed to inform physicians and patients of the increased risk in the meantime, then the vendor is negligent. 

This perpsective will help physicians advocate for policies that lead to an environment where HIEs and physicians share accountability for safe patient care.   Effective policies will lead to contracts and agreements which acknowledge that:

1. HIEs and HIE infrastructure are tools used by physicians during the course of patient care
2. HIEs are responsible for informing patients and doctors about the inherent risks of  the electronic health information exchange including changes in risks when issues are identified
3. HIEs have a responsibility to continually monitor for and mitigate risks associated with their services that may impact quality of care provided by physicians

 

Bipartisan Health IT Support and ARRA Insulate EHR Incentive Funds From Budget Cuts

A physician colleague recently asked me why I am confident that CMS will not cut off EHR incentive funding in the future.   This question is important to him and other physicians who plan to qualify for up to $44,000 in CMS incentive payments by achieving the meaningful use of EHRs.   They fear that the dragging economy and political discord will result in budget reductions that will cut this and other important health IT funding programs.    What I see, though, is a decade-long track record of bipartisan support for health IT initiatives and a 2009 federal law that requires CMS to provide funding for the EHR incentives and other health IT programs.

In his 2004 State of the Union speech President Bush envisioned the adoption of EHRs for all Americans by 2014.   Since then bipartisan support at both the state and federal levels for health IT initiatives toward the achievement of that vision has held strong.   At the federal level CMS  not only established a new office in 2004 to support health IT, the Office of the National Coordinator of Health IT (ONC) but has also increased funds to support ONC initiatives which promote the adoption and use of EHRs.  CMS works collaboratively with ONC and has consistently shown an understanding that the broad adoption and effective use of EHRs are necessary to better manage spiraling healthcare costs.   CMS understands that the data captured by EHRs is superior to claims-based data when attempting to analyze quality and establish benchmarks.    Physicians have long complained that claims-based data is incomplete and does not fairly demonstrate the quality of care they provide.     EHRs must be broadly adopted in order to capture accurate and meaningful data that can then be used to improve quality or save costs.  

It is important to recognize that CMS is required to provide EHR incentives to physicians by law.   Specifically, the $800 billion American Recovery and Reinvestment Act (ARRA) of 2009, commonly refered to as the Stimulus Bill, allocates over $36 billion to health IT programs through the Health Information Technology for Economic and Clinical Health (HITECH) Act.   This funding includes an estimated $34 billion for the Medicare and Medicaid EHR Incentive Program and over $300 million to support state-wide health information exchange efforts.

In order to cut funding for EHR incentives, this means that bipartisan support would have to be garnered in the House and Senate to rescind ARRA or part of ARRA.   The intent of ARRA  initiatives is to stimulate economic activity and produce jobs.   In the current economic environment it would seem very risky, perhaps even foolish, for a politician to drum up support for new legislation that eliminates economic stimulus activity, especially if that activity is already producing jobs.

So, is the EHR Incentive Program stimulating the economy and producing good jobs?   I am not an economic expert, but from what I see around me the answer is clearly, "yes".    I see job openings in the local paper for healthcare system IT analysts and other staff, I speak with IT consultants most of whom are actively seeking personnel, I hear about physician offices investing into the economy $10,000-$70,000/doctor to implement EHRs or upgrade other office technologies, I read about physicians receiving $44,000 federal incentive payments and about hospitals receiving larger amounts, some of which is surely returned into local economies.  The graph below is a composite view of the 3-year stock performance of the health IT sector since 2009.   EHR vendors and other health IT companies appear to be thriving well since ARRA was passed despite the depressed economy.

I suspect that several years from now when experts analyze the impact of the $800 billion stimulus package, the puny $36 billion provided to health IT initiatives through the HITECH portion of ARRA will go down as perhaps the most bang for the buck in terms of stimulating the economy.  

The EHR incentive funds appeared to be well insultated from budget cuts for these same reasons. 

Texas Medical Association video provides in-depth look at meaningful use, how RECs can help physicians

This video does a good job of describing Meaningful Use, the electronic health record (EHR) incentive program and how the four regional extension centers (RECs) in Texas leverage federal grants to subsidize services for physicians that help them select/implement or upgrade an EHR, and then use their EHR to improve quality of care and meet the Meaningful Use requirements.  

The four RECs in Texas currently charge primary care physicians only $300 for consulting services valued at $5,000.  These services include:

o    Select and implement a certified EHR (or upgrade your current EHR to a certified version)

o    Optimize your practice workflow,

o    Achieve meaningful use,

o    Qualify for EHR incentives, and

o    Obtain CME credit hours      

 

Community HIE decisions are best made in collaboration with local physicians who use EHRs

Physicians who use electronic health records (EHRs) in their offices are increasingly being called upon in their communities to participate in the development of local health information exchanges (HIEs).    During the early stages of HIE planning there are important decisions that are best made in collaboration with local physicians.   As with any health information technology usage, the anticipated benefits of exchanging electronic health data must be balanced against the inherent risks of the technology.   Physicians who use EHRs already have valuable experience with some of the inherent risks associated with electronic health data usage, but may not have experience with the clinical risks associated with the exchange of electronic health data.    The following case scenarios are intended to raise awareness and understanding of key patient safety risks associated with the clinical use of electronic personal health information (PHI) that could be obtained through a community-wide HIE.  

Conflicting data scenario:  A nurse records a penicillin allergy in the hospital EHR when a patient experiences GI symptoms after receiving a penicillin injection.   The next day, the patient is seen by her primary care physician (PCP).   After reviewing the history, the PCP is convinced that the reported symptoms were unrelated to the penicillin injection.   She records “No Known Allergies” in her office EHR.   The local HIE retrieves “allergies” from both EHRs and displays this patient’s allergies as both “no known allergies” and “penicillin.”  

In such cases, the physician will have to reconcile the data by considering the sources, dates, and times of each and decide whether additional investigation is necessary.   

Segmented data scenario (this applies only if the HIE will allow patients to exclude some or all of their data as a part of the consent process):   For privacy reasons an HIV patient decides to exclude his diagnoses from the HIE which results in a problem list so that it does not disclose his HIV status.   He also excludes data from two sources: his psychiatrist and a psychiatric hospital.   This patient had suffered an episode of neuroleptic malignant syndrome secondary to an antipsychotic medication a year ago while under the care of the psychiatrist at that hospital.   Since records from the psychiatrist and hospital are excluded, the HIE will not contain this information.   A physician viewing the patient’s information through the HIE will see no record of the patient’s susceptibility to a life-threatening event from a certain class of medications.  

Informing the viewing physician that the patient has excluded some data from the Problem List and some data from both a physician and a hospital may prompt important additional questions and dialogue with the patient that could prevent an avoidable adverse event.  

 Clinical Risk Management

Community-wide HIE initiatives are increasingly turning to local physicians who use EHRs to assist with assessments of both the benefits and risks associated with the clinical use of electronic health data shared across their community.  The clinical risks outlined in these scenarios can be managed through the following principles: 

1.  An HIE must provide physicians access to the source, date and time for all displayed data

 2.  An HIE must alert clinicians when data or data sources are excluded  

• The alert should specify the type of data (“lab results”) or type of source (“hospitals”) that have been excluded from the HIE through the patient consent process

3.  An HIE must inform physicians about:

• The patient consent policy used by the HIE (and of policy changes when they occur
• A list of the specific types of data they are generally able to access through the HIE
• A list of the specific sources of data that the HIE exchanges with

Modifications to the HIPAA Privacy Rules Under HITECH Will Burden Small Physician Practices

The HITECH Act requires HHS to revise the HIPAA Privacy Rule to remove the exclusion for Accounting of Disclosures for treatment, payment and health care operations to the extent that the disclosures are made through an EHR.    In addition, it requires HHS to determine what information is to be collected and then included in these disclosures.    In 2010 HHS published a Request For Information (RFI) to seek comments on individual’s interests in learning of disclosures, the burdens on Covered Entities in accounting for these disclosures and the capabilities of current technologies to facilitate disclosures.    The resulting proposed rule is an attempt by HHS to balance the individual’s privacy rights against the burdens on Covered Entities.    HHS is accepting comments on this proposed rule up until August 1, 2011. 

At a high level, it appears that the proposed rule primarily does two things:

1. Provides individuals a right to request a new "Access Report" that lists who has accessed their PHI in an electronic designated record set (which is basically medical records, billing records, or other electronic information that is used for payment or treatment decisions) for any purpose including for treatment, payment and health care operations.    The proposed rule limits the information in an Access Report to content which is already required by the Privacy Rule to be collected.    The assumption is that limiting content in this manner will enable a more automated process by which Covered Entities could produce an Access Report and that this would therefore ease their burden.
2. Makes changes to "streamline" the Privacy Rule's current Accounting of Disclosures provision, such as limiting the types of disclosures that must be accounted for.     As with the Access Report, HHS showed consideration to the burden placed on Covered Entities by making a number of changes to the individual's existing right to an Accounting of Disclosures that would make it easier for Covered Entities to comply with the requirements.   

Despite these positive changes, the proposed rule significantly underestimates the burden on small physician practices.    Although I agree that these changes do, in general, ease some of the burden on Covered Entities, it is primarily the large healthcare systems that will be able to leverage these changes to their advantage.    I do not believe that these changes sufficiently ease the excessive burden on providers in small practices who do not have the resources to leverage the changes to their advantage.    

HHS uses the assumption that limiting content in the Access Report to that which is already required to be collected [i.e. in an EHR] will enable a more automated report and therefore ease the burden on Covered Entities when an individual requests a report.  This assumption is misleading because it assumes that all Covered Entities have the resources necessary to produce a report that meets all the requirements.   According to the proposed rule, the Access Report must meet certain specifications as defined in the rule, must consolidate content from multiple systems if they exist, must allow individuals to limit their requests to specific time periods or persons, and must be made available in an electronic format as requested by the individual if possible.    Although the information in the Access Report is limited to content already required to be collected, EHR vendor products are not required to provide an automated process to produce an electronic report that meets the proposed rule’s requirements.     Therefore, it will not typically be a simple automated process to produce the report.     Instead, the Covered Entities will have to produce the report through a manual process in which some technical skills are needed to design and configure the report to meet the proposed rule’s specifications, to consolidate content from multiple systems, to customize the report to meet requested limitations and/or to re-format the report.   

For example, programming skills will be needed to create an Access Report from a typical EHR that produces an automated audit log that only shows the User’s ID when a record is accessed, but not the individual’s name as required for the Access Report.    In that case the report must be re-configured to map the actual name of the individual in place of the recorded User ID.    As we know, when one change is made in an electronic report, other changes may be needed to accommodate the change.    In this example, mapping content from the NAME field to the USER ID field might also require the report writer to increase a character limit in the USER ID field so as to not cut off long names.    This second change could cause the report to extend beyond the set margins of the report’s design, therefore requiring the report writer to change the design of the report.    A small practice will not typically have someone with the expertise to program such a report and will therefore have to hire an IT consultant.

Covered Entities must utilize the time and effort people who have the needed technical skills to meet the proposed rule’s reporting requirements.    The difference between small practices and large providers is the availability of technical expertise to do this manual work.     Most large healthcare systems and some large physician practices have an IT Department or employ IT personnel who have the expertise and skills needed to design, configure and format reports.    For large entities, the Access Report does not create a significant new burden because they already have the expertise to produce their reports. But very few small physician practices have the resources necessary to do this.     So in order to produce an Access Report, a small practice will have to hire outside resources to design, configure and format the reports at variable costs.    The actual cost will be dependent on the complexity of each report and the IT consultant’s hourly rates ($100-$250/hour).     As the proposed rule is currently written, a small practice will typically have to hire external resources, at their own expense, to write the report and then be required to provide the report at no cost to the requesting individual.

As acknowledged in the proposed rule, the Accounting of Disclosure is recognized by HHS to be more complex and will require a “manual, expensive, and time consuming process for Covered Entities and Business Associates.”   One purpose of the new Access Report is to be an alternative to Accounting of Disclosures in order to mitigate this known burden of disclosures.    Nevertheless, the Access Reports will still require “manual” work that involves technical skills and will be a significant burden on small practices.    Also, since the Accounting of Disclosure reports are more complex they will require more manual work and technical skill than Access Reports.    The burden of disclosures on small practices will therefore be much greater than for large systems that already employ the technical expertise to design, configure and format the reports.

 In summary:

1. The proposed rule requires small practices to provide requesting individuals with a new Access Report which places excessive burden on small practices at an unreasonable cost.    The burden of producing an Access Report should be on the vendor’s EHR product and not on the physician.     The proposed rule should be modified to require small practices to provide the system’s automated audit log, as configured by the vendor, if available, from any of their systems that store PHI.    The burden should be placed on the vendors to configure their products to produce automated reports that meet the specifications and requirements.    If a small practice has to hire IT consultants to design and configure or modify an Access Report, they should be allowed to charge the individual for the actual costs incurred.
2. This proposed rule also requires small practices to provide requesting individuals with an Accounting of Disclosure which also places excessive burden on small practices at an unreasonable cost.    The burden of producing Disclosure reports should be on the vendor’s EHR product and not on the physician.    The burden should be placed on the vendors to configure their products to produce automated reports that meet the specifications and requirements.    If a small practice has to hire IT consultants to design and configure or modify an Accounting of Disclosure report, they should be allowed to charge the individual for the actual costs incurred.

Help Available For Small Physician Practices to Overcome Technology Challenges

American Medical Association (AMA) President, Cecil B. Wilson, M.D., said in an AMA Commentary this week, "Physicians should take the time to explore their practice needs, assess their practice's readiness to adopt health IT and select the right system for the practice --and its patients".    This is wise advice that I wholeheartedly agree with.

I also agree that the successful adoption and meaningful use of electronic health records (EHRs) impose many new challenges onto physician practices and that overcoming these barriers is especially difficult for physicians in small practices or solo practices that are constrained by limited resources.   My only disappointment with Dr. Wilson's message to physicians is that it failed to highlight how Regional Extension Centers (RECs) can be leveraged by physicians to address these issues with EHR adoption and use.

The HITECH portion of the 2009 Reinvestment Act (ARRA) included over $677 million in grant funds to establish RECs across the nation to cover every geographic region.   The purpose of each REC is to provide consulting services to physicians that help them overcome many of the described barriers to the adoption and use of EHRs.   It is important for physicians to know that the RECs receive federal subsidies specifically based on and proportionate to the number of primary care physicians in solo or small group practices (<10 physicians) that they successfully help adopt, implement and meaningfully use an EHR.  In other words, RECs are financially dependent on providing effective health IT consulting services to a segment of physicians who have the greatest need for such services.

In Texas there are four RECs including the North Texas REC (NTREC) for which I volunteer time as Board Chairman.    Other Texas physicians volunteer their time to comprise 50% of the governing boards for each of the four RECs.   Our goal is to ensure that our RECs are physician-friendly and remained focused on providing high quality services that meet the technology needs of small physician practices in each region.   Texas RECs collaborated with each other to create a common business plan that leverages the federal subsidies to charge Texas physicians a token fee of $300 for IT consulting services worth over $5,000.    

NTREC will receive 100% of their allotted subsidies if we successfully help 1,500 physicians adopt EHRs and achieve meaningful use.   Since last October more than 500 North Texas physicians have enrolled for NTREC services; over half of them have already successfully implemented an EHR and are now working on the achieving meaningful use of their investment.

My hope is that physicians in other states will emulate our efforts by actively engaging in the governance of their region's RECs to ensure that they are physician-centric and remain focused on addressing the unmet needs of the small physician practices.

 

Private E-mail Communications Between Physicians and Patients—Identity proofing, Authentication and Encryption

Case study:   A plaintiff claims that his physician sent him an e-mail with poor medical advice that led to an adverse medical event.  The defendant physician agrees that the e-mail in question provides grossly negligent advice, but claims that she never sent such an e-mail.   Unfortunately, the physician had been using her own, personal home e-mail program to communicate with patients without using encryption or authentication software.  A costly investigation eventually proved that the e-mail had originated from an unknown third-party spammer who used a technique called “spoofing” to insert the physician’s e-mail address into the "From" field in the e-mail that was sent to the patient.

Although this physician avoided a malpractice suit, she bore the financial burden of a technical investigation to prove the e-mail was not from her. This is only one example of a number of privacy and security issues with physician-patient e-mail. But these problems are avoidable and e-mail can be safely used if the physician can be sure of four things:

1. They are using the authentic e-mail address of the patient
2. A message received from the patient has actually been sent from their authentic e-mail address
3. Each message (sent or received) has not been changed while traversing across the Internet
4. Only the physician and the patient are able to read each other’s e-mail messages

E-mail encryption programs and secure messaging programs both provide safeguards that ensure this level of privacy and security needed for physician-patient e-mail.   From a legal perspective, these technologies, when combined with appropriate procedures of use, make it very difficult for someone to successfully repudiate (deny sending or receiving) an e-mail in a legal situation.   As noted in this case, regular home and business e-mail programs do not typically include such safeguards.

The Texas Medical Board (TMB) specifically requires physicians to “authenticate” patients prior to initiating e-communications, and to only use e-communications with established patients.   Although the TMB does not specify how this is to be accomplished, the procedure typically involves “identity proofing” patients during an office visit.   Patients physically present themselves to an office staff member who is authorized to register new “users” into the physician’s secure e-mail system.   After being registered in the system, the patients will receive the “credentials” that allow them to receive and send messages through that system.  The type of e-mail system used by the physician determines the type of “credentials” the office will provide.  The credentials may be a password, a biometric feature (i.e. finger print), or a physical device such as a CD, smart card, or thumb drive that contains a password “key”.

After the patient is identity proofed, secure e-mail systems are able to use built-in “authentication” technologies to ensure:

• a message received has actually been sent from the credentialed patient’s mailbox
• a message sent or received has not been changed while it traveled over the Internet
• a message sent can only be received and decoded by the credentialed patient.

Taking care to set up authentic e-mail accounts with identified patients and using an e-mail program (encrypted e-mail or secure messaging) that includes "authentication" technologies are necessary to establish the trust needed when engaging in private medical conversations.   In addition, these work flow procedures and technologies will help the physician stay within HIPAA regulations that require encryption when PHI is sent over the Internet.

Comparison of Web-based vs. Traditional EHRs For Physician Offices

An ambulatory electronic health record (EHR) can be provided to the physician practice through one of two different models:    

1. Web-based-- also referred to as a "hosted EHR" or the "ASP Model" where the physician accesses the EHR through an Internet connection
2. Client-Server (C/S)--  the traditional model where the EHR server may physically resides in the  physician's office

Both models are considered to be acceptable, but each has inherent pros and cons to consider.   The traditional model of choice has been the “client-server” model.   In this model the EMR software is installed on a server that is typically located in the physician’s office.  The physician and staff access the EMR through computer devices that are connected to the server through a local area network (LAN) set up in the office.  The computers may be connected wirelessly to the network if desired.   This model has a few similarities to loading Quicken on your home computer and then using Quicken to pay bills online: 

1. After loading Quicken onto your computer you will periodically be advised by Quicken to take "updates" to fix known "bugs" in the software.  Similarly, you will load the EHR software onto the server in your office and physically download any updates to fix "bugs" that the vendor discovers and fixes.     
2. Microsoft periodically advises you to take security updates on your home computer.  Similarly, the EHR server will need to take periodic updates from Microsoft.
3. You may later decide to upgrade Quicken to its latest version, and then purchase and install the Quicken upgrade on your computer.  Similarly, you will want to upgrade your EHR software periodically, usually every 12-18 months.
4. You may decide in the future to purchase a new home computer that is faster;  you will have to then load the Quicken software onto that new computer and transfer all of your old Quicken data to the new computer.  Similarly, you will need to periodically replace the EHR server with a newer one that is faster, stronger and/or meets future recommended requirements of the EHR software.  And make sure your data gets transferred as well.

The web-based model is gaining popularity.  In this model the EHR software is located on a server at a remote location designated and hosted by the EHR vendor.  The physician and staff access the EHR through the Internet on computer devices in the office.  This is analogous to online banking that you access on your home computer and use to pay your bills online (instead of using Quicken).  Using this analogy: 

1.  You will not physically have to take updates because the bank will update the software themselves
2.  Microsoft will not ask you to take Microsoft security updates to the online banking server because the bank hosts the server and will do that themselves
3. When there is an upgrade to the online banking software, you do not have to purchase and physically load that software on your computer because the bank does that on their server that you are simply accessing.
4. If the online banking server is too slow you will not have to purchase a new server, the bank will do that (if enough customers complain)...and they will migrate your data over to that new server)

Here is a comparison chart for these two EHR models:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Personally, the business side of me is strongly averse to allowing a 3^rd party vendor to take care of the “heart and soul” of my practice (i.e. the revenue dollars and the clinical data).   Hence, in private practice I would strongly favor keeping the server in-house.     However, the clinic I currently work at is a small part of a large academic institution.   For our ambulatory EMR I am leaning toward recommending a web-based model.  The presence of an institutional IT Department whose primary purpose is to support the education of thousands of students, not to understand and dedicate the resources needed to provide a high level of clinical IT support required for a clinician using an EHR.  And I know who is most likely to get trumped down the road when conflicting priorities arise!