New York Times: Panel Set to Study Safety of Electronic Patient Data

New York Times author Milt Freudenheim has published an interesting article on health IT:

"Panel Set to Study Safety of Electronic Patient Data" (Dec. 13, 2010, link)

In the article Mr. Freudenheim presents various viewpoints on health IT safety and usability, and reports on an upcoming Institute of Medicine (IOM) Committee on Healthcare IT safety.

In general, the expressed viewpoints reported upon are consistent with the position in the Healthcare IT Ecosystem of those quoted. I wish to add some commentary to a number of those stated positions.

Mr. Freudenheim observes:

Taking a fresh look at such concerns, the Institute of Medicine created the Committee on Patient Safety and Health Information Technology to run a yearlong study and issue recommendations. The 16-member panel is meeting for the first time on Tuesday in Washington.

(This new IOM Committee is in addition to a 2009 study by the National Academies/National Research Council that concluded that "Current Approaches to U.S. Health Care Information Technology are Insufficient", which has largely been invisible. The IOM is the health arm of the National Academies.)

I would add that this Committee is at least a decade late. That it is occurring at all seems to be at the behest of a multitude of complaints and "blows of the whistle" from clinicians who increasingly depend (either voluntarily or by coercion) on this technology to provide safe care.

I would also add that it is my hope the IOM committee with not be overly politicized, considering the stated unconditional exuberance of the past two administrations towards health IT, and that a wide variety of stakeholders will be heard. (For instance, as a medical informatics specialist whose mother was injured as a result of HIT interference with clinician communications, will I be allowed to testify?)

Mr. Freudenheim then relates the points of view of stakeholders.

In February, the F.D.A. said it had received 260 reports of malfunctions related to health information technology “with the potential for patient harm,” including 44 reported injuries and six reported deaths in 2008 and 2009. The malfunctions were reported voluntarily to the agency, mainly by hospitals.

“Because these reports are purely voluntary, they may represent only the tip of the iceberg,” said Dr. Jeffrey Shuren, a senior F.D.A. policy and enforcement official.

I'd written about this at "FDA on Health IT Adverse Consequences: 44 Reported Injuries and 6 Deaths, Probably Just Tip of Iceberg" where I noted:

This is a technology almost universally touted as inherently beneficial, right up to our most senior elected leaders, who are now pushing this unproven technology under threat of penalty for non-adopters.

Healthcare IT irrational exuberance can perhaps be illustrated in statements such as this:

“We have the capacity to transform health with one thunderous click of a mouse after another,” said (former) HHS Secretary Michael Leavitt - 2005 HIMSS Summit

I also opined at "If The Benefits Of Healthcare IT Can Be Guesstimated, So Can And Should The Dangers" that one could, as a type of thought experiment, extrapolate from these numbers to guesstimate the effects of universal health IT in the US. The results were startling, even if just an experiment:

[We might have] 880,000 injuries per year, 120,000 deaths when universal HIT use is achieved ... While this is a mere thought experiment, the result certainly suggests we need to know the actual rates of HIT-related patient harm, and act to understand and minimize these events.

In setting national healthcare policy, we should not rely on thought experiments - but even more importantly, we should not be relying on guesswork and wishful thinking as we are currently.

Unfortunately, national policy has been set up to now on wishful thinking. As I stated, the IOM meeting is coming none too soon.

The NYT article then reports on a statement made by ONC Chair David Blumenthal:

“All options for assuring safety are on the table,” said Dr. David Blumenthal, the Obama administration’s national coordinator for health information technology.

Yet Dr. Blumenthal is clearly an adherent to unbridled exuberance about health IT. At "Science or Politics? The New England Journal and the 'Meaningful Use' Regulation for Electronic Health Records" I wrote:

... In the NEJM article "The 'Meaningful Use' Regulation for Electronic Health Records", David Blumenthal, M.D., M.P.P. (ONC Chair) and Marilyn Tavenner, R.N., M.H.A. (10.1056/NEJMp1006114, July 13, 2010) available at this link, the opening statement is (emphases mine):

The widespread use of electronic health records (EHRs) in the United States is inevitable. EHRs will improve caregivers’ decisions and patients’ outcomes. Once patients experience the benefits of this technology, they will demand nothing less from their providers. Hundreds of thousands of physicians have already seen these benefits in their clinical practice.

I think it fair to say those are grandiose statements and predictions presented with a tone of utmost certainty in one of the world's most respected scientific medical journals.

Even though it is a "perspectives" article, I once long ago learned that in writing in esteemed scientific journals of worldwide impact, statements of certainty were at best avoided, or if made should be exceptionally well referenced.

I note the lack of footnotes showing the source(s) of these statements.

I also note the lack of mention of literature refuting or potentially refuting these statements of certainty. [Followed by a list of such literature just off the top of my head - ed.]

Dr. Blumenthal then appeals to authority:

Dr. Blumenthal said health information experts like Dr. Donald M. Berwick, the Medicare and Medicaid administrator, and Dr. Brent James, of Intermountain Healthcare, based in Salt Lake City, “agree that electronic health records will improve the safety of care.”

I am unaware of the expertise of Dr. Berwick and Dr. James in this domain, and the peer reviewed literature they've written that supports such a statement while soundly refuting literature written by other experts that indicates otherwise.

(Perhaps at Intermountain, custom systems that took decades to develop utilizing their Medical Informatics expertise do show safety gains, but such systems and the lessons learned building them are not easily portable to a country's worth of organizations and practitioners, especially under HITECH timeframes.)

Freudenheim then quotes Blumenthal as stating:

“At the same time, any time you change the world you create risks,” Dr. Blumenthal said in a telephone interview last weekend.

This sounds typical of utopian ideology. Yes, any time you change the world you create risks, but you should not attempt to change the world cavalierly and blindly to those risks. (That's the path the National Program for Health IT in the United States has been on, until the IOM meeting was called.) Idealists tend to believe the collateral damage that is caused by utopian experiments (e.g., communism) are a necessary sacrifice to achieve the utopia. Such values are both abhorrent and alien to medicine.

“We want to make sure that implementation is as safe as it can be and all safety benefits are realized.”

Blumenthal's been painted into a corner by tons of complaints on HIT safety; ONC must act, even if just putting on a show about safety considerations. If there were true concern for safety he'd recommend slowing down HITECH timelines until the industry gets its act together and our understanding of HIT usability, safety, and other issues is resolved; cf.: statements of HIMSS leaders on 'needing to be patient' for the industry to get healthcare IT right:

As I'd written about HIMSS admissions of health IT unsuitability to task at "NIST Provides Healthcare IT Industry with Remedial Undergraduate Computer Science Education":

... What have been their product design and development practices, such that leaders of their own trade group HIMSS (as I pointed out in other posts) opine we should be "patient" for them to figure it all out about how to do health IT better and they need more time, and that the technology does not support its users properly due to lack of efficiency and usability of EMRs currently available? (As at my July 2010 post "The National Program for Healthcare IT in the U.S., and the Elephant in the Living Room".)

Further, from the NYT article:

He [Blumenthal] said that if the Institute of Medicine “concludes that regulation is an important part of this fabric of assuring safety, we will want to balance regulation and innovation as we do in every marketplace.”

That he even needs to make such a statement is likely revealing of biases on regulation, which seem aligned to the industry. To wit:

“The policing of design by a third party or agency, however well intended, will likely stifle innovation and inhibit the growth and development of electronic health records in the future,” said Carl Dvorak, executive vice president of Epic Systems, which has built electronic records systems for Kaiser Permanente and other large health care and hospital groups.

There is a lack of evidence supporting such a statement (e.g., pharma has been regulated for decades, as is its clinical IT). The fact that NIST has just delivered Computer Science 101-level usability guidelines to the HIT industry in its recent report “NIST Guide to the Processes Approach for Improving the Usability of Electronic Health Records” to help solve the HIT unusability crisis also suggests that 30+ years of un-regulation did not facilitate ‘innovation.’

In fact 'unregulation' appears to have led to prima facie innovation failure and paralysis as far as usability is concerned.

Unusable health IT might as well not exist as far as clinicians are concerned. It is a menace to the safe practice of medicine. This is a first principle.

Per the NYT, the industry trade group HIMSS has gone mum:

The industry has recently avoided speaking out on a role for the F.D.A. In a statement for this article, the Healthcare Information and Management Systems Society, a Washington-based industry group, said only that it “supports the administration’s decision to ask the Institute of Medicine to study this complex issue and report back over the next 12 months.”

They are certainly not taking a leadership role on this issue. In my humble opinion they will allow regulation, only kicking and screaming and being dragged into it by force. Patients come second to profits - the only factor that will be "stifled" as vendors are coerced to make better products.

The NYT article goes on:

Last month, in protest of one common industry practice, the American Medical Informatics Association said “hold harmless” clauses in many purchasing contracts were unethical. The clauses typically absolve manufacturers of responsibility for any errors or misuse.

“We said we value innovation, but we don’t value it more than safety,” said Kenneth W. Goodman, a University of Miami bioethicist who headed an association advisory group on patient safety.

It took a lot of writing and politicking to get AMIA to this point as well, at least to express it openly (cf.: my efforts here).

Finally, with regard to the IOM meetings on HIT safety, there will be industry stakeholders in attendance such as CCHIT and EPIC.

I believe they should be held to scientific standards of delivery. If they deliver marketing-based spin, they should be called to present scientific evidence for their stance – and not just “positive” evidence. They should be made to refute “negative” evidence as well, not ignore it.

In summary, I welcome the New York Times bringing these issues to the public.

I also welcome IOM's entry into studying HIT safety. While a "Committee on Patient Safety and Health Information Technology" should have been convened years ago, it's better late than never. (Except for patients already injured or killed, of course.)

The results may remain as invisible as the aforementioned National Research Council study. I also doubt the Committee's findings will change hearts and minds. Idealism, profit motive, and irrational exuberance are hard to rectify.

But their effects on people's behaviors can - and should - be regulated.

-- SS

Addendum Dec. 17:

Healthcare Renewal blog to IOM: I have the information of the type you apparently seek on HIT-related injury. My Drexel Univ. site on HIT failures that's been around since 1999 comes up in the first few hits of Google searches on that subject, and has a banner at the top about my mother:

(click to enlarge, or go to site)

Anyone at IOM listening?

-- SS

NIST Provides Healthcare IT Industry with Remedial Undergraduate Computer Science Education

The National Institute of Standards & Technology (NIST) has published a guide entitled:

NIST Guide to the Processes Approach for Improving the Usability of Electronic Health Records

It is available free at this link in PDF: http://www.nist.gov/itl/hit/upload/Guide_Final_Publication_Version.pdf (hat tip to an AMIA colleague for posting the URL on an AMIA mailing list.)

The NIST was commissioned by HHS/ONC to study Health IT issues such as usability and report on them.

I find the publication both welcome, and pitiable.

As I started to read ch. 6, for example, I observed material that is suitable for undergraduate computer science instruction:

6. User-Centered Design Process in EHRs

User-centered design is a bedrock principle for creating usable systems and devices. [You don't say? - ed.] One of the most common reasons why systems are poorly designed is that designers and developers fail to engage users in appropriate ways at appropriate times. [Hear that, my young Paduan learners? - ed.] At its core UCD is a process that relies on systematic understanding of users and their environments, and iterative design and testing based on user performance objectives. (Details on usability testing are provided in Section 9.)

UCD has been shown to be effective in many fields. In aviation, for example, this method has been used to develop cockpit navigation displays for low-visibility surface operations. [22] By taking the limitations and capabilities of the flight crew into account, navigation errors have decreased by almost 100%. The adoption of UCD has also been shown to be effective in the design of personal computers. When working on a redesign of the laptop computer, a UCD process was employed. Users were asked to offer feedback about the current model and to offer input about ways to improve the current design. User-centered design was successful in increasing market share, brand equity, and customer satisfaction. [23] In fact, user-centered design has been elevated to an ISO standard. [24] UCD serves to engineer improved human performance into a system or device, and has been crystallizing for several decades as a design philosophy. [25]

While there is no singular model of UCD, the instantiations embody the following principles:

• Understand user needs, workflows and work environments
• Engage users early and often
  
• Set user performance objectives
• Design the user interface from known human behavior principles and familiar user interface models
• Conduct usability tests to measure how well the interface meets user needs
• Adapt the design and iteratively test with users until performance objectives are met

[HHS needs ONC to commission NIST to provide schooling for the HIT industry on these bons mots? - ed.]

As an iterative process, UCD is a cycle that serves to continually improve the application. For each iteration, critical points and issues are uncovered which can be improved upon and implemented in subsequent releases. An illustration of the UCD process is included in Figure 1.

"User centered design process in EHR's." Undergraduate-level computer science 101 instruction from NIST for the healthcare IT industry? (click to enlarge)

Here is Figure 1:

User centered design 101 (click to enlarge)

I might even have used this in teaching high school students about computer programming.

Readers can download the entire report at the above URL.

I find this publication, or, rather, the need for it to exist at all in 2010, remarkable. Absurd and an embarrassment, in fact. Master of the Obvious [1] material that apparently was not so obvious to this industry.

This is after all a multi-billion dollar industry making claims its products will "revolutionize medicine" and other exceptional claims (but without exceptional evidence). These claims have been pushed so hard that many tens of billions of dollars (with penalties) have been earmarked to either entice -- or coerce -- physicians and hospitals to use these products.

What has this industry, including vendors and highly paid management consultants and contractors, been doing, exactly, for the past thirty+ years?

What have been their product design and development practices, such that leaders of their own trade group HIMSS (as I pointed out in other posts) opine we should be "patient" for them to figure it all out about how to do health IT better and they need more time, and that the technology does not support its users properly due to lack of efficiency and usability of EMRs currently available? (As at my July 2010 post "The National Program for Healthcare IT in the U.S., and the Elephant in the Living Room".)

That HHS needs NIST to provide undergraduate level remedial teaching to the multibillion dollar health IT industry is a very poignant commentary indeed on the priorities of that industry regarding engineering rigor, talent management, attention to safety, and other factors affecting human lives.

These observations speak strongly to the need for regulation for this industry, for a talent management and trade association shakeup of major proportions, and most especially for an awakening of our government servants to exactly what the real situation is with respect to HIT on the ground.

12/14/10 addendum: it struck me that the Guide might need another chapter. I suggest a chapter entitled:

"Listening to informatics experts when they say your product will kill people, instead of firing them."

-- SS

[1] This was another pithy line from my early medical mentor, pioneering cardiothoracic surgeon Victor Satinsky, MD at Hahnemann Medical College.

Health IT: "Danger"

In an article simply entitled "Danger", Health Data Management author Elizabeth Gardner spells out some "inconvenient truths" about health IT.

Many of the contributors have opined on the risks associated with health IT; several are newly contrite about this issue:

Danger
By Elizabeth Gardner
Health Data Management Magazine, 08/01/2010

Even to Ross Koppel, electronic health records are better than paper ones, "or cuneiform tablets, smoke signals, or carrier pigeons," he adds. He prefers to use hospitals and doctors that have EHRs.

But the University of Pennsylvania sociologist specializes in analyzing interactions between medical computer systems and the people who use them, and he's found enough problems to turn him into an industry gadfly on the potential dangers of EHRs.

"A resident will get an alert at 50 [milligrams of a certain drug] at one hospital, 60 at a second hospital, and no alert at a third hospital because they turned it off," Koppel says. "So he thinks the 70 milligrams he's ordered there are safe. The residents don't know whether the alerts are on or off. They're not familiar with many medications and they start a new rotation every thirty days. They use these alerts as safety bumpers and that's not safe."

... Koppel has found plenty of other glitches, from outright programming errors to user interfaces that make life difficult for clinicians. Numerical values appear in an order that makes sense to the computer but looks random to a human; positive test results aren't always flagged for review; weights aren't consistently labeled as pounds or kilograms (which can lead to babies, for example, being given twice, or half, the medication they need).

"Everyone focuses on why physicians are resistant to computers, but I would rather focus on how difficult the systems are to use," Koppel says. "Most physicians are the smartest guys in the room. Their resistance to technology as such is zero, but they resist software that has a clunky structure."

Dr. Koppel, a sociologist, is a well recognized name in health IT critical thinking circles. He will not win any favors from the health IT vendors and CIO's for that comment about physicians and smartness, but he is quite correct. Physicians are not Luddites. They readily adapt new technology proven as good for patients.

In fact, in my observations IT personnel are the true Luddites, clinging to inappropriate, rigid business-IT views on the healthcare IT development and implementation process (vs. more appropriate and modern agile methodologies), holding unshakable, stereotypical views about physicians, and remaining unreasonably obstinate on clinician complaints about "clunky" health IT user experiences.

Every year the ECRI Institute, Plymouth Meeting, Pa., a not-for-profit organization that evaluates health technology, issues a top 10 list of technology hazards in medical care. "Problems with computerized equipment and systems" ranked seventh this year, right behind "needlesticks and other sharps injuries" and ahead of "surgical stapler hazards." Most of the incidents reported to ECRI by its 5,000 members (hospitals, health systems, payers, and other interested parties) were due to convergence of computers and medical devices in areas like medication management and the routing of device alarms to clinicians' cell phones and pagers. (ECRI Institute points out that such problems are "most certainly underreported.")

Under-reporting of health IT hazards is a familiar theme to this author, as in a 2009 paper entitled "Remediating an Unintended Consequence of Healthcare IT: A Dearth of Data on Unintended Consequences of Healthcare IT" that was not published due to first-round reviews. Some of those reviews were legitimate and constructive regarding revision, but others appeared to suggest the topic was verboten (for example, "nothing is in this paper that could not be read in any big city newspaper", rather the oxymoron considering the paper's topic). I did not bother with a revision, simply making the paper public and bypassing the peer review censorship I saw coming.

But EHRs can easily cause errors, too. Plenty of experts believe that too many systems are being installed too fast into environments too complex to be easily computerized. In the frenzy to be eligible for federal EHR meaningful use incentive payments, and avoid reimbursement penalties starting in 2015, institutions may be setting themselves up for disastrous computer-induced medical errors.

The theme of "too fast" has been present in my writings for awhile now; see for example my 2008 posts "Should The U.S. Call A Moratorium On Ambitious National Electronic Health Records Plans?" and "Open Letter to President Barack Obama on Healthcare Information Technology".

"I'm one of the biggest believers [in EHRs], but there's tremendous pressure to implement these systems so fast," says medical informaticist Dean Sittig, associate professor at the University of Texas Health Science Center at Houston and a leading researcher on successes and failures of EHR implementations. "It worries me that people won't have adequate time to come to grips with what they're doing and test their systems properly."

Dr. Sittig did write some excellent, pioneering articles on the indispensibility of the CMIO role ("information architect" - PDF) back in the mid-1990's that I use in my teaching. However, a few years ago he told a former student of mine (he was unaware of that relationship) who listed me as a reference on her CV to not do so, as I was not a "real medical informaticist" or words to that effect. Seems at the time he may have taken issue with my realist views on the problems with health IT.

The medical environment is more complex than other fields like aircraft navigation, which is already hard enough to computerize, notes Nancy Leveson, professor of aeronautics and astronautics at the Massachusetts Institute of Technology. She's a pioneer in software safety ... "We're talking about a professional environment of doctors, and changing the way they do business," Leveson says. "Most other kinds of automation aren't doing that.

This issue is critical and at the root of health IT dysfunction. No other profession is being asked to use IT in the manner in which clinicians have been asked. No other profession may have an information model as complex that they're asked to record in painstaking, granular detail, either.

Because software engineers aren't taught about usability and the impact of their systems on the world, they think they'll just automate it the way they want and make people do it their way. There's a lot of stuff out there [in health care] that's very difficult to use. The industry is naive about introducing software and the change it requires and the potential hazards it introduces, and they think it's going to be all right."

I would replace the word "naive" with "willfully ignorant, complacent and negligent." There are simply no acceptable excuses for a field that has been in existence for decades to be as toddlers on the impact of their work.

... Clinicians who already have extensive experience with EHRs are under no illusions that everything works smoothly. "It's inevitable that some new errors will be introduced [with EHRs]," says David Bates, M.D., chief of general medicine at Brigham and Women's Hospital, Boston, a patient safety expert, and a member of the information technology executive committee of Partners HealthCare, Brigham's parent.

Considering the ice-cold reception by most of those clinician experts (e.g., in the medical informatics community) to my writings on HIT problems that began in 1999 and now reside at my Drexel site here, and to the similar writings of others, I disagree with Bates' assessment. I think the experts have now painted themselves into a corner and have been forced by reality and their own willful blindness into admitting the truth about this experimental technology. (A PubMed search on "Bates DW" is not generally revealing of papers on health IT risks until relatively recently.)

"The key thing is to devote enough resources and attention to fixing them [errors] after they happen. Your EHR may prevent 10 errors for every new one it causes [not sure where these figures come from or if they're generalizable at all - ed.], but you have to have an approach for dealing with the new ones."

Again, I would differ. The key thing is to prevent them from happening as much as possible. The pharma and medical device industries do this through RCT's, post market studies, and strong regulatory requirements for their products' manufacture and use.

Bates is not an advocate of regulation of health IT. As in my post "JAMA letter: Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards", in 2009 Bates signed on to an unpublished letter to JAMA (archived here) in response to Koppel and Kreda's article on "hold harmless" clauses that stated "... the belief that the best approach to increase the safety and effectiveness of EHR systems is by legal regulation of system vendors is misplaced." (Incidentally, the letter that JAMA did publish was mine.)

... Partners has been developing its own in-house EHR for several decades, and still encounters things that need fixing. For example, when physician order entry was introduced, the system made it possible to order fatally large doses of intravenous potassium, because the initial order choices hadn't been properly vetted by the internal team responsible. The nurses who executed the orders knew enough to catch the error before it harmed a patient, but Bates says it took a year and a half to get the screen corrected in the order entry system.

I can add that taking a year and a half to correct a potential fatality-causing screen in a home-built clinical IT application is not just a technological issue, but also an organizational, political and leadership issue.

... "Emergency care is by definition nonlinear and unpredictable, and information technology tends to enforce a certain amount of linearity: you can't do step 5 until you've done steps 1 through 4," says Wears. Emergency room personnel often care for multiple patients simultaneously and have to do things "out of order" so they can be more efficient. If an EHR enforces a linear pattern, it will just get in their way, and they'll compensate by running a parallel system on paper and putting information into the EHR later. "That subverts one of the fundamental things you wanted the system to do-give you real-time feedback on good and bad ideas," Wears says.

The realities of the ED cannot be neatly dealt with as if a calm, solitary office environment .

There's plenty of blame to go around. Koppel and Leveson say software design, or lack of it, is a common culprit, and they take vendors to task for not focusing on usability.

Again, there is no reasonable excuse for IT intractability in a mission critical sector.

Leveson says part of the problem is a lack of regulatory standards. "The FDA doesn't want to oversee anything and that's a mistake," she says. "So it's become this free-for-all in the industry."

I've used that same language. In my 2009 post E-Health Hazards: Provider Liability and Electronic Health Record Systems I wrote "the unregulated free-for-all that has been the health IT marketplace, with dangerous and even outrageous practices I noted starting a decade ago, must come to an end as the market matures and as diffusion of this technology massively increases per the government mandates now in effect."

Though experts say EHRs clearly fall under the category of medical devices, the FDA has steered clear of directly regulating them. Its ill-starred policy of requiring pre-market approval for blood-bank software, begun back in the 1990s, resulted in major vendors pulling out of the market altogether and stifling innovation ... "That kind of regulation provides a huge economic disincentive and there hasn't been any substantial improvement in blood bank software in 10 years," says Geisinger's Walker. "If the FDA required it for EHRs, it would harm patients more than help."

I disagree with Walker and especially disagree with the latter statement, based on one anecdotal case of IT regulation (ironically, it's HIT proponents who most often claim that 'anecdotes' of patient harm don't make data).

Further, the FDA was called in initially because of IT dangers in existing blood banking software. Also, the "innovation" referred to could more accurately be referred to as "lifecycle adaptation and enhancement", not true innovation. In other words, there was not enough profit to be made in maintaining mature software under regulation. The effect might be to push the quick-buck profiteers out of the industry, and thus improve quality and innovation.

The Swedish Medical Products Agency is leading the way for consideration of HIT in the EU as a medical device to be regulated as in my post "Improving Patient Safety In The EU: HIT Should Be Classified As Medical Devices". Yet, that didn't seem to impact Swedish innovation; in the UK, Wrightington, Wigan and Leigh NHS Foundation Trust has recently awarded its hospital information system contract to Swedish healthcare systems provider, Cambio (link).

Albeit in another anecdote, FDA's regulation did not harm pharma IT as far as I could tell, while a Group Director in Merck Research Labs' Research Information Systems Division.

Truth is, there is no good data one way or the other regarding regulation, but after thirty or more years of an unfettered HIT industry, I believe it reasonable to say that the presence of harmful HIT speaks more for regulation than for a continued industry "free-for-all."

The Agency for Healthcare Research and Quality is currently working with the FDA, VA and other federal agencies to develop a common format for reporting I.T.-related patient safety events and unsafe conditions.

"What took so long" is my question.

Read the whole article. The myth of health IT beneficence continues to be eroded. One can only hope the tens of billions earmarked for the technology in the recent economic "recovery" legislation will become similarly eroded in years to come, to allow the technology to be safely improved - that is, in vitro, not in vivo.

-- SS

Internal FDA memorandum of Feb. 23, 2010 to Jeffrey Shuren on HIT risks. Smoking gun? I report, you decide.

From the aforementioned Huffington Post Investigative Fund article "FDA, Obama Digital Medical Records Team at Odds over Safety Oversight" and timeline of industry resistance to government oversight of health IT (link), one document stands out in my mind.

The internal FDA memorandum of Feb. 23, 2010 ("not intended for public use") to Jeffrey Shuren on HIT risks. which I have now re-hosted at this link (PDF) is quite fascinating.

Internal FDA Memo ("not intended for public use") on potential dangers of health IT. Download the PDF here.

The memo begins:

This report serves to characterize medical device reports (MDRs) in the Manufacturer and User Facility Experience (MAUDE) database, inclusive of MedSun reports, pertaining to Health Information Technology (H-IT) safety issues as requested by the Office of the Center Director, Center for Devices and Radiological Health (CDRH), in contrast to the previously submitted MedSun and Office of Compliance information.

(I've mentioned MAUDE here and here, including a report of an HIT-related patient death at the latter link.)

To those "anecdotalists" in the healthcare information technology community who believe reports of HIT-related harm are "anecdotal, and anecdotes don't make data" (as opposed to the "Markopolists"):

When an internal FDA review of their own data concludes the following, I invite you to think about the point of view that maintains that reports of HIT-related patient injury and death are so 'fragmentary' as to not merit (actually, demand) significant resources be diverted to rigorously addressing the issue of HIT risk:

In summary, the results of this data review suggest significant clinical implications and public safety issues surrounding Health Information Technology. The most commonly reported H-IT safety issues included wrong patient/wrong data, medication administration issues, clinical data loss/miscalculation, and unforeseen software design issues; all of which have varying impact on the patient’s clinical care and outcome, which included 6 death and 43 injuries. The absence of mandatory reporting enforcement of H-IT safety issues limits the number of relevant MDRs and impedes a more comprehensive understanding of the actual problems and implications.

This is especially true considering the FDA's own noted limitations of their information sources:

Limitations of the MAUDE search and final subset of MDRs include the following:

1. Not all H-IT safety issue MDRs can be captured due to limitations of reporting practices including

... (a) Vast number of H-IT systems that interface with multiple medical devices currently assigned to multiple procodes making it difficult to identify specific procodes for H-IT safety issues;
... (b) Procode assignments are also affected by the ability of the reporter/contractor to correctly identify the event as a H-IT safety issue;
... (c) Correct identification by the reporter of the suspect device brand name is challenged by difficulties discerning the actual H-IT system versus the device it supports.
2. Due to incomplete information in the MDRs, it is difficult to unduplicate similar reports, potentially resulting in a higher number of reports than actual events.
3. Reported death and injury events may only be associated with the reported device but not necessarily attributed to the device.
Memo: H-IT Safety Issues
4 Correct identification by the reporter of the manufacturer name is convoluted by the inability to discern the manufacturer of the actual H-IT system versus the device it supports.
5 The volume of MDR reporting to MAUDE may be impacted by a lack of understanding the reportability of H-IT safety issues and enforcement of such reporting.

If HIT were VIOXX or Phen-Fen, the class action lawsuits would likely be starting already.

(Note: for more on why there is a scarcity of data on HIT related adverse events, see my paper "Remediating an Unintended Consequence of Healthcare IT: A Dearth of Data on Unintended Consequences of Healthcare IT" at this Scribd link. This paper was not accepted on first draft by the medical informatics peer review process. I received anonymous review comments such as one that paradoxically stated that the paper "did not contain anything that could not be read in any big city newspaper", an odd comment indeed considering the topic. On that basis I decided not to attempt a revision but to post the paper publicly. -- SS)

One has to ask why this internal FDA report has not been made public until the Huffington Post article, nor been acted upon vigorously. The term of art is "double standard" compared to pharmaceuticals and other medical devices.

When the NEJM starts publishing unreferenced statements of absolute certainty like this from ONC Chair Blumenthal:

The widespread use of electronic health records (EHRs) in the United States is inevitable. EHRs will improve caregivers’ decisions and patients’ outcomes. Once patients experience the benefits of this technology, they will demand nothing less from their providers. Hundreds of thousands of physicians have already seen these benefits in their clinical practice.

and the HuffPo Investigative Fund quotes him as follows:

“We know that every study and every professional consensus process has concluded that electronic health systems strongly and materially improve patient safety. And we believe that in spreading electronic health records we are going to avoid many types of errors that currently plague the healthcare system,” Blumenthal said when unveiling new regulations in Washington on July 13.

... a statement easily demonstrable to be without merit, in fact, then one has to wonder where science has gone.

One also has to wonder if someone is short-circuiting the FDA's role in regulating this technology.

Could Blumenthal (in essence a family doctor), Sibelius (a trial lawyer), DeParle, or others, or the White House itself be telling FDA how to conduct its business? Are they impeding FDA's regulatory role in the irrationally exuberant multi-billion $$$ race to HIT utopia?

Finally, it is my belief that numerous health IT/medical informatics academics and talking heads who've steadfastly avoided the issue of health IT-related patient harm, or scoffed at it in legally-discoverable forums, might find themselves as defendants in upcoming plaintiff lawsuits. "Knew, or should have known" is the phrase that might apply.

As I learned from my pre-informatics Transit Authority medical management experience, juries will likely not take kindly to academic and marketing arguments akin to Scott Adam's sarcastic example of the logical fallacy of "ignoring all anecdotal evidence":

"I always get hives immediately after eating strawberries. But without a scientifically controlled experiment, it's not reliable data. So I continue to eat strawberries every day, since I can't tell if they cause hives."

-- SS

Cerner - Fuqua School of Business 'Corporate Ethics 101' Paper and Website Disappear

On April 16 at "Healthcare IT Corporate Ethics 101: A Strategy for Cerner Corporation to Address the HIT Stimulus Plan" I wrote about a Duke Fuqua School of Business paper (apparently authored by a Cerner official) promoting a business strategy of regulatory manipulation to restrain the free market for HIT products.

The paper, and the Fuqua School of Business web page "Past Papers" on which the paper was promoted, have both disappeared as of this April 18 writing.

I have posted an image of the "Past Papers" page and updated my link to an archived copy of the paper, but the scrubbing of the Fuqua site and removal of the paper is interesting.

-- SS

Addendum Apr. 19 -

A former HIMSS staffer related to me that I am likely blacklisted from the HIT vendor industry as a result of my writings on health IT on this site and at my academic site dating to 1999, via verbal exchanges and even in writing among HIT organizations. It could explain why my CV's been uniformly ignored by that industry since the early 2000's.

If so, so be it. Who else might be on that blacklist, I wonder?

Also, didn't Richard Nixon get into a bit of trouble for maintaining such a list after it was discovered?

Healthcare IT Corporate Ethics 101: 'A Strategy for Cerner Corporation to Address the HIT Stimulus Plan'

Combination in restraint of trade: An illegal compact between two or more persons to unjustly restrict competition and monopolize commerce in goods or services by controlling their production, distribution, and price or through other unlawful means. Such combinations are prohibited by the provisions of the Sherman Anti-Trust Act and other antitrust acts.

I have written on these blog pages that the IT industry has staged an invasion of the healthcare professions.

One of these invasions has to do with the ethics of the IT industry, ethics at odds with medical ethics and the Hippocratic oath. The HIT industry is characterized by an overarching interest in profits and cavalier attitudes towards HIT-related adverse clinical events through sales of inferior products (domestically as well as abroad) based on archaic technologies, exaggerated claims of benefits, ultra-aggressive marketing, and legalized suppression of adverse events information about unproven, non-secure, largely experimental health IT medical devices.

I find it truly remarkable, more than 20 years into consumer availability of the GUI, that in the 2009 publication "Principles and Proposed Methods of EMR Usability Evaluation and Rating" (PDF) the major HIT trade group HIMSS admits that:

Electronic medical record (EMR) adoption rates have been slower than expected in the United States, especially in comparison to other industry sectors and other developed countries. A key reason, aside from initial costs and lost productivity during EMR implementation, is lack of efficiency and usability of EMRs currently available.

Unbelievable. What has this industry been doing for the past few decades?

Worse, the health IT industry is entirely unregulated and has pushed to maintain that status quo. Now the HIT industry may be clamoring for industry regulation as a means of restraint of trade as described below.

The public is beginning to wake up to the vendor and HIT trade group puffery, at least with regard to security hazards and exaggeration of the benefits:

Electronic health records prompt security, costs concerns
Richmond Times-Dispatch
By Tammie Smith
Published: April 5, 2010

The thought of one's personal medical information being just a computer click away does not sit well with many consumers. In a March 2009 survey of 1,238 randomly selected adults by the Kaiser Family Foundation, the Harvard School of Public Health and National Public Radio, 59 percent of respondents didn't think confidentiality of electronic medical records could be assured ... 76 percent thought it was likely that an unauthorized person would get access to medical records online.

... While there are anecdotal stories of electronic health records improving outcomes, the data are mixed on whether they save money. A Harvard Medical School study published in the American Journal of Medicine last year linked 2003-2007 cost and quality data for 4,000 hospitals, including the 100 "most wired" hospitals. The researchers concluded that the electronic health records systems in place so far "might modestly improve" quality quality but produced no savings on administrative or overall costs.

'Anecdotal'? 'might'? 'modestly'? Is that worth spending hundreds of billions of dollars on, at a time when the healthcare system is struggling to make ends meet, I ask?

Unfortunately, the public and healthcare regulators need a further awakening about the Healthare IT industry's ethics.

A profoundly disappointing lesson in the ethics of the healthcare IT sector (and the B-schools as well) can be gleaned from the following, a paper written by a Cerner employee and two health industry colleagues for a Duke Fuqua School of Business course.

The course is "Health Economics & Strategy (HLTHMGMT 326), Distance Executive MBA" (syllabus here in PDF). The course's stated purpose:

We will apply the tools of economics and strategy to address the challenges and opportunities of today's health care managers and policy makers. We will begin most classes with analysis of recent news, then discuss a case, and conclude with additional insight on the application of economics and strategy.

The paper is entitled -

"A STRATEGY FOR CERNER CORPORATION TO ADDRESS THE HIT STIMULUS PLAN" (PDF).

*** April 18 NOTE: the paper apparently has been scrubbed and is no longer available from the above link as it was on April 16. A copy is here (PDF).

It is actually highlighted at Duke professor David Ridley's page "Duke University Fuqua School of Business: Past Papers."

*** April 18 NOTE: the "Past Papers" page has also seemingly been scrubbed. This is how it looked two days ago:

(click to enlarge)

This appears to be a Final Paper for an online MBA program course for executives. These are therefore not just students in the academic sense; as in my own healthcare informatics courses, I've had 'students' who concurrently were executives and managers in healthcare companies and organizations.

All three authors are listed at business networking site LinkedIn.com:

• Dan Aycock - appears as Business Strategist at Cerner
• Aparna Prasad - MBA Candidate at The Fuqua School of Business, Duke University
• Barri Stiber - Administrative Fellow at Legacy Health - formerly Senior Analyst at The Advisory Board Company

The paper is emblazoned with the Cerner corporate logo on its cover page and could be mistaken for an official document:

Paper's cover page. Click to enlarge

From the paper, an example of HIT corporate ethics (and business school ethics as well):

Electronic health records (EHRs) have the potential to improve the healthcare system through several means including reduced medical errors, better coordination of care, and reduced costs. However, adoption of EHR systems in the U.S. has been slow; only 1.5% of acute care hospitals have comprehensive EHR systems.

While the Bush administration made efforts to spur adoption of these systems, the Obama administration’s American Recovery and Reinvestment Act of 2009 (ARRA) has pushed EHR adoption to the fore with over $20 billion dollars in incentives. With such a large infusion into a relatively small market the effects of the stimulus package have enormous strategic implications for EHR vendors.

This paper seeks to clarify these implications, understand the strengths and weaknesses of various players in the industry and recommend a strategy for Cerner Corporation to maximize its profit from the stimulus package and thereby secure a dominant position in the HIT industry.

... We recommend that Cerner collaborate with other incumbent vendors to establish high regulatory standards, effectively creating a barrier to new firm entry. Other strategic recommendations to capture market share, facilitate EHR adoption, and improve Cerner’s operational readiness are detailed and framed within an implementation plan.

I am going to highlight one key sentence for emphasis:

We - recommend - Cerner - collaborate - with - other - incumbent - vendors - to - establish - high - regulatory - standards, effectively - creating - a - barrier - to - new - firm - entry.

Did I read that correctly?

The paper goes on to explain:

... With the introduction of stimulus funding, this industry is ripe for disruptive innovation, which could significantly change the competitive landscape. Examining Christensen’s work on disruptive innovation outlined in Figure 6, the primary factor that will influence the entry of new HIT vendors is regulation.

Therefore, the technology standards and definitions of “meaningful use” which are under development have the potential to raise or reduce barriers to entry, limiting or enhancing the ability for disruptive innovations to enter at a lower performance point. When asked about which competitors the organization is most concerned about, a Siemens Executive indicated “it is these new guys who could come in and undercut prices with substandard products.”

["New guys" ="substandard"? This from a company that apparently fired an informatics physician for raising concerns that a substandard ICU system was going to kill patients - ed.]

Therefore, incumbent firms, like Cerner, have strong incentives to influence regulation in their favor, keeping barriers to entry high.

[Influence in their favor, not in the favor of patients, to maintain the industry oligarchy? - ed]

In other words, to stifle disruptive innovation and prevent newcomers from entry into the HIT business, large HIT vendors should influence regulation towards high standards impossible for newcomers to meet.

NOT that they should influence regulation for the sake of patient safety!

This student is apparently a Cerner strategist seeking an MBA. His colleague Barri Stiber was a Senior Analyst at The Advisory Board Company, a company that serves "nearly 3,000 progressive organizations worldwide—health care, health benefits, and educational organizations alike—providing innovative solutions to their most pressing challenges such that they can “hardwire” best-practice performance."

This paper raises a number of questions:

• Does this paper reflect a strategy that would amount to illegal restraint of trade and/or fall under the federal RICO act, through knowingly and willfully advancing a lobbying strategy to strangle fair competition?

• Were any of these authors on Cerner's payroll when this was written?

• Are Mr. Aycock or other authors giving such advice to Cerner management presently?

• Did or does Cerner use this paper or derivatives thereof internally?

• Does this paper reflect on the business ethics of Cerner or other large HIT vendors? Will they openly condemn its ideas as both wrong minded and monopolistic, using their influence to create a market adverse to smaller competitors - not to mention the paper's seeming lack of concern for what really matters - the "customer" (patients)?

• Did or does this paper reflect a more widespread healthcare IT large player collusion on restraint of trade?
  

• Is this how the Advisory Board company conducts its business in advising healthcare organizations?

• What type of professor would exalt a paper via posting it as an example for other students to emulate, a paper whose basic premise is unethical, or at the very least on the precipice of unethicality?

• Does this professor teach such ethics?

• Why was this paper not returned to its authors with a big, red "F" on it? That's what I would have done.

• What other papers are accepted by this professor that demonstrate similar business "strategies" in other sectors?

Finally, and perhaps most importantly:

• Does this paper reflect, or did it influence, current Cerner or other large HIT vendor business strategy?
  

Recent developments are consistent with that, i.e., Cerner starting to acknowledge need for regulation, per the Feb. 2010 story "FDA Considers Regulating Safety of Electronic Health Systems" by the Huffington Post Investigate Fund, http://huffpostfund.org/stories/2010/02/fda-considers-regulating-safety-electronic-health-systems).

From that article:

.... Yet some inside the industry favor stepped-up scrutiny. One major vendor, Cerner Corporation, which has voluntarily reported safety incidents to the FDA in recent years, signaled its support for a rule that would make those reports mandatory. Cerner has reported potential safety concerns because it is the “right thing to do,” a company official said.

I was puzzled by that turnaround.

Perhaps now I know from where it arose.

It certainly is the "right thing to do." It's the right thing to do to enhance profits and enforce restriction of market entry by "disruptively innovative" newcomers.

Those newcomers might actually hold the answers to improving healthcare IT and reducing costs through fair, free market competition, saving lives and money the healthcare system dearly needs. (For example, see my post "Hospitals Under the Knife: Sacrificing Hospital Jobs for the Extravagance of Healthcare IT".)

-- SS

Addendum Apr. 16 -

A commenter speculates that:

... When I did my MBA, back in the day, we were one of the first programs to have a working business background as a requirement for admission. From that base I would make the following guesses:

• The people were not only on the company payroll, but also were having their tuition paid for by the company.
• This document was widely circulated within the company,
• The document was highlighted as a means for the university to curry favor with the company thus increasing recruits or for financial gain.

... The modern remote MBA program is in many instances simply a way to check a box for employees on the fast track to senior management. Often papers are written with the support of the company and access to department heads who contribute to material turned in.

From my experience this is not some theoretical exercise, but a document that, even retiled, will be used internally to drive policy.

While that is speculation, it is certainly plausible; nothing would surprise me in the health IT industry.

Addendum Apr. 19 -

A former HIMSS staffer related to me that I am likely blacklisted from the HIT vendor industry as a result of my writings on health IT on this site and at my academic site dating to 1999, via verbal exchanges and even in writing among HIT organizations. It could explain why my CV's been uniformly ignored by that industry since the early 2000's.

If so, so be it. Who else might be on that blacklist, I wonder?

Also, didn't Richard Nixon get into a bit of trouble for maintaining such a list after it was discovered?

-- SS

A Simple Lesson for the Health IT Industry

From an Op Ed "Living with the Electronic Car" in today's Wall Street Journal:

"A Toyota executive recently explained to a Congressional committee investigating claims of uncontrolled acceleration: "We need to reduce the number of things we ask our customers to do correctly." In fact, the exec was describing the essence of responsible engineering - though perhaps the balance in auto design has gotten out of whack."

Considering the feedback from physicians on the needless complexity of electronic medical records and other computerized medical devices for example at "An Honest Physician Survey on EHR's", it seems the healthcare IT industry has yet to learn this simple lesson.

I'm frankly not convinced there's "anyone home" in this complexity-loving industry who could fathom such advice as a good business practice.

It also seems that industry may not give a damn about such lessons, even in the most safety critical of environments, the intensive care unit, as long as profits are maintained.

See for example "A Lawsuit Over Healthcare IT Whistleblowing and Wrongful Discharge: Malin v. Siemens Healthcare." Also see "Third-Party Reviews of Medical Devices Come Under Scrutiny at the FDA - Except Healthcare IT Medical Devices, Which Get Special Accommodation" on political maneuvering by this industry to avoid the federal regulation other healthcare drug and device sectors have been subject to for decades (largely as a result of public health disasters such as this and this, I might add).

The interesting aspect of these issues is that the executives and officials behind these decisions and machinations are setting themselves up as near-indefensible defendants in future litigation by patients (and their estates) harmed or killed by healthcare IT-related problems.

For instance, I had communications with the Joint Commission leadership over issues I raised in my July 22, 2009 JAMA letter to the editor "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards." Namely, on how hospital executives were violating their fiduciary and Joint Commission safety standards obligations, and jeapardizing patient safety, in signing the traditional health IT contract calling for confidentiality about health IT malfunctions and defects. The JC Leadership is quite well aware of this letter and my more thorough essay here.

Nothing has been heard from the Joint Commission on these issues since.

Perhaps never before have the malpractice lawyers been provided a better scenario for taking the houses and personal property from irresponsible and/or conflicted healthcare and health IT regulators and other officials via lawsuits as health IT diffusion increases, with its "tip of the iceberg" injury and death occurrences now firmly established.

-- SS

Third-Party Reviews of Medical Devices Come Under Scrutiny at the FDA - Except Healthcare IT Medical Devices, Which Get Special Accommodation

This WSJ article caught my eye:

Third-Party Reviews of Devices Come Under Scrutiny at the FDA
March 15, 2010
By ALICIA MUNDY and JARED A. FAVOLE

WASHINGTON—When medical-equipment makers like Philips Electronics NV, Siemens AG and General Electric Co. need approval for some new devices, they don't always have to start at the Food and Drug Administration. They can pay companies to do the reviews, which are then routinely approved by FDA officials most of the time.

Now this third-party outsourcing program has come under fire at the FDA, and the agency is weighing whether to end it. Agency officials question the quality of the reviews and whether they have served the program's original purpose: saving U.S. taxpayers money.

The "real value to industry may be that this is perceived as a way to 'sneak things,'" said an FDA official at a December meeting on device approvals, according to minutes reviewed by The Wall Street Journal. Some third-party reviewers advertise speed and a friendlier process.

At a time when the FDA is moving against third party device reviews, HHS and its Office of the National Coordinator for health IT (ONC) are soliciting to create third party EHR "certification" bodies for healthcare information technology (HIT) medical devices such as electronic medical records systems, decision support tools, clinician order entry and alerting, etc. (see RIN 0991-AB59, "Proposed Establishment of Certification Programs for Health Information Technology", PDF available at this link.)

This comes at the same time as FDA admitting this technology harms and kills patients, but the extent is unknown (existing FDA data is likely the "tip of the iceberg" reports Jeffrey Shuren MD JD at the HIT Policy Committee, Adoption/Certification Workgroup, special meeting on health IT safety on February 25, 2010).

See:

"FDA on Health IT Adverse Consequences: 44 Reported Injuries And 6 Deaths, Probably Just 'Tip of Iceberg'" at http://hcrenewal.blogspot.com/2010/02/fda-on-health-it-adverse-consequences.html

and

"On ONC's "Proposed Establishment of Certification Programs for Health Information Technology" at http://hcrenewal.blogspot.com/2010/03/on-oncs-proposed-establishment-of.html

More from the WSJ article:

... The agency's concerns about the third-party reviews come as the FDA is re-evaluating its entire device-approval process. In addition, the agency has recently announced tighter regulation of some machines that deliver radiation in the wake of reports of more than 300 cases of overdoses from CT scanners at four hospitals.

Changes under consideration at the FDA include terminating the third-party program, limiting the kinds of devices that it covers, or giving the outside reviewers more data on devices to improve the quality of their work, according to the minutes and interviews with agency officials. Jeffrey Shuren, the device division director, said the FDA will release proposed changes later this year and cautioned that no decisions have been made.

To qualify for an outsourced review, a new device must be similar to a device already on the market, and it must carry low or moderate risk to the patient.

The December 2009 minutes say "third parties often don't have appropriate expertise." The minutes cite "poor quality of review documents— they often just repeat what is in the submission, and don't provide any analysis of the data."

(The point on lack of expertise is a point I raise in my aforementioned commentary on ONC's "Proposed Establishment of Certification Programs for HIT." I wrote: HHS should not be creating new, potentially (likely?) amateur organizations and bureaucracies overseeing these new virtual medical devices that will have variable (or no) experience in software validation, certification, regulation, postmarketing safety surveillance, etc. Rather, HHS should be leveraging existing governmental expertise in certifying, validating and regulating mission critical IT.)

The industry as always is looking out for - itself, patients coming in second:

Terry Sweeney, vice president of clinical affairs at Philips Healthcare, said the third-partyprogram benefits industry and helps relieve the FDA of a burden. "Every week's delay [i.e., in rigorously assuring medical device safety - ed.] can cost the company a large sum of money," he said.

It's not like the time differential is enormous:

It takes an average of about 72 days for a company to get final clearance for a device when it goes the third-party route, according to the FDA. That includes the time for the agency to sign off on the outside reviewer's conclusion and compares with an average 109 days for similar applications that go directly to the FDA.

So, the vendors seem to be saying, let's compromise the device safety evaluation process via third party reviewers so we can get to market a month sooner.

The FDA is having serious second thoughts about this state of affairs.

Worse, on health IT devices, the HHS itself via ONC is soliciting for the creation of third party reviewers for HIT, while the FDA itself seems marginalized or even unwilling to shoulder the burden of patient protection from faulty HIT.

Odd. Why do computerized HIT medical devices such as EMR's get special government accommodation?

-- SS

For more on HIT challenges see "Contemporary Issues in Medical Informatics: Common Examples of Healthcare Information Technology Difficulties" - http://www.tinyurl.com/healthITfailure

On ONC's "Proposed Establishment of Certification Programs for Health Information Technology"

The Office of the National Coordinator for Health Information Technology of HHS (the Department of Health and Human Services) has issued a proposed rule "RIN 0991-AB59 Proposed Establishment of Certification Programs for Health Information Technology." The proposed rule is available in PDF at this link and more information is available from ONC itself at this link.

I have written a response to the proposed rule that will be sent as a public comment to the Federal eRulemaking Portal (http://www.regulations.gov/search/Regs/home.html).

I reproduce my response below:

Mar. 9, 2010

Re: RIN 0991-AB59, "Proposed Establishment of Certification Programs for Health Information Technology" (http://www.federalregister.gov/OFRUpload/OFRData/2010-04991_PI.pdf):

Dear HHS/ONC:

I believe the deadlines driving establishment of a certification program for health IT as proposed in RIN 0991-AB59, as well as for achieving “meaningful use of healthcare IT” and for onset of medicare penalties for “non adopters”, will result in diffusion of healthcare IT that, in the words of the Jan. 2009 National Research Council report on health IT “will not be sufficient to achieve medical leaders' vision of health care in the 21st century and may even set back the cause” (http://www8.nationalacademies.org/onpinews/newsitem.aspx?RecordID=12572).

I believe the national health IT system that will result will be injurious to patients at an unacceptably high level as well.

I am a physician and Yale-trained medical informatician and have been writing about the challenges of healthcare IT since the late 1990’s. My bio is at http://www.ischool.drexel.edu/faculty/ssilverstein/biography.htm and my teaching site on HIT difficulties is at http://www.ischool.drexel.edu/faculty/ssilverstein/failurecases/ . I also write on Medical Informatics and HIT for the Healthcare Renewal blog of the Foundation for Integrity and Responsibility in Medicine (FIRM), a 501(c)(3) policy think tank, at http://hcrenewal.blogspot.com.

I have labored over the past decade to steer health IT efforts away from known and predictable paths of difficulty, failure and adverse consequences based on medical science, the science of Medical Informatics, ethical considerations, and the experience of other nations with HIT. I am writing to you to express serious concerns about ONC’s HIT Certification Program NPRM (http://www.federalregister.gov/OFRUpload/OFRData/2010-04991_PI.pdf).

In effect, the NPRM calls for healthcare IT to receive a special governmental accommodation, apparently in part due to politically-decided, and certainly non-scientifically derived timelines. The special accommodations are in the areas of certification, post-market surveillance and inadequate use of existing regulatory expertise over safety-critical IT by agencies with specific domain expertise in that undertaking, thus “reinventing the wheel.”

(On the non-scientific nature of the timelines, see, for example, “Predicting the Adoption of Electronic Health Records by Physicians: When Will Health Care be Paperless?”, Ford et. al, JAMIA 2006 13: 106-112, http://jamia.bmj.com/content/13/1/106.full.pdf.) [note: also see addendum below - ed.]

First and foremost, the term “safety” itself appears in the RIN 0991-AB59 proposal text only four times, and not in the context of strong provisions to safeguard patients from adverse consequences of healthcare IT. This in and of itself is, quite frankly, of great concern, especially in the context of known HIT safety issues.

For instance, FDA’s testimony at ONC’s HIT Policy Committee Adoption/Certification Workgroup meeting on HIT safety (Feb. 25, 2010) itself revealed known patient injuries and deaths related to healthcare IT difficulties.

Even more importantly than the fact of these HIT-related adverse events, however, was the revelation that the true extent of these adverse events is unknown. As FDA’s Jeffrey Shuren, MD, JD expressed it, the data he provided is likely “just the tip of the iceberg.” This supports the contention that the technology is still in an experimental phase, rather than being tried and true.

A growing body of literature supports that view (e.g., see “2009 a pivotal year in HIT” at http://www.ischool.drexel.edu/faculty/ssilverstein/failurecases/?loc=cases&sloc=2009).

It also seems that unscientifically arrived at timelines (i.e., the politically-decided timelines for HIT adoption and achievement of “meaningful use”) that ignore the experimental nature of healthcare IT – that it is not yet “ready for prime time” in a national rollout - are promoting a rush to a superficial certification and surveillance process.

This is alien to the science, culture and ethical obligations of medicine and its practitioners.

The latter process, surveillance, is apparently intended to merely surveil continued conformance of HIT to agreed-upon standards, not patient safety as in the pharmaceutical and tangible-medical device postmarketing surveillance process.

I consider HIT a medical device that is virtual in nature, but a medical device nonetheless, a position the EU is steering towards. See "The Medical Products Agency’s Working Group on Medical Information Systems: Project summary" (available in English translation in PDF at http://www.lakemedelsverket.se/upload/foretag/medicinteknik/en/Medical-Information-Systems-Report_2009-06-18.pdf).

While I believe the NPRM proposal is a step up from the former certification roles envisioned by CCHIT and HIMSS, the proposal still lacks the rigor I have called for in many of my writings about HIT over the past decade.

On the formation of new “ONC-Approved Accreditors” (ONC-AA’s) for certification, this is a special accommodation for the HIT industry that appears to inexplicably place that sector in a favored position compared to the pharmaceutical, medical device and other industries that utilize safety-critical IT.

The FDA, for example, has significant expertise in validating and regulating IT in the pharmaceutical and medical device industries, including that used in clinical trials which bear similarities to HIT used in the delivery sector. For instance, see "General Principles of Software Validation; Final Guidance for Industry and FDA Staff" at http://www.fda.gov/downloads/RegulatoryInformation/Guidances/ucm126955.pdf.

This document opens with the statement:

• This guidance outlines general validation principles that the Food and Drug Administration (FDA) considers to be applicable to the validation of medical device software or the validation of software used to design, develop, or manufacture medical devices.

As yet another example, NASA has published a document “Certification Processes for Safety-Critical and Mission Critical Aerospace Software” (http://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20040014965_2004000657.pdf). This document begins:

• Since safety-critical aerospace software is prevalent and important to human life, what is the rationale behind certification of such software? In other words, how do engineers know when a new software product works properly and is safe to fly? In the United States, software must undergo a certification process described in various standards by various regulatory bodies including NASA and the Requirements and Technical Concepts for Aviation (RTCA) which is enforced by the Federal Aviation Administration (FAA).

• How do researchers know which standards apply to their software? Each NASA center and the FAA have unique certification processes for different types of software. For example, there are special processes for the Space Shuttle and different processes for the Space Station. Any software that flies onboard an aircraft in FAA airspace must adhere to special FAA certification processes. There are also different processes depending upon whether the software is safety- or mission-critical or falls into another category. The UK and Europe have similar certification processes.

HHS should not be creating new, potentially (likely?) amateur organizations and bureaucracies overseeing these new virtual medical devices that will have variable (or no) experience in software validation, certification, regulation, postmarketing safety surveillance, etc. Rather, HHS should be leveraging existing governmental expertise in certifying, validating and regulating mission critical IT.

Further, what is to protect these new bureaucracies from being staffed by those with conflicts of interest with the industry whose products they are purported to certify and surveil? At the very least, existing federal agencies have policies on such conflicts.

Of note, we have a prime example of what can occur due to politically-mediated rushing of healthcare IT – that of the UK’s National Programme for Healthcare IT (NPfIT).

British PM Tony Blair repeatedly sought to shorten the timetable for the NHS national IT programme in a move that would have brought results for patients in time for a general election in 2005 (see http://www.computerweekly.com/Articles/2008/02/18/229447/secret-downing-street-papers-reveal-tony-blair-rushed-nhs.htm.) The result was predictable. A summary of the UK’s House of Commons, Public Accounts Committee’s 2009 report on near-disastrous problems in their £12.7 billion national EMR program is at http://www.publications.parliament.uk/pa/cm200809/cmselect/cmpubacc/153/15304.htm. From that summary:

• “Recent progress in deploying the new care records systems has been very disappointing …The Programme is not providing value for money at present because there have been few successful deployments of the Millennium system and none of Lorenzo in any Acute Trust … Despite our previous recommendation, the estimate of £3.6 billion for the Programme's local costs remains unreliable … Little clinical functionality has been deployed to date, with the result that the expectations of clinical staff have not been met … Patients and doctors have understandable concerns about data security."

And so forth.

Further, from the UK National Audit Office Executive Summary of 16 May 2008 (http://www.nao.org.uk/publications/0708/the_national_programme_for_it.aspx):

• At the outset of the Programme, the aim was for implementation of the systems to be complete and for every patient to have an electronic care record by 2010, although the timetable from 2006 was described as tentative. While some parts of the Programme are complete or well advanced, the original timescales for the Care Records Service – one of the key components of the Programme – have not been met.

We ignore the UK experience at our peril, an experience in a medical environment smaller and far more government-controlled than our own.

Finally, I call attention below to the actual ONC NPRM passages from which my concerns arise on “time constraints” leading to a rushed and superficial certification program (which I believe is frankly cavalier and irresponsible considering the stakes involved).

I believe that a rushed National Program for HIT in the United States will suffer the same fate as the aforementioned National Programme for IT in the UK, and perhaps even a worse fate as the UK’s socialized medicine system is certainly a smaller, more homogeneous and more controllable testbed environment for experimenting with HIT.

In summary, I believe the current approach to Healthcare IT certification is inadequate, in large part due to time constraints set upon the effort that are themselves artificially rushed and inadequate. I believe much more significant leveraging of existing biomedical and mission critical IT certification/validation expertise is essential, and that patient safety, not continuing adherence to existing standards should be a primary concern of post-implementation surveillance.

Thank you for considering these views.

I believe rushing health IT, and burying our heads in the sand about the predictable and demonstrated repercussions of doing so as outlined above and on this and other websites, is a very bad idea.

Making like an ostrich on national-scale healthcare IT is a very bad idea.

I have written about FDA myself and not always in complementary terms (e.g., here, here), but my concern is that the creation of multiple new potentially amateur organizations does not bode well for HIT, either.

The key to successful HIT certification, validation and patient safety is 1) leveraging the needed expertise but 2) without industry conflict of interest and 3) without the pathologies of the HIT 'ecosystem' and culture spoiling the environment (see my aforementioned website on HIT difficulties for more on that topic, as well as the HIT ecosystem essay at that site).

Perhaps a new federal HHS subunit is a potential solution - a Clinical Computing Administration (CCA) with regulatory teeth.

The oversight of hundreds of billions of dollars of technology and the patients the technology itself affects calls for a quite serious approach to these issues, in my view.

-- SS

March 9, 2010 Addendum:

On rushing national health IT programs - unknown to me when I wrote the post above, this article just appeared in the British Press:

Patients' medical records go online without consent
Telegraph.co.UK
By Kate Devlin, Medical Correspondent
Published: 10:20PM GMT 09 Mar 2010

Those who do not wish to have their details on the £11 billion computer system are supposed to be able to opt out by informing health authorities.

But doctors have accused the Government of rushing the project through, meaning that patients have had their details uploaded to the database before they have had a chance to object.

... Hamish Meldrum, [the British Medical Association] chairman, writes: "The breakneck speed with which this programme is being implemented is of huge concern ... "If the process continues to be rushed, not only will the rights of patients be damaged, but the limited confidence of the public and the medical profession in NHS IT will be further eroded."

... Norman Lamb, the Liberal Democrat health spokesman, said: "The Government needs to end its obsession with massive central databases. "The NHS IT scheme has been a disastrous waste of money and the national programme should be abandoned."

Read the whole thing.

-- SS