Don't Worry, the Feds Say Your Medical Information Will Be Kept Absolutely Private

With the planned burgeoning of health IT nationally and the formation of information "exchanges", ensuring information privacy, confidentiality and security become paramount. Systematic threats to medical privacy, confidentiality and security could do significant damage to our Republic.

Yet, according to Modernhealthcare.com in "Looking to loosen privacy rules in Calif." (Dec. 7, 2010):

The head of a federal privacy and security advisory committee and a lawyer for a prominent consumer affairs organization are scheduled to press California officials this week to revise that state's health information exchange (HIE) guidelines [which have strong opt-in consent requirements -ed.] to conform to less-stringent federal privacy recommendations.

Joseph Conn, author of the article relates:

Deven McGraw, director of the Health Privacy Project at the Center for Democracy & Technology, a Washington think tank, and Mark Savage, a San Francisco-based lawyer for Consumers Union [McGraw is also an appointee to a prominent role in the federally charted HHS Health IT Policy Committee; see below - ed.], are to participate via telephone Thursday in a meeting of the California Privacy and Security Advisory Board [CalPSAB].

Here's the problem:

The CalPSAB advises the state's health secretary on healthcare privacy and security policy. Given the traditional leadership role that California plays in the healthcare industry, the board's recommendations could influence how patient consent is handled in electronic health information exchanges nationwide.

Why these recommendations? To satisfy the needs of the reckless rush to national health IT:

McGraw, a lawyer, is a member of the federally charted Health IT Policy Committee, created pursuant to the American Recovery and Reinvestment Act of 2009 to advise the Office of the National Coordinator for Health Information Technology at HHS. McGraw also serves on five work groups or subcommittees of the Health IT Policy Committee. She is chairwoman of its privacy and security workgroup and co-chairwoman of its privacy and security tiger team. [The name "tiger team" makes me wonder who's going to get mauled - ed.]

McGraw and Savage sent a letter Oct. 6 to California Health and Human Services Sec. S. Kimberly Belshe along with a copy of the tiger team's recommendations on privacy and security for health information exchange originally sent to ONC head David Blumenthal on Aug. 19. They also sent Belshe a 10-page "briefing paper" summarizing those recommendations and a follow-up letter Dec. 5.

The briefing paper urged California to "adopt a comprehensive framework of privacy protections such as that recommended by the tiger team." [I.e., that are less stringent than California's - ed.]

They threw a little fear into their recommendations:

The brief also warned that with the first stage of a federal IT incentive program beginning soon, without a consent policy in place, "California's privacy and security framework for patient health information cannot be completed." Furthermore, if that framework isn't completed, the brief asserted, "eligible providers cannot achieve the meaningful-use criteria and benefit from the substantial federal reimbursements."

In other words, "The feds have rushed you to such a point that you cannot possibly have enough time to seriously consider and put into place rigorous privacy regulation, so adopt our 'tiger team' recommendations (or you ain't gonna get money from the feds)."

This is not reassuring.

Among other issues, it seems another example, as in HITECH itself, of the Federal Government setting timelines and policies and using the "fear, uncertainty and doubt" (FUD) principle to manipulate and strong-arm the States into ceding their rights to regulate healthcare. Such Federal overreach seems to be common these days.

Only now, due to the nature of the data involved, this gets personal.

Listen to us, we're the Tiger Team!

Of course, there's always plausible deniability:

Officially, the ONC is not a party to the push by McGraw and Savage to leverage the federal tiger team's work in California, according to the ONC. Asked whether the ONC was aware of and supports the efforts of McGraw in California, spokeswoman Nancy Szemraj said, "We have no knowledge of this letter."

Again, not very reassuring or credible, considering:

1) as above, that McGraw and Savage sent a letter Oct. 6 to California Health and Human Services Sec. S. Kimberly Belshe along with a copy of the tiger team's recommendations on privacy and security for health information exchange originally sent to ONC head David Blumenthal on Aug. 19.

and:

2) McGraw's role on five work groups or subcommittees of the Health IT Policy Committee:

Health IT Policy Committee (A Federal Advisory Committee)

The Health IT Policy Committee will make recommendations to the National Coordinator for Health IT on a policy framework for the development and adoption of a nationwide health information infrastructure, including standards for the exchange of patient medical information. The American Recovery and Reinvestment Act of 2009 (ARRA) provides that the Health IT Policy Committee shall at least make recommendations on standards, implementation specifications, and certifications criteria in eight specific areas.

-- SS

Addendum Dec. 10, 2010:

This post generated a comment containing a significant logical fallacy, apparently from Harley Geiger, staff counsel of the CDT (Center for Democracy and Technology) which is one of the key actors mentioned in the Modern Healthcare story. The comment and my comment back can be seen in the comments section at this post.

If the comment was truly from Mr. Geiger, I would be even less confident than before that an organization whose staff counsel will not or cannot proffer a logically coherent argument will protect our precious freedoms.

-- SS

Annals of Electronic Information Security

At The Hill, former House Speaker Newt Gingrich raises a good point about the leak of hundreds of thousands of diplomatic cables and other private information:

"You have a private first class who downloads a quarter million documents, and the system doesn't say, 'Oh, you may be over extended?' I mean, this is a system so stupid that it ought to be a scandal of the first order," Gingrich said.

Regardless of which administration(s) are responsible (these systems probably took many years to reach their current form), one wonders if commercial EMR's suffer from the same oversights.

-- SS

The Economist, Information Privacy, Microsoft, and Technological Determinism: An Online Debate

At The Economist, an online "debate" entitled Health 2.0 has been posted (link). It poses a debate between two experts.

In this case, the debate is between Peter Neupert, Corporate vice-president, Microsoft Health Solutions Group, vs. Deborah Peel, MD, Founder, Patient Privacy Rights and leader of the Coalition for Patient Privacy.

The readers are asked to vote upon whether they agree or disagree with this statement:

This house believes that any loss of privacy from digitising health care will be more than compensated for by the welfare gains from increased efficiency.

Note the phrase "will be."

Readers are also permitted to post comments.

My response was as follows:

30/11/2010 19:16:26 pm

Dear Sir,

The premise of this entire debate is logically fallacious, in fact begging the question.

This statement implies proven or inevitable "gains" from health IT. This is far from certain.

Health IT such as electronic medical records systems and computerized order entry systems (CPOE) remain highly experimental medical devices. They are unregulated devices as well. Their effects on medical care can be toxic, and patients are exposed to these effects without informed consent. The "gains" attributed to them are increasingly doubted in a growing body of literature.

See

"Common examples of healthcare IT difficulties" at http://www.ischool.drexel.edu/faculty/ssilverstein/cases/

and

"2009 a pivotal year in healthcare IT"
at
http://www.ischool.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc...

for exposure to some of this literature.

In essence, management information systems and other business computing-derived approaches, customs and traditions for software design, development and lifecycle have proven ill suited in healthcare. Clinical computing and business computing are conflated; yet, they are two fundamentally different subspecialties of computing.

Further, medicine is a scientific discipline, yet the approach to IT in healthcare has been nearly devoid of science and critical thinking.

Sacrificing privacy for a dream that may or may not be true is not good social policy.

In the aftermath of the latest Wikileaks disclosures, a scientific approach - such as assertions about the beneficence of IT in healthcare not being made without strong, robust scientific evidence and without consideration of the downside evidence not being proferred so freely - would be a fine start.

S. Silverstein, MD
Drexel University
College of Information Science and Technology
Philadelphia, PA USA.

I found the position of Peter Neupert (Corporate vice-president, Microsoft Health Solutions Group) defending the motion particularly concerning:

Consumers must trust that the organisations they are engaged with are accountable and will respect—and protect—the privacy of their data.

"Must trust?"

I find this remarkable in the context of repeated violations of "trust" I've noted at this blog such as at my posts:

• "Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?",

• "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?",

• "Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?",

• "Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts",

• "Insurers Test Data Profiles to Identify Risky Clients",

• and others.

Neupert's view is especially paternalistic and naive in the context of Wikileaks repeatedly and recently leaking hundreds of thousands of supposedly secure documents, stolen from U.S. intelligence by at least one known person and probably others. If the Pentagon and U.S. intelligence cannot keep information secure, how can lowly hospital IT departments?

The moderator's initial comments are also disturbing:

... Supporters argue that health information technologies have advanced to the point that such [security] concerns are vastly overblown. After all, do not financial data flow freely and with little incident over digital systems? On this argument, any loss of privacy will be more than offset by efficiency gains. In arguing for the motion, Peter Neupert of Microsoft, a software firm, insists that digital medicine must be centred on the patient—rather than, say, the doctor or the insurer, as is often the case today [this 'centered on the patient' meme sounds good, but what exactly does it mean? - ed.] —and that medical information must be as mobile as the patient. If that is the case, he argues, it is not merely the efficiency of health systems that will improve but also the value of health care—and perhaps health outcomes too.

MR VIJAY V. VAITHEESWARAN
Correspondent, The Economist

Note the statements of absolute certainty - "will be more than offset by efficiency gains", "will improve", etc. They remind me of the statements made in the NEJM by the Director of ONC, Dr. David Blumenthal, as I wrote at "Science or Politics? The New England Journal and The 'Meaningful Use' Regulation for Electronic Health Records":

The widespread use of electronic health records (EHRs) in the United States is inevitable. EHRs will improve caregivers’ decisions and patients’ outcomes. Once patients experience the benefits of this technology, they will demand nothing less from their providers. Hundreds of thousands of physicians have already seen these benefits in their clinical practice.

On that I had commented:

Even though it is a "perspectives" article, I once long ago learned that in writing in esteemed scientific journals of worldwide impact, statements of certainty were at best avoided, or if made should be exceptionally well referenced. I note the lack of footnotes showing the source(s) of these statements.

The meme of technological determinism, that computerization in medicine is synonymous with, and will deterministically provide "improvements", no matter what the evidence, is quite concerning coming from a company as profoundly large and influential as Microsoft.

Further, the complete omission of consideration of the adverse clinical consequences (let alone mere information breaches) that may occur along the way to cybernetic utopia in healthcare is very disturbing. These are experimental medical devices, are unregulated, and are used without patient informed consent. Yet the IT industry seems to opine as if these systems are only to be used on experimental lab rats.

These systems produce "legible gibberish" of no clinical use to clinicians, but take clinician time to generate through distracting "clickorrhea." For example, just the placement of an IV and fluid infusion generates a half page of nonsense:

Actual "legible gibberish" from an ED EHR report, major health IT vendor. Half a page on how an IV was started and a saline infusion given. (How many distracting clinician mouse clicks did it take to produce this?) Click to enlarge.

Addendum 12/8/10 - From "Hidden Malpractice Dangers in EMRs", Steven I. Kern, Esq., Medscape.com:

Too Much Information

... Pages of repetitive documentation can be more time-consuming to review than brief, handwritten notes. When important information is embedded in paragraphs of boilerplate, it can easily be overlooked. The chance of missing critical data increases.

Overlooking important information is, of course, a significant cause of malpractice. A positive finding embedded in a string of negative findings can easily be missed.

Ironically, my own mother was injured as a result of EHR-related disruption not long ago. Further, just the initial two and a half weeks of hospitalization generated more than 2,800 laser printed pages of "legible gibberish" (which cost just under $1000 to obtain; Kinko's should only have it so good).

A fellow physician I know well related:

From: [redacted name of MD]

Good Lord! I am so sorry to see this and hope your Mom gets better. You must be furious.

May I add to the cacophony? My wife went to [another local hospital's] ER for emergency transfusion. Their Emr displayed someone else's info under her name & SSN. Had I not been there she would have received incorrect treatment.

My wife went to [yet another hospital] for hip replacement. After surgery, while she slept off her anesthesia, a nurse came in and started injecting her. I asked and learned it was insulin. I stopped the nurse (with difficulty). My wife's not diabetic. Her screen showed someone else's orders. Had I not been there she might have died.

So keep up the good work... please!

[redacted name of MD]

How many other patients have been injured or killed as a result of EHR's?

In fact, we really don't know how many adverse events related to EHR's occur. As the Joint Commission itself admits in its Sentinel Events Alert #42, Safely implementing health information and converging technologies: "There is a dearth of data on the incidence of adverse events directly caused by HIT overall." I further wrote on this issue in a paper "A Dearth of Data on Unintended Consequences of Healthcare IT" here.

Is this a proper environment for national rollout of these clearly experimental medical devices, one should ask?

The memes of technological determinism and health IT "white-as-driven-snow" beneficence seem as difficult as vampires to eradicate.

Yet if this technology is to achieve the benefits of which it is capable via remediation of current IT industry customs, traditions and practices, these memes must be challenged and defeated.

Regarding health IT in the real world, reality matters.

-- SS

Insurers Test Data Profiles to Identify Risky Clients

Stories like this one today at the WSJ disturb me.

“Insurers Test Data Profiles to Identify Risky Clients”
Wall Street Journal
Nov. 19, 2010

From that story:

Life insurers are testing an intensely personal new use for the vast dossiers of data being amassed about Americans: predicting people’s longevity.

Insurers have long used blood and urine tests to assess people’s health—a costly process. Today, however, data-gathering companies have such extensive files on most U.S. consumers—online shopping details, catalog purchases, magazine subscriptions, leisure activities and information from social-networking sites—that some insurers are exploring whether data can reveal nearly as much about a person as a lab analysis of their bodily fluids.

In one of the biggest tests, the U.S. arm of British insurer Aviva PLC looked at 60,000 recent insurance applicants. It found that a new, “predictive modeling” system, based partly on consumer-marketing data, was “persuasive” in its ability to mimic traditional techniques.

The research heralds a remarkable [alarming? -ed.] expansion of the use of consumer-marketing data, which is traditionally used for advertising purposes.

Read the entire article.

The reason I find this article disturbing is that it can and probably should be looked at as another example of technophiles and opportunists with no knowledge of (or lack of caring about) Social Informatics, a decades-old discipline with a focus on studying the unintended consequences of new information and communications technologies (ICT's), enabling our society to move one step closer to centralized control.

Social Informatics (SI) refers to the body of research and study that examines social aspects of computerization, including the roles of information technology in social and organizational change, the uses of information technologies in social contexts, and the ways that the social organization of information technologies is influenced by social forces and social practices.

Stories such as the above WSJ story, and others in their running series on Internet privacy, also dampen my enthusiasm about the possibility that electronic medical information will be kept private, confidential and secure.

-- SS

Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts

I have written frequently about the pipe dream of secure national electronic medical records, such as in Febraury 2010 at my post "Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?", my post "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?", as well as "Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?" and others.

I was also quoted on July 30, 2010, in a Philadelphia Inquirer story about the theft of a laptop computer with data on 21,000 patients from Thomas Jefferson University Hospital here, and also interviewed August 2 by local NPR station WHYY-91FM, where I stated:

"There is almost no excuse for unencrypted data to be sitting on any computer at a hospital or any organization," said Scot Silverstein, a Drexel University expert on health-information technology.

In the latest health-data-on-computer-theft-of-the-week, the Inquirer ran this story today about a local theft ten times as large as July's:

Medical-data breach said to be major

By Jane M. Von Bergen, Inquirer Staff Writer, Thu, Oct. 21, 2010

A computer flash drive containing the names, addresses, and personal health information of 280,000 people is missing - one of the largest recent security breaches of personal health data in the nation.

"We deeply regret this unfortunate incident," said Jay Feldstein, the president of the two affiliated Philadelphia companies, Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan.

The breach, which involves the records of Medicaid recipients, is the first such Medicaid data breach in Pennsylvania since at least 1997, according to the state's Department of Welfare, which has oversight.

There is little more I can add to my prior postings on this issue except the words of privacy advocate, psychiatrist Dr. Deborah Peel:

The security failure, one of the several largest in nearly two years, involves nearly two-thirds of the insurers' subscribers. It became known only after The Inquirer requested information Tuesday evening. The insurers said the drive was missing from the corporate offices on Stevens Drive in Southwest Philadelphia. It noted that the same flash drive was used at community health fairs.

"That seems grossly irresponsible," said Dr. Deborah Peel, a Texas psychiatrist who heads Patient Privacy Rights, an advocacy group.

"Why would you be hauling around private patient information to a health fair," she said. "I can't imagine what they were thinking, taking this data out of a locked room at company headquarters.

"What's tragic is that this is a particularly vulnerable group of people," Peel said. "They tend to be vulnerable to identity theft, vulnerable to discrimination." Medicaid recipients are low-income people.

As to encryption (a built-in feature of the upper tier versions of Windows and of Mac OS X):

They [the companies] would not comment on the riskiness of taking the drive to health fairs, nor would they say whether the data on the drive was encrypted.

Highly likely translation: no.

The companies issued an apology:

"At Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan, our number one priority is our members. Since reporting this unfortunate incident to the Department of Public Welfare, we have actively and responsibly executed a multifaceted plan to inform those affected, while also evaluating and enhancing our security measures to ensure this does not happen again."

[Did any employee have their "privileges revoked" -- the medical term of art for a physician who is 'fired' -- I wonder? - ed.]

Perhaps the executives in charge of this data, as well as the IT department, should read stories like the aforementioned July 30, 2010 story.

However, I fear there are those who are ineducable or hopelessly irresponsible when it comes to acting cautiously and responsibly regarding computer-based medical information, in the poorly bounded, complex, unpredictable world of healthcare.

That is not to even mention deliberate theft for personal gain.

This is why the dream of secure national electronic medical records seems a pipe dream for the foreseeable future.

-- SS

10/23 Addendum

in an updated story, the Inquirer reports the data was indeed unencrypted, although the companies claimed an encryption project was in progress.

Healthcare Legislation to "Control the People?"

At "AMA And Almost 100 Physician Societies Sound Off To CMS On Health IT" I referred to concern held by AMA and ~94 other medical specialty societies about comments overheard from senior government officials that:

complex measures and high reporting thresholds are needed to discourage EP's - Eligible Professionals (i.e., eligible for government EHR subsidies) from switching back to the use of paper during this transition to EHRs.

Such reporting requirements could not only 'discourage' a switch back to paper even if these 'government-approved' EHR's turned out to be a clinical and/or operational nightmare (which I feel is likely if not unavoidable based on numerous writings at this blog and here), but also could force event those planning to stay with paper and endure the "penalty" for doing so to move to computer systems. The human resources required to satisfy truly ominous reporting requirements via paper records might simply be too burdensome.

This could be perceived as an ingenious and devious plan to establish control of healthcare providers via IT and data. (He who controls the data, controls the playing field.)

Privacy activist Dr. Deborah Peel shares related concerns as expressed in a Wall Street Journal article yesterday "Your Medical Records Aren't Secure."

Along the lines of control, now there's this, recently posted on the Drudge Report:

Shocking Audio: Rep. Dingell Says ObamaCare Will Eventually ‘Control the People’ (link)

I don't care which "people" Dingell's referring to - 300 [sic] Americans (he left out "million"), physicians, insurers, etc. Our government has no business discussing "controlling" anyone.

Ideology aside, the control mentality of government over medicine, facilitated by healthcare IT, is starting to rear an ugly head. I'm afraid this phenomenon might get really out of hand in the very near future.

-- SS

Addendum: there appears to be a healthcare IT industry sockpuppet writing in the comments thread at the aforementioned WSJ article by Dr. Peel, under the especially inappropriate nom de blog "Hank Dagny." The usual dismissal of physician concerns about HIT, unqualified statements, ad hominem attacks, and other games typical of an industry shill occur throughout that comment thread.

See my reply at this link. (It takes a moment to load the WSJ comment thread.)

Also see this summary of a Canadian analysis of electronic health record security at the blog of security technologist Bruce Schneier. Hat tip to Joseph Arpaia, MD.

Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?

At "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?" I wrote that the holy grail of electronic medical record efforts - the creation of a networked, interoperable, secure national medical records system - may be far more difficult than anyone expected due to vulnerabilities in current, widespread IT networking and OS platforms.

Now we hear the situation is even worse than in the articles I cited at that post:

Wall Street Journal
Feb. 18, 2010
Broad New Hacking Attack Detected

Global Offensive Snagged Corporate, Personal Data at nearly 2,500 Companies; Operation Is Still Running

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach.

The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

One can only imagine how internet-connected hospitals, generally an IT backwater, might fare under such an onslaught.

... In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier's military email account, NetWitness found. A Pentagon spokesman said the military didn't comment on specific threats or intrusions.

At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee's apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past.

Read the while article. These breaches are an unpleasant reality in 2010, but what's worse is there really are no solid metrics for the true extent of this 'disease.'

Perhaps future Internet technologies will reduce or eliminate the problem, as one reader suggested in a comment to my aforementioned post. I do not believe, however, that patients and their medical records should be used as guinea pigs until those new networking and security technologies are widely deployed and well-proven.

In effect, this is probably not a good time for actual records-level interoperability to be deployed in any manner other than in consideration of a future strategy. Operationalizing that strategy should probably await a time when the "digital ether" in which the data resides and moves is more mature, unless proprietary networks and technology are to be used and without connection to the Internet. Planning data-level compatibility between systems, on the other hand, is work that should continue.

Finally, the layoffs and staffing levels in today's IT departments (at both vendor and user shops), plus the outsourcing of critical IT functions to overseas contractors where workers' loyalty to the primary firm is questionable at best, may be a contributing factor to the nakedness of corporate America's information systems.

-- SS

Networked, Interoperable, Secure National Medical Records a Castle in the Sky?

The holy grail of electronic medical record efforts of late is the creation of networked, interoperable, secure national medical records that would allow a physician in Palo Alto to retrieve the records of a patient from Hoboken if that patient moved or was found (in the hackneyed and somewhat histrionic scenario) unconscious on the streets of San Francisco.

Recent events have made me skeptical we are anywhere near ready for such a technological accomplishment:

McAfee: Big Business Under Constant Cyber Attack
01.29.10

At the World Economic Forum Annual Meeting in Switzerland, McAfee announced the results of a survey of 600 IT security execs in "critical infrastructure enterprises worldwide": that is, in places such as utility companies, banks, and even oil refineries. And apparently, they're constantly under cyber attack and also extortion related to those attacks.

It's a real battlefield out there.

The report, written by the Center for Strategic and International Studies (CSIS), says that 54 percent of those surveyed have already been attacked. The culprits behind the cyber-attacks are listed as "organized crime-gangs, terrorists, or nation-states."

In other words, not simply teenage hackers or cyber-papparazi interested in the medical condition of a movie star.

Only one-fifth of the IT execs surveyed believe their systems are currently secure. One-third say things are worse now, vulnerability-wise, than a year ago, due to budget cuts.

What constitutes a cyber attack? A distributed denial of service (DDoS) is the most typical ... mitigation can be hampered by the local laws, working in multiple countries, or the economics of where they operate. For example, half of those surveyed claim the laws in their countries don't do enough to prevent or deter cyber attacks. That's especially true for Russia, Mexico, and Brazil.

Other attack vectors include DNS poisoning where Web traffic is redirected, SQL injection attacks on back-end data via a public Web site, and plain old theft of services.

If you need a plot for your new thriller novel, keep in mind that 20 percent of these companies are not just cyber-attacked, but have also been threatened with attacks in the last two years in "low-level extortion" attempts.

... Those surveyed said the money loss is the worst part, second is the loss of reputation, and (if you thought you weren't important) loss of customers' personal information is third.

This is a worldwide survey, and almost two-thirds of those surveyed believe foreign governments were responsible in some way for previous attacks. The two countries considering the biggest threats: China (by 33 percent of those surveyed) and the good ol' U.S. of A. (by 36 percent). China believes it's the biggest target.

The full report, called In the Crossfire: Critical Infrastructure in the Age of the Cyber War is free on McAfee's Web site in PDF format.

I note that Google recently called in the National Security Agency to help analyze a major corporate espionage attack:

The attacks targeted Google source code -- the programming language underlying Google applications -- and extended to more than 30 other large tech, defense, energy, financial and media companies. The Gmail accounts of human rights activists in Europe, China and the United States were also compromised.

Then there's this:

Intelligence Chief: U.S. at Risk of Crippling Cyber Attack
Feb. 4, 2010

The United States is at risk of a crippling cyber attack that could "wreak havoc" on the country, Director of National Intelligence Dennis Blair said.

"What we don't quite understand as seriously as we should is the extent of malicious cyberactivity that grows, that is growing now at unprecedented rates, extraordinary sophistication," Blair said.

... He said one critical "factor" is that more and more foreign companies are supplying software and hardware for government and private sector networks. "This increases the potential for subversion of the information in ... those systems," Blair said. [Outsourcing our HIT development overseas sounds like a great idea - ed.]

Read the linked articles in their entirety.

Perhaps we should focus on the local at present. National networked EMR's are a great concept, but there are a few social-technical details that remain to be worked out beforehand.

A Castle in the Sky...

-- SS

Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?

In an essay that ties together recent exposés of serious IT security flaws (starting with Operation Aurora) and a culture of secrecy that pervades the IT industry and industries who use IT, I ask the question:

Is universal healthcare IT really a good idea in 2010?

The complete essay is at my academic site at this link.

Operation Aurora was a cyber attack, conducted in mid-December 2009 and apparently originating in China, against Google and more than 20 other companies, including Adobe Systems, Juniper Networks, Rackspace, Yahoo, Symantec, Northrop Grumman and Dow Chemical.

The attack used "0-day" vulnerabilities (newly discovered and unknown to the software vendor, i.e., "day zero" of the vendor's knowledge of the defect) in Microsoft's Internet Explorer. One target was Google's email service, Gmail. It is not unrealistic to suspect that successful break-ins to that service could have gotten dissidents jailed or killed. Entire countries have warned users to switch to other browsers, at least until a vulnerability fix can be found. I find this stunning.

I also bring to bear recent reports of a culture of secrecy among IT vendors and users about these defects and vulnerabilities. This culture of secrecy seems prevalent in health IT, with perhaps even higher stakes for people (patients) when systems malfunction.

The essay is long-ish and at times technical.

The IT issues it addresses, though, are at the root of why I believe the current push in health IT is a bad idea and that we need to "slow down" to a more temperate pace.

Again, the full essay is here.

-- SS

1/24/2010 Addendum:

It appears Microsoft has known about the Internet Explorer bug since Sept. 2009.

The flaw was in the Microsoft Security Response Center's (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S. companies forced the company to release an emergency, out-of-band IE update.

Actually, this was not a "zero day attack", but a "120 day attack." One wonders if EHR vendors have similar queues.

-- SS

Two New Challenges to a Healthcare Cybernetic Utopia: Yet More Hurdles Exposed

At "2009: a Pivotal Year in Healthcare IT" I concluded that 2009 had proven to be a critical year in HIT, due to authoritative publications on HIT difficulties and related issues that appeared that year.

It was good to see the critical thought processes and the scientific methods inherent in modern medicine applied to the irrational exuberance and marketing-dominated field of healthcare IT.

It seems in 2010 the trend may continue.

Two new very interesting publications have recently come to my attention regarding the complications that can, and are, introduced by HIT.

These complications are worsened by the "boatload of cash," as one author expressed it, that is helping fuel what I term an irrational exuberance, or purchased exuberance, in this technology and its use in social re-engineering in medicine.

-----------------------

The first publication of note is a newsletter "Medical Risk Management Advisor" from ProAssurance Indemnity Company, Inc. and affiliates, a provider of medical insurance for clinicians. It can be downloaded here (PDF). It advises:

On choosing an EHR system:

Be sure to obtain physician input and review of the software prior to purchase to ensure it meets the needs of your practice. Consider talking to other medical practices already using the software, not only to assist in your decision, but to anticipate flaws or errors existing users may have encountered. Lastly, establish a process to address problems discovered after implementation.

"Anticipating flaws or errors existing users may have encountered" seems to be at odds with nondisclosure clauses in heathcare IT contracts, but this insurer seems to have gotten the message that HIT is not a perfected technology by a long shot.

On Alert fatigue:

Physicians may ignore e-prescribing alerts for a variety of reasons (e.g., excessive alerts or alerts that are not clinically useful). Again, input from physicians prior to implementation can help prioritize and choose alerts appropriate to the practice.

That the advice has to be given by an insurance company to healthcare organizations that "input from physicians prior to implementation" is crucial reflects a pathology, whose root is within the paternalistic and patronizing IT culture.

This culture and occupation has invaded medicine and supplied endless predictions of utopia for at least the past thirty years, in a domain it generally understands at the level of a layperson.

On "additional features" creating risk: [HIT incurs risk? How can the tool touted to revolutionize medicine incur risk? - ed.]

For example, some software programs require a diagnosis listed with each prescription. Consider the following: a patient is on Depakote for bipolar and seizure disorders, but the e-prescribing system only notes bipolar disorder because of its one-diagnosis limitation by design.

Subsequently, the patient becomes manic and the on-call psychiatrist starts the patient on lithium for the bipolar disorder. Checking the e-prescribing system, he notes Depakote was prescribed for bipolar disorder so he titrates the Depakote to discontinuation.

The patient has a seizure during the titration which leads to death.

The on-call psychiatrist assumed the patient was on Depakote solely for bipolar disorder and not seizures. If the diagnosis feature had been more extensive or had not been used with the software, the on-call psychiatrist might have explored further before discontinuing the Depakote.

Again, input from physicians prior to implementation may help prevent potential risks.

(According to Socky the Meditech Sockpuppet, such events are impossible.)

On Interoperability:

Another issue is whether your e-prescribing system fully integrates with pharmacy systems. Using the previous example, what if the diagnosis was changed in the psychiatrists’ system, but the pharmacy system did not automatically update this information? Be sure to investigate the compatibility of your system with others in your area. Not all pharmacies have e-prescribing capabilities. Many rural areas do not have the broadband internet access required.

It is unfortunate that the HIT vendor community is based on a business-computing model. That culture is extremely territorial. Seamless interoperability will be a long time in coming in HIT.

On Medication Reconciliation:

Physicians and pharmacies may find it difficult to trust the completeness and currency of the medication history and reconciliation, since medication histories often derive from multiple sources. Continue to verify medication histories with patients, and update records accordingly.

What? Actually not rely on the computer? What kind of extremist anti-health IT Luddite advice is this insurer proffering?

On Indemnity or "Hold Harmless" agreements:

Finally, be cautious about entering into hold harmless agreements with software vendors. Your ProAssurance policy excludes from coverage liability assumed under any contract or agreement, unless the liability would be imposed by law in the absence of the contract or agreement. It covers only the insured’s professional liability and not the liability of another party that the insured may assume through an indemnity agreement. If you are asked to sign such an agreement, you should have your attorney carefully review the agreement and your insurance policy.

I did not think of this issue when I wrote my July 2009 JAMA letter to the editor and a fuller posting on this issue at my Drexel HIT difficulties website here.

In addition to violating their fiduciary responsibilities and Joint Commission Safety Standard obligations, hospital executives signing nondisclosure and hold harmless agreements may be putting their organizations under undue financial risk if a HIT-related catastrophe occurs.

-----------------------

The second publication of note is an article from the IEEE (Institute of Electrical and Electronics Engineers). A Jan. 6, 2010 IEEE Spectrum article entitled "More Hurdles Appear in U.S. Electronic Health Record Adoption" has been published. I would actually have entitled it "More Hurdles Exposed in U.S. EHR Adoption", but that's not important now.

What is important, once again, is the Management Information Systems (business computing) approach to healthcare IT. The typical convoluted licensing arrangements for this software (really a virtual clinical tool that happens to reside on a computer) has created this fine mess:

The first was a story from a few months back that [the IEEE author] ran across recently from the Washington State Spokesman-Review about Inland Northwest Health Services suing the owner of Deaconess Medical Center, which the paper said alleged breach of "contracts and bad faith dealings that imperil the region's acclaimed electronic medical records network.

It is a bit complicated, but in essence, in 1994, Spokane's Deaconess Medical Center, Providence Holy Family Hospital, Providence Sacred Heart Medical Center & Children's Hospital and Valley Hospital & Medical Center established the non-profit Inland Northwest Health Services (INHS) as a way to merge competing lines of business and to oversee them. One of the things INHS did was to invest in electronic medical records using MEDITECH's technology. [You mean this Meditech? - ed.]

Apparently, Community Health Systems, a Tennessee company that bought Spokane's Deaconess Medical Center and Valley Hospital & Medical Center in 2007 decided that it was going to start charging INHS $150,000 a month to use the MEDITECH license, claiming that Deaconess Medical Center was owner of the license. INHS says that Deaconess transferred ownership to it years ago.

The Spokesman says some 38 hospitals along with many private practices and clinics are affected by the dispute.

The upshot of all this is that license ownership of the underlying EHR technology will likely be a big issue in the future as more regional health information networks are started, as will be technology lock-in (INHS has been using MEDITECH technology for 13-years, and it moving to another EHR is unlikely to be an easy or inexpensive proposition). Neither issue has appeared much in the EHR literature.

Yes, indeed, except once again I would have written:

The upshot of all this is that license ownership of the underlying EHR technology will likely be a big disaster in the future...

... as the HIT vendors will likely only allow their profitable licensing practices to be pried from their cold, dead fingers (metaphorically speaking, of course).

Then, this on EHR patient data trafficking:

... there was also a story in the American Medical News in late November about the Cleveland Clinic giving $1 million to a start-up company called Explorys to "commercializing the patient database search system Cleveland Clinic developed." The Cleveland Clinic has a very extensive EHR system and data base of patient information that it now wishes to exploit.

As I mentioned last month, there was a report by PricewaterhouseCoopers LLP that found 76% of healthcare executives surveyed felt that all the data being collected in their EHR systems was going to be their organization's greatest asset over the next five years. It also found that the executives only felt they could recoup their investments if they could exploit that information in some way.

The IEEE author largely addresses health IT failure as an impediment to such EHR patient data trafficking. In my Oct. 2009 post "Health IT Vendors Trafficking in Patient Data?" I came at the issue from an ethical and legal angle. I wrote:

This practice [trafficking in EHR patient data] raises numerous questions:

• Meaningful informed consent issues: as an example, of 1000 patients at one of the facilities using this vendor's HIT products, what percentage would be able to tell me they know their data is being trafficked to pharmaceutical companies and other organizations for profit?

• Healthcare data ownership and stewardship issues: who, exactly, extracts the data for aggregation and sale? Hospital employees properly trained and bonded (i.e., Healthcare Information Management professionals) regarding privacy of patient data? IT personnel lacking such credentials and experience? HIT vendor employees?

• De-identification issues: what processes are being used to de-identify data? Who is performing it? At some point before the data is de-identified, it is protected information in identifiable form. Is access to the data during de-identification audited in any way, and if so, by whom? If not, why not? (Also see article on re-identification below.)
  

• Legal issues: who is, by contract, liable for data breaches that occur in the transfer process?

• Fiduciary issues: as I expressed in my July 22, 2009 JAMA letter to the editor regarding "vendor hold harmless" and IT defects gag clauses, are hospital executives further violating their fiduciary responsibilities by signing HIT contracts that surrender ownership of patient data to third parties? (see my posts "JAMA letter: Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" and "Inquiry to Joint Commission on points I raised in my JAMA letter on HIT" for more on those issues.

• Pharma integrity issues: with the many stories on this blog and others about ethically questionable pharma practices such as ghostwriting, manipulation of clinical research, suppression of research, pushing drugs on physicians and patients for unapproved off-label uses, etc., what are these organizations going to do with the data? Who will have access to it, and will their access be audited? Are they going to resell it? Might they try to re-identify data to locate individuals of interest? And so forth.
  

Serious consideration of these issues in vendor-led healthcare data trafficking becomes more imperative in the face of just how easy it is to "re-identify" data:

Ohm, Paul: "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization" (August 13, 2009). University of Colorado Law Legal Studies Research Paper No. 09-12. Available at SSRN: http://ssrn.com/abstract=1450006

In Dec. 2007 I'd also presented to the IEEE Medical Technology Policy Committee on some of these issues in "To the Moon in a Hot Air Balloon: Why is Clinical IT Difficult?". In response, they introduced me to the term "resilience engineering" in the sense that healthcare IT was lacking in that particular characteristic:

The term Resilience Engineering represents a new way of thinking about safety. Whereas conventional risk management approaches are based on hindsight and emphasise error tabulation and calculation of failure probabilities, Resilience Engineering looks for ways to enhance the ability of organisations to create processes that are robust yet flexible, to monitor and revise risk models, and to use resources proactively in the face of disruptions or ongoing production and economic pressures.

Health IT as a cybernetic miracle? As I've stated before, healthcare is a harsh environment for cybernetics, talent to accomplish the needed IT and medical culture changes essential to successful computerization in medicine is grossly mismanaged by the HIT and hospital industries, and reality is a harsh mistress.

-- SS

Private medical records offered for sale

Private medical records have been offered for sale in the U.K.

And quite cheaply, too...

e-Health Insider (Europe)
Private Medical Records Offered for Sale
Oct. 20, 2009

Medical records of patients treated at a private British hospital, The London Clinic, have been illegally sold to undercover investigators.

The revelations were made in ITV’s Tonight Programme report, Health Records For Sale, broadcast last night.

The programme reported that hundreds of files containing details of patients’ conditions, home addresses and dates of birth were offered to undercover reporters for just £4 each by sales executives from India, contacted online.

That's about $6.56 U.S. each. A genuine bargain for those intrepid medical identity thieves, and pesky government death panels ...

The records offered for sale appear to have been medical records that consultants working at the London Clinic, the hospital processes its own records internally, who contracted with a firm called DGL (DGL) Information Technologies UK to digitise their records.

DGL is then claimed to have sub-contracted to another firm, Scanning and Data Solutions (SDS), which scanned them into computers in the UK. SDS in turn is said to have sub-contracted further work on the files to a company in Pune, India, which had signed tight confidentiality agreements.

With all this contracting and subcontracting - four layers? - adding potential security breach possibilities, and if this is not an uncommon practice, perhaps paper is safer than electronic health records?

... The reporters bought more than 100 records belonging to UK patients but were told they could obtain up to 30,000 more on demand. Confidential records were offered by condition such as particular cancers.

Of 116 files bought by ITV, 100 of which were confirmed as genuine, were for patients who had been treated in private hospitals. Although not NHS records they did contain some NHS data, including referral letters from GPs.

The potential abuses resulting from such sales are of great concern. If it happened in the UK, it can happen in the U.S.

One patient whose record was affected by the security breach said in the documentary that the data breach was ‘one step up from grave-robbing’.

I agree with that assessment.

These practices call for the most severe penalties, and if the authorities lack the will, confidence in EMR privacy, confidentiality and security will suffer, along with the physician-patient relationship.

The old ST:TOS line "Sometimes a man will tell his bartender things he'll never tell his doctor" could become too applicable for comfort.

Sometimes a man will tell his bartender things he'll never tell his doctor ... especially if they suspect their data is for sale to the Talosians, Captain ...

-- SS

Health IT Vendors Trafficking in Patient Data?

Of all of the risks regarding electronic health records, the largest is perhaps to privacy and confidentiality, and other civil liberties through the ability of information technology to rapidly duplicate and disseminate massive amounts of data.

This duplication and dissemination can be performed in a controlled manner for the betterment of patient and public health, but it can also occur in a harmful manner that serves the interests of others, often without meaningful informed consent by the patients (legal jargon on typical disclosure forms that almost nobody reads or understands does not fall into what I consider "meaningful").

This can occur in, for example, the stealing of computers and computer backup disks, tape etc., which seems to be a common occurrence in the news in recent years, or through corporate processes that carry inherent risk of abuse. Here is just one recent example of both data mismanagement and theft involving not patients (by chance) but physicians themselves:

Blue Cross: Thousands of doctors' computer data stolen

Wednesday, October 07, 2009

By Bill Toland, Pittsburgh Post-Gazette

Tens of thousands of doctors under contract with Pittsburgh's Highmark Inc. are being notified that their personal information, including Social Security numbers or tax ID numbers, may have been compromised when a laptop containing sensitive data was stolen from a Blue Cross-Blue Shield Association employee.

Physicians and specialists in western and central Pennsylvania are being notified of the breach this week, according to a Highmark spokesman. Across the country, the number of affected doctors is expected to reach the hundreds of thousands once a review of the theft is complete, said national Blue Cross-Blue Shield Association spokesman Jeff Smokler. The stolen computer did not contain patient information. [Simply due to luck -ed.]

The letter sent to Highmark providers said "a BCBSA employee [transferred] provider data information onto a personal laptop, in violation of BCBSA's established data security policies.

I have recently become aware of an example of purposeful corporate healthcare data trafficking that gives me pause.

Cerner’s LifeSciences traffics in patient data taken from the EMRs its company sells to healthcare organizations. See the document below. They advertise:

Cerner LifeSciences’ data warehouses and consulting services help you manage your R&D opportunity through Cerner’s analytical solutions. Through our data mining of our vast warehouse of electronic health records (EHRs), you can accelerate development processes and reduce business risks. Each year, new compounds debut new abilities or first-in-class molecules. Far more common are new compounds that target the same receptors as compounds already in the market ... This is when Cerner LifeSciences makes it possible to analyze anonymous, HIPAA-compliant, EHR-derived data for efficacy and safety.

Cerner apparently includes contract language with their HIT customers that allows them to traffic in "de-identified" patient data for sale to drug companies and others, getting the data essentially as a "value add" (to the HIT vendor, that is) from its healthcare IT customers. (The flyer below does not indicate pricing of healthcare data, but it's likely substantial.)

A major HIT vendor selling patient data to anyone who wants it. Click to enlarge. (Full copy is at this link in PDF format).

This practice raises numerous questions:

• Meaningful informed consent issues: as an example, of 1000 patients at one of the facilities using this vendor's HIT products, what percentage would be able to tell me they know their data is being trafficked to pharmaceutical companies and other organizations for profit?

• Healthcare data ownership and stewardship issues: who, exactly, extracts the data for aggregation and sale? Hospital employees properly trained and bonded (i.e., Healthcare Information Management professionals) regarding privacy of patient data? IT personnel lacking such credentials and experience? HIT vendor employees?

• De-identification issues: what processes are being used to de-identify data? Who is performing it? At some point before the data is de-identified, it is protected information in identifiable form. Is access to the data during de-identification audited in any way, and if so, by whom? If not, why not? (Also see article on re-identification below.)
  

• Legal issues: who is, by contract, liable for data breaches that occur in the transfer process?

• Fiduciary issues: as I expressed in my July 22, 2009 JAMA letter to the editor regarding "vendor hold harmless" and IT defects gag clauses, are hospital executives further violating their fiduciary responsibilities by signing HIT contracts that surrender ownership of patient data to third parties? (see my posts "JAMA letter: Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" and "Inquiry to Joint Commission on points I raised in my JAMA letter on HIT" for more on those issues.

• Pharma integrity issues: with the many stories on this blog and others about ethically questionable pharma practices such as ghostwriting, manipulation of clinical research, suppression of research, pushing drugs on physicians and patients for unapproved off-label uses, etc., what are these organizations going to do with the data? Who will have access to it, and will their access be audited? Are they going to resell it? Might they try to re-identify data to locate individuals of interest? And so forth.
  

Serious consideration of these issues in vendor-led healthcare data trafficking becomes more imperative in the face of just how easy it is to "re-identify" data:

Ohm, Paul: "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization" (August 13, 2009). University of Colorado Law Legal Studies Research Paper No. 09-12. Available at SSRN: http://ssrn.com/abstract=1450006

Abstract:

Computer scientists have recently undermined our faith in the privacy-protecting power of anonymization, the name for techniques for protecting the privacy of individuals in large databases by deleting information like names and social security numbers. These scientists have demonstrated they can often 'reidentify' or 'deanonymize' individuals hidden in anonymized data with astonishing ease. By understanding this research, we will realize we have made a mistake, labored beneath a fundamental misunderstanding, which has assured us much less privacy than we have assumed. This mistake pervades nearly every information privacy law, regulation, and debate, yet regulators and legal scholars have paid it scant attention. We must respond to the surprising failure of anonymization, and this Article provides the tools to do so.

Further, Cerner is digging deeper into the life sciences, licensing its "Discovere" system to clinical trials vendor such as Quintiles Transnational (link to story in Bizjournals.com):

Quintiles will use Cerner’s Web-based Discovere product, whose features include the ability to integrate data from study participants and site researchers and increase data quality by reducing transcription errors, the companies said in a release. A Cerner spokeswoman said the company isn’t disclosing financial terms of the deal.

According to an entry at HISTalk, part of "Discovere" is the former First Genetic Trust technology that Cerner bought some time ago. Quintiles signed an agreement with Cerner back in 2001 and took an equity position in it. The Discovere modules include biobanking, research registries, public health investigator workflow, clinical trials management, and adverse event reporting.

Is Cerner also selling HIT-gleaned patient data to Quintiles and other CRO's (clinical research organizations)?

Other HIT vendors are sure to follow in Cerner's footsteps for competitive reasons, if not already doing so.

Another major issue:

HIT vendors like this are devoting resources to profit from medical data, diverting resources from their core business. Might health IT vendors make better use of their resources, such as improving the core products they sell to hospitals and clinicians, avoiding the "mission hostile user experience" I wrote about in this eight part series?

Might they devote resources to solving problems that are affecting entire national health IT programs, instead of peddling data from the systems they have managed to implement to third parties?

From the UK's experiences as recorded in 2007 by the former head of their National Program for HIT in the NHS (NPfIT):

Richard Granger has said he was “ashamed of the quality of some of the systems put into the NHS by Connecting for Health suppliers”, singling Cerner out for criticism (link). Going further than he before in acknowledging the extent of failings of systems provided to some parts of the NHS - such as Milton Keynes – the Connecting for Health boss, said "Sometimes we put in stuff that I'm just ashamed of. Some of the stuff that Cerner has put in recently is appalling."

As recorded in Jan. 2009 by the UK House of Commons - Public Accounts Committee :

... Termination of Fujitsu's contract has caused uncertainty among Trusts in the South and new deployments have stopped. One option: have a choice of either Lorenzo or [Cerner] Millennium. There are, however, considerable problems with existing deployments of [Cerner] Millennium and serious concerns about the prospects for future deployments of Lorenzo.

... Programme not providing value for money at present because there have been few successful deployments of the [Cerner] Millennium system and none of Lorenzo in any Acute Trust. Trusts cannot be expected to take on the burden of deploying care records systems that do not work effectively … the Department should assess the financial case for allowing Trusts to put forward applications for central funding for alternative systems compatible with the objectives of the Programme.

Most recently, in the UK Cerner's Millennium product is blamed for the jump from 1,700 to 23,000 patients whose referrals don’t meet the 18-week target from referral to treatment at Barts and the London NHS trust.

Should HIT vendors be devoting resources to data peddling, instead of focusing on their core mission to produce usable HIT that can facilitate healthcare professionals in providing care?

Finally, as an added item of interest, our current healthcare "czar", Nancy-Ann DeParle was on the board of Cerner just prior to appointment in the current administration.

All of these issues considered, while I am not implying improprieties current or future, the possible permutations of problems in the resale of clinical data by HIT vendors potentially created by careless data stewardship, profit motive, conflict of interest, malevolent motives, etc. is endless.

If there ever were a scenario for civil liberties groups to explore, it's this one.

-- SS

addendum on HIT quality and COI issues: found this at HISTalk as well:

IT outsourcing puts MU Health at risk

An associate professor of pathology at University of Missouri criticizes his employer’s decision to outsource to Cerner … A simple Internet search turns up a plethora of complaints and reports of lawsuits regarding the effectiveness of Cerner’s software and, more important, its failure to provide requested support. The pattern of receiving untested software has been a recurring problem at this institution ...

... University Hospital’s success depends largely on the effectiveness of the people in information technology. In the past on two occasions, the billing was so flawed the hospital faced serious fiscal problems. The most recent one was in 2002, when the hospital’s viability was threatened. The major issue was the inability to produce accurate and timely billings, which cost the system millions of dollars. [where have I seen that before? How about: here (Yale) and here - ed.]

... The medical school’s administrative residency program is on probation and is undergoing critical review; a major factor is that the Cerner system is so cumbersome that resident training is compromised … Three years ago, the radiology department dropped a Cerner software program because it was seriously flawed.”

... [UM President] Forsee has several business and personal ties to the company (Cerner). Forsee and Cerner CEO Neal Patterson serve together on at least two boards of trustees, and online records indicate Forsee’s son-in-law, Brandon Bell, works for Cerner.”

If this all is true, I believe the problems with HIT in general are no better now, and probably worse, than when I started writing about such issues a decade ago.

I rest my case on whether the HIT vendors should focus on solving basic quality, usability and efficacy issues before peddling data ...

-- SS