Interoperability

The proliferation of patient portals offered by provider organizations has created significant usability challenges for patients while providers are feeling pressure to integrate portals to improve service quality, enhance workflow and provide a more unifying experience to patients. “The rising interest in and demand for patient-facing tools, especially patient portals, has attracted to the market a number of different vendor approaches and consumer-focused patient health record offerings designed to meet various situation-specific provider and patient needs,” said Santosh Mohan, a management fellow in IT transformation in the office of the CIO at Stanford Health Care who previously served as a senior consultant at The Advisory Board Company. Mohan stresses his opinions are his own and do not reflect those of Stanford Health Care. “Interoperability challenges and the lack of a centrally envisioned strategy for making these tools available to patients are resulting in a landscape where health information is increasingly available online, but spread broadly across the portals of various care settings and organizations that own the data.” [Also: 21 awesome photos from past HIMSS conferences] As a result, patients increasingly are being challenged to interact with multiple portals, often making it more difficult for them to be effective participants in their own care, and providers are facing the need to integrate portals to improve service quality, enhance workflow and provide a more unifying experience to patients in order to compete for consumers, Mohan explained. “Curbing ‘portal sprawl’ and rethinking patient engagement techniques to bring them up to par with consumer online experiences from other industries is no easy feat – it requires providers to cautiously navigate a complex vendor landscape and carefully evaluate ways to streamline patient experience, all without compromising functionality, usage and existing levels of patient acceptance,” he added. Mohan will deliver a presentation titled “Too Many Patient Portals – What Can You Do About It” on Tuesday, March 1, 2016, at HIMSS16. The session will be in the Sands Expo Convention Center in Galileo 1004. “My session’s objective is to surface some emerging approaches that provider organizations are pursuing to integrate patient portals across various care settings within their enterprises, and to weigh the pros and cons of these approaches,” Mohan said. “This is a roundtable session, so I will get participants to share their challenges and goals with respect to their portal-related efforts and to surface some best practices. The goal is to discuss how we can make portals accessible in a meaningful way and be effective at the same time.” Mohan suggested one big takeaway from the session will be attendees gaining a better understanding that organizations should plan portal strategies for the long-term but remain flexible in the near-term. “The immediate value of offering a quick, integrated view of a patient’s health profile must be balanced with the ultimate goal of morphing a portal into an advanced and engaging tool for the patient,” Mohan said. “Ultimately, a portal should act like a health-GPS, providing patients with situation-relevant content, navigating them back to health, and helping them stay on course. The challenge for provider organizations is how to bring this vision to life.” Twitter: @SiwickiHealthIT This story is part of our ongoing coverage of the HIMSS16 conference. Follow our live blog for real-time updates, and visit Destination HIMSS16 for a full rundown of our reporting from the show. For a selection of some of the best social media posts of the show, visit our Trending at #HIMSS16 hub.

More than 30 interviews with thought leaders will be broadcast over two days.

The development of standards through the lab will help ONC further develop interoperability standards, official says.

Group joins with insurance broker Willis Towers Watson on new program.

This time of year, millions of Americans file taxes. We are required to move sensitive financial data from employers and banks to the Internal Revenue Service. In the old days, we waited for paper W2’s and bank statements to arrive by mail and then spent hours with pencils and stacks of paper. But now tax preparation software enables automatic retrieval and upload of data in seconds and without error. Why is this possible? Because each of us controls our own financial data.  Now imagine that we want our sensitive health records transferred to a new doctor. We fill out paper forms, mail or fax them, pay fees, and if we are lucky a stack of printed paper records arrives by fax or mail at our new doctor’s office weeks or months later. Weeks after that they might be scanned into an electronic health record as images but, even then, they can’t be searched easily. At our first visit, we will answer a long list of questions. The answers are in our record, but the office staff and doctor will find it more efficient to re-enter them manually. There will be errors (like the male patient of Eric’s recorded by the system as female).   See all of our HIMSS16 previews Why the difference? Much has been written recently about information blocking — the inability or unwillingness of hospitals and doctors to share electronic data from our health records with one another. Lack of technical interoperability and regulations protecting security, privacy, and confidentiality are often blamed. But the reality is that technical barriers are falling. The same technology that enables your smartphone to pull sensitive financial data from your bank to pay your taxes or a taxi driver can be applied to your health care records. More importantly, the regulatory path to health records sharing is now open — the rules are already on the books. There are three ways your health care records can be shared electronically. All require your permission. One doctor’s system can query another doctor’s system for specific bits of your record (a digital version of a phone call request). One doctor’s system can push bits of your record to another doctor’s system (a digital version of a fax). Or the doctor’s system can give you your record and you can give it to anyone you wish. The last approach is called “consumer-mediated” sharing.  The advantage of consumer-mediated sharing is that you control your data, and you authorize access to it each time.  The disadvantage? Most people would rather not waste time with the tedium of authorizing data access, especially as it might exist today in online portals run by doctor offices, hospitals, and insurance companies. They want convenience. This is where the application programming interface or API could come into play. Just as tax preparation software handles the details, the right health care APIs can enable the exchange of data for specific purposes. Need a record of your last physical exam for softball camp? Need to know how much you spent on health care claims last year? Need to let your primary care doctor know the results of a recent specialist or emergency room visit? The right app could handle each of those needs for you with a few simple clicks.  How do recent regulatory changes permit this to happen? First, by law (HIPAA), health systems have to give you your data upon request. In 2015, the federal government set a new requirement that providers must provide that data to an application you designate (meaningful use Stage 3 regulation paragraph 495.24(d)(5)(ii)). Second, the data must be available in “machine readable” form so the app can help you make sense of it (HIT Certification regulation 170.315(g)(9)(ii)(3)). To meet these technical requirements, health records vendors have voluntarily agreed to collaborate on open standards for securing access to clinical information. Third, the apps will have to be secure in addition to being easy to use.  The tax preparation software example illustrates that we will pay others to move our data if they can do so securely. But for them to earn our trust, they will have to meet the privacy, security, and consumer protection standards that are required for sensitive health data.  The technical and regulatory pathway is clear. Nothing in law or regulation prevents consumer-mediated health record sharing. If we enlist someone we trust – our neighborhood health system, our insurer, our doctor, or even a favorite retailer to demand data on our behalf – the hospitals and doctors we authorize must respond. If we consumers demand and authorize easy record sharing, the health care system must make it happen.  Eric Schneider, MD is Senior Vice President for Policy and Research at the CommonWealth Fund, Aneesh Chopra is the co-founder and executive vice president of Hunch Analytics, and David Blumenthal, MD, is President of the CommonWealth Fund.   

(SPONSORED) Learn how embracing the use of big data management with interoperability can ultimately mean the difference between life and death.

Execs will point to specific examples where interoperability has worked in other industries and what healthcare can learn from how well those scale.

A high percentage of IT workers admit to not following the same security protocols they are expected to enforce, according to a new survey conducted across the United States by Absolute, a Canadian security firm. In fact, 33 percent admitted to successfully hacking their own or another organization and 45 percent admitted to knowingly circumventing their own organization's security policies. "The big surprise for us in this survey is that the gatekeepers are really the gatecrashers," said Stephen Midgley, vice president of global marketing for Absolute. Moreover, he said, while the survey of IT department managers included several industries, the findings apply across the board, with healthcare no exception. [Also: Hollywood Presbyterian gives in to hackers, pays ransom] "Given that IT is the security gatekeeper for an organization, it was alarming to see such high incidents of non-compliant behavior by IT personnel," he said. "Even if these actions are being performed to validate existing infrastructure, senior leadership should be aware that this activity is occurring. It may also be worthwhile to consider third-party audits to ensure adherence with corporate security policies." IT decision-makers bear the brunt of responsibility. Of those surveyed, 78 percent said the organization's security is primarily IT's responsibility. The report also showed that 65 percent of IT decision makers believe they would likely lose their job in the event of a security breach. "The gaps in current data breach response plans and in upholding general best practice policies must be addressed," Midgley said. As he sees it, when it comes to security – especially in healthcare, but also in other sectors – there's an accountability divide. "That is a very precarious space for IT to be in," Midgley said. "They are tasked with data security, but aren't actually responsible for the device that contains that data.” "I think in healthcare it's magnified," he added, "because of HIPAA, HITECH, PHI. So, you can have all the security in place, but at the end of the day, IT is reliant on the employee to ensure security is implemented correctly. Yet, what we find is those very same employees try to find ways to circumvent the security policies that have been put in place." There's a lot of work for IT in terms of bridging that gap, he said, and recommended that organizations implement technology that is adapted to their environment that gives them complete visibility and control of the devices. Midgley mentioned the example of one healthcare entity that has a policy of automatically wiping data from any device – laptop, tablet or phone – that goes beyond a certain location. [Like Healthcare IT News on Facebook] "They assume that device has PHI on it," he said. "It's mitigating the risk of a data breach." The survey – which polled 501 U.S. adults who work in information security management roles in companies or organizations with 50 or more employees – found that security remains at the top of the IT spending list, with 87 percent of respondents expecting increased investment in security this year. Twitter: @HealthITNews

Ransomware attack had locked out administrators unless they agreed to the demand of 40 Bitcoins.

Institute for Critical Infrastructure Technology says the feds should do more than just suggest safeguards.