Quality and Safety

Too many healthcare organizations are focused on securing the wrong assets, leaving them vulnerable to cyberattacks and putting patients at risk, a new report from Independent Survey Evaluators claims. When healthcare leaders focus primarily on protecting patient data, they often fail to address actual cybersecurity threats that directly affect patient health, the report said. So if an active medical device or electronic work order were infiltrated by cybercriminals, the patient could be directly affected. On the other hand, an electronic health record is secondary – it requires a provider to alter the data before it could potentially harm a patient. ISE studied 12 healthcare organizations, two healthcare data facilities, two active medical devices, two Web applications and other devices found on healthcare networks over the course of two years to determine the possibility of remote attacks and the readiness of these institutions to keep data secure. "We found hospitals were antiquated in their network designs and unsure about the technologies that could effectively help them," the study's authors said. [Also: Hollywood Presbyterian gives in to hackers] "In many cases, vendor products purchased for a security purpose were inappropriate for the organization, and those systems that were appropriate were deployed incorrectly, all resulting in heavy waste while not achieving an improvement in security posture," they added. Researchers separated threat vectors into primary, secondary and tertiary "attack surfaces" that expose patient health, more than their health data. Many systems that are the focus of prevention efforts "have little value with regard to personally identifiable information or personal health information – the assets hospitals strive to protect most – yet they have direct consequences with regard to patient health," according to the report. "These attack surfaces are largely left unprotected by hospitals and are precisely the attack surfaces to be targeted by an adversary seeking to harm a patient." Among the primary surfaces: clinicians, medicine, active medical devices and surgery. Secondary (EHRs, passive medical devices, test results, work orders) and tertiary surfaces (climate controls, physical storage, barcode scanners, connected power) often get outsized attention. Actions taken by health leaders often only handled unsophisticated threats, according to study, which left plenty of openings for attackers to get into information systems. Often, protection strategies assumed the attacks weren't aimed toward garnering targeted information, and therefore ignored the specific strategies and motivations of cyberattackers. All of the hospitals in the study were failing on a range of levels to address modern security issues, largely in part, due to a lack of funding. [Like Healthcare IT News on Facebook] "Security vulnerabilities in healthcare are a result of systemic business failures," said Ted Harrington, executive partner at ISE and one of the study's leaders, in a statement. "We found egregious business shortcomings in every hospital, including insufficient funding, insufficient staffing, insufficient training, lack of policy, lack of network awareness and many more." According to the study, one of the greatest vulnerabilities is that patients and visitors often have physical access to networks and equipment – an issue unique to healthcare. Time, accuracy and the environment also played into sometimes adverse security circumstances. Along with the study, ISE published a blueprint to aid healthcare organizations in shifting the security focus. It outlines specific threats and the consequences of a breach, in addition to methods for healthcare institutions to better secure its systems. Twitter: @JessiefDavis

As policy wonks and advocates battle over just how much meaningful use will likely change in 2016, the Physician Quality Reporting System might have snuck up on healthcare IT staffs tasked with implementing new technology platforms. "The focus for most of the health IT folks has obviously been meaningful use regulations, and there hasn’t been a lot of focus on the PQRS," said Deborah Gash, CIO of Kansas City, Missouri-based St. Luke's Health System. In fact, Gash said she actually had what she called an "aha!" moment when colleagues at St. Luke's began asking her about how best to address PQRS stipulations in concert with other reporting requirements. [Also: 21 awesome photos from past HIMSS conferences] Gash and Anantachai Panjamapirom, senior consultant at The Advisory Board Company, will present on St. Luke's experience in "PQRS and Alignment Opportunity — Concept to Operationalization," during HIMSS16 beginning in late February. "Bringing awareness to what this program is, how we were able to work through all the operational issues, and create a program to allow us to follow through and successfully meet the requirements was something we thought would be worthwhile to share," Gash said. Panjamapirom said numerous Advisory Board clients, such as St. Luke's, have already taken steps to align not only MU and PQRS, but also try to devise strategies to bring other programs, such as Hospital Inpatient Quality Reporting and the Value-Based Payment Modifier, into efficient alignment. Twitter: @HealthITNews "Most of what you have to do is workflow and culture changes," Gash said, "such as documenting the right elements and being consistent about it, plus developing workflows and decision support tools in your EHR to ensure you're getting the quality data captured. That's really where the lion's share of the work is for organizations." Gash also said larger organizations are not necessarily better prepared to operationalize alignment. "I think the complexity of the organization can increase your risk," she said. "I find smaller practices that are paying attention do quite well.  It's that lack of awareness and understanding of what you have to do in the requirements that puts you at risk." "PQRS and Alignment Opportunity - Concept to Operationalization" will be presented March 1 from 2:30 - 3:30 p.m. at Sands Expo Convention Center, Palazzo D. Twitter: @HealthITNews This story is part of our ongoing coverage of the HIMSS16 conference. Follow our live blog for real-time updates, and visit Destination HIMSS16 for a full rundown of our reporting from the show. For a selection of some of the best social media posts of the show, visit our Trending at #HIMSS16 hub.

The Healthcare Leadership Council has identified six healthcare reforms that should be implemented by the White House, Congress and the healthcare industry to reform healthcare; it was announced last week at a Capitol Hill briefing and in a report highlighting the changes. For starters, nationwide health information interoperability in the private sector should be achieved by December 31, 2018, the group said. The group also targeted the Food and Drug Administration, saying reforms that focus on reducing administrative burdens placed on the organization should be enacted so the FDA can better bring innovative treatments and technology to patients. [Also: Hollywood Presbyterian gives in to hackers] “These steps aren’t revolutionary, but they're transformative,” said HLC President Mary R. Grealy, in a statement. “Innovation is too often put on the backburner when we discuss healthcare policy, but it’s critical to elevating health system value and to address quality and cost challenges." The Centers for Medicare and Medicaid Services also needs to improve the Enhanced Medication Therapy Management Model to reach its goal of improving patient health and should implement best practices for Medicare, insurers and healthcare providers to improve care for the chronically ill, the group said. The federal government should reform outdated physician self-referral and anti-kickback statutes and expand Medicare payment waiver policies to protect against fraud and abuse, while improving care coordination. Cybersecurity also needs focus, the group said, pointing to Congress and the states to standardize privacy laws and increase access to patient data. The recommendations are compiled from the HLC's National Dialogue for Healthcare Innovation initiative – a collaboration of patient advocacy leaders, drug company representatives, patient advocacy leaders, patient groups and other industry experts that convened over the course of a few months. David Barrett, CEO of Lahey Clinic and Bill Hawkins, chairman and CEO of Medtronic, co-chaired the group. [Like Healthcare IT News on Facebook] “There's a widespread understanding that, for all of our healthcare system’s considerable strengths, we need to make strides in providing high-quality care at sustainable costs," Susan DeVore, president and CEO of Premier, Inc. and HLC chair, said in a statement. "The six steps on which we have reached agreement will move us significantly in that direction." HLC has begun meetings with congressional leaders about the recommendations and will continue the conversations in the coming weeks. The compiled recommendations were produced by a partnership with NORC, the independent public policy research organization at the University of Chicago. Twitter: @JessiefDavis

Apple chief defies government demands to unlock the iPhone of one of the San Bernardino terrorists, creating a backdoor into the system’s software.

SA Ignite plans to launch PQRS Assistant, a system that provides an automated way for provider organizations to track the various levels and scores for Medicare Part B payments, at HIMSS16. The Physician Quality Reporting System is a quality reporting program from the Centers for Medicare and Medicaid Services that encourages individual eligible professionals and group practices to report information on the quality of care to Medicare. PQRS gives participating professionals and group practices the opportunity to assess the quality of care they provide to their patients, helping to ensure that patients get the right care at the right time, CMS said. SA Ignite’s meaningful use system is used to automate attestation, the vendor said, and the company now is adapting meaningful use lessons learned to help providers respond to the increasing number of pay-for-performance models in healthcare, said Tom Lee, founder and CEO of SA Ignite. See all of our HIMSS16 previews “PQRS is a longstanding program and set of measures, but in recent years CMS has used PQRS to turn from pay-for-reporting to pay-for-performance in Medicare Part B,” Lee said. “In pay-for-reporting, providers just submit a number of measures and regardless of those values are incentivized in the same amount or avoid the same penalty. In Medicare Part B, the game has changed, and these measures now are used for pay-for-performance. Providers measure values and are rated against other peers across the country, and then are placed in different quality tiers, which directly affects their reimbursement.” Currently, the CMS report card for Medicare Part B is not communicated to a provider organization until nine months after a performance year has concluded, Lee said. As such, there is no real-time monitoring of quality scores during a performance year. “Our new PQRS Assistant system enables a provider organization to predict during a performance year what its CMS quality score will be based on, and as a result, the organization can make changes to its workflows to maximize its score while it still has a chance to make a difference,” Lee said. “The ultimate vision is combining our MU Assistant with our PQRS Assistant and have their predictive analytics focused on back-office score optimization.” The CMS Merit-Based Incentive Payments System, or MIPS, for Medicare Part B starts in 2017, appears to bring together meaningful use and PQRS in a value-based payment model where providers will have a MIPS score. Under MIPS, every provider organization will earn up to 100 points on a competitive scale to be able to gain up to a 27 percent bonus or lose up to a 9 percent penalty. Lee said provider organizations can calculate the return on investment of this technology based on the new reality in healthcare. [Like Healthcare IT News on Facebook] “These value-based rules are very complicated and change all the time, and in the absence of automation it’s very difficult to fulfill the new business processes,” he said. “You are left with people using very primitive tools like spreadsheets to try to manipulate data to try and comply with a payer’s requirements. Further, provider organizations now are forced to do even more with even less. Because of the complexity on the value-based side of payments, including population health efforts, things simply are getting more complicated with more money attached.” When it comes to provider organization staff trying to cope with the new reality of value-based payments, the supply of qualified professionals, such as data analysts and compliance experts, who know how to optimize for value is getting out of balance with the demand, Lee said. “So you need technology that allows fewer people to do more,” he said. Twitter: @SiwickiHealthIT This story is part of our ongoing coverage of the HIMSS16 conference. Follow our live blog for real-time updates, and visit Destination HIMSS16 for a full rundown of our reporting from the show. For a selection of some of the best social media posts of the show, visit our Trending at #HIMSS16 hub.

Institute for Critical Infrastructure Technology says the feds should do more than just suggest safeguards.

For the first time, the Centers for Medicare and Medicaid Services and America's Health Insurance Plans have announced standard quality measures among payers, a move designed to reduce confusion and complexity for reporting providers. On Tuesday, CMS and AHIP released seven sets of clinical quality measures to help get insurers on the same page. This is the first set that will be used as basis for quality-based payments. They were developed by a Core Quality Measures Collaborative, made up of CMS, major commercial health plans, physician groups and other stakeholders. [Also: CMS, ONC seek feedback on quality measures reporting] These measures create a set of core standards for all payers primarily for physician quality programs. They are in the following seven sets: accountable care organizations, patient centered medical homes and primary care; cardiology; gastroenterology; HIV and Hepatitis C; medical oncology; obstetrics and gynecology; and orthopedics. The measures will be rolled out in several stages, said CMS, which is already using measures from each of the core sets. CMS also said it will apply the core measures to Medicare quality programs, eliminating repetitive measures. Partners in the collaborative recognized that physicians and other clinicians must currently report multiple quality measures to different entities, CMS said. [Also: NQF CEO urges better quality measures] CMS worked with commercial plans, Medicare and Medicaid managed care plans, purchasers, physicians and other care provider organizations, as well as consumers to identify core sets of quality measures that payers have committed to using for reporting. The Core Quality Measures Collaborative, led by AHIP and its member plans' chief medical officers, leaders from CMS and the National Quality Forum, established the broadly agreed upon core measure sets that could be used for both commercial and government payers. More measure sets will be added and updated over time. "In the U.S. healthcare system, where we are moving to measure and pay for quality, patients and care providers deserve a uniform approach to measure quality," said CMS Acting Administrator Andy Slavitt. "This agreement today will reduce unnecessary burden for physicians and accelerate the country's movement to better quality." "This agreement on a set of core measures for primary care and the PCMH represents a big step toward the goal of administrative simplification for family physicians and improved quality of care," said Douglas E. Henley, MD, executive vice president and CEO of the American Academy of Family Physicians. Commercial health plans will use these core sets of measures when contracts come up for renewal, or if existing contracts allow changes in the performance measure set. CMS is also working with federal partners including the Office of Personnel Management, Department of Defense, and Department of Veterans Affairs, as well as state Medicaid plans to align quality measures where appropriate. The Core Quality Measures Collaborative views the upcoming year as a transitional period, as it begins to work with the new measures and affected organizations. They plan to monitor progress, invite broader participation, and possibly add additional measures and measure sets. Patient groups were a vital part of the collaborative. [Like Healthcare IT News on Facebook] "What we released today is a start at achieving consensus on the best measures, but we need to continue pushing for even better ones," said Debra L. Ness, president of the National Partnership for Women & Families. "We need measurement that works for clinicians and helps them improve care, while also providing information that is meaningful and actionable for patients and families." This work will influence CMS's implementation of the Medicare Access and CHIP Reauthorization Act of 2015. It is part of CMS's commitment to ensuring programs work for providers while keeping the focus on improved quality of care for patients, CMS said. CMS has also developed a draft Quality Measure Development plan, fueled by the development of the core measure sets as well as the discovery of gaps in the measures.  Twitter: @SusanJMorse

A recent study funded by Agency for Healthcare Research and Quality suggests that patients with fully electronic health records experienced fewer adverse events such as hospital-acquired infections. In order to be considered a fully electronic EHR, "physician notes, nursing assessments, problem lists, medication lists, discharge summaries and provider orders are electronically generated," according to researchers. Using 2012 and 2013 Medicare Patient Safety Monitoring System data, AHRQ examined outcomes for cardiovascular, pneumonia and surgery patients – specifically with regard to occurrence rates of 21 adverse events in four clinical domains: hospital-acquired infections, adverse drug events, general events (falls or pressure ulcers, for instance) and post-procedural events. [Also: CMS awards $110M for patient safety] "To assess the role of EHRs in preventing adverse events, the researchers measured to what extent care received by patients in the 1,351 hospitals was captured by a fully electronic EHR," said Amy Helwig, MD, deputy director of AHRQ's Center for Quality Improvement and Patient Safety, and Edwin Lomotan, MD, medical officer and chief of clinical informatics at AHRQ's Center for Evidence and Practice Improvement, in a blog post. The findings of the study, published in the Journal of Patient Safety, show that, of more than 45,000 patients at risk for nearly 350,000 adverse events in the study sample, 13 percent were exposed to fully electronic health records. Among all patients examined in the study, the occurrence rate of adverse events was 2.3 percent, or 7,820 adverse events. Patients with EHRs, meanwhile, had 17 to 30 percent lower odds of any adverse event. Helwig and Lomotan said that health IT has shown patient safety gains, but research to prove it has often looked at just one healthcare provider at a time. "A question that remains unanswered is the impact of fully installed electronic health records systems used in multiple organizations," they wrote. "Another big question: can EHRs go beyond improving safety-related processes to actually preventing adverse events, such as potentially deadly hospital-acquired infections, from reaching patients?" The findings from "Electronic Health Record Adoption and Rates of In-hospital Adverse Events"  suggest hospitals with EHR can offer more coordinated care from admission to discharge to reduce the risk of patient harm. They note, however, that adverse event odds varied by medical condition and type of event. “For example, patients hospitalized for pneumonia and exposed to a fully electronic EHR had 35 percent lower odds of adverse drug events, 34 percent lower odds of hospital-acquired infections, and 25 percent lower odds of general events. Among patients hospitalized for cardiovascular surgery, a fully electronic EHR was associated with 31 percent lower odds of post-procedural events and 21 percent fewer general events," they wrote. [Like Healthcare IT News on Facebook] Helwig and Lomotan caution that the AHRQ study raises a few questions. “The findings showed a significant relationship between fully electronic EHRs and adverse drug event rates for patients hospitalized with pneumonia, but not for those with cardiovascular disease or needing surgery,” they wrote. “This may be due to the fact that certain high-alert medications, such as opioids, which are often associated with adverse drug events, were not included in the MPSMS measures." Still, the authors said as more hospitals mature in their use of EHRs, those systems can play a key role in preventing adverse events. Twitter: @MikeMiliardHITN

Electronic health records are typically touted as providing two primary and vital services: readily accessible patient records and protection against contraindicated medications. But Intermountain Healthcare is benefiting from a growing and transformative versatility in the application of its EHRs.

The American Hospital Association has sent a list of demands the Centers for Medicare and Medicaid Services before the federal agency creates new rules surrounding electronic quality reporting measures. CMS earlier this month extended the public comment period for eCQM from Feb. 1 to Feb. 16, 2016. For starters, AHA, the largest hospital organization in the country, wants CMS to release the results of the previous eCQM demonstrations and pilots. [Also: CMS extends comment period on quality reporting] The organization also wants the agency to expand eCQM education and outreach. CMS and the Office of the National Coordinator first put out their request for public comment on Dec. 31, 2015, which called for feedback on several items related to the certification of health information technology. The request also asks for feedback on electronic health record products used for reporting to CMS incentive programs such as the Hospital Inpatient Quality Reporting Program and the Physician Quality Reporting System. AHA senior vice president of public policy Ashley Thompson wrote in comments to acting CMS administrator Andy Slavitt that the “AHA is encouraged that CMS is requesting feedback on several areas of concern to providers.” AHA leaders want CMS to outline transition plans from chart-based reporting to electronic reporting across CMS programs and clearly explain how eCQM will work other organizations’ reporting requirements, such as The Joint Commission. [Like Healthcare IT News on Facebook] Lastly, the AHA asked the agency to speed up efforts to identify and define data needed for reporting and to make sure that any modifications to definitions will align with existing requirements for eligible and critical access hospitals. “The AHA recommends that CMS also consider the input received to date from EHs, CAHs and eligible providers about their eCQM experiences, including the evidence from CMS eCQM pilots and demonstrations, to inform future rulemaking,” AHA wrote. Twitter: @HealthITNews