ads

,
Showing posts with label MAUDE. Show all posts
Showing posts with label MAUDE. Show all posts
The "Meaningful Use" program for EHRs is a mismanaged boondoggle causing critical issues of patient safety, EHR usability, etc. to be sidestepped.

This is on top of the unregulated U.S. boondoggle which should probably be called "the National Programme for IT in the HHS" - in recognition of the now-defunct multi-billion-pound debacle known as the National Programme for IT in the NHS (NPfIT), see my Sept. 2011 post "NPfIT Programme goes PfffT" at http://hcrenewal.blogspot.com/2011/09/npfit-programme-going-pffft.html.

The complaints are not just coming from me now.

As of January 21, 2015 in a letter to HHS at: http://mb.cision.com/Public/373/9710840/9053557230dbb768.pdf, they are now coming from the:

American Medical Association
AMDA – The Society for Post-Acute and Long-Term Care Medicine
American Academy of Allergy, Asthma and Immunology
American Academy of Dermatology Association
American Academy of Facial Plastic
American Academy of Family Physicians
American Academy of Home Care Medicine American Academy of Neurology
American Academy of Ophthalmology
American Academy of Otolaryngology—Head and Neck Surgery
American Academy of Physical Medicine and Rehabilitation
American Association of Clinical Endocrinologists
American Association of Neurological Surgeons
American Association of Orthopaedic Surgeons
American College of Allergy, Asthma and Immunology
American College of Emergency Physicians
American College of Osteopathic Surgeons
American College of Physicians
American College of Surgeons
American Congress of Obstetricians and Gynecologists
American Osteopathic Association
American Society for Radiology and Oncology
American Society of Anesthesiologists
American Society of Cataract and Refractive Surgery and Reconstructive Surgery
American Society of Clinical Oncology
American Society of Nephrology
College of Healthcare Information Management Executives
Congress of Neurological Surgeons
Heart Rhythm Society
Joint Council on Allergy, Asthma and Immunology
Medical Group Management Association
National Association of Spine Specialists
Renal Physicians Association
Society for Cardiovascular Angiography and Interventions
Society for Vascular Surgery


In the letter to Karen B. DeSalvo, National Coordinator for Health Information Technology at HHS, these organizations observe:

Dear Dr. DeSalvo:

The undersigned organizations are writing to elevate our concern about the current trajectory of the certification of electronic health records (EHRs). Among physicians there are documented challenges and growing frustration with the way EHRs are performing. Many physicians find these systems cumbersome, do not meet their workflow needs, decrease efficiency, and have limited, if any, interoperability.

Of course, my attitude is that we need basic operability before the wickedly difficult to accomplish and far less useful (to patients) interoperability. 
 
... Most importantly, certified EHR technology (CEHRT) can present safety concerns for patients. We believe there is an urgent need to change the current certification program to better align end-to-end testing to focus on EHR usability, interoperability, and safety.

Let me state what they're saying more clearly:

"This technology in its present state is putting patients at risk, harming them, and even killing them, is making practice of medicine more difficult, is putting clinicians at liability risk, and the 'certification' program is a joke."

... We understand from discussions with the Office of the National Coordinator for Health Information Technology (ONC) that there is an interest in improving the current certification program. For the reasons outlined in detail below, we strongly recommend the following changes to EHR certification:

1. Decouple EHR certification from the Meaningful Use program;
2. Re-consider alternative software testing methods;
3. Establish greater transparency and uniformity on UCD testing and process results;
4. Incorporate exception handling into EHR certification;
5. Develop C-CDA guidance and tests to support exchange;
6. Seek further stakeholder feedback; and
7. Increase education on EHR implementation.

Patient Safety
Ensuring patient safety is a joint responsibility between the physician and technology vendor and requires appropriate safety measures at each stage of development and implementation.

I would argue that it's the technologists who have butted into clinical affairs with aid from their government friends, thus the brunt of the ill effects of bad health IT should fall on them.  However, when technology-related medical misadventures occur, it's the physicians who get sued.

... While training is a key factor, the safe use of any tool originates from its inherent design and the iterative testing processes used to identify issues and safety concerns. Ultimately, physicians must have confidence in the devices used in their practices to manage patient care. Developers must also have the resources and necessary time to focus on developing safe, functional, and useable systems.

Right now, those design and testing processes compare to those in other mission-critical sectors employing IT quite poorly.

Considering fundamental stunningly-poor software quality that I've observed personally, such as lack of appropriate confirmation dialogs and notification messages supporting teamwork, lack of date constraint checking (see my report to FDA MAUDE at http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfmaude/detail.cfm?mdrfoi__id=1729552 and many others at http://hcrenewal.blogspot.com/2011/01/maude-and-hit-risk-mother-mary-what-in.html), and other fundamentals, I would say grade schoolers could probably have done a better job of safety testing than the vendors and IT amateur-implementers of the major systems I observed did. 

... Unfortunately, we believe the Meaningful Use (MU) certification requirements are contributing to EHR system problems, and we are worried about the downstream effects on patient safety.

In other words, computers and the government thirst for data do not have more rights than patients.  In the current state of affairs, as I have observed prior, computers do seem to have more rights than patients and the clinicians who must increasingly use them.

... Physician informaticists and vendors have reported to us that MU certification has become the priority in health information technology (health IT) design at the expense of meeting physician customers’ needs, patient safety, and product innovation. We are also concerned with the lack of oversight ONC places on authorized testing and certification bodies (ATCB) for ensuring testing procedures and standards are adequate to secure and protect electronic patient information contained in EHRs.

Not just security, but patient safety also.  See for example my Feb. 2012 post "Hospitals and Doctors Use Health IT at Their Own Risk - Even if 'Certified'" at http://hcrenewal.blogspot.com/2012/02/hospitals-and-doctors-use-health-it-at.html.

Read the entire letter at http://mb.cision.com/Public/373/9710840/9053557230dbb768.pdf.

Sadly, while on the right track regarding the problems of bad health IT, the societies take a Milquetoast approach to correction:

... In May 2014, stakeholders representing accredited certification bodies and testing laboratories (ACB & ATL), EHR vendors, physicians, and health care organizations provided feedback to ONC on the complexities of the current certification system. Two main takeaways from these comments were for ONC to host a multi-stakeholder Kaizen event and to prioritize security, quality measures, and interoperability in the EHR certification criteria. We strongly support both of these ideas...

A multi-stakeholder "Kaizen event'?  (http://en.wikipedia.org/wiki/Kaizen)

That's one recommendation I find disappointing.  The industry plays hard politics, and organized medicine wants to play touchy-feely "good change" management mysticism with that industry and their government apparatchiks.  That's how organized medicine wants patients and the integrity of the medical profession to be protected from the dysfunctional health IT ecosystem (see http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=ecosystem)?  

When I originally created my old website called "Medical informatics and leadership of clinical computing" back in 1998, Kaizen events were not exactly what I had in mind.

Finally, the American Medical Informatics Association (http://www.amia.org) was apparently not informed of this letter, nor did it participate in its drafting.  While this is regrettable, as the organization is the best reservoir of true Healthcare Informatics expertise, I opined to that group that this may have been due to the organization's tepid response to bad health IT and to industry control of the narrative, and the problems these issues have caused for physicians and other clinicians. The lack of AMIA leadership regarding bad health IT is an issue I've been pointing out since the late 1990s. AMIA has been largely a non-critical HIT promoter.  That stance has contributed to the need for this multiple-medical specialty society letter in the first place.

Parenthetically, and for a touch of humor about an otherwise drab topic: Here's an example of how management mysticism plays out in pharma.

It's meant to be satirical, but captures reality all too well, in fact scarily so at times:


Management mysticism and muddled thinking.  See https://www.youtube.com/watch?v=kwVjftMMCIE

In pharma, as well as in hospital IT in my days as CMIO, gibberish like this was real.  I imagine it's no different in many hospital management suites these days.

-- SS

1/28/2015  Addendum:

Per a colleague:

FierceHealthIT (1/28) reports, “It’s time for the American Medical Association and more than 30 other organizations urging change in the electronic health record certification process to be part of the solution, former Deputy National Coordinator for Health IT Jacob Reider said in a blog post.” Reider said, “So far, I don’t see much [any?] engagement from the AMA or the others who signed the letter. It’s relatively easy to write a letter saying someone else is responsible for solving problems. Time to step up to the plate and participate in the solutions, folks!"

Regarding the victims of compelled use of bad health IT, this erstwhile health IT leader opines "It's relatively easy to write a letter saying someone else is responsible for solving problems?"

That is simply perverse.

I ask: why are we in the midst of a now-compelled national rollout with Medicare penalties for non-adopters when a former government official once responsible for the technology remarks that it's apparently not the makers' problem and that it's "time to step up to the plate and participate in the solutions, folks [a.k.a. end users]!"

(One wonders if Reider believes those who step up to the plate are entitled to fair compensation for their aid to an industry not exactly known for giving its products away, free.)

It seems to me it's not up to (forced) customers to find solutions to vendor product problems, some deadly.

It's the responsibility of the sellers.

Put more bluntly, Reider's statement is risible and insulting.

I've already opined the following to the AMA contact at the bottom of the letter:

... Relatively milquetoast approaches such as multi-stakeholder Kaizens are not what I had in mind ... A more powerful stance would be to advise society members to begin to avoid conversion, report on bad health IT, and even boycott bad health IT until substantive changes are realized in this industry.

That's "stepping up to the plate" to protect patients, in a very powerful way.

-- SS
6:02 AM
Transparency in the health IT sector is akin to the transparency of Pb (lead).

The following report comes from the FDA Maude (Manufacturer and User Facility Device Experience) voluntary-reporting database, reported by a (likely unhappy) biomedical engineer a month after the "incident" - the nature of which is deliberately kept hidden.  This is regarding the PICIS "Pulsecheck" EHR for emergency departments:

Report Date     05/14/2010

PICIS INC. CARESUITE ED PULSECHECK S/W, TRANSMISSION & STORAGE PATIENT DATA
Event Type:  Other
Patient Outcome:  Required Intervention

Event Description

The customer has reported a patient incident that has prompted a review of their internal process and possible issues surrounding the incident. The customer report alleges the involvement of picis' ed (emergency dept. ) electronic health record application, whereby, duplicate results were received by the picis ehr application from an enterprise info system, which, when displayed in their entirety may have contributed to some degree of confusion for the treating physician - the context of which the customer has declined to clarify any further.  [What in the world? -ed.] At this time, we have been informed by the customer that they are restricted by senior leadership from disclosing any specific details regarding the patient's status, the specific type of result or evidence of application performance to support picis' investigation.

"Restricted by senior leadership from disclosing any specific details regarding the patient's status, the specific type of result or evidence of application performance to support Picis' investigation?"

That is perverse on its face, and probably in violation of Joint Commission safety standards on reporting of incidents that could affect other organizations.


Manufacturer Narrative

Picis' investigation into the reported incident is based on a limited exchange of info with the customer, as well as our internal review of the application design and current configuration in use at the reporting site. Review of configuration files, existing system build at the client site, interface specification documents and previous customer communications demonstrate that the customer implemented and accepted the picis edis in 2008. During this process, the picis edis system was configured to display all results sent from the customer's enterprise system rather than configuring the results display in 'overwrite' mode. Prior to acceptance, an investigation by picis and the client revealed that it was the sending system, sending multiple duplicate results messages [great quality - ed.] and a request was made by the customer of that enterprise vendor [I can only wonder who that was - ed.] to investigate. However, due to the enterprise system's protocol for 'add on' tests, it was not possible to utilize the 'overwrite' configuration due to the risk of filtering out unique results and subsequently not presenting the clinicians with important info. Therefore, the customer elected to have all results displayed.

A workaround that apparently, from the limited information provided, led to physician confusion..."the context of which the customer had", not very helpfully, "declined to clarify any further."

Hospitals also are required to have add'l safeguards in place for the handling of critical results including expedited reporting of critical results with a licensed responsible caregiver rather than relying solely on standard results reporting processes (joint commission national patient safety goal 02. 03. 01).

This is not a resounding statement of confidence in health IT...

The customer is currently working with a 3rd party integration consultant to improve the handling of results sent to picis' electronic health record application. We are providing support as it is requested. At this time, no corrective action is needed. 

The "senior leadership" that withheld details was protecting what, exactly?  Money and contracts, perhaps; conflicts of interest, possibly ... but not patients.

All I can say is:

Imagine if this was a report on a new drug suspected of harming people. 

What in heaven's name was going on here?

As I've written many times, and as illustrated by this MAUDE report, the health IT industry must first be transformed into one of evidence-driven IT practices and transparency before anyone touting its products has any business even speaking about the technology "transforming medicine."

-- SS

10:24 AM
Australians seem to not be as seduced by the Siren Song of cybernetic miracles as health IT leaders in the United States.

It took an Australian computer scientist at U. Sydney to dissect and perform a detailed analysis of the internals of an American EHR system, the results of which were disturbing to say the least.  This was a task the American members of the American Medical Informatics Association (AMIA) should have taken on.  It's not as if they're unaware of clinical IT problems.

It also seems to take a group of Australian researchers at the Univ. of New South Wales, the Australian Patient Safety Foundation, and the University of South Australia to perform a forensic analysis on U.S. data in the FDA's Manufacturer and User Facility Device Experience (MAUDE) database, instead of Americans themselves. 

At least AMIA allowed the Australians the opportunuty to present their findings.

In "Patient Safety Problems Associated with Heathcare Information Technology: an Analysis of Adverse Events Reported to the US Food and Drug Administration" (free fulltext at this link), AMIA Annual Symposium Proceedings 2011;2011:853-7 the Australian researchers including Medical Informaticist and critical thinker Dr. Enrico Coiera (see here) analyzed healthcare information technology (HIT) events associated with patient harm submitted to the MAUDE database:

We downloaded all 899,768 reports that were submitted to MAUDE from January 2008 to July 2010 and searched for events using a broad definition of HIT as “hardware or software that is used to electronically create, maintain, analyse, store, receive, or otherwise aid in the diagnosis, cure, mitigation, treatment, or prevention of disease, and that is not an integral part of (1) an implantable device or (2) medical equipment.” We retrieved and classified 678 reports describing 436 unique events using a previously published methodology. Of the 436 HIT-related events that we examined, 11% (n=46) were associated with patient harm [this excludes the "near misses" - ed.] ... In this paper we specifically focus on examining the 46 events where HIT problems were associated with patient harm.

These submissions are voluntary, and due to systematic, severe impediments to submissions as below, this data likely represents a very small fraction ("tip of the iceberg" per FDA itself, link) of the true incidence of these events.  See the addendum to this post "Systematic impediments to voluntary reporting of health IT risks."

Summarizing the Australian researchers' findings (read the entire paper at the link above):


Medication problems represented 41% of the events of these types:

  • Wrong patient
  • Wrong dose or overdose
  • Missed and delayed doses

Clinical process problems
represented 33% of the events:
  • Use errors in entering information ("use error" is an error due to poor and confusing design, as opposed to "user errors")
  • Poor functionality of CPOE and PACS

Exposure to radiation occurred in 15% of the events

Surgery problems occurred in 11% of the events.

The authors recommended that "strategies to improve the safety of HIT should focus on designing safe user interfaces, integrated checks of key identifiers and decision support, and engineering safer clinical processes."

Unfortunately, that does not appear to be occurring in the U.S. to any significant degree.  "Certification" of health IT to meet government criteria for financial incentives is unrelated to such measures and is in my view symptomatic of industry regulatory capture (see here and here).  The IOM itself has instituted a "watch and wait" policy, a likely unique special accommodation in current regulation of medical devices (see here).

I reiterate this MAUDE data is voluntary and the impediments to its reporting systematic and severe.  See addendum to this post.

In the category of good sense on electronic medical records, I note the following articles:

Victoria aims for more open ICT strategy 

Pulse+IT Magazine
Kate McDonald
02 October 2012

The newly formed Victorian Information and Communications Technology Advisory Committee (VITAC) has released a draft strategy (PDF) describing how the state government should manage and use ICT to better provide government services.

The strategy recommends that the government engage more closely with the ICT sector and move away from customised products in favour of existing market offerings.

... It recommends that the government engage with the ICT market early in the procurement lifecycle. “We will avoid being locked into single suppliers by favouring open standards and will be open to any qualified ICT provider regardless of size. Procurement of ICT services will be made more efficient.”

The strategy should also provide guidance to agencies to move away from customised major ICT developments and use existing market offerings with little or no customisation instead.

What this means is abandoning the approach of large, single-source (monolithic), proprietary clinical information systems from large health IT vendors that try to cover everything, in favor of smaller, open standards-based "best-of-breed" applications (from vendors of all sizes) that can be woven together to meet users' needs:

The subsequent fallout from the Ombudsman's report led to the Victorian government cancelling several programs, including the $323 million HealthSMART program, an ambitious project to roll out common eHealth infrastructure throughout Victoria's public health services.

This included implementing iSOFT's (now CSC) i.PM patient administration system and Cerner's clinical information system in its hospitals, as well as InterSystems' TrakCare platform for community health agencies.

I note that another article in eHealth Insider mentions the same strategy in the UK, "Winchester switches off Cerner in ED":

The Royal Hampshire County Hospital in Winchester has switched off Cerner Millennium in A&E and moved to Patient First.  The electronic patient record system will also be switched off for theatres and order communications at the old Winchester and Eastleigh Healthcare NHS Trust ... Basingstoke and North Hampshire was pursuing an alternative IT strategy, built around a 'best of breed' approach to building on its existing systems.

The U.S. has yet to learn these lessons, and will likely repeat the same mistakes at the cost of hundreds of billions of dollars.

Unfortunately, I have no answers.  I see no way to avoid it, considering the HITECH momentum that favors the large-vendor monolithic product model.

-- SS

--------------------------------------

Addendum.  Systematic impediments to voluntary reporting of health IT risks:

From the 2010 FDA internal memo on health IT risks:

Limitations of the MAUDE search and final subset of MDRs include the following:

1.  Not all H-IT safety issue MDRs can be captured due to limitations of reporting practices including:

... (a) Vast number of H-IT systems that interface with multiple medical devices currently assigned to multiple procodes making it difficult to identify specific procodes for H-IT safety issues;
... (b) Procode assignments are also affected by the ability of the reporter/contractor to correctly identify the event as a H-IT safety issue;
... (c) Correct identification by the reporter of the suspect device brand name is challenged by difficulties discerning the actual H-IT system versus the device it supports.

2.  Due to incomplete information in the MDRs, it is difficult to unduplicate similar reports, potentially resulting in a higher number of reports than actual events.

3.  Reported death and injury events may only be associated with the reported device but not necessarily attributed to the device.

4.  Correct identification by the reporter of the manufacturer name is convoluted by the inability to discern the manufacturer of the actual H-IT system versus the device it supports.

5.  The volume of MDR reporting to MAUDE may be impacted by a lack of understanding the reportability of H-IT safety issues and enforcement of such reporting.

From the 2012 IOM report on health IT safety:

... While some studies suggest improvements in patient safety can be made, others have found no effect. Instances of health IT–associated harm have been reported. However, little published evidence could be found quantifying the magnitude of the risk.

Several reasons health IT–related safety data are lacking include the
absence of measures and a central repository (or linkages among decentralized repositories) to collect, analyze, and act on information related to safety of this technology. Another impediment to gathering safety data is contractual barriers (e.g., nondisclosure, confidentiality clauses) that can prevent users from sharing information about health IT–related adverse events. These barriers limit users’ abilities to share knowledge of risk-prone user interfaces, for instance through screenshots and descriptions of potentially unsafe processes. In addition, some vendors include language in their sales contracts and escape responsibility for errors or defects in their software (i.e., “hold harmless clauses”). The committee believes these types of contractual restrictions limit transparency, which significantly contributes to the gaps in knowledge of health IT–related patient safety risks. These barriers to generating evidence pose unacceptable risks to safety.
… “For example, the number of patients who receive the correct medication in hospitals increases when these hospitals implement well-planned, robust computerized prescribing mechanisms and use barcoding systems. But even in these instances, the ability to generalize the results across the health care system may be limited. For other products— including electronic health records, which are being employed with more and more frequency— some studies find improvements in patient safety, while other studies find no effect.

More worrisome, some case reports suggest that poorly designed health IT can create new hazards
in the already complex delivery of care. Although the magnitude of the risk associated with health IT is not known, some examples illustrate the concerns. Dosing errors, failure to detect life-threatening illnesses, and delaying treatment due to poor human–computer interactions or loss of data have led to serious injury and death.”

Not knowing the magnitude of the risks is an effect of the impediments, and does not represent a good environment for national implementation in my view.

I also add "fear of medical malpractice litigation" to the lists above.

-- SS
6:34 AM