Politico 2015: EHR sellers using “gag clauses” (despite Koppel/Kreda's 2009 JAMA article on EHR nondisclosure clauses, and my 2009 JAMA Letter to the Editor on how these clauses violate Joint Commission safety standards)

I have not blogged on EHR issues in some time, despite some interesting source material such as:

• "Evidence Summary: Electronic Health Records (EHRs)" at http://www.ohri.ca/kta/docs/KTA-EHR-Evidence-Review.pdf ; 
• "Electronic Health Records Software Often Written without Doctors' Input" at http://www.scientificamerican.com/article/electronic-health-records-software-often-written-without-doctors-input/ ; and
• "Avoiding Expensive And Consequential Health Care Decisions Based On Weak Research Designs" [e.g., EHR expansion - ed.] at http://healthaffairs.org/blog/2015/08/31/avoiding-expensive-and-consequential-health-care-decisions-based-on-weak-research-designs/.

These can be read at the links above, and are self-explanatory.

A new Politico investigation and article, however, is worth writing about:
  

Politico
Doctors barred from discussing safety glitches in U.S.-funded software
Darius Tahir
09/11/15
http://www.politico.com/story/2015/09/doctors-barred-from-discussing-safety-glitches-in-us-funded-software-213553

President Barack Obama’s stimulus put taxpayers on the hook for $30 billion in electronic medical records, many of which have turned out to be technological disasters.

But don’t expect to hear about the problems from doctors or hospitals. Most of them are under gag orders not to discuss the specific failings of their systems — even though poor technology in hospitals can have lethal consequences. 

[Change the "can" to "does", e.g., ECRI Deep Dive, http://hcrenewal.blogspot.com/2013/02/peering-underneath-icebergs-water-level.html - ed.]

A POLITICO investigation found that some of the biggest firms marketing electronic record systems inserted “gag clauses” in their taxpayer-subsidized contracts, effectively forbidding health care providers from talking about glitches that slow their work and potentially jeopardize patients.

[E.g., see http://hcrenewal.blogspot.com/search/label/glitch - ed.]

POLITICO obtained 11 contracts through public record requests from hospitals and health systems in New York City, California, and Florida that use six of the biggest vendors of digital record systems. With one exception, each of the contracts contains a clause protecting potentially large swaths of information from public exposure. This is the first time the existence of the gag clauses has been conclusively documented.

I note this Politico article appears six years after the seminal JAMA article on hold harmless and defects nondisclosure clauses:

• "Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians" by Koppel and Kreda, JAMA 2009;301(12):1276-1278), http://medecon.pbworks.com/f/IT%20Accountability%20JAMA09.pdf,

as well as:

• this author's followup JAMA Letter to the Editor "Healthcare IT, Hospital Responsibilities, and Joint Commission Standards" (can be seen in its entirety at http://jama.jamanetwork.com/article.aspx?articleid=184302) pointing out that such clauses and those who signed them were in violation of Joint Commission safety standards. 
• (I published a longer version at http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=koppel_kreda.  Also see my 2009 post at http://hcrenewal.blogspot.com/2009/03/health-care-information-technology.html).

In that 2009 JAMA Letter to the Editor I observed:

... In their Commentary, Dr Koppel and Mr Kreda made clear the problems associated with applying the customs and traditions of business software contracting and sales (where “hold harmless” and “keep defects secret” clauses are commonplace) to health care information technology (HIT) as if they are the same. I believe that ignoring their differences has likely created an epidemic of violations of hospital governing body responsibilities and Joint Commission standards for health care organization leadership.

In 2015 I stand by these assertions.  Computer and business personnel - through arrogance, selfishness, narrow-mindedness and other issues - have made a mess assuming that business software practices apply to clinical medicine and healthcare IT.  In the latter domain, however, increased clinical stress and hypervigilance due to bugs clinicians have to work around (that might have been fixed sooner), lessening their performance and increasing risk, and patient injury and death has been the result of a belief that clinical computing is just a niche area of business computing.  (I've been making this point for at least 15 years, I might add.)

Such contractual practices endanger patients, and in 2015 are reckless, negligent and inexcusable.

http://injury.findlaw.com/accident-injury-law/recklessness.html
Recklessness means the person knew (or should have known) that his or her action were likely to cause harm. Negligence means that the person acted in violation of a duty to someone else, with the breach of that duty causing harm to someone else.

More from the Politico article:

Vendors say such restrictions target only breaches of intellectual property and are invoked rarely.

IP breaches?  While I understand the business issues at hand, in reality this is farcical.  There is little unique and valuable IP in these systems...as if one EHR vendor would really copy off another EHR vendor's screens.  I've seen many EHRs and their instruction manuals and in my opinion there's little worth stealing from any of these look-alike systems.

But doctors, researchers and members of Congress contend they stifle important discussions, including disclosures that problems exist. In some cases, they say, the software’s faults can have lethal results, misleading doctors and nurses who rely upon it for critical information in life-or-death situations.

Change the "can" to "do."  See ECRI link above, posts such as at http://hcrenewal.blogspot.com/2011/09/sweet-death-that-wasnt-very-sweet-how_24.html, and as readers here know, I have one less living relative thanks to EHR faults.  (I know of others that I cannot discuss.)

Critics say the clauses – which POLITICO documented in contracts with Epic Systems, Cerner, Siemens (now part of Cerner), Allscripts, eClinicalWorks and Meditech – have kept researchers from understanding the scope of the failures.

I actually refute that.  I believe many researchers (in the field of Medical Informatics, at least) were blinded by their own wishful thinking about health IT and their own misplaced overconfidence in computing.  My writings for a decade and that of many other "iconoclasts", based on experience and insight from other fields in which we worked, clearly raising huge red flags, were derided or summarily ignored.  For instance, see my post "The Dangers of Critical Thinking in A Politicized, Irrational Culture" from almost exactly five years ago at http://hcrenewal.blogspot.com/2010/09/dangers-of-critical-thinking-in.html.  There was enough data to ascertain that major problems were extant.

Even the ECRI Deep Dive EHR safety study referenced above, now at least three years old, finding 171 IT mishaps in 9 weeks in just 36 hospitals voluntarily reported, causing 8 significant harms and 3 possible deaths, is rarely cited by the "researchers."  See http://hcrenewal.blogspot.com/2013/02/peering-underneath-icebergs-water-level.html.

... Sheldon Whitehouse (D-RI) asked a panel of witnesses [during a HELP committee hearing earlier this summer], including Allscripts CEO Paul Black: “Can anyone on this panel see a single reason why these contracts should have gag clauses in them?”  No one ventured a reason.

Perhaps, I ask, because it would be hard to say something like "Senator, our computers have more rights than patients, and we don't give a damn about patient harm as long as the $$$ keep rolling in, and payouts for screw-ups that do make it to court are manageable", Ford Pinto-style, in such a setting?

After POLITICO disclosed its findings, an aide to HELP Chairman Lamar Alexander (R-Tenn.) said the committee would look at the issue, “exploring potentially harmful effects of these clauses – including how they could inhibit interoperability.”

The interoperability issue is a diversion if not a non-sequitur.  Dreamers still believe billions will be magically saved, and lives saved, via "interoperability", ironically at a time when basic operability is poorly achieved.

Let me state this clearly:  health IT will always be a major cost center and will never result in the mass cost savings attributed by the pundits to it.  From experience, I state that is a pipe dream, a fantasy, a risible statement consistent with a mania over the technology.  The issues in medicine that cost dear money are complex, and are not amenable to solution via cybernetic miracles.

See http://hcrenewal.blogspot.com/2012/09/wsj-koppel-and-soumerai-major-glitch.html for more on this issue:

... a comprehensive evaluation of the scientific literature has confirmed what many researchers suspected: The savings claimed by government agencies and vendors of health IT are little more than hype.

To conduct the study, faculty at McMaster University in Hamilton, Ontario, and its programs for assessment of technology in health—and other research centers, including in the U.S.—sifted through almost 36,000 studies of health IT. The studies included information about highly valued computerized alerts—when drugs are prescribed, for instance—to prevent drug interactions and dosage errors. From among those studies the researchers identified 31 that specifically examined the outcomes in light of the technology's cost-savings claims.

With a few isolated exceptions, the preponderance of evidence shows that the systems had not improved health or saved money.

Rather than saving money, the industry is sucking in some of that $17 or so trillion the United States just doesn't have (http://www.usdebtclock.org/).  See for instance "The Machinery Behind Health-Care Reform: How an Industry Lobby Scored a Swift, Unexpected Victory by Channeling Billions to Electronic Records", Washington Post, by Robert O'Harrow Jr., May 16, 2009.

Back to Politico:

... Take Cerner’s agreement with LA County’s Department of Health Services, signed in November 2012 and worth up to $370 million. It defines the vendor’s confidential information as “source code, prices, trade secrets, mask works, databases, designs and techniques, models, displays and manuals.” Such information can only be revealed with “prior written consent.” The protections cover the provider company, and its employees.

Such agreements, which are typical of the contracts examined by POLITICO, “contain broad protections for intellectual property and related confidentiality and non-disclosure language which can inhibit or discourage reporting of EHR adverse events,” said Elisabeth Belmont, corporate counsel at MaineHealth.

Belmont said she had also seen non-disparagement wordings that prohibit providers from disseminating negative information about the vendor or its software. POLITICO found no direct evidence of such clauses.

"Non-disparagement wording?"

How about good old-fashioned Orwellian thought control?  See my Oct,. 2013 post 'Words that Work: Singing Only Positive - And Often Unsubstantiated - EHR Praise As "Advised" At The University Of Arizona Health Network' at http://hcrenewal.blogspot.com/2013/10/words-that-work-singing-only-positive.html.

... The executive branch—the Office of the National Coordinator for Health IT (ONC) and the Centers for Medicare and Medicaid Services are responsible for the subsidy program— has done little about the clauses, though providers and researchers have been grumbling about them since the 2011 Institute of Medicine report warning that “[t]hese types of contractual restrictions limit transparency, which significantly contributes to the gaps in knowledge of health IT–related patient safety risks.”

...Agency officials say they deplore the clauses but lack the capacity to directly address the problem. “We strongly oppose ‘gag clauses’ and other practices that prevent providers and other health IT customers and users from freely discussing problems and other aspects of their health IT,” an ONC spokesman said.

But, he continued, ONC cannot police them. The clauses take a variety of forms, and the extent to which vendors invoke them varies, making enforcement difficult – particularly for a small agency that doesn’t have investigative or police powers.

A small agency that doesn’t have investigative or police powers?  Really?  Yet - ONC is a promoter of the non-regulatory "Safety Center" concept as a solution to health IT safety risks.  See for instance http://hcrenewal.blogspot.com/2014/04/fda-on-health-it-risk-reckless-or.html.  Their response above to Politico seems disingenuous.

What follows in the Politico article is vendor excuses and soothing reassurances, like this one:

... Epic executives said they encourage open discussion. “With permission, we very frequently allow folks to share information around the software,” said Epic’s vice president for client success, Eric Helsher.

I'll surmise I would not be able to easily get detailed information on the ten thousand EPIC "issues" I highlighted at my Nov. 2013 post "We’ve resolved 6,036 issues and have 3,517 open issues": extolling EPIC EHR Virtues at University of Arizona Health System", http://hcrenewal.blogspot.com/2013/11/weve-resolved-6036-issues-and-have-3517.html, for publication on this blog.

... a lot of problems may go under-reported. That offends [Dr. Bob] Wachter, who says the patient safety world “takes it as religion” that information be shared as widely as possible.

“These are worlds colliding. You can understand why a technology business would put restrictions on screenshots. But we’re not making widgets here, we’re taking care of sick people,” he said.

“At some level, I’d say, ‘How dare they?’”

"At some level?"  What level, exactly?

How about the life-and-death level?

Worlds colliding, indeed; the aforementioned business-IT world and the clinical world.  I would drop the "at some level" phrase, though, and also go back to my 2009 JAMA letter observation that I repeat once again: 

... In their Commentary, Dr Koppel and Mr Kreda made clear the problems associated with applying the customs and traditions of business software contracting and sales (where “hold harmless” and “keep defects secret” clauses are commonplace) to health care information technology (HIT) as if they are the same. I believe that ignoring their differences has likely created an epidemic of violations of hospital governing body responsibilities and Joint Commission standards for health care organization leadership.

Health IT companies are simply not team players in medicine.  Their heavy-handedness and narrow thinking has harmed and killed patients.   How many in total? 

Last year I spoke to a half dozen US House members and a dozen or so aides of House members who could not attend.   I was accompanied by two Plaintiff's lawyers (yes, Plaintiff's lawyers) who told their own tales of EHR-mediated catastrophes whose survivors they had represented.  They were there for that purpose, to inform the US Reps that health IT was killing people.

Extrapolating the ECRI Deep Dive study figures and adding in other known cases, the true level of harms is anything but pretty.

It would be a very useful exercise to measure it explicitly rather than using the Ostrich approach (see for instance my post "FDA on health IT risk:  "We don't know the magnitude of the risk, and what we do know is the tip of the iceberg, but health IT is of 'sufficiently low risk' that we don't need to regulate it" (http://hcrenewal.blogspot.com/2014/04/fda-on-health-it-risk-reckless-or.html). 

However, obtaining the data in a robust matter could result in those reporting the data violating EHR gag and non-disparagement clauses.

We must respect the rights of the computers...

-- SS

Addendum:  the Politico article, unfortunately, while a major piece, did not cite Koppel/Kreda or their pioneering 2009 JAMA article.  I surmise this was an oversight.

11:04 AM

Shareholders Take Notice That Patients Used As Unconsented Guinea Pigs, Physicians as Bank by Health IT Vendors

At my Jan. 2009 post "Waste Feared in Digitizing Patient Records: Wall Street Journal" and others I have written about the illegitimacy of the abuse of patient rights, as well as abuse of clinician trust committed by health IT vendors using patient care settings as an unconsented software development laboratory and beta testing site. I wrote:

The IT industry uses hospitals, doctor offices and patients as alpha and beta test sites and subjects, unregulated by the FDA or other agency. When HIT fails, there is no central agency to report the failures to, only the vendor. Fixes go into a "queue" for remediation, with priority level decided by the vendor.

Clinicians are also used by HIT vendors as a form of bank and insurance company. HIT vendors depend on (free!) physician and nurse ingenuity in finding workarounds to the ill-conceived design and user experience (link to my eight part series on this issue) that their products usually present so that their products can even be salable. This, of course, taxes and tires clinicians at the expense of patients and hampers and complicates EHR diffusion. Clinicians become, in effect, unpaid development consultants to HIT companies (or, perhaps more accurately, since EHR's do become essential to medical practice, indentured servants to the HIT vendors).

Also, under the unethical, Joint Commission-violating and executive fiduciary responsibility-violating "Hold Harmless" and "Defects Nondisclosure" HIT contracting clauses, clinicians pay the price for bad patient outcomes, even if the causative factor was HIT errors. (See Health IT Hold Harmless and Defects Gag Clauses: Have Hospital Executives Violated Their Fiduciary Responsibilities By Signing Such Contracts?, and my July 22, 2009 JAMA letter to the editor on this issue.) Thus, clinicians become an insurance company, bank and risk safety net (a term that might not be inappropriate is "suckers") for the HIT vendors. This is not an optimal way to treat one's ultimate customers.

HIT is a mess, but that doesn't stop HIT vendors from simply lying about their financial status and future projected business to the investor community.

Now, HIT company shareholders are taking note of these industry (mal)practices. These (mal)practices are hitting shareholders where it really hurts - in the pocketbook. My comments in [red italics]:

Allscripts shareholders file class action suit
Healthcare IT News
August 05, 2009 | Bernie Monegain, Editor

CHICAGO – Allscripts shareholders have filed a lawsuit alleging the company broke federal securities laws when it went live with the newest version of its EHR clinical software, Touchworks [i.e., a "version" that had not been thoroughly tested and validated outside hospital walls, a practice HIT vendors get away with due to the near spinelessness of regulators such as the Joint Commission, FDA, and others - ed.] .

Allscripts officers say the suit is without merit.

[As I pointed out at "Do Healthcare Organizations Truly Want Electronic Health Records To Succeed?" regarding the lawsuit my own organization filed against this company and its partner Medicomp Systems (civil complaint PDF here), where incomplete, untested and non-functional software was sold by this company for use by our physicians, I'd say the allegations do deserve further investigation - ed.]

"We are aware of the lawsuit and have reviewed the complaint," Allscripts officials said Wednesday. "While it is our policy not to comment on the substance of pending litigation, we believe the lawsuit is without merit and will vigorously defend the allegations."

The lawsuit, which seeks class action status, has been filed in the United States District Court for the Northern District of Illinois on behalf of those who purchased the common stock of Allscripts-Misys Healthcare Solutions, Inc. (formerly known as Allscripts Healthcare Solutions, Inc.) between May 8, 2007 and Feb. 13, 2008. It names Allscripts-Misys Healthcare Solutions, CEO Glen Tullman and Chief Financial Officer William J. Davis as defendants.

At a user conference in Orlando, Fla., July 30-31, Allscripts CEO Glen Tullman told some of the attendees that Allscripts might have rushed version 11 of Touchworks to market too quickly.

["Might have" rushed it out too quickly? It had, in fact, been delayed several months according to the lawsuit. "Perhaps" the delays needed to be lengthier. In other words, f*** the doctors and patients, we're getting this cr** out the door so as to not further injure our profits with further delays - ed.]

He said the company was caught off guard by providers who found new uses for the product.

["New uses?" (We all know that when companies sell broken HIT, it's always the doctors' fault) ... Likely translation: clinicians tried to practice medicine the way they saw best, not the way the Allscripts software designers saw best or "approved of." (Arrogance, anyone?) The clinician users tried to use the software in a real-world setting while applying the improvisations needed for proper patient care in a poorly bounded, uncertain environment (per Nemeth and Cook) and found the software's support of the uncertainties and realities of the clinical environment, and likely the software's stability itself, poor - ed.]
Tullman and Faisal Mushtaq, the company's senior vice president of product development, said Allscripts has invested roughly $14 million to improve stability and performance [after throwing the doctor and patient test subjects to the wolves after a "might have rushed it out" premature rollout - ed.], and they expect the next version, to be rolled out soon, to work more smoothly.

[I really despise the "version 1.1 will be much better" in healthcare settings, as it goes back to the issue of sick patients as unconsenting subjects in a software testing lab, and physicians as a bank and insurance company for the vendors when things go wrong -ed.]

The complaint alleges that defendants failed to disclose the following adverse facts:

* Allscripts lacked the necessary resources [i.e., smart, a.k.a expensive, people who actually know what they're doing thanks to the appropriate informatics education and expertise. Were the ones they did have tied up in patchwork remediation and crisis management? - ed.] to install V-11 software at customer sites; Allscripts had no historical basis to estimate the completion of V-11 or the impact V-11 sales might have on the company's 2007 revenues and earnings [if they made stuff up, that would not be too uncommon in today's financial environment. Also, the "lack of necessary resources", not unique to Allscripts, portends quite poorly for the planned, manic rush to national EHR by the cavalierly short deadline of 2014 - ed.]

* The complexity of V-11 had materially and adversely lengthened the sales cycle and revenue recognition cycle for the company's V-11 sales contracts [Another instantiation of my belief that business IT sales practices are inappropriate for clinical IT, where there are unconsenting "customers" with special rights - patients. One also wonders: did clinicians balk at a Rube Goldberg contraption but hospital executives purchase it anyway? - ed.];
* Allscripts was currently experiencing adverse and continuing delays in the installation of V-11 software systems [which were perhaps not revealed by clients, thanks to secrecy clauses regarding defects and problems as noted by Penn's Koppel and Kreda in JAMA? - ed];

* Based on the foregoing, defendants had no reasonable basis for their statements concerning Allscripts' current and future financial performance and projections.

The law firm of Izard Nobel LLP, based in West Hartford, Conn. announced the class action lawsuit on Wednesday.

Click here to read the complaint: http://www.izardnobel.com/allscriptsmisyshealthcare/ .

The PDF of this class action complaint is here.

So, it seems entirely possible the defects nondisclosure clauses promulgated by these vendors, and accepted by meek hospital executives and CIO's, may have supported and/or led to a situation of shareholder fraud.

It would be ironic indeed if these cavalier HIT practices end, and the HIT vendors began to adhere to principles of responsibility and resilience engineering, not due to regulatory pressures but due to shareholder lawsuits.

Finally, Allscripts CEO Tullman was a campaign adviser to the President on healthcare. It's perhaps due to advisers like this that national plans for healthcare reform are sinking like the Titanic. As per my Feb. 18, 2009 Wall Street Journal letter:

... it is the government that has been deceived [rather than the public] by the HIT industry and its pundits. Stated directly, the administration is deluded about the true difficulty of making large-scale health IT work. The beneficiaries will largely be the IT industry and IT management consultants ... The government has bought the IT magic bullet exuberance hook, line and sinker.

-- SS

addendum:

Perhaps I should self-turn in this post as "fishy" to the healthcare reform snitch line at "flag@whitehouse.gov"?

5:21 PM

Making Hospitals Safer by Making Healthcare IT Safer

At my July 24, 2009 HC Renewal post "Inquiry to Joint Commission on points raised in my July 22, 2009 JAMA letter on HIT", I reproduced a letter I sent to the Joint Commission seeking their opinions on the issue of Health IT "hold harmless" and "defects nondisclosure" contractual terms. (See "Health Care Information Technology Vendors' Hold Harmless Clause - Implications for Patients and Clinicians", JAMA 2009;301(12):1276-1278 and my HIT difficulties website essay here.)

Those contractual terms cause hospital executives to violate Joint Commission safety standards and their own fiduciary responsibilities to people both providing and seeking care in hospitals. My inquiry was acknowledged, and I await a reply.

In Making Hospitals Safer for Patients, New York Times, Aug. 2, 2009 , Mark R. Chassin, president of The Joint Commission, wrote:

To the Editor:

Jim Hall makes an important point about the costs and preventability of harm caused by medical errors, but his suggestion for a National Medical Safety Board is not the answer. It is not sufficient to investigate health care “crashes” one at a time and hope to transform the health care system into one that performs more reliably.

Too often, the lessons learned are not easily transferable to other hospitals or even to other problems within the same organization.

The key to transforming our health care system into a safer one is to use proven quality improvement methods — already in use in high-risk fields like aviation and nuclear power — as part of everyday work ...

In a followup email to the Joint Commission, I pointed out to Dr. Chassin that this is the same key to improving the quality and safety of EHR, CPOE and other information technology-based medical devices.

I also pointed out that "Hold harmless" and "Defects nondisclosure" -- a.k.a. "gag clause" -- contractual methods (unless I'm mistaken, in which case we're all in jeopardy) are not used in building and deploying safety-critical devices found in the aviation and nuclear energy industries.

-- SS

7:19 AM

Inquiry to Joint Commission on points I raised in my July 22, 2009 JAMA letter on HIT

As I posted here, my letter "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" was published in JAMA on July 22, 2009. A preview of the letter can be seen here, or a full version here if you subscribe to JAMA.

This JAMA letter covered some of the same points I addressed extensively at my Drexel HIT website essay "Hold Harmless and Keep Defects Secret Clauses", including the major point that hospital executives signing HIT "Hold Harmless" and "Defects Nondisclosure" contracts are in violation of Joint Commission standards for conduct related to safety, and in violation of their fiduciary responsibilities towards patient and employee safety and freedom from undue liability.

I've sent the following inquiry to Paul M. Schyve, M.D., Senior Vice President, The Joint Commission:

July 24, 2009

Paul M. Schyve, M.D.
Senior Vice President
The Joint Commission
schyve@jointcommission.org

Cc: MChassin@jointcommission.org, otrippi@jointcommission.org

Dear Dr. Schyve,

In testimony to the House Committee on Veterans' Affairs on July 22, 2009 at this link , you state:

... The Joint Commission has established standards that require the hospital to:

• Create a culture in which adverse events are reported and evaluated for underlying ("root") causes, and preventative actions are taken.
• Identify high-risk processes and prospectively determine their possible modes of failure, the effects of those failures, and the actions that will prevent the failures or mitigate their effects.
• Establish a culture of safety throughout the hospital. This accreditation standard became effective January 1, 2009, although its purpose and expectations were publicized for over a year in advance.

In my JAMA letter to the editor of July 22, 2009 entitled " Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" ( link ), I point out that the Hold Harmless and Defects Nondisclosure clauses signed by hospital executives in contracting for healthcare information technology (such as CPOE and EHR systems) are in violation of Joint Commission safety standards, as well as hospital executive fiduciary responsibilities to patients and clinicians. These clinical IT systems can and do cause medical errors and patient harm.

My letter was in response to Koppel and Kreda's March 25, 2009 article " Health Care Information Technology Vendors' "Hold Harmless" Clause: Implications for Patients and Clinicians ", JAMA. 2009;301(12):1276-1278.

I am interested in the Joint Commission's response to the issues I raise.

I await a response.

-- SS

7:08 AM

JAMA letter: "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards"

My letter "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" was published in JAMA yesterday. A preview of the letter can be seen here, or a full version here if you subscribe to JAMA.

The letter was in response to Koppel and Kreda's groundbreaking March 2009 JAMA article "Health Care Information Technology Vendors' Hold Harmless Clause: Implications for Patients and Clinicians."

The JAMA letter covered some of the same points I addressed extensively at my Drexel HIT website essay "Hold Harmless and Keep Defects Secret Clauses", including the major point that hospital executives signing such contracts are in violation of Joint Commission standards for conduct related to safety, and in violation of their fiduciary responsibilities towards patient and employee safety and freedom from undue liability. In the Drexel website essay I also noted that:

... these stipulations [hold harmless and gag clauses in contracts] further instantiate my observation that health IT lacks the rigor of medical science itself, its major Achilles heel.

Koppel and Kreda note in their JAMA reply to my JAMA letter that:

Dr Silverstein's letter adds context to our Commentary on HIT vendors' self-protective "hold harmless" clauses while introducing an important discussion about hospitals' and vendors' possible violations of Joint Commission standards. We agree with Silverstein about the misapplication of the standard business software contracting model.

Of interest, the American Medical Informatics Association (AMIA) had authored a reply to Koppel and Kreda quite different than mine, which for a time appeared on their national website (www.jamia.org) but was later withdrawn apparently due to concerns that such a letter might be viewed as an official organizational position. It was entitled "Response to Commentary in JAMA -- Ross Koppel, David Kreda" and can be read in its entirety here.

The AMIA response piece concluded:

"While we support increased transparency around error disclosure, the belief that the best approach to increase the safety and effectiveness of EHR systems is by legal regulation of system vendors is misplaced. Such an approach would stifle innovation and not achieve the desired goals. At a minimum equal attention needs to be given to the role that provider organizations bring to configuration, management and oversight of the software and related processes."

In fact, Koppel and Kreda addressed the provider side issues extensively in their article.

Of interest, JAMA did not publish the AMIA response but instead published mine. Perhaps it's because JAMA felt I had something important to say, as opposed to simply making excuses for HIT vendors and valuing prevention of "stifling of innovation" over hospital leadership's safety and fiduciary obligations to patients and staff.

"The belief that the best approach to improving HIT safety is via regulation is misplaced?" (Misplaced how, exactly?) Tell that to the airline or public transit or pharma or the medical device industries. Or to the public whose care is increasingly dependent upon these HIT systems.

It is my firm opinion that "innovation" done recklessly, in secrecy, without accountability, and via exploitation is not innovation at all.

-- SS

July 23 addendum:

Dr. Koppel has forwarded to me a letter he and Mr. Kreda submitted to AMIA in response to AMIA's aforementioned critique of his March 2009 JAMA "Hold Harmless Clause" article. Koppel and Kreda's letter, "On the AMIA Response to Commentary in JAMA by Ross Koppel and David Kreda" can be read here (MS Word .doc format).

Highlights:

... Where the AMIA authors disagree with us is the emphasis placed on errors produced in the coupling. [The coupling of healthcare organization and software, i.e., alterations and customizations beyond the control of the software vendor - ed.] We say a vast number or errors are generated in the marriage. But they say we have essentially ignored how many errors are created by doctors and hospitals seeking to consummate their relationship with HIT systems in situ ...

... A brief recap of our JAMA commentary seems in order. We wrote about: (1) the HIT vendor “non-disclosure” clauses that prevent clinicians from sharing information about errors generated from faulty software; (2) the clauses that remove all vendor responsibility for errors in their systems – and place all responsibility on clinicians and hospitals (the “hold harmless/learned intermediary” clauses); (3) the need to protect vendors from responsibilities for errors introduced when hospitals implement HIT or when untrained or incompetent clinicians use the HIT; and (4) the need for more balanced contracts that are fair to clinicians and hospitals ...

... Given that we addressed the non-software issues we are said to have ignored, we are not sure why our JAMA commentary earned the response it received on official AMIA letterhead. We hope, therefore that this letter can further a longer conversation about the many ways to make clinical IT software and its implementation better. Nonetheless, we stand by our statement that the imbalance in incentives we described in our JAMA Commentary is a structural obstacle that on balance hurts improving the clinical part of clinical IT.

Read the whole thing at the link above. (I placed Koppel and Kreda's response to AMIA on my faculty server. The response, to the best of my knowledge, was not published by AMIA itself.)

-- SS

7:06 AM

Irish Physicians Opt Out of Vital Patient Maintenance Care, Refuse to Release Records; Court Agrees

Well, no, actually. Irish physicians did not opt out of "maintaining" the healthcare of patients and refuse to release their medical records. Even imagining such an event is absurd.

IT providers in Ireland did, however, opt out of caring for the HIT of 180+ hospitals and releasing the source code so others could do it:

HSE fails in bid to secure IT servicing for 180 hospitals

By Tim Healy

Thursday July 16 2009

The HSE [Health Service Executive - ed.] has failed to get a High Court order compelling a company to continue providing vital computer maintenance services for 180 hospital and other sites around the country.

Ms Justice Mary Laffoy also refused to grant an injunction requiring the company, Eamon Keogh, trading as Keogh Software, Harold's Cross, Dublin, to temporarily release source codes necessary for someone else to maintain and fix the computer system's software.

[In other words, traditional business computing customs of source code secrecy even in face of software orphancy shall apply - quite inappropriately - to healthcare, and providers and patients be damned. - ed.]

The system is used by A&Es, radiology departments, HSE billing services as well as in environmental health areas and "parliamentary affairs" of the HSE.

Keogh Software, which laid off all its staff providing the service on May 29, undertook to maintain the service until yesterday's judgment.

The HSE had sought an injunction requiring it to continue to provide the service pending full court proceedings.

Ms Justice Laffoy ruled that the issue of the release of the software source codes should be dealt with under an independent resolution procedure set up to deal with this eventuality.

[By that time, the hospitals will have been forced to return to manual methods and then replace the systems, or run the risk of chaos and patient harm from defective software, assuming it functions at all - ed.]

The judge also turned down a cross-application from Mr Keogh for an injunction requiring the HSE to pay for work done under a new fee agreement entered into by the parties on April 3 last.

She also dismissed his application for an injunction waiving a HSE requirement that he produce a tax clearance certificate prior to payments being made.

When the High Court heard applications from both sides last month for their respective injunctions, the judge was told the dispute was precipitated when operational problems were experienced in Naas Hospital's radiology information system [not an unimportant system - ed.]

The HSE claimed Mr Keogh failed to respond properly to these while he (Keogh) claimed they were denied access to the system by the HSE [vendor denied access to malfunctioning RIS software needing remediation? I simply find that hard to believe - ed.]

hnews@herald.ie

- Tim Healy

One wonders who will be held accountable if this unremediated, defective software results in patient harm or death. (I, however, doubt it will be the IT vendor.)

Thus are the dangers of hospitals becoming dependent on an IT industry privileged and accomodated to the point of having no accountability (as in the U.S. as detailed by Koppel and Kreda in JAMA here). Thus are also the dangers of hospitals becoming dependent on proprietary HIT, and/or not having the expertise nor the source code required to fix bugs and perform maintenance themselves.

I add that nearly our entire country is about to go that route.

But at least the software will be "certified" by the fierce watchdog group and safety advocate, the CCHIT.

Fierce to its critics and to its own organizational safety, that is (HIMSS, CCHIT's parent organization, is currently seeking to have CCHIT declared the monolithic force for HIT 'certification' in the United States).

-- SS

11:10 AM

Complacency and Healthcare IT: Who is Taken More Seriously on Risk, A CMIO or A Public Transit Authority Doctor?

In this post I make a very shameful comparison. Shameful to the healthcare industry, that is, and coming from an unusual perspective due to my diverse professional background.

I received quite interesting comments from a number of informatics colleagues regarding the linked patient's account of Health IT mayhem at "A Most Interesting Patient Account of Misery by EHR". The comments suggested that patient's account was not unusual.

Example:

Without being specific I can say from first hand information that this is not an isolated incident... the horrific experience is unfortunately in my direct experience typical.

and this:

... As you know, I’ve been in the HIT business, advocating for full integration of computing into clinical care, for more than three decades. The upshot, though, is that this country’s hospitals are not ready for wholesale automation of even the most rudimentary kind (such as using barcodes in clinical settings), much less a real EMR. I’d give it another 10-15 years ... before even considering advocacy for much in the way of EMRs. Not that there are EMRs we should advocate for now, in any case.

and this:

This hits home, I hope this gentleman keeps telling his story. He is one of the lucky ones that "lived to tell". These are the stories no one believes until it happens to them or a loved one ... He would be saving lives if he talks. I know the retaliation is hard to swallow. I lost my job, but walked out with dignity because I know that I did the right thing. This was such a traumatic event for him and he was one of the lucky ones who were coherent enough to know that something was wrong.

My colleagues are afraid of giving specifics largely due to fear of reprisal from their healthcare and health IT employers. Health IT chaos, though, is clearly more widespread than commonly reported.

Yet in the U.S. in 2009 we find ourselves poised to rapidly spend $20 billion, more than the annual budget of NASA (at $18.7 billion), on these unproven technologies.

Now, a little history from my heterogeneous past:

After a 1990 subway accident in Philadelphia that killed several people and injured hundreds, at a time when I was Medical Programs Manager [of preventive programs] and Medical Review Officer for the regional transit authority SEPTA (pre-informatics), I became sensitized to the potential outcomes of complacency. As I wrote here, some of the the factors contributing to the accident involved complacency and the ignoring of medical advice by non medical personnel.

Yet, the National Transportation Safety Board (NTSB) came in and investigated thoroughly. Improvements were made.

Has something similar ever occurred after an HIT failure?

It always puzzled me why my concerns about health IT problems, dating from my time as a hospital-based Chief Medical Informatics Officer (CMIO) in the 1990's, seemed to raise little concern among the IT and hospital administration and even among some of the hospital physicians themselves. It still puzzles me why my colleagues in active CMIO roles report the same problems in 2009.

It concerns me greatly that HIT is entirely unregulated as its devices become far more complex, and more intrusive in the "biochemical pathways-like" organizational complexities of healthcare. It concerns me that HIT vendors have the best environment of any healthcare vendor: freedom from liability and accountability, and freedom from defect disclosure. It concerns me that hospital executives have agreed to such terms, I believe violating both their Joint Commission safety standards obligations and their fiduciary responsibilities.

As a hospital CMIO observing profound HIT difficulties, it was as if I was supposed to simply acquiesce to the chaos in a medical ICU, in a cardiac catheterization lab, medical clinics, etc. caused by HIT design and implementation deficiencies. It was as if the reaction to my detailed accounts of issues putting patients at risk was that I was simply not a 'team player.' The complacency was palpable. The behaviors consistent with a belief that the IT personnel were wizards, exempt from the scrutiny afforded to mere mortals, was equally palpable.

It was jarring and bizarre. In fact, being a CMIO was more jarring than my earlier physician role in the Philadelphia transit authority, where I sometimes had to deal with very troubled vehicle operators with substance abuse problems and aggressive, sometimes abusive and very scary Philly union officials.

As an example of what I dealt with in that environment, I scanned a 1988 SEPTA transport workers union newsletter whose cover shows a drawing of an injured employee on crutches and a Donald Duck figure with a stethoscope representing the Medical Department physicians, holding a note telling the ostensibly crippled employee to return to work. The newsletter cover is at this link (jpg) and below.

(click to enlarge)

Note the text about the medical department and the duck cartoon on the right depicting the doctors ("quack, quack").

In retrospect, I felt far less uncomfortable as a physician in the mass transit environment than I did as a CMIO at a major hospital. I did not expect much in the way of rigor and science from a transit agency and transit union leaders.

Remarkably, though, I also never feared retaliation or being fired for pointing out potential safety problems. Doing so, in fact, was taken quite seriously, by the Medical Director, the GM's office, Industrial Relations, the system Safety Officer, even the unions when presented the cold, hard facts. Never as Medical Programs Manager and Medical Review Officer was I ignored, as I was as a hospital CMIO.

I felt less comfortable as a hospital CMIO than in the mass transit authority, as I expected a lot more from hospital leadership ... and still do.

On the other hand, I respected the union leaders' directness and unabashed defense of their membership.

Physicians can learn something from them in regards to defense of patient care, and defense of their own profession.

My writing style has, in part, certainly been informed by past interactions with TWU, UTU, BLET, BRS and other transit union leaders and members.

-- SS

Addendum Apr. 18:

Although the causality of this terrible accident just one day after my post above is yet to be determined, I am often reminded of the public safety aspects of my prior line of work in ensuring fitness for duty of public servants in safety sensitive roles:

Sat, Apr. 18, 2009
Man struck, killed by SEPTA bus

By DAVID GAMBACORTA
Philadelphia Daily News

Milton Boneta cheated death seven months ago when he was struck by a SEPTA bus in his wheelchair at 8th Street and Girard Avenue. Fate revisited him in cruel fashion at the same intersection yesterday. This time, he was not as lucky.

Police said the Route 47 bus crushed Boneta, 61, as he crossed 8th Street in his motorized wheelchair at about 4:15 p.m. Based on the reactions of witnesses and the grisly scene, there was no chance he could have survived this accident ...

"The operator told me to check for a pulse or to see if he was breathing," [a witness] said, adding that his body clearly was too badly mangled for any lifesaving efforts.

Remembering what I used to do in public transit vs. the inability to perform a similar function as a CMIO in hospitals brings into focus the absurdity of allowing IT personnel to have a veto on issues that concern patient care and safety. (As the head of the Division of Biostatistics and Bioinformatics of a major medical center who had his staff review my HIT site recently wrote me, he "could not imagine any reasonable individual" - i.e., hospital executive - allowing that situation to occur, and found it "downright scary.")

Hospitals can cover up and bury their mistakes, especially when related to the relatively esoteric issues of HIT dysfunction, so perhaps their attitudes can be more cavalier than in the transit industry.

-- SS

7:52 PM

Will The True Incidence of Healthcare IT-Caused Patient Adverse Outcomes Please Stand Up?

The article Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians, Ross Koppel and David Kreda, Journal of the American Medical Association, 2009; 301(12):1276-1278 (JAMA) has caused much discussion in healthcare IT circles.

I have become aware of discussions centered on issues such as:

• The factors besides vendor design flaws and defects that contribute to the unsafe and ineffective use of health information technology,

• The degree of effect caused by end user organization customizations,

• whether a focus on legal or regulatory action is misplaced

• Whether such regulation could "stifle innovation", and

• Other interesting and stimulating related issues.
  

These discussions miss the forest for the trees, unfortunately.

They are all speculation.

I could just as easily - as a thought experiment - argue and rationally support a point of view that vendor defects, shortcomings, ill conceived user interfaces etc. are the greatest cause of HIT problems, that a sole focus on regulatory action is the best path, and that regulation would not stifle innovation but promote it by forcing complacent, lazy companies protected by the current status quo to become competitive, to hire the very best and brightest and most experienced who they now forgo as "too disruptive, too expensive, lack the latest programming skills", etc.

None of this speculation really matters in the big scheme of things.

What does matter is the fact that we now have before us a "grand confounder" - the anechoic effect caused by vendor contracting - that throws into doubt existing assumptions about HIT-caused errors.

Who among us can now say what the number of physician observed defects really is, what the rate of HIT error really is?

I've had several of my colleagues already tell me since the Koppel article that they know of HIT caused errors and even patient adverse consequences, but they are afraid to speak out. What is the morbidity and mortality change associated with use of HIT vs. paper?

Who really knows?

There is a significant, perhaps high likelihood that the current state of HIT contracting, and the muting effect it creates, combined with fear of retaliation by potential objective HIT reporters (a.k.a. whistleblowers) makes any such estimation highly questionable at best.

Speculation is irrelevant. What we need is a return to the rigor of medicine - to science - in HIT itself.

That can only happen in an environment where users are free(er) to share their observations and findings about HIT problems.

Such one-sided, safety adverse HIT contractual clauses must end.

-- SS

3:15 PM

This Former Chief Medical Informatics Officer is Feeling a Bit Betrayed

In thinking further about the "hold harmless" and "defects gag clause" originated by Health IT vendors and agreed to by hospital executives as I described at Have Hospital Executives Violated Their Fiduciary Responsibilities by Signing Such Contracts?, I can state I feel a sense of (past) betrayal.

Only now thanks to a Penn sociologist and a software consultant (plus the fortitude of JAMA, under some criticisms recently on other matters, in publishing this article) do we formally find out that hospitals have been literally "dumping" on physicians by signing contracts with the HIT vendors leaving the docs "holding the bag" for software errors and malfunctions, and gagging their organizations from openly talking about defects and problems. In other words, physicians hold the risk, everyone else holds the money.

Actually, since EMR mostly benefits the payers, I'd more correctly say hospital administrations have largely sold physicians down the river, an act that echoes of contempt and betrayal let alone breach of fiduciary responsibility and the Joint Commission standards I believe apply as in the post linked above.

It's not as if hospital administrations cannot negotiate these issues, nor are they forced to sign such provisions if vendors refuse to negotiate. They could send such vendors out the door. If this had been done as a routine by hospital executives, the health IT vendors would have been forced to give in years ago. Health IT was and is not mandatory for operations; the latest survey in NEJM indicates only ~9% of hospitals are using EMRs.

I also believe possible claims of ignorance and/or "we didn't read the fine print" don't fly. Hospital execs have the responsibility and duty to research such issues and read the fine print, or at the very least counsel did. In effect, at best the spinelessness of hospital administrations over the years may have spoiled the vendors to expect such concessions. (One also wonders about special "incentives" that might make hospital administrations weaker than they might otherwise be on such issues.)

Now I better understand perhaps why as CMIO/Director of Informatics at Christiana Care Health System in the late 1990's I never got to see the HIT contracts. I likely would have been a lot less eager to try to "sell" the EMR idea to the medical staff if I had been aware of the "vendor held harmless" provisions they faced if a software design problem or glitch in these immensely complex devices contributed to patient harm. I also feel betrayed in my CMIO role by not being informed of these contract provisions.

I wonder how many former and present CMIO's out there are now thinking along the same lines.

Ironically, as a Group Director at Merck Research Labs two years later I did review my department's informatics contracts, in fact I was required to, all several million dollars' worth, and in fact was involved in vendor negotiations (I had a personal grant of authority of $100,000 for smaller contracts). Pharma truly reveals hospitals for the IT backwater they are.

Finally, there appears to be a mainstream media boycott of the Koppel/Kreda article. As of 1:30 PM EST March 26, Google news shows almost no coverage except JAMA, ZDNet and Fox Business News. With Google web search, I find mostly copies of the U. Penn press release, and links to a few blogs, including this one.

I've previously noted this fascinating, Google-revealed phenomena about media noncoverage of politically inconvenient stories.

I've contacted the WSJ who printed my editorial letter on Health IT last month. Perhaps they'll get the scoop on the issues raised by Koppel and Kreda.

-- SS

10:19 AM

Health IT "Hold Harmless" and Defects Gag Clauses: Have Hospital Executives Violated Their Fiduciary Responsibilities By Signing Such Contracts?

July 2009 - Note: also see my letter to the editor in JAMA on this same topic, "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards", published July 22, 2009, available online at this link.

Regarding healthcare IT "Hold Harmless" and Defects Gag Clauses as revealed by the JAMA article Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians by Koppel and Kreda:

Have hospital executives violated their fiduciary responsibilities by signing such contracts, and violated Joint Commission standards of hospital leadership conduct as well?

Fiduciary (fidOO'shēe"rē), in law, a person who is obliged to discharge faithfully a responsibility of trust toward another. Among the common fiduciary relationships are guardian to ward, parent to child, lawyer to client, corporate director to corporation, trustee to trust, and business partner to business partner. In discharging a trust, the fiduciary must be absolutely open and fair. Certain business methods that would be acceptable between independent parties dealing with one another “at arm's length” may expose a fiduciary to liability for having abused a position of trust.

Hospital management conduct is not bound by traditional business law only, just as physicians and other clinicians hold additional obligations. In both cases, obligations go beyond that of, say, a manager or worker at a McDonald's or a Wal-Mart. In healthcare there are "special" third parties involved with critical rights and responsibilities, namely, patients and clinicians.

At Health Care Information Technology Vendors' "Hold Harmless" Clause I expressed great concern about the remarkable revelations in Koppel and Kreda's expose of arguably unethical and clearly inexcusable contracting practices by healthcare IT producers and vendors.

The vendors have declared themselves off limits from liability even if patients die as a result of software defects and malfunctions, pushing that liability onto clinicians. Vendors have simultaneously declared themselves the Ministry of Information, Soviet style, on such defects.

I also expressed my concern that the contractual suppression of information dissemination on health IT problems and defects may be one reason websites on health IT difficulties, such as the site I started in 1998 (in fact cited by Koppel and Kreda) remain uncommon on the Web. This is despite my documentation of continued, ongoing, world wide interest in this topic (see my 2006 AMIA abstract on this issue here, PDF, and poster here, PPT).

It is not just the vendors who may be acting against the best interests of medical science and patient safety, however.

It also seems to me that hospital executives, boards and counsel have fiduciary responsibilities, as well as obligations under principles of due diligence, Joint Commission and other regulatory guidelines, etc. to protect not just patients from defective technologies but also to protect their staffs from unfair risks and legal liabilities. I note that these health IT contracts have apparently been signed willingly by hospital executives, against the best interests of patients and medical staffs. Nobody is holding a gun to their heads, and nobody is forbidding negotiation of terms.

As a former CMIO/Director of Informatics I would never have signed such a contract. Period. (Of course, CMIO's and Directors of Informatics don't generally sign or even see health IT contracts, as they are Chiefs and Directors of Nothing.)

Have hospital executives, boards of directors and counsel been violating their responsibilities and obligations every time they've signed a healthcare IT "hold vendors harmless, it's all on your docs" and "shhhh! keep the defects secret" contract? Have they abused their positions of trust?

NIH research leaders and grant reviewers, as an example, consider seriously any problems with research that might place not just research subjects but also investigators at risk, medically, legally and otherwise. I perform this function on NIH study section panels.

Let's look at the Joint Commission Hospital Accreditation Program Leadership Chapter, and its standards for hospital leadership (link, PDF):

Leadership
LD.01.03.01

Standard LD.01.03.01
The governing body is ultimately accountable for the safety and quality of care, treatment, and services.

Rationale for LD.01.03.01
The governing body’s ultimate responsibility for safety and quality derives from their legal responsibility and operational authority for [organization] performance. In this context, the governing body provides for internal structures and resources, including staff, that support safety and quality.

The governing body has a legal responsibility for safety and quality, not just a moral obligation. One of the "internal structures" is healthcare IT that is safe and effective and that does not expose patients or staff to undue risks.

How does signing "hold harmless" and "defects gag order" clauses with an HIT vendor serve such a purpose, exactly?

Hospital executives know, should know, or should have known that such provisions would remove incentives for health IT vendors to produce the best products and to correct deficiencies rapidly, thus increasing risk to patients and clinicians.

Elements of Performance for LD.01.03.01
5. The governing body provides for the resources needed to maintain safe, quality care, treatment, and services.

One of those resources is health IT.

Standard LD.02.01.01
The mission, vision, and goals of the [organization] support the safety and quality of care, treatment, and services.

Rationale for LD.02.01.01
The primary responsibility of leaders is to provide for the safety and quality of care, treatment, and services. The purpose of the [organization]’s mission, vision, and goals, is to define how the [organization] will achieve safety and quality. The leaders are more likely to be aligned with the mission, vision, and goals when they create them together. The common purpose of the [organization] is most likely achieved when it is understood by all who work in or are served by the [organization].

How is a contract with an HIT vendor that calls for hiding defects in health IT and exposing staff to liability for defects in same serving the above purposes?

Standard LD.02.03.01
The governing body, senior managers and leaders of the organized medical staff regularly communicate with each other on issues of safety and quality.

Does that include communication on health IT defects? Can a medical staff member ask to see a database of such defects when the hospital has signed a nondisclosure of defects agreement with an HIT vendor?

Rationale for LD.02.03.01
Leaders, who provide for safety and quality, must communicate with each other on matters affecting the [organization] and those it serves.

I ask the same question as above.

Standard LD.03.01.01
Leaders create and maintain a culture of safety and quality throughout the [organization].

Safety for whom, exactly? Patients, or patients and staff?

How is exposing professional staff to undeserved liability from defective health IT serving the creation of a culture of safety and quality for them? How is suppressing information on health IT defects and problems helping patient safety and care quality?

How is lack of seeking informed consent on health IT use from patients whose care is mediated by health IT devices with known but undisclosable defects creating a culture of quality?

How is hiding such defects creating a culture of quality in the community's other hospitals, that may be considering purchase of the very same health IT?

Standard LD.03.04.01
The [organization] communicates information related to safety and quality to those who need it, including staff, licensed independent practitioners, [patient]s, families, and external interested parties.

Rationale for LD.03.04.01
Effective communication is essential among individuals and groups within the [organization], and between the [organization] and external parties. Poor communication often contributes to adverse events and can compromise safety and quality of care, treatment, and services. Effective communication is timely, accurate, and usable by the audience.

Are physicians and nurses explicitly informed by administration that clinicians are liable for bad outcomes due to software problems? Are they informed of the gag clause? Are patients informed of unremediated health IT defects existing at time of service?

This standard seems a veritable smoking gun regarding breach of fiduciary responsibility and Joint Commission obligations when hospital leadership signs agreements specifically excluding the sharing information about health IT defects and complaints. It is already known that hospitals maintain lists of health IT defects, some in the thousands of items. A number of the defects rise to the level of creating considerable risk to patients, and nobody is in a hurry to remediate them. (See my proposed although somewhat tongue in cheek "HIT Informed Consent" that describes some of these known defect categories here).

Standard LD.04.04.03
New or modified services or processes are well-designed.

... 3. The hospital's design of new or modified services or processes incorporates: Information about potential risks to patients.

4. The hospital's design of new or modified services or processes incorporates: Evidence-based information in the decision-making process. Note: For example, evidence-based information could include practice guidelines, successful practices, information from current literature, and clinical standards.

How does the contractual inability to communicate about health IT defects, which its executives willingly sign, serve this purpose?

Standard LD.04.04.05
The [organization] has an organization-wide, integrated [patient] safety program.

... 12. The hospital disseminates lessons learned from root cause analyses, system or process failures, and the results of proactive risk assessments to all staff who provide services for the specific situation.

Disseminates lessons learned, except when the HIT contract they've signed with a vendor forbids it, that is.

The practices of the health IT industry, and the dealings of the hospital leadership with that industry, may in fact be a scandal of national (or international) proportions.

I urge physicians and concerned others reading this to read the Univ. of PA press release "Why Are Healthcare Information Manufacturers Free of All Liability When Their Products Can Result in Medical Errors?" here, obtain the JAMA article by Koppel and Kreda, and call their congressional and other representatives to have these self-serving industry practices that ignore protection of patients and practitioners from undue jeopardy stopped.

I also believe any clinician under lawsuit related to hospital HIT malfunction, and/or patients harmed, should consider suit against the management that signed the contracts allowing the defective IT's entry into the hospital and mandated clinicians to use the HIT.

I, for one, already have begun discussing these issues with my representatives in Washington, and they've expressed great surprise at these revelations.

-- SS

2:16 AM

Health Care Information Technology Vendors' "Hold Harmless" Clause - The Largest IT Industry Abuse Ever?

Dear fellow physicians, nurses and other clinicians:

You thought frivolous medical malpractice suits were a problem?

Guess what:

It's worse. Along with your patients you are nonconsented beta testers and experimental subjects of the health IT industry, and potential victims of the computer industry's arrogance and dysfunction.

In the remarkable article Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians, Ross Koppel and David Kreda, Journal of the American Medical Association, 2009;301(12):1276-1278, we learn that:

Healthcare information technology (HIT) vendors enjoy a contractual and legal structure that renders them virtually liability-free—“held harmless” is the term-of-art—even when their proprietary products may be implicated in adverse events involving patients. This contractual and legal device shifts liability and remedial burdens to physicians, nurses, hospitals, and clinics, even when these HIT users are strictly following vendor instructions...HIT vendors are not responsible for errors their systems introduce in patient treatment because physicians, nurses, pharmacists, and healthcare technicians should be able to identify—and correct—any errors generated by software faults. [Yes - we're all knowing magicians with the power to read minds, infer incorrect lab values via therapeutic touch, and possess encyclopedic knowledge in our heads at all times. This raises the question: if we are that omniscient to be able to identify and correct software faults with 100 percent accuracy to avoid patient harm, then why do we need electronic medical records at all? - ed.]

Also see the Univ. of Pennsylvania press release "Why Are Healthcare Information Manufacturers Free of All Liability When Their Products Can Result in Medical Errors?" here.

In the new Koppel and Kreda JAMA article we also learn that:

HIT implementations are massively complex, and are fraught with delays, errors, resistance, work process redesign, frustration, and outright failure. Healthcare facilities cannot predict the myriad scenarios in which software failures could result in patient harm and liability, and they are not likely to be knowledgeable a priori about frequent vendor updates.

We additionally learn that:

The significant disparity between buyers and sellers in knowledge and resources [about healthcare IT problems] is profound and consequential. Vendors retain company confidential knowledge about designs, faults, software-operations, and glitches. Their counsel have crafted contractual terms that absolve them of liability and other punitive strictures while compelling users’ non-disclosure of their systems’ problematic, or even disastrous, software faults.

[This is simply astonishing. In other words, health IT customers and users have a gag order imposed on them regarding software faults and defects, while clinicians -- through their ingenuity, their labor in finding defect workarounds, and their liability -- serve (as I've written) as captive beta testers and an insurance company for HIT vendors - ed.]

These observations are nothing short of astonishing. They do help explain, however, the near silence of hospitals and their executives regarding healthcare IT faults, an observation I made in this 2006 AMIA presentation about the scarcity of such information:

Access Patterns to a Website on Healthcare IT Failure (Abstract [pdf], Poster [ppt].)

The Joint Commission also made this observation in their Dec. 2008 Sentinel Events Alert on Health IT:

There is a dearth of data on the incidence of adverse events directly caused by HIT overall.

The new JAMA article may also explain why HIT is so often done so poorly as to present a mission hostile user experience, as I started to write about a decade ago at my healthcare IT difficulties website here, as I outlined in an eight part series starting here, as the American College of Physician Executives noted here, as the National Research Council noted here ("Current Approaches to US Healthcare IT are Insufficient"), and as many others noted as well:

Healthcare IT News (3/10, Merrill) reported, a survey conducted by the American College of Physician Executives found "that although more physician leaders are using healthcare information technology, they still find it clunky and unresponsive to their needs." The survey of 1,000 ACPE members "revealed that the biggest source of frustration is a lack of input from physicians when designing and implementing healthcare information technology systems. Many said involving clinicians at the planning stages would pre-empt many of the problems that crop up later." One respondent noted that "systems are chosen according to administrative criteria rather than what physicians need."

Without accountability, a manufacturer is unmotivated to produce quality products at the expense of profits. They become complacent and lazy. This is an excellent reason why major HIT applications are as abhorrent as they are and violate so many fundamental principles of human computer interaction and resilience engineering.

It can also explain why talent management within the vendors is biased against hiring medical informatics experts, who would resist intellectual laziness of their non-informatics profit oriented (and unaccountable) counterparts.

Koppel and Kreda note that such stipulations defeat patient safety efforts and are contrary to the principles of evidence based medicine. I can add that such stipulations are contrary to the principles of good engineering.

These stipulations further instantiate my observation that health IT lacks the rigor of medical science itself, its major Achilles heel. This is one reason why I believe a national HIT initiative at this point in time is going to be, as in the UK, nothing short of an expensive debacle.

The existence of "hold harmless" clauses and gag orders raises many questions:

• Clinical supervisors of other physicians are indeed practicing medicine. Are Health IT vendors in fact practicing medicine by cybernetic proxy via these IT systems?
• Aren't the vendors' own claims of revolutionary healthcare quality improvements mediated via EMR's, alerts and reminders, clinical decision support, etc., malfunctions of which physicians may be held liable, prima facie evidence that the vendors are in fact practicing medicine by proxy?
  
• Should not these purveyors of cybernetic (i.e., virtual) medical devices be held accountable for their products, as in the pharmaceutical and the non-cybernetic (i.e., physical) medical device industries?
  
• How did such a situation regarding critical healthcare devices arise?
• In what other healthcare or other technology intensive industries, if any, do similar conditions exist, and what are the repercussions?
  
• How long has this situation existed?
• Why is it tolerated by clinicians?
• Why is it tolerated by clinical leaders?
• Why is it tolerated by medical professional societies, such as the AMA, the ACPE, etc., supposedly representing their members' interests?
• Why is it tolerated by hospitals and their executive leadership and boards of directors?
• Why is it tolerated by IS departments in hospitals?
• Why is it tolerated by hospital general counsel?
• Are there possible civil tort/RICO (racketeering)/criminal implications regarding patients injured by defective health IT where defects were known but not disclosed?
• Is not such a protective arrangement prima facie evidence that this technology is indeed experimental, with patients and clinicians as unconsented experimental subjects?
  
• Why is it tolerated by our government?

Regarding the last point, the Obama administration has promised an atmosphere of national accountability and responsibility. Why, then, has it simultaneously employed the coercive force of government (payment penalties for HIT non adopters after the absurdly short period of five years from now, 2014) to push an exploratory medical device from an unaccountable industry of unproven ROI at a cost of tens of billions of dollars on to the medical profession? This reality raises another question as I suggested in my WSJ Letter to the Editor of February 18, 2009. I wrote:

Dear Wall Street Journal:

You observe that the true political goal is socialized medicine facilitated by health care information technology. You note that the public is being deceived, as the rules behind this takeover were stealthily inserted in the stimulus bill.

I have a different view on who is deceiving whom. In fact, it is the government that has been deceived by the HIT industry and its pundits. Stated directly, the administration is deluded about the true difficulty of making large-scale health IT work. The beneficiaries will largely be the IT industry and IT management consultants.

In other words, was the administration misled by the health IT industry? I believe it might have been.

As an example, Mr. Obama's healthcare IT policy campaign adviser per the WSJ Glen Tullman, CEO of HIT vendor AllScripts and Board member of the industry-created government contractor CCHIT ("Certification Commission for Healthcare IT"), probably didn't tell Mr. Obama his company was selling goods that did not function properly. (Here is a link to my organization's Civil Complaint against AllScripts, PDF). We apparently cannot know how many other organizations had their own complaints that might not have made it into litigation, due to the aforementioned gag orders. (Ironically, I found out about the lawsuit at my own organization only through an anonymous comment at the HIT gossip site HISTalk.)

Incidentally, by matter of pure speculation, I was not permitted involvement in that implementation despite having been a pioneering CMIO at a larger healthcare system years prior and the only formally educated medical informaticist at my organization. My writings on health IT dysfunction were well known to the IT staff and likely the vendor after a short web search; it would have been in the vendors' interests to keep me away from sales and implementation of known deficient health IT. Again, this is simply speculation.

On the other hand, I am aware of major healthcare organizations with "portfolios" of hundreds or thousands of issues and defects awaiting remediation, and CMIO's struggling against cavalier bureaucracies who want the doctors even in critical care areas to live with the problems, and vendors who are not in a hurry to fix their products.

Some of the problems rise to the level of critical with regard to patient safety. Under contract, the problems cannot be disclosed to the public, to patients whose care might fall under the aegis of these systems, or to other healthcare organizations seeking the same systems. I hope to be a plaintiff's witness when the inevitable lawsuits for patient injury place such capricious vendor, hospital and IT leadership on the witness stand.

Finally, in fairness the JAMA article discusses issues beyond the vendors' control such as misuse or poor training done by the host organization using the IT.

Possible remedies to the situation of unaccountability for the outcomes of HIT misdesign, malfunction and other defects are outlined in the article. See it or the press release at the above links if you lack JAMA access.

As I've written numerous times on this site, due to the implications and especially now due to the revelation that the scarcity of adverse events information related to HIT is probably by design, I favor stringent health IT regulation as in pharmaceutical IT.

Whatever happens, however, I know this. For the sake of patient safety:

This sorry, abusive and inexcusable travesty must end ... now.

Finally, to health IT vendors, as my early medical mentor, pioneering cardiovascular surgeon and educator Victor P. Satinsky, MD might have said:

If you can't take the heat of the responsibilities of clinical medicine, then get out of our kitchen.

-- SS

3:59 PM