Who Benefits? - Despite Data Breaches, Staff Cuts, Vulnerable Patients' Coverage Cuts, Transplant Program Probation, Multi-Million Dollar Executive Compensation Persists at UPMC

There are so many things wrong with US and global health care that it is easy to get lost in the details, and despair of finding solutions.  Keep in mind, however, that the intractability of many of the problems may be quite man made.  Many problems may persist because the status quo is so beneficial to some people.

The Current Troubles at UPMC

Consider, for example, the troubles that have recently plagued UPMC, the giant health care system in western Pennsylvania.  In the last month, the following reports have appeared.

Electronic Data Breach Affected 2200 Patients

On May 15, the Pittsburgh Tribune-Review reported,

Personal data may have been stolen from more than 2,000 UPMC patients by an employee of an outside company the hospital giant used to handle emergency room billing, the latest in a string of data thefts to hit Pittsburgh health companies.

Note that this was only the most recent data breach at UPMC,

 UPMC was the victim of a data breach last year in which Social Security numbers and other sensitive data from all 62,000 UPMC employees were stolen when thieves hacked into an employee database at the health system.

The confidentiality of patient records is a  major responsibility of health care professionals and hospitals.  Yet UPMC does not seem to be doing a good job in protecting such confidentiality.

UPMC Move to Cut 182,000 "Vulnerable" Elderly Patients from it Medicare Advantage Plan Challenged in Court

The Pittsburgh Business Times reported on May 21,

Health system UPMC will defend its decision to cut 182,000 seniors from its provider network at a Commonwealth Court hearing May 27 in Harrisburg.

The hearing will determine whether UPMC complied with a consent decree that was reached last year and intended to protect 'vulnerable' populations from fallout of the messy Highmark-UPMC divorce. The seniors have Medicare Advantage coverage through UPMC rival Highmark Inc., and most commercial contract relations between the two health care titans ended Dec. 31.

This doesn't sound like the "patient-centered" care UPMC boasts about on its website.

UPMC to Cut 3,500 Staff Via Buyouts

Modern Healthcare reported on May 26,

In Pittsburgh's fiercely competitive healthcare market, UPMC announced voluntary buyouts to reduce its labor costs.

The system—which has also cut its hospital capacity in recent months—offered 3,500 workers voluntary buyouts to 'achieve cost-savings for UPMC by adjusting our workforce to meet the demands of the healthcare marketplace,' said spokeswoman Gloria Kreps.

Not mentioned by UPMC spokespeople were the possible effects on patient care of cutting about 5% of the most experienced members of the UPMC workforce.

UPMC Attorneys Disqualified from Defense of Wrongful Death Case

The Pittsburgh Post-Gazette reported on May 30,

The law firm that represents UPMC in many civil matter was disqualified from a medical malpractice cast this week after a judge found that an attorney from Dickie, McCarney & Chilcote improperly spoke with and advised a witness.

This does not say a lot for how UPMC managers pick legal counsel and manage their seemingly many legal defenses.

UPMC Lung Transplant Program on Probation, Again

On June 2, the Tribune-Review reported,

A national organ-sharing group has put UPMC's lung transplant program on probation for a year, listing concerns about how the program handled donated organs. 

The United Network for Organ Sharing cited 14 cases in 2013 and 2014 when the hospital system accepted lungs that UPMC doctors later found could not be transplanted in intended recipients, said Dr. Jonathan D'Cunha, UPMC's lung transplantation surgical director.

UPMC kept the organs for other patients in UPMC Presbyterian in Oakland, an approach approved by regional organ procurement groups that supplied the lungs, D'Cunha said. But UNOS, a nonprofit that manages the American organ transplant system, objected to what it called 'an unusually high number of instances' of the practice.

Probation ordered by the board of UNOS and the Organ Procurement and Transplantation Network took effect Monday, according to UNOS.

D'Cunha said the transplant program remains fully operational but will be operating under a corrective-action plan.

This was not the first trouble that a UPMC transplant program has encountered.  As the Pittsburgh Post-Gazette reported,

This is  the second time UPMC has been placed on probation for a transplant problem.

In 2011, it was placed on probation ... after disease was transferred from a living kidney donor to a recipient.

Note that while the first instance of probation seemed to suggest competency issues, the latest one seems to be about ethical issues.  By transplanting kidneys into immediately available UPMC patients who may have lower priorities than other patients on the list, UPMC may be disfavoring patients from "outside," whose transplants, incidentally, would not generate much revenue for UPMC.

An editorial in the Post-Gazette suggested while UPMC "pleads ignorance" about these rules, "Western Pennsylvania's largest hospital network should have known better."

Just Another Bad Month?

Thus it was just another bad month at the office for UPMC management.  But UPMC management has had lots of bad months.  For example, since 2011, we have previously discussed
-  Fantastical musing by the UPMC CEO about health care run by computers, not doctors (look here)
-  Fantastical claims by UPMC in response to a lawsuit that is has no employees (look here)
-  Numerous malpractice cases filed against UPMC related to problems with its electronic medical records (look here, here, here, here)
-  Layoffs at UPMC due to problems with its electronic medical records (look here)
-  A lawsuit by the Mayor of Pittsburgh claiming UPMC should be stripped of its non-profit status (look here).  

The $6.4 Million CEO, and the Other Million Dollar Managers

One would think that these series of events, all in a short time, coupled with all these previous stories, might raise questions about who is running the institution, and what they are being paid.


Instead, however, the Pittsburgh Tribune-Review published a story on May 15, 2015, about just how well paid top UPMC managers continue to be.

UPMC's Jeffrey Romoff banked total compensation of $6.4 million two years ago, ranking the chief executive's pay among the nation's highest for nonprofit health leaders.

The 69-year-old Romoff was one of 31 employees of Western Pennsylvania's largest integrated health system to be paid more than $1 million in 2013,...

Romoff's 2013 pay, which included a base salary of nearly $1 million plus $5 million in incentives and deferred income, was down 3 percent from the previous year but well above the median compensation for a nonprofit hospital CEO.

The defense of Mr Romoff's compensation followed the same pattern we have discussed repeatedly. Justifications for exceedingly generous compensation for health care managers, particularly of non-profit hospital, often are superficial, limited to talking points we have repeatedly discussed, (first  here, with additional examples of their use here, here here, here, here, here, here, and here.)  These are:
- We have to pay competitive rates
  We have to pay enough to retain at least competent executives, given how hard it is to be an executive
- Our executives are not merely competitive, but brilliant (and have to be to do such a difficult job).

So,

UPMC spokeswoman Susan Manko wrote in an email that compensation for the company's executives is tied to performance that is based on 'clearly defined goals, including quality of care, community benefit, financial measures and other key factors.'  Pay takes into consideration what other industry executives are making, she noted.

Thus,, by inference, she implied Mr Romoff's brilliance in meeting the "clearly defined goals," and overtly stressed the competitive rates talking point.

However, the clearly defined goals including putting the transplant on probation twice, having several electronic data breaches, trying to discharge the most experienced employees, being sued for being a non-profit in name only, being subject to numerous malpractice suits, and having one law firm used to defend one of these suits disqualified,  and dumping hundreds of thousands of elderly, "vulnerable" patients?  Really?

A fair comparison was to other overpaid managers, not to the dedicated health care professionals who make the system work?  Really?

Also, as the Pittsburgh-Tribune Review reported on February, 2015, the Chairman of the Board of UPMC, Nicholas Beckwith, thinks Mr Romoff is a

brilliant leader and stood by the board's decision to pay Romoff $6.6 million a year, among the highest CEO salaries for nonprofits in the region.

Furthermore,

'When people ask me about his pay, I say, ‘What would you pay him?'' Beckwith said. 'If they're going to understand the brilliance of Jeffrey Romoff, they have to acknowledge there's no more effective leader in the nation than Jeff Romoff.'

So here was the "brilliance" talking point really writ large.  The most effective leader in the entire US?  Really?

At best, Mr Beckwith seemed to be only thinking about the financial performance of UPMC, rather than its clinical performance, its ethical performance or its effects on patients and their outcomes. But then again, Mr Beckwith might not know much about that,

Beckwith worked as a salesman for Murrysville-based Beckwith Machinery and eventually became its CEO.

But one letter to the Pittsburgh Tribune-Review did suggest

Perhaps UPMC should consider offering buyouts to that group of egotists who inhabit the upper reaches of the U.S. Steel Tower. Then they could move to the next phase of life — old and wealthy.

Summary

So we have presented the recent unpleasantness at UPMC as emblematic of some of the types of unpleasantness that afflict US (and global) health care, including threats to patients' confidentiality and access, problems with quality of health care, possible ethical misconduct, ill treatment of experienced health care staff, etc.  Yet consider that despite these multiple failings, and a history of similar failings going back years, the top hired managers of the non-profit hospital health care system are being made millionaires many times over.  They clearly are benefiting greatly from the current system, regardless of whether the system benefits others.  In fact, one begins to wonder if they are paid well despite the current problems, or because of them?

So one lesson is: every time some new version of health care dysfunction appears in public, think not only about its bad effects on patients, professional values, the public, etc.  Think about who is gaining from the current bad status quo.

 For a slightly more specific lesson....  In a 2014 interview, corporate governance experts Robert Monks and Nell Minow, Monks said,

Chief executive officers' pay is both the symptom and the disease.

Also,

CEO pay is the thermometer. If you have a situation in which, essentially, people pay themselves without reference to history or the value added or to any objective criteria, you have corroboration of... We haven't fundamentally made progress about management being accountable.

The symptom and the disease have metastasized to health care, from huge for-profit corporations now also to even small non-profit hospitals.   Thus, like hired managers in the larger economy, health care managers have become "value extractors."  The opportunity to extract value has become a major driver of managerial decision making.  And this decision making is probably the major reason our health care system is so expensive and inaccessible, and why it provides such mediocre care for so much money. 

One wonders how long the people who actually do the work in health care will suffer the value extraction to continue?
As we have said far too many times - without much impact so far, unfortunately - true health care reform would put in place leadership that understands the health care context, upholds health care professionals' values, and puts patients' and the public's health ahead of extraneous, particularly short-term financial concerns. We need health care governance that holds health care leaders accountable, and ensures their transparency, integrity and honesty.

But this sort of reform would challenge the interests of managers who are getting very rich off the current system.

As Robert Monks also said in the 2014 interview,

People with power are very reluctant to give it up. While all of us recognize the problem, those with the power to change it like things the way they are.

So I am afraid the US may end up going far down this final common pathway before enough people manifest enough strength to make real changes. 

ADDENDUM (16 June, 2015) - This post was re-posted on OpEdNews.com. 

11:24 AM

Don't worry, your information's safe. Community Health Systems says data stolen in cyber attack: just a mere 4.5 million people affected this time.

I have often written about my observations of the generally unimpressive qualifications and capabilities of IT personnel, up to and including the CIO's, in healthcare settings (e.g., baccalaureate-level education in a doctoral and post-doctoral setting, usually no clinical or biomedical experience, no computer science background, no medical informatics background, and sometimes not even a formal management information systems education) compared to other sectors such as pharma and academia.  I've written about this as an impediment to health IT progress and to healthcare IT safety.

Now, I increasingly believe the healthcare IT backwater is becoming a downright societal threat, for another reason.  Yet another in my "don't worry, your information's safe" series (http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy):

Community Health Systems says data stolen in cyber attack

http://www.foxbusiness.com/industries/2014/08/18/community-health-systems-says-data-stolen-in-cyber-attack/
Published August 18, 2014
Reuters

U.S. hospital operator Community Health Systems Inc said on Monday personal data, including patient names and addresses, of about 4.5 million people were stolen by hackers from its computer network, likely in April and June.

The company said the data, considered protected under the Health Insurance Portability and Accountability Act, included patient names, addresses, birth dates, telephone numbers and Social Security numbers. It did not include patient credit card or medical information, Community Health Systems said in a regulatory filing.

It said the security breach had affected about 4.5 million people who were referred for or received services from doctors affiliated with the hospital group in the last five years.

If you're a department store, or a McDonald's, such breaches might be more understandable.  When you're a life-critical industry such as healthcare, and under HIPAA regulations regarding privacy and confidentiality, these incidents are increasingly unforgivable.

The FBI warned healthcare providers in April that their cybersecurity systems were lax compared to other sectors, making them vulnerable to hackers looking for details that could be used to access bank accounts or obtain prescriptions, Reuters previously reported.

Again, inexcusable.  Health IT amateurs (and, of course, the Management Recruiting Firms that hospital retain to find them, who are equally clueless about what it takes to be a health IT expert) don't just endanger your health; they endanger your economic well being, even when you're not ill.

The company said it and its security contractor, FireEye Inc unit Mandiant, believed the attackers originated from China. They did not provide further information about why they believed this was the case. They said they used malware and other technology to copy and transfer this data and information from its system.

Just great.

Community Health, which is one of the largest hospital operators in the country with 206 hospitals in 29 states, said it was working with federal law enforcement authorities in connection with their investigation into the attack. It said federal authorities said these attacks are typically aimed at gathering intellectual property, such as medical device and equipment development data.

Oh. that's reassuring - our data's being stolen by honest thieves who would never, EVER think of selling the data to dishonest thieves who steal people's identities, and then money...

It said that prior to filing the regulatory document, it had eradicated the malware from its systems and finalized the implementation of remediation efforts. It is notifying patients and regulatory agencies as required by law, it said.

It also said it is insured against such losses and does not at this time expect a material adverse effect on financial results.

Oh, that's very nice.  Millions of people potentially put at risk, but insurance will cover for incompetence.

Perhaps the insurers should more critically evaluate the quality of work of the people they're insuring.

-- SS

9:56 AM

Why It's Crazy to Want Your Most Confidential Information Put into An Electronic Medical Records System

Besides the reasons I outlined in posts retrievable by these query links (link, link), there's this from ZDNet.com:

Microsoft warns of first critical Windows 8, RT security flaws

It's been less than a month since Windows 8 and Windows RT-powered Surface tablets were launched and went on sale, but Microsoft is already warning that the two next-generation operating systems contain critical security vulnerabilities that are due to be patched this coming Tuesday.

Among the various flaws, versions from Windows XP (Service Pack 3) all the way through to Windows 8 are affected, including versions of the Office suite, and versions of Windows Server. Released only in September, Windows Server 2012 requires patching to maintain maximum security.

The latest vulnerabilities include three critical security vulnerabilities for Windows 8, and one critical security vulnerability for the Surface-based Windows RT operating system. These flaws are considered "critical" and could allow remote code execution on vulnerable systems.

I note that Windows XP was released worldwide for retail sale on October 25, 2001, which was more than eleven years ago.  That security vulnerabilities are still being patched in 2012 is stunning.  Also, many enterprise information systems and most hospital clients (workstations) run on Windows-based servers and Windows installed local machines (UNIX, MacOS and other OS's are very rare on general-purpose hospital workstations).

From a Microsoft website here:

... The partners listed below are CCHIT 07/08 certified and fully utilize the Microsoft database and server platform.

Abraxas Medical Solutions	GE Healthcare
Allscripts	gMed
Aprima Medical Software Inc.	Greenway Medical Technologies
ASG Software Solutions	Henry Schein, Inc.
Eclipsys	McKesson
e-MDs	NextGen
GEMMS, Inc.	UroChartEHR
gloStream	Learn more about our partners

This partial list includes many very large HIT sellers.  There are many others as well.

By simple reckoning, it's likely we'll be seeing critical security vulnerabilities in Windows 8 - in 2023.

It goes without saying that these security problems will continue to be exploited by identity thieves, medical information merchants, and others with no rights to "protected" information.

In my opinion, the (still not yet realized) convenience of being able to have one doctor transmit your record to another, thus avoiding a FAX machine, the Postal Service or the telephone, and the trillion-dollar "solution" to the nearly non-existent problem of being found unconscious in some foreign land with no ID, no companions, and some hidden, critical medical condition not findable on physical exam and bloodwork, EKG, x-rays etc. that will cause death if not treated in minutes, is not worth the risk of having one's most private information spilled all over the Internet.

EHR's should not be accessible on networks beyond a physician's office or the robustly encrypted network of a hospital, and the information security personnel kept on very short leashes, for the foreseeable future.

I am unwilling to cede my own privacy to cybernetic utopians who ignore alarming evidence - plain to see at the aforementioned query links at the top of this post - nor can I in good faith recommend doing so to the public in 2012.

Considering the information in the many posts at the aforementioned query links (as here: link, link -- be aware you need to hit "older posts" at the bottom of each page to see all of them), that position is straightforward.

-- SS

11/9/2012 Addendum:

Also see my Oct. 2012 post "Computer Viruses Are 'Rampant' on Medical Devices in Hospitals."

-- SS

7:50 AM

Computer Viruses Are "Rampant" on Medical Devices in Hospitals

As if there weren't enough problems with hospitals as computing backwaters, now there's this:

Computer Viruses Are "Rampant" on Medical Devices in Hospitals

A meeting of government officials reveals that medical equipment is becoming riddled with malware.

Technology Review
Published by MIT
David Talbot
Wednesday, October 17, 2012

Computerized hospital equipment is increasingly vulnerable to malware infections, according to participants in a recent government panel. These infections can clog patient-monitoring equipment and other software systems, at times rendering the devices temporarily inoperable.

While no injuries have been reported, the malware problem at hospitals is clearly rising nationwide, says Kevin Fu, a leading expert on medical-device security and a computer scientist at the University of Michigan and the University of Massachusetts, Amherst, who took part in the panel discussion.

I note the seemingly universal refrain "no injuries have been reported" once more (see this query link to similar statements regarding IT malfunctions), which is irrelevant since reporting mechanisms for medical errors are noted to be deficient.

Software-controlled medical equipment has become increasingly interconnected in recent years, and many systems run on variants of Windows, a common target for hackers elsewhere. The devices are usually connected to an internal network that is itself connected to the Internet, and they are also vulnerable to infections from laptops or other device brought into hospitals.  [I note that it should be impermissible to connect "alien" machines to a hospital's network without authorization, and that attaining that level of security protection is not difficult - ed.]  The problem is exacerbated by the fact that manufacturers often will not allow their equipment to be modified, even to add security features.

In a typical example, at Beth Israel Deaconess Medical Center in Boston, 664 pieces of medical equipment are running on older Windows operating systems that manufactures will not modify or allow the hospital to change—even to add antivirus software—because of disagreements over whether modifications could run afoul of U.S. Food and Drug Administration regulatory reviews, Fu says.

In other words, let's run at high risk if it avoids the time and expense of FDA reviews that would ensure the equipment is safe and operates as expected with the software updates.

As a result, these computers are frequently infected with malware, and one or two have to be taken offline each week for cleaning, says Mark Olson, chief information security officer at Beth Israel.

It is unclear how the servers running the hospital information system, electronic health records systems, physician order entry systems etc. are immune to spread of the malware.

"I find this mind-boggling," Fu says. "Conventional malware is rampant in hospitals because of medical devices using unpatched operating systems. There's little recourse for hospitals when a manufacturer refuses to allow OS updates or security patches."

The worries over possible consequences for patients were described last Thursday at a meeting of a medical-device panel at the National Institute of Standards and Technology Information Security and Privacy Advisory Board, of which Fu is a member, in Washington, D.C. At the meeting, Olson described how malware at one point slowed down fetal monitors used on women with high-risk pregnancies being treated in intensive-care wards.

In its face, that is potentially catastrophic depending on the degree of "slowdown" and whether data is lost.

"It's not unusual for those devices, for reasons we don't fully understand, to become compromised to the point where they can't record and track the data," Olson said during the meeting, referring to high-risk pregnancy monitors. "Fortunately, we have a fallback model because they are high-risk [patients]. They are in an IC unit—there's someone physically there to watch. But if they are stepping away to another patient, there is a window of time for things to go in the wrong direction."

The reasons seem obvious to anyone who's had a serious malware infection on their PC.  I've only had one - a computer I bought at a fleamarket for $7 was so severely infected it was unusable for even basic tasks, and was resistant to virus removal.  I solved that problem by installing a fresh copy of the OS, immediately followed by all patches and the latest anti-malware software.

The computer systems at fault in the monitors were replaced several months ago by the manufacturer, Philips; the new systems, based on Windows XP, have better protections and the problem has been solved, Olson said in a subsequent interview.

This implies the older systems were running on Win 98 or earlier or an old version of Win NT.  Amazing.

At the meeting, Olson also said similar problems threatened a wide variety of devices, ranging from compounders, which prepare intravenous drugs and intravenous nutrition, to picture-archiving systems associated with diagnostic equipment, including massive $500,000 magnetic resonance imaging devices.

Olson told the panel that infections have stricken many kinds of equipment, raising fears that someday a patient could be harmed. "We also worry about situations where blood gas analyzers, compounders, radiology equipment, nuclear-medical delivery systems, could become compromised to where they can't be used, or they become compromised to the point where their values are adjusted without the software knowing," he said. He explained that when a machine becomes clogged with malware, it could in theory "miss a couple of readings off of a sensor [and] erroneously report a value, which now can cause harm."

I opine that harm could already have occurred; it just may not been recognized as such nor reported.  Disappearing data and other EHR failure modes known to have caused harm and/or deaths could be related to malware, for example.

... Malware problems on hospital devices are rarely reported to state or federal regulators, both Olson and Fu said. This is partly because hospitals believe they have little recourse. Despite FDA guidance issued in 2009 to hospitals and manufacturers—encouraging them to work together and stressing that eliminating security risks does not always require regulatory review—many manufacturers interpret the fine print in other ways and don't offer updates, Fu says. And such reporting is not required unless a patient is harmed. "Maybe that's a failing on our part, that we aren't trying to raise the visibility of the threat," Olson said. "But I think we all feel the threat gets higher and higher."

I note that health IT related problems are also rarely reported, with only one vendor being the exception (see my post on the FDA MAUDE voluntary reporting database here).  The reasons likely are not because "hospitals believe they have little recourse" - the real reasons may be fear, complacency and/or incompetence.

Speaking at the meeting, Brian Fitzgerald, an FDA deputy director, said that in visiting hospitals around the nation, he has found Beth Israel's problems to be widely shared. "This is a very common profile," he said. The FDA is now reviewing its regulatory stance on software, Fitzgerald told the panel. "This will have to be a gradual process, because it involves changing the culture, changing the technology, bringing in new staff, and making a systematic approach to this," he said.

Changing the culture would be nice, considering we are now entering a national rollout of complex enterprise clinical resource and workflow control systems anachronistically known as "electronic medical records."

In an interview Monday, Tam Woodrum, a software executive at the device maker GE Healthcare, said manufacturers are in a tough spot, and the problems are amplified as hospitals expect more and more interconnectedness. He added that despite the FDA's 2009 guidance, regulations make system changes difficult to accomplish: "In order to go back and update the OS, with updated software to run on the next version, it's an onerous regulatory process."

My comment is, if you can't take the heat of work in the real-world medical setting, if you cannot be part of the medical team, then get out of the clinic.  You're likely to do more harm than good.

John Halamka, Beth Israel's CIO and a Harvard Medical School professor, said he began asking manufacturers for help in isolating their devices from the networks after trouble arose in 2009: the Conficker worm caused problems with a Philips obstetrical care workstation, a GE radiology workstation, and nuclear medical applications that "could not be patched due to [regulatory] restrictions." He said, "No one was harmed, but we had to shut down the systems, clean them, and then isolate them from the Internet/local network."

He added: "Many CTOs [chief technology officers - ed.] are not aware of how to protect their own products with restrictive firewalls. All said they are working to improve security but have not yet produced the necessary enhancements."

Then why are they CTO's?  Is this the phenomenon of generic or underqualified managers rearing its head?

Fu says that medical devices need to stop using insecure, unsupported operating systems. "More hospitals and manufacturers need to speak up about the importance of medical-device security," he said after the meeting. "Executives at a few leading manufacturers are beginning to commit engineering resources to get security right, but there are thousands of software-based medical devices out there."

One can only wonder if others have done a Ford Pinto cost-benefit analysis and decided the costs of settlement from injured and dead patients is less than the cost of remediation.

-- SS

10:15 AM

Bad health IT and its effects on willingness of patients to share sensitive information

I call your attention to this video from the 2nd International Summit on the Future of Health Privacy where HC Renewal occasional contributor Dr. Scott Monteith, a psychiatrist, presents on how health IT damages the physician-patient relationship, the bedrock of good medicine, in one case via an inexcusable health IT defect.

The defect nearly cost a woman her good reputation - and her child - by "transforming" coffee drinking into solvent sniffing.

The video is here:  http://www.healthprivacysummit.org/events/2012-health-privacy-summit/custom-129-ec40d08a35f947e487f68a5f534a9e82.aspx

Dr. Monteith on how bad health IT damages trust.  See video at this link starting at 4:40.

Dr. Monteith starts at 4:40 when he is asked

"Do you feel HIT affects the willingness of patients to share sensitive information with providers?"

His answer is a definite "yes", and the video should be seen to understand his reasons, the largest one being the trust that is injured by this technology as currently (mal)implemented, failing to maintain privacy, data integrity, affecting doctor-patient interaction (e.g., due to poor usability), etc.

His two examples where HIT has injured trust, resulting in decreased willingness of patients to share sensitive information:

• A patient feared compromised privacy regarding psychiatric information (a fear that was certainly well-justified in view of ABC's recent expose of health IT breaches as I wrote about at my Sep. 14, 2012 post "A Reason to Refuse Use of EHR's in Your Health Care, and Demand Paper.")

• An error in EHR-generated record affecting a child custody battle, with a husband alleging unfitness of the mother due to substance abuse.  The EHR incorrectly showed a damaging diagnosis due to both a data mapping flaw (lumping multiple diagnoses under the same code) and a user interface flaw (permitting all of the diagnoses lumped under that code to not be seen, only the worst one) that transformed caffeine (i.e., coffee) overuse to "inhalant abuse."  

Stunningly, Dr. Monteith reported the error was not remediated even after several years.

As seen by the voluntary reports submitted by one of many HIT sellers (link), the only one that seems to do so, and some involuntary ones such as at this link, these issues are just the "tip of the iceberg." That exact phrase was uttered by a senior FDA official himself, reflecting known severe impediments to information diffusion on harms, as I reported at this link.

Yet the government (e.g., HHS's Office of the National Coordinator for Health Information Technology, ONC) and IT industry push this technology like candy, emphasizing largely unproven benefits and completely ignoring downsides such as damaged trust, damaged reputations that could have cost a woman custody of her child, and damaged bodies.

A video of an attorney personally affected by these issues is at this link:   http://www.healthprivacysummit.org/events/2012-health-privacy-summit/custom-137-ec40d08a35f947e487f68a5f534a9e82.aspx

-- SS

10:36 AM

A Good Reason to Refuse Use of Today's EHR's in Your Health Care, and Demand Paper

I've written before that health IT, including the technology and the social infrastructure in which it resides, is not ready for widespread diffusion.  Its widespread dissemination (on largely economic grounds) at this point in its development is premature, and is destructive.

So much, in fact, that I am considering demanding that any physician I see or hospital I visit use paper records, not any EHR they have available.

Think that extreme?  In the real world as it exists today, perhaps the notion that one should freely spill one's deepest confidences into an insecure EHR system is the extreme view.

The reason (aside from the risk today's clinical information technology presents):  yet another addition to my series of posts on health IT privacy breaches at this query link, this time from ABC News:

Your Medical Records May Not Be Private: ABC News Investigation

BY JIM AVILA (@JimAvilaABC) AND SERENA MARSHALL (@SerenaMarsh)

Sept. 13, 2012

Psychiatric Therapy Notes Get Shared Within One Health Care System; and Other Info Spreads on a Black Market

You walk into the doctor's office. They lead you to a private room and shut the door. The nurse enters writes on a chart (or maybe an iPad) and shuts the door. A doctor enters and shuts the door.

It all screams of privacy -- privacy you expect.

But what if you were to find out those medical records containing your private history, family history and medication history weren't so private after all?

Considering electronic breaches in other sectors, and the fact that hospitals' core competencies do not include computing or computer security, why would anyone expect privacy?

Julie, a lawyer from Boston, discovered that her sensitive health information was available to anyone who worked at the hospital.  (See video of Julie at this link).

For an attorney who might be involved in nasty litigation, that is not a career-enhancing prospect.

"My expectation was that my records were going to be private, especially my therapy records," Julie said. "And if another doctor wanted to see my records, they'd ask me and then I'd give my authorization for them to view my records if they needed to see them."

In an ideal world not pervaded by inappropriate leadership of health IT and incompetence, perhaps.

Julie, who requested her last name not be used, was diagnosed with in her late teens and began seeing a psychiatrist in 2002 after speaking with her primary care physician.

She, like millions of Americans, thought her conversations with her psychiatrist were confidential.

"I thought I had protection under HIPAA (the Health Insurance Portability and Accountability Act) for my psychotherapy notes to be private and I thought only my psychiatrist could see those," the 42-year-old said, adding that she noticed over the years her physician started entering them electronically.

A law is only as good as the technology and people behind it, and technology and the people may not be so good:

According to the HHS Health Information Privacy Tool, there were at least 78 breaches so far this year affecting 500 or more individuals, many affecting thousands, some tens of thousands.

Known to those in the health IT world as the "Wall of Shame," the HHS site lists more than 21 million individuals who have been victims to date.

The Privacy Rights Clearinghouse found more than 130 breaches so far in 2012 -- breaches affecting any number of individuals.

Try that with paper...how many 18-wheel trucks would it take to haul 21 million charts?

What she didn't realize was that her physician's notes could be accessed by doctors and other health-care providers who worked in the same health-care system (6,000 doctors and nine affiliated hospitals) to have access -- information she learned after going to see an on-call physician for a stomach issue and realizing he knew about intimate relationship information only disclosed to her psychiatrist.

Concerned, she requested a copy of her medical records from the health care system.

Within those records she saw every note, every meeting, every conversation she had with her psychiatrist.

"It was pretty traumatic because I felt that, you know, this man read without -- against my wishes -- without my consent," Julie said. "He read private information that I disclosed to a therapist that I didn't even tell my best friends about."

There are supposed to be multiple levels of access security in EHR's, but that has to 1) work properly out of the box, 2) be implemented properly, and 3) be enforced.  That's three very large assumptions...

And while most hospitals have rules about who may access medical records, compliance for the most part is not strictly regulated.

Indeed.

In fact, an ABC News investigation found that often medical information is so unprotected, millions of records can be bought online. Because so many people have access, the entire system is vulnerable to theft, experts told ABC News.

These are an on-their-face reasons to refuse entry of your data in EMR systems.

To see exactly how easy it was to find medical records online, ABC News enlisted the help of IT specialist Greg Porter, a consultant with Allegheny Digital.

"This isn't very sophisticated," Porter said. "If you can use a Web browser and you can search to www.google.com, you can begin to try and obtain some of this information."

With two clicks of a mouse, Porter found somebody willing to sell a data dump of diabetic patients with information including their names, birth dates and who their insurance provider was, among other details. Another seller offered 100,000 records of customers who purchased health insurance in the last three to 12 months.

"Typically, what we find are things like first name, last name, address, medical condition, whether they were a smoker, diabetic patient, perhaps even as intensive as, or invasive as whether they are HIV-positive or not," Porter said. "Some of the most intimate information about all of us potentially could be revealed if appropriate safeguards aren't put in place.

Putting appropriate "safeguards" into place hurts healthcare organizations' bottom lines.

Security professionals are seeing an increase in theft via the "insider threat," Porter said.

"It's a depressed global economy," Porter added. Thieves might approach medical staff and offer upward of $500 per week for providing 20 to 25 insurance claim forms, medical records or health financing records, Porter said. Those documents fall under HIPAA security rules and are considered protected health information.

Could never happen, right?

In June, a hospital medical technician at Howard University pleaded guilty to selling patient information, including names, birth dates and Medicare numbers, for $500 to $800 per transaction for more than a year.

In August, a hospital employee at Florida Hospital Celebration was arrested for accessing more than 700,000 patient records in two years.

According to the FBI, Dale Munroe accessed car accident victims' date and sold it to someone who passed it on to chiropractors and attorneys.

And this week, the University of Miami Health System said that two workers had "inappropriately" accessed patient data and "may have sold the information to a third party."

On the black market, "health information is far more valuable than Social Security numbers," said Dr. Deborah Peel, founder and chairwoman of Patient Privacy Rights.

I stand corrected.

ABC News' searches found one seller offering database dumps for $14 to $25 per person. After a quick email inquiry into the sale of records, ABC News was sent, unsolicited, 40 individuals' private health information, including their names, addresses and body mass index.

Another inquiry yielded an offer of more than 100 records that, if purchased, would have included everything from Social Security numbers to whether someone suffered from anxiety or hypertension, or even their HIV status.

ABC News contacted patients from one of the lists to see if they knew their information was being sold over the Internet and if they had consented.

One victim named Rafael said he had not "recalled" giving anyone permission to sell his information.

"I'm appalled, I'm disgusted and I'm very much concerned," Rafael said. "Who's giving out my personal information like that? I thought there were security and safeguards for these things. I thought … your medical records are confidential."

So, in addition to the risks to good care posed by today's EHRs, now one has to be concerned about risks to one's privacy, damage to one's career, and to one's financial health as well.

... [Privacy advocate Dr. Deborah] Peel believes ways to fix the privacy vulnerabilities are available. "Technologies exist today to allow you to selectively share parts of your record that are relevant on a need-to-know basis with your other physicians and no one else, but we don't have those technologies in wide use," she said.

Not in the short term, unfortunately.

For Julie, privacy is a battle she continues to fight.

"I asked … please restrict the records and of course they said 'No,'" she said.

Great.  How reassuring.

"Let me also assure you that our physicians and other staff access information on a strictly 'need to know' basis and as such, we do not restrict access to clinical information from any department or physician," the hospital told her. "I take your concerns very seriously and understand your need for privacy with your psychiatric records. Sometimes it can be a challenge to balance access to records for patient care purposes with the need for privacy."

Bullsh*t, I say, having led EMR implementations at large hospitals where these exact issues were considered.

Since discovering her records were available to the whole health system, Julie has stopped seeking care out of concerns for her privacy.

That. of course, destroys the whole purpose of electronic records to "improve access" to "accurate medical information."

... In sharing her story, Julie wanted to come forward for those who couldn't.

"The difference in this situation is I actually chose to come here and I actually chose what I'm gonna say and what I'm not gonna say; but when my medical information is available to everybody, I don't have that decision," she said. "Somebody else is making that decision for me and that really makes me feel violated. So that's why I'm here: Because I think it's a really big problem and I wanted to do something about it. "

The people who in essence are "making that decision for me" are technologists, or technology hyper-enthusiasts, who ignore technology's downsides and ethical considerations.  I defined that defective character type at this post.

The systemic technological and attitudinal problems (further) exposed by this ABC investigation cannot reasonably be expected to be fixed, and probably cannot be fixed, in a short time frame.

Thus, I suggest patients who do not desire to be guinea pigs on health information security, privacy and confidentiality consider refusing use of EHR's to record and diffuse their confidential medical information. A person should not be coerced to risk their privacy and financial security while the health IT industry "gets its act together."

On a pragmatic basis alone in 2012, the risk-to-benefit ratio may simply be too high.  For instance, what are the odds that you'll be found unconscious and without contact information in some distant land, vs. privacy breach or ID theft from an EHR?

Further, there is no legal requirement that electronic records be used for rendering of medical care.  There is also no legal requirement that live patients consent to be used as test subjects for hospitals and software companies in refining their IT systems ("beta testing") to make them secure.

If a physician or hospital refuses to honor the request, and/or refuses to provide care, litigation should be pursued.

-- SS

7:27 AM

EHR sabotage for ransom: Try this with paper!

I have frequently written that health IT, touted as a technology that will deterministically "transform medicine", allows (aside from clinical chaos) new sorts of problems, such as information security abuses en masse, to occur.  See this query link for numerous postings on that topic:  http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy

I am not, of course, advocating a return to paper; I am in fact "pro-good IT" but "anti-bad IT."

"Bad IT" is IT that interferes with quality patient care for any reason, permits evidence spoliation, permits overbilling, exposes confidential medical information to unauthorized parties, etc.

Here is another example of unintended consequences of bad health IT.  Try this trick with paper:

Attackers Demand Ransom After Encrypting Medical Center's Server
John E Dunn, Techworld
August 14, 2012 

Details have emerged of an extraordinary data breach incident in which a U.S. medical practice had thousands patient records and emails encrypted by attackers who then demanded a ransom to unscramble the data.

The incident appears to have come to light after a security blogger 'Dissent Doe' noticed a data breach report made by Illinois-based The Surgeons of Lake County medical centre to the US Department of Health and Human Services.

According to a small newswire that reported events, attackers were able to compromise one of the medical centre's servers, encrypting its contents including 7,067 patient records and a quantity of emails.

The first the centre knew about the attack was on 25 June when a ransom note for an undisclosed sum was posted on the server, at which point it was turned off.

It is not clear whether the data was recovered through backups but the organisations reported the incident to the police and Department of Health.

... What marks the compromise out from almost every data breach attack recorded is that the attackers opted to extort the victim organisation rather than attempting to sell or exploit the data itself.  [Cyber criminals should never be assumed to be uncreative - ed.]

It remains unlikely that the intention was to abuse this data directly; having occurred only days before the extortion note was received, the criminals would normally want a longer period to execute data and identity theft crimes. Most data theft criminals attempt to go undetected for this reason.

The criminals will, nevertheless, had access to sensitive data including names, addresses, social security and credit cards numbers plus medical records, prompting the centre to inform its affected patents of the breach.

"This is a warning bell. Maybe they're the canary in the coal mine that unpredictable things can happen to data once it's digitized," [you think? - ed.] said Santa Clara University law school professor, Dorothy Glancy, quoted by Bloomberg.

This incident is, quite simply, stunning.  In addition to identity theft concerns, a patient whose information was cybernetically 'held hostage' could have suffered clinically as a result.

A warning bell indeed about "bad IT."

-- SS

3:20 PM

Banking as the Standard Healthcare Should Look Up To On Medical Information Security?

At past posts "Don't Worry, Your Electronic Medical Records Are Getting Safer With Every Passing Day", "Another Episode of "But Don't Worry, Your Records are Safe..." and "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure", "Don't Worry, Your Records are Safe - Part IV" and others, I wrote on the issue of medical record security.

Banking has been held as the standard as to which medicine has been compared, with medicine being called archaic and behind the times for its reliance on paper.  Banking security is cited as a reason why electronic medical records can also be secured.

There's this:

Fraud Ring In Hacking Attack On 60 Banks 

June 27, 2012

Some 60m euro is stolen from bank accounts in a massive cyber raid, after fraudsters raid dozens of banks around the world.

By Pete Norman, Sky News Online

Sixty million euro has been stolen from bank accounts in a massive cyber bank raid after fraudsters raided dozens of financial institutions around the world.

According to a joint report by software security firm McAfee and Guardian Analytics, more than 60 firms have suffered from what it has called an "insider level of understanding".

"The fraudsters' objective in these attacks is to siphon large amounts from high balance accounts, hence the name chosen for this research - Operation High Roller," the report said.

"If all of the attempted fraud campaigns were as successful as the Netherlands example we describe in this report, the total attempted fraud could be as high as 2bn euro (£1.6bn)."

The automated malicious software programme was discovered to use servers to process thousands of attempted thefts from both commercial firms and private individuals.

The stolen money was then sent to so-called mule accounts in caches of a few hundreds and 100,000 euro (£80,000) at a time.

Credit unions, large multinational banks and regional banks have all been attacked.

Sky News defence and security editor Sam Kiley said: "It does include British financial institutions and has jumped over to North America and South America.

"What they have done differently from routine attacks is that they have got into the bank servers and constructed software that is automated.

"It can get around some of the mechanisms that alert the banking system to abnormal activity."

The details of the global fraud come just a day after the MI5 boss warned of the new cyber security threat to UK business.

McAfee researchers have been able to track the global fraud, which still continues, across countries and continents.

"They have identified 60 different servers, many of them in Russia, and they have identified one alone that has been used to steal 60m euro," Kiley said.

"There are dozens of servers still grinding away at this fraud – in effect stealing money."

That's all very reassuring.   Let's put all of our personal medical secrets online ASAP.  Don't worry, your information's safe and secure.

-- SS

10:39 AM

More Electronic Medical Record Breaches: You Could Not Do This With Paper

I have written repeatedly on the dangers posed by poorly managed health IT regarding information breaches.  See "2011 Closes on a Note of Electronic Medical Record Privacy Breach Shame" and other posts at this query link:   http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality

Now this, from Kaiser Health News and The Washington Post:

As Patients' Records Go Digital, Theft And Hacking Problems Grow 

By David Schultz

Jun 03, 2012

As more doctors and hospitals go digital with medical records, the size and frequency of data breaches are alarming privacy advocates and public health officials.

Keeping records secure is a challenge that doctors, public health officials and federal regulators are just beginning to grasp. And, as two recent incidents at Howard University Hospital show, inadequate data security can affect huge numbers of people.  

With paper, you'd need a stream of trucks to accomplish this magnitude of theft:

On May 14, federal prosecutors charged one of the hospital's medical technicians with violating the Health Insurance Portability and Accountability Act, or HIPAA. Prosecutors say that over a 17-month period Laurie Napper used her position at the hospital to gain access to patients' names, addresses and Medicare numbers in order to sell their information. A plea hearing has been set for June 12; Napper's attorney declined comment.

Just a few weeks earlier, the hospital notified more than 34,000 patients that their medical data had been compromised. A contractor working with the hospital had downloaded the patients' files onto a personal laptop, which was stolen from the contractor's car. The data on the laptop was password-protected but unencrypted, which means anyone who guessed the password could have accessed the patient files without a randomly generated key. According to a hospital press release, those files included names, addresses, and Social Security numbers -- and, in a few cases, "diagnosis-related information."

I add that they could also probably have booted the laptop from alternate media, and/or removed the hard drive and inserted into another computer, to access the contents.

Ronald J. Harris, Howard University's top spokesman, said in an e-mail that the two incidents are unrelated, but declined to answer further questions. In its press release about the stolen laptop, the hospital said it will set new requirements for all laptops used by contractors and those issued to hospital personnel to help protect data.

Still it could have been worse. Much worse.

Just days after Howard University contacted its patients about the stolen laptop, the Utah Department of Health announced that hackers based in Eastern Europe had broken into one of its servers and stolen personal medical information for almost 800,000 people -- more than one of every four residents of the state.

How many trucks (and Stargate SG-1 style invisibility cloaks) would it take to inconspicuously steal 800,000 paper charts, I ask?

And last November, TRICARE, which handles health insurance for the military, announced that a trove of its backup computer tapes had been stolen from one of its contractors in Virginia. The tapes contained names, Social Security numbers, home addresses and, in some cases, clinical notes and lab test results for nearly 5 million patients, making it the largest medical data breach since the Department of Health and Human Services began tracking incidents two and a half years ago.

Five million charts in a country of 300 million people...

As recently as five years ago, it's possible no one outside Howard University would have known about the incidents there. But, new reporting rules adopted as part of the 2009 stimulus act insure the public knows far more about medical data breaches than in the past. When a breach occurs that affects 500 or more patients, health care providers now must notify not only HHS, but also the media.

Meaning there were breaches the public does not know about.

Deven McGraw, director of the health privacy project at the Center for Democracy & Technology, a Washington-based Internet advocacy group, said the number of incidents is growing with the increased use of digital health records. The health care industry, she added, has been slow to respond.

A problem is not enough "motivation."

"Many financial companies have used encryption for years and they probably wonder what the heck is going on with the health care industry," McGraw said. "It's much cheaper to deploy safeguards than to suffer a breach."

I offer a one word answer:  complacency.

Now for the "spin control":

This growing problem puts HHS in a tough spot. It is pushing hospitals and doctors to adopt electronic health records, but it's also responsible for punishing health care providers who fail to properly secure their patients' records.

"Mistakes happen, incidents happen, corners get cut from time to time," said Susan McAndrew, deputy director for health information policy at HHS's Office of Civil Rights. "That's where we come in."

"From time to time" is a rather modest description of the millions of breaches mentioned in just this posting.

 But as I've written before, don't worry, your records are safe.

Just don't tell the doctor about that "incident" at that seedy club the other night, and find some other excuse to get the antibiotics you need, and that information will be safe, too.

-- SS

10:43 AM