Hospitals

Hospitals Feature Story

Transferring data securely from medical devices to EMRs

HMT-201202-SECURITY_LOK-IT_90x126Cardiac clinic moves closer to going paperless.

Administrators in the cardiac electrophysiology clinic at the George E. Wahlen Department of Veterans Affairs Medical Center in Salt Lake City, Utah, struggled to keep up with the stacks of paper produced by medical devices used to monitor patients’ hearts. They would spend hours upon hours scanning sheets of paper so that the results could be transferred to the hospital’s electronic medical records (EMR) system.

Kimberly A. Selzman, M.D., director of arrhythmia/cardiac electrophysiology at the Salt Lake V.A. medical center, wanted to find a way to electronically transfer those records.

She knew that there had to be a better way to handle all the data. The medical devices produce a telemetry strip similar to electrocardiogram (EKG) and details on how the device is functioning and the battery status. “It’s important, and we want to keep that information,” Selzman says, in particular if a patient has a future problem so that doctors can pinpoint, for example, when an abnormal heart rhythm may have started.

The medical devices that Selzman and other cardiologists use to monitor patients’ pacemakers and implantable cardioverter defibrillators print out reports on scrolls of paper five-inches wide. That format is not conducive to medical record keeping. In addition, the thin paper wears easily, making the records illegible over time.

To solve that problem, clinic officials hooked up the medical devices, called programmers, to printers. Heart patients routinely come into the clinic to have their pacemakers or defibrillators checked. With each patient visit, the programmer generates reports up to 15 pages long – and each day the clinic runs, 25 patients come through. The mounds of paper quickly begin to rise.

Dr. Selzman turned to the manufacturer of one of the medical devices that spit out the reams of reports: St. Jude Medical Inc. That’s when she found out the programmer came equipped with a USB port. But that was only a start. The U.S. Department of Veterans Affairs rules for encrypted medical records precluded the medical center from using a standard USB flash drive.

“We needed something that could be seen by the programmer and met all the privacy concerns of the V.A.,” Selzman says. “They have a lot of requirements. You couldn’t just use any old USB drive.”

Standard USB flash drives do not protect the data stored on them, so encryption is needed in order to satisfy the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These laws state that if organizations have a data breach where personal health information stored on a portable device is lost or stolen and it was not encrypted with a U.S. National Institute of Standards and Technology-approved algorithm, then they must follow data breach notification procedures and are subject to federal penalties up to $1.5 million per occurrence.

The issue became further complicated because most encrypted flash drives require software for the user to enter a password. This process of software authentication requires a keyboard and/or mouse, a monitor and the use of commonly supported operating systems. The medical devices had none of these. They only had USB ports embedded within the devices.

For typical encrypted flash drives to work, it would have required the medical device company to rewrite the software on the programmers so that it could interact with those drives. That process would have taken months and a substantial budget.

After going through several drives, the search by the V.A. and St. Jude led them to the LOK-IT Secure Flash Drive made by Systematic Development Group, which is based in Deerfield Beach, Fla.

The LOK-IT drives are the only Federal Information Processing Standards (FIPS) 140-2 Level 3-certified flash drives that utilize hardware user authentication with an onboard PIN pad. So, much like an ATM, users punch a pin code into a 10-key PIN pad on the device to unlock the drive and access data stored on it. The use of the PIN pad eliminates reliance on a keyboard and computer to unlock and use the drive. That makes it platform independent. The operating system used by the medical device didn’t matter. The software didn’t need to be rewritten to access the encrypted drive, and the medical devices could see the drives.

Finding a flash drive that worked with the medical devices was only a partial victory. The V.A., like many federal agencies and major corporations, does not allow the use of thumb drives for data security reasons.

LOK-IT’s FIPS 140-2 Level 3 rating was critical to the cardiac clinic getting permission to use the drive. The rating was developed by the federal government, and the 140 series refers to computer security standards that specify requirements for cryptography modules. The U.S. National Institute of Standards and Technology sets the criteria; a Level 3 validation requires that a component is tamper resistant, encrypts data and allows identity-based authentication.

LOK-IT has an internal epoxy potting that prevents unauthorized access to the internal components. If someone tries to remove the epoxy potting, it causes irreversible damage to the components and renders it unusable. To encrypt data, LOK-IT drives use on-the-fly, full-disk, 256-Bit AES hardware encryption. All data stored on the drive is automatically encrypted by LOK-IT’s encryption controller. And it’s onboard PIN pad allows for a seven- to 15-digit pass code.

It took months, but in the end the V.A. information technology department gave the cardiac clinic permission to use the flash drive. IT authorized access to the locked USB ports on the clinic’s desktop computers so that clinic staff could upload the data from LOK-IT.

Implementing the drive was simple. Basically, it’s a plug-and-play device, so there’s little training to be done. There were “no glitches … no hesitation,” Selzman says.

The clinic found an added benefit for patients who have home monitoring devices that transmit their cardiac reports using a landline. The reports are uploaded by the patient at home to the medical device companies’ websites. There are various devices, so there are several different sites where the patient reports end up. LOK-IT helps those patients who don’t have a landline by allowing the data from the medical device at home to be transferred to the hospital’s electronic medical records.

The clinic uses other medical devices besides St. Jude’s product, including Medtronic devices. Selzman says the LOK-IT drives they purchased also work with the Medtronic devices.

For the clinic’s two physicians, two nurses and administrator, LOK-IT has made filing patients’ medical records much easier. What once took hours can now be done at the end of a clinic day in 30 minutes. The stacks of paper are gone.

“It’s easier to find patient data,” Selzman says.

Instead of looking through piles of paper, doctors now can search electronically. And the cardiac clinic has moved closer to the V.A.’s goal of going paperless.                  

For more on LOK-IT, click here.

 

 

Making the cloud work for healthcare

The healthcare industry is looking to technology to improve patient care and efficiency. So it’s no surprise that many healthcare organizations have been looking closely at the advent of perhaps the biggest upheaval in information technology since...

 

How safe is the cloud?

HMT-201202-SECURITY_CommVault_90x126All of the pieces are in place to enable secure and compliant cloud-based storage environments.

For the past several years, cloud security has been one of the biggest concerns among healthcare IT decision-makers as they consider how best to transition operational and clinical applications and data out of the healthcare IT data center and into the cloud. The real question is one of perception versus reality.

A perceived lack of cloud security can sometimes stop a healthcare IT organization dead in its tracks when it looks at the cloud as an option for data storage. Many industries, particularly healthcare, have always been held to a higher standard when it comes to regulatory compliance and data retention, which prevents them from taking a “risk” in the cloud. Also, the lack of cloud providers who are willing to sign business associate agreements (BAA) as mandated by HIPAA has limited the amount of options for healthcare organizations. This unjustified fear of lax cloud security and support of compliance requirements means healthcare IT organizations lose out on all of the business, cost and operational benefits that can come with storing data in the cloud.

The economic benefits that come with storing operational and clinical data in the cloud are too great to ignore. Because cloud storage providers leverage multi-tenant architectures, infrastructure costs are shared across many users. This helps lower costs substantially versus on-site solutions, which require additional provisioning, power, cooling costs and more.

While many organizations benefit today from keeping online, de-duplicated data copies available for fast recovery, massive growth will still require more disk and tape to contain exploding amounts of data. Cloud storage offers a low-cost tier of storage that enables several new compliance, disaster recovery and data backup solutions. More readily available than offline vaulted data, cloud-based storage delivers these key use cases to help solve today’s data management problems, including:

•    Tiering data retention to cloud storage, which alleviates the need to expand data center capacity;
•    Archiving stale data to cloud-based storage to free up existing space within the data center;
•    Cost-effective disaster recovery for small and medium healthcare organizations without large upfront and operational investment;
•    Content indexing data before moving to the cloud to meet compliance requirements and minimize search/retrieval times during e-discovery operations; and
•    Remote office backup directly to cloud-based storage.

There are many aspects to securing data in the cloud. People who move application and email servers into the cloud are concerned with spam, hackers and phishing attacks. Those who are considering the cloud to store data for disaster recovery or long-term archiving/retention of operational and clinical data or PACS images are concerned with others gaining access or visibility into vital clinical data. There is also physical security and the specter of some nameless individual strolling into a cloud service provider’s data center and walking away with a jump drive full of patient data. Many healthcare IT decision-makers are worried about all of the above.

Think about the data in terms of your own data center. You have anti-virus and filtering software tools that monitor and prevent email attacks, as well as encryption and data storage technologies to meet your needs for compliance, recovery and retention. Healthcare vendors offering cloud-based services know that the support of BAA is mandatory for your organization. It is also a safe bet that cloud service providers have guards protecting their physical sites.

There are a few things that you should look for, however, to ensure that your data is being protected in the cloud. Your cloud solution should include:

•    Embedded encryption that secures data backup and archive data in-flight or stored within the cloud;
•    Integrated alerting, reporting and data verification functionality to help ensure that data has safely reached the cloud without the risk associated with manual scripting or standalone gateway appliances;
•    Native REST/HTTP integration to deliver seamless data and information management across on-site and cloud-based storage architectures; and
•    Integrated features, such as de-duplication and compression to enable efficient movement of backup and archive data across a network for long-term cloud storage.

It is inevitable that healthcare IT organizations will turn to the cloud to keep pace with the growth of data and the demands placed upon them by meaningful-use requirements. It may take time to overcome the fear inherent in handing over control of your data to someone else. But consider this: There was a time when using a credit card online invoked the same type of fear; nobody wanted to be the first to dip a toe in the pool. The technology needed to keep data secure, protected and recoverable is here today, and adoption will grow. It’s just a matter of time.      

 Jay Savaiano is director of healthcare business development, CommVault. For more on CommVault, click here.

                    

   

Getting started with cloud computing

When Emory Healthcare in Atlanta began advancing its disaster recovery (DR) plan to include a complete remote backup data center, its staff had two choices: build the data center themselves or co-locate at a premium facility. To build its own data center, Emory...

 

RCM a critical component of accountability models

Revenue cycle management holds the key to successful financial contracting in the world of accountability reform.

"Profitability" is a dirty word in healthcare, but let’s face it – financial success enables healthcare providers to invest profits to provide better quality of care and support accountable models now and in the future. Revenue cycle is a critical component of accountability models and should not be an afterthought after selecting a clinical system. Now is the time to ensure you have the proper infrastructure in place to support accountability models that will require new reimbursement capabilities that incorporate different approaches to risk, such as episodic bundling.

Much has been written about accountable care, but it can be hard to keep up with all the change that healthcare reform is bringing to both the clinical and financial sides of healthcare. It is clear that many provider organizations are planning, prioritizing and juggling multiple IT projects, including 5010, ICD-10 and meaningful-use compliance. With meaningful use and shared savings, the focus of most provider organizations has been on clinical systems, often overlooking the importance and impact that revenue cycle has on healthcare reform challenges and needs.

As the healthcare industry considers the complexities of proposed payment models for accountable care organizations (ACOs), episode-based payments are emerging as a promising model for incentive alignment. What many provider organizations will realize as they dive deeper into the complex reimbursement strategies necessitated by ACOs is that revenue cycle demands will increase while fee-for-service revenues decrease. Organizations not ready to manage complex new payment models, such as episodic bundling and capitation, will likely see their revenue begin to shrink while they consider which processes and systems need to change for success.  

If you are a healthcare finance professional, make sure you are working with your clinical teams on the importance of revenue cycle systems that can support complex reimbursement.

According to a report from the Center for American Progress, “At the heart of health reform is the fundamental challenge to simultaneously improve the quality of our healthcare and lower its costs. And at the heart of meeting that challenge is changing the way we use and pay for care.” Much has been said about quality of care when discussing healthcare reform or accountable care, but very little emphasis has been placed on the importance of reimbursement and the revenue cycle. But what if you didn’t have to cut costs to keep up quality? What if you were able to focus on investing them in the assets and resources you need to improve your patients’ care while also supporting your bottom line?

So that we are all on the same page, let’s define bundling and episodic bundling. Navigant Consulting provides comprehensive definitions for both:

“Bundling is the process of grouping services for payment purposes – either for a particular person over a predefined period of time or for a particular clinical diagnosis or procedure. Instead of providers receiving payment for each individual service performed, they receive one payment amount for a group of services related to either a particular person or a particular diagnosis or procedure.

“Under episodic bundling, a provider or group of providers receives a single payment per person and health event (e.g., hip fracture or knee replacement), with payment adjusted for the severity of the presenting patient’s condition. Episodic bundling may include a wide range of providers and services – for example, hospitals, physicians, physical therapists and long-term care facilities – it typically focuses on hospital and physician care along with some ancillary services.”

There are organizations out there that are eager to take on risk, but they are finding that the administrative and revenue cycle processes necessary for success differ from their historical fee-for-service arrangements. Is it that their current systems and processes don’t have the technical capabilities to execute these payments? In some cases, the answer may be yes, but there are systems out there that do support these capabilities. The key here is deciding how you plan to use episodic bundling and making sure you have the right process, people and systems in place to execute effectively. Here are a few crucial steps we recommend provider organizations take in order to ensure success when exploring bundled and episodic payments:

•    Make sure you are considering the billing process. What are the penalties if you double-dip? What processes and systems can you put in place to identify charges included in the bundle? Can this process be automated?
•    How will you distribute the payments? What systems can you put in place to help pay (bonus structures, withholds, capitation) with the accountability theme? If you are paying your providers fee for service, how can you incent them to control cost and quality?  
•    Will your episodes be confined to your door or extend beyond them? This becomes especially important in an accountability model. The questions about incenting providers become more interesting if the providers you are incenting are outside your organization.  
•    What level of flexibility should you adopt to help keep the doors open to new, different and financially beneficial payment contracts and models? Will your revenue cycle system support the ­models?  
•    How will you use the bundles to understand variation in care across your patient population? What data will you use to understand variation, and what systems will aggregate both codified clinical data and the cost of the aggregate charges? Revenue cycle would be a good place to start.
•    Look for best practices and understand where there is under- and over-utilization. We can’t look at the gate-keeper models of capitation – since the incentive is on quality and efficiency, under-utilization will add to cost in the long run.  

As providers consider these important issues, flexible and robust revenue cycle technology will become a requirement for successful healthcare organizations that want to provide quality care, stay profitable and stay in business.

No one knows what the future holds, but we believe that, over the next five years, revenue cycle and episodic payments will rule the accountable care headlines. We are seeing a trend of an increasing number of healthcare executives who plan to become part of an accountable care organization. Given this, the need for strong revenue cycle management and ­management of episodic bundling are critical, ­including:

•    Having reimbursement directly linked to outcomes;
•    Self-managing utilization in response to outcomes-based reimbursement;
•    Referral and appointment management, patient experience;
•    Distribution of shared savings;
•    Understanding which charges are reimbursed individually or part of a bundle;
•    Becoming proactive in scheduling patients for services and alerting medical staff if appointments are missed; and
•    Strong analytics.

We have the utmost respect for healthcare financial executives out there – they are playing a game of hot potato with various compliance initiatives while trying to stay profitable and provide the best care possible. We would love to hear from other provider organizations. Is your organization considering becoming an accountable care organization? Are you executing episodic payments today? How is your organization handling episodic and bundled payments? If you aren’t handling these payments today, what plans, if any, do you have for the future?      

Seema Mathur (Twitter: @aylafur) is a product manager for GE Healthcare, and Kim Lorusso (Twitter: @kimlorusso) is a product marketing manager for GE Healthcare. For more on GE Healthcare, click here.

   

Page 1 of 37

  

Current Issue

Search HMT

Hospitals Industry News

  • 1
  • 2
  • 3
  • 4