EMR vs EHR redux

Nate Bagley from Software Advice asked me to review his article and it jogged my memory… I wrote this a few years ago.  Only Nate offers some Google data to back up the idea that essentially an Electronic Medical Record (EMR) is a patient’s medical record sourced from one provider; an Electronic Health Record (EHR) is sourced from several providers. This is in line with Nate’s quote from Don Fluckinger, “EHR seems to refer to a record that can be shared back and forth and amended among multiple providers.

If I get my healthcare from one provider, say Sutter Health, where one electronic record is shared between primary care, nurses and specialists, is that an EHR or EMR?

Until the NHIN or HIEs gain traction, Sutter’s health record cannot be shared with Stanford Hospital literally across the street!


a dissection (no pun intended) of the EMR market

On behalf of a peer, Chris Thorman, I offer  his breakdown of the EMR market:

  • The size of the outpatient EMR market;
  • What EMR vendors have the most physicians using their system; and,
  • What EMR vendors have the most practices using their system.s

Please click here for Chris Thorman’s analysis

Trend away from private practice?

An article in the New York Times describes the movement of physicians from private practice to becoming employees of medical clinics. Of particular interest to me was this:

But an even bigger push may be coming from electronic health records. The computerized systems are expensive and time-consuming for doctors, and their substantial benefits to patient safety, quality of care and system efficiency accrue almost entirely to large organizations, not small ones. The economic stimulus plan Congress passed early last year included $20 billion to spur the introduction of electronic health records.

I question the above statement for the following reasons:

  • Cost: Web based (SaaS) EMRs such as those offered by PracticeFusion (actually free), SOAPware,  and others are less expensive since the Physicians do not have to maintain expensive in-house hardware and software.
  • Time-consuming for doctors: I don’t see why an EMR used by private practice is any more time consuming than an EMR used in a clinic. All a Physician has to do is learn to type with 10 fingers and he/she will discover e-prescribing, electronic lab orders, faster patient search etc are features that far outweigh their paper alternatives.
  • Patient safety and quality of care: These benefits accrue equally to users of EMRs be they in private practice or clinics.

EMRs and Clinical trials – some questions….and answers

Chris Thorman, from a web site that reviews of electronic health record programs, posted a good article proposing that data from Electronic Medical Records (EMRs) be used for clinical trials, with the following benefits for Physicians considering the purchase of an EMR:

  • Participating in these trials is easier through an EHR than through traditional paper means;
  • Using EHR data solves many of the major problems that clinical trials face; and,
  • Purchasing an EHR creates a big ROI for physicians who decide to participate in clinical trials.

In theory, this sounds great and I found one example: the renowned Mayo clinic’s effort with Centerphase.

I ask the following questions, offer my answers, and welcome comments.

  1. What part of the pre-consent record can a clinical trial investigator access? Only data that is marked ‘non-confidential’ and does not identify the patient.
  2. As a follow on, if the trial investigator is allowed to see pre-consent eligibility or screening attributes only, how can access to the rest of the patient record be suppressed? Implement strict fine grained access controls at the attribute level of a patient record.
  3. Can the investigator access pre-consent data that is marked as confidential? He/she cannot!
  4. Can the patient waive confidentiality or regulatory access restrictions on sensitive pre-consent data? Only with full understanding of the implications
  5. If clinical trial specific data is co-mingled with standard care data, is that data available for insurance/reimbursement purposes? No
  6. As a follow on, what constitutes the “legal medical record” when clinical trial and standard care data are commingled? Only standard care data, acquired by a diagnosis
  7. When a study subject either completes a study or withdraws study consent, does their research-only data remain part of the permanent EMR database? No, it should be erased
  8. Assuming access to trial-specific data is allowed, can a physician who is not a clinical trial investigator, change trial data that they feel are incorrect? No
  9. Should research data be separated from standard clinical care data? Yes
  10. Is there a difference in access rights between standard care data that will be included in the research versus standard care data that will not be included in the research?  No, clinical trial investigators should only have access to data that is included in the research.

MUMPS anyone?

As a kid I got mumps and stayed home from school with swollen glands;  today there is the MMR vaccination for children fortunate to live in developed countries.

I am not writing about the disease though, rather the programming language used to create electronic medical record software, for example: VISTA and EPIC. This is another assignment from my class, Healthcare Informatics – the University of California, Davis.

If you were writing a new Electronic Medical Record (EMR) software solution today, would you use MUMPS, which is admittedly widely deployed?

Those in favor might argue:

  1. MUMPS is the language used by existing EMR deployments from large established EMR vendors,
  2. The MUMPS database does not waste disk space as it uses sparse arrays and B-trees queries are  faster than indexed relational databases.
  3. MUMPS based EMR systems installed today are stable and reliable.

I posit no, because:

  1. Where would you find MUMPS programmers today? Are new college graduates proficient in MUMPS or JAVA/C++ ?
  2. How would you interface with other EMRs today? Interoperability is the one of the biggest challenges between healthcare systems today and creating a new EMR system based on older non-standards approaches will not result in an interoperable system.
  3. Rather than run a MUMPS based system on large monolithic hardware, a new EMR system could be written on distributed highly available hardware.

Of course there is also the option of not writing your own EMR software,  but rather using a Cloud computing EMR solution from vendors such as  AdvancedMD or (my local favourite) Practice Fusion.

How to select and deploy an Electronic Medical Record system

This blog entry is a brief summary of readings I have covered as part of my training in healthcare Informatics from the University of California, Davis and is sourced from this paper and this book

The medical practice has to be ready to adopt an EMR and most importantly to recognize that the medical practice is adopting a vision, not just a technology. A vision means the practice will offer better patient care, a more efficient office and improved financials.  The most important role in the implementation of an EMR is a ‘champion’. The role of this champion is to gain buy-in and trust from perhaps reluctant staff in the medical institution, since workflows and business processes will likely change. Users of the new system must have high psychological ownership of the new technology.

Steps in the implementation of an EMR

Information gathering

  • Collect information: Patient data, radiology and lab reports
  • Assess workflows: Appointment scheduling, events during and after a patient visit, unscheduled visits and questions etc
  • Financial impact: Beyond the initial cost of the software are costs for training, maintenance and upgrades.

Selection Phase

Subsequent to information gathering, the medical practice selects an EMR. A few choices: proprietary vendors such as EPIC, Cerner and Eclipsys or  OpenSource alternatives . Both require creating evaluation criteria and extensive RFI/RFP processes by a project steering committee. Furthermore members of the medical practice should visit other practices and view their EMR implementations.

Keys to success

  • People are key to the successful implementation of an EMR. Everyone, clinicians and yes patients, must be aware of the new system to gain buy-in.
  • Workflow will be redesigned
  • A good project plan: just like the rollout of any enterprise software system, a good project plan is required that that clarifies responsibilities, sets objectives, generates tasks, and provides tight control and feedback with ongoing problem solving.

Alternative solution to installing an EMR

Of course a simpler alternative would be to select a hosted SoftwareAsAService (SaaS) offering that requires no in-house software, servers, or expensitve technical support staff.  A SaaS solution that I like and have interacted with over the blogosphere is Practice Fusion. Contrarians might argue that a hosted service is a one-size-fits all solution that does not fit the current practices of a medical practice. I would counter that an in-house system will be expensive to modify to suit a medical practice’s needs.

Hosted or in-house, the medical institution must recognize that their workflows and practices will have to change if they wish to gain the undeniable benefits on an Electronic Medical Record.

Image below courtesy of HIMS Analytics

Will you entrust the US government or a private entity with your electronic medical records?

The ARRA stimulus bill provides incentives for medical providers to use Electronic Medical Records for storing patient healthcare information. (To read more about Meaningful Use and certified Electronic Medical records, beyond the scope of this posting, please refer to CCHIT). The overarching goal is to allow medical records to be exchanged between health-care providers. A simple example: An employee changes jobs and receives new health insurance, which requires him to use a different healthcare provider. How does he transfer his medical records to that new health-care provider.  Or a soldier is treated in a military hospital, then transferred to the VA and finally to a public/private hospital. How does his/her electronic medical record transfer between the three distinct institutions.

In transferring electronic patient data between institutions:

  • How does American law protect the privacy and security of patient health-care data?
  • Why are Americans hesitant to share medical information electronically?

On Monday January 25th, 2010 a study by the Ponemon institute revealed that Americans distrust the Federal Government or private enterprise to electronically store their health-care data.

Of the 868 Americans surveyed about their views on digitizing and storing health records, only 27% said they would trust a federal agency to store or access the data–the same percentage as those who would trust a technology firm like Google Microsoft or General Electric

Let’s examine how US Federal law protects electronic medical records

Health Insurers and Providers who are covered entities must comply with your right to:

  • Ask to see and get a copy of your health records
  • Have corrections added to your health information
  • Receive a notice that tells you how your health information may be used and shared
  • Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing
  • Get a report on when and why your health information was shared for certain purposes

Nothing implied about electronic medical records, nor exchange of electronic data and most importantly authenticating the individual who is requesting access to the records. In an electronic medical record system, how can I be certain that Joe Smith is who he claims to be when he logs into the system. Is user-name password sufficient security?

  • In light of the ARRA stimulus bill, the US Department of Health and Human Services (HHS) revised the privacy rule in December 2008. (11 page PDF here). In summary:
  1. Access: Individuals must be provided timely access to their medical data
  2. Disputation/Correction: Individuals must be able to dispute and correct information in their health record, from a simple typo, corruption of digital information in transit  between entities and even medical identity theft.
  3. Openness/Transparency: Individuals must have access to their record and know what is in there and how it is disclosed.
  4. Individual choice: Individuals must be able to choose how data is shared. For example which doctor is allowed to view their record delegating access to another person in case the individual/patient is incapacitated and cannot access their record.
  5. Collection/Use: Individuals have the right to know how their medical data is distributed/used; that data is only used for their care and not distributed beyond the patient’s consent.
  6. Data quality/integrity: Data is secure and not compromised
  7. Accountability/Auditing: An audit trail and legal accountability exists to know who was authenticated and authorized to access an individual’s data.

The word “trust” appears 13 times in the 11 page document, the phrase “trust in electronic exchange of information” appears six times. Clearly the HHS is attempting to gain the public trust in an electronic exchange of health data.

  • The Federal Trade Commission proposed a breach notification rule (50 page PDF) “requiring vendors of personal health records and related entities to notify individuals when the security of their individually identifiable health information is breached.”

So, given the above laws, why does the Ponemon study find Americans so distrustful to store their electronic health data. The study revealed:  Users rated health records as far more sensitive than other information they typically share with Web companies. On a scale from one to seven, medical data received an average rating of 6.64, while credit card information received only a 4.27 and online search records just a 1.86.

I posit that:

  • Internet searches can be reasonably anonymous.  I can search for information from a public computer such as the library or a firewall can transform my computer’s identity (IP address).
  • If my credit card information is compromised I am protected by the credit card company; so much so that credit card companies have sophisticated software that track errant spending patterns and forewarn me. Am I in an obscure overseas country attempting to purchase a $3000 airline ticket?
  • Americans, historically, have a distrust in their government. The Bill of Rights dating back to 1791 protects the individual (for example unreasonable searches).  So why should the government be trusted with personal health information?

The problem is health information potentially reveals personal and important details about an individual: their weight, medications, illnesses, addictions, allergies,  perhaps even sexual preferences. (Interestingly under the US law, patients do not have access to their  psychotherapy notes. See HIPAA rule “You do not have the right to access a provider’s psychotherapy notes.” )

The real problem I believe is what options does a an individual have if their electronic medical record has been compromised? Witness two recent incidents in California where electronic patient information was stolen: UCSF – (600 patients) and Kaiser (15000 patients).

Is the FTC breach rule sufficient?

I think the rule is sufficient, but the ubiquity, and ease of electronic data duplication, makes it difficult to gain the trust of users. If my medical records are stolen, what comfort is the rule? The answer individuals require from electronic medical record vendors is “we will encrypt your data, at rest and in transit.” At rest means data in a database is encrypted; in transit means, that the data as it is transmitted across computer networks. Today, encryption in transit is easily achieved with SSL. Encryption at rest is rare because it is practically difficult to implement. If I encrypt “Joe Smith” as “aS@Pn!”, then how do I search for his record, as I cannot search for “Smith”? How does another, say reporting application, access and present the encrypted data? How do I index a database (group all the “Smith”s together) if the data is encrypted? How can a receiving party in another institution (sharing electronic medical records) decrypt the data? As the UCSF and Kaiser incidents note, unencrypted data was stored on detachable disks and subsequently stolen.

Electronic medical record vendors and the US government have a long way to go to gain public trust.

(This posting is an assignment from my UC Davis Informatics class on telemedicine)