Our Cancer Journey Week 27

Although radiation therapy is the easiest part of the journey thus far (except for the daily drives into Boston for treatment), we're awaiting the symptoms that will develop 2 to 3 weeks into the process.     Although Kathy has not yet experienced any skin changes, she is beginning to feel the transient shooting breast pain we were warned about.  Overall it's a small price to pay for preventative value of radiation therapy.

It's been a good week for Kathy and for Unity Farm (our property was the site of Unity Meeting House in the 1700's).    All twelve chickens are old enough to live in the coop and we've moved our house rabbits into the pen, so that our paddock looks like a Cadbury Easter egg commercial - clucking chickens and rabbits running around together.   We readied an acre of pasture for a new fence and redesigned the area around the barn to accommodate the herd of alpaca and llama which arrive this Summer.   We rebuilt the hayloft, added electrical and water systems to the barnyard, and cleaned out the woodlot.  Despite the persistent numbness and foot pain, Kathy has been keeping up with the farm activities and I devote my nights and weekends to heavy lifting.   We're both sleeping a bit more and I've lost 5 pounds via the  "farm workout" program.

One aspect of the cancer journey worth highlighting is the community of former patients, current patients, and future patients that connect in support of each other.   Every week I receive a call from a friend or colleague explaining that they, their sister, or their spouse has been recently diagnosed with breast cancer.   To me it seems like an epidemic.  There is truly one degree of separation among everyone I know and breast cancer.

Thus, the journey continues and we are actively helping others with advice, encouragement,  and prayers.  Radiation Therapy feels like the last step in a long process, but we know the relief at the end of the journey will be complicated by the emotional and physical strain accumulated along the way.   Watching the chickens chase the fireflies at dusk makes every day a bit better.

The June HIT Standards Committee

The June HIT Standards Committee focused on several important issues related to the real world implementation of healthcare information exchange.

Judy Murphy, Deputy National Coordinator, began the meeting by announcing the progress we've all made on EHR adoption and use of federally mandated standards.    110,000 clinicians have attested to meaningful use and 2400 hospitals have achieved this milestone.    $5.7 billion in stimulus payments have been made.

We then began a detailed review of the Governance RFI by the NwHIN Power Team.   Dixie Baker presented useful background on the Governance RFI defining the terms "Conditions for Trusted Exchange", "Accreditation Body", "Validation Body", "NwHIN Validated Entity", and "Readiness Classification".   With that foundation, she presented the two key recommendations from the NwHIN Power Team

*Safeguards Conditions for Trusted Exchange, which are basic policies ensuring trust that do not change often, should be codified in federal regulations
*Interoperability Conditions for Trusted Exchange, which are the technologies that ensure the security of the trust fabric, will evolve rapidly and in the interest of agility should be established collaboratively by the Validation Bodies with oversight by ONC.

A robust discussion followed and we concluded that the validation bodies should not choose the interoperability conditions for trusted exchange.  Instead, a public/private body, such as the HIT Standards Committee should perform this task, similar in concept to certification criteria.   Certification bodies do not set standards and certification criteria, they look to federal regulation for those details.

Dixie discussed in detail the 21 questions from the RFI that were assigned to the NwHIN Power Team.   The Standards Committee agreed with most of the recommendations, but had a lengthly discussion about three concepts
*Need to be careful to respect existing laws such as HIPAA.   This can be accomplished by enumerating current HIPAA addressable criteria as individual conditions for trusted exchange
*Need to be consider a modular approach to validation, given that different network participants may offer different services that have different conditions for trusted exchange
*Need to be careful about the scope of the conditions for trusted exchange.  Does it require all payers to establish new agreements with existing administrative trading partners?   Although the Governance RFI is a real enabler for clinical data exchange which is largely a work in progress, it could be burden on existing administrative data exchange.

Dixie also presented the comments from the Privacy and Security Workgroup.

Jamie Ferguson and Betsy Humphreys presented a summary of the Vocabulary task force recommendations for value and code sets.    The announced the culmination of two years of work - CMS has agreed to fund a curated national vocabulary repository to be hosted at NLM which will make all the necessary meaningful use code sets and crosswalks available to all stakeholders at no charge.   A true milestone in inoperability that addresses all the Vocabulary Task Force recommendations.

Next, Majorie Rollins and Leslie Kelly Hall presented a summary of the Hearings on Clinical Quality and Patient-Generated Data.  There is a great deal of excitement about creating quality measures that are based on current EHR data elements that are captured as  part of normal clinical workflows.   Similarly, there was universal agreement on the importance of patient sourced data regarding functional status, symptoms, care preferences and consent.

Doug Fridsma presented an update on the S&I Framework, highlighting the work in progress, the new initiatives, and the plans post ARRA funding that will ensure tighter integration of the Standards Committee, the Standards Development Organizations, and the S&I Framework teams.   We'll discuss this topic in more detail at the July meeting.

Finally, John Derr and John Feikema updated the committee on the status of  Long-Term and Post-Acute Care (LTPAC) Initiatives.   All agreed that LTPAC workflows should be incorporated into future Federal meaningful programs.     I highlighted the work of Larry Garber in Massachusetts to accelerate LTPAC integration into the state HIE.  http://www.nehcc.com/_documents/_session_handouts/garber-improving-massachusetts-post-acute-care-transfers.pdf

A powerful meeting with many debates, but consensus on the recommendations needed to accelerate real world interoperability.

Meaningful Consent

One major issue facing private and public Health Information Exchanges (HIE) is how to ensure patients privacy preferences are respected by obtaining their consent before data is shared.  This Boston Globe article illustrates the complexity of the issue.

Today I met with a multi-disciplinary team of attorneys, vendor experts, and IT leaders to discuss BIDMC's approach to private HIE consent.

After two hours of discussion, here's what we agreed upon:

Patients and families should be able to control the flow of their data among institutions.  The ability for the patient to chose what flows where for what purpose is "meaningful consent"

To achieve "meaningful consent" we will ask all the patients of our 1800 BIDMC associated ambulatory clinicians to opt in for data sharing among the clinicians coordinating their care.

Patients may revoke this consent at any time.

Consent for patients under 18 years old and not emancipated will be sought from their parents.   Upon turning 18, the patients themselves will select their consent preferences.

The process for sharing data will function as follows
*Authorized clinicians with a need to know clinical information for treatment, payment or operations will electronically request a view of data from a community practice using our "magic button" protocol

 Only patients shared in common between the two organizations can be queried.

 All requests will be audited.

 Data will be displayed from organizations where the patient has opted in for disclosure of their information.   There will not be a "break the glass" feature to override patient privacy preferences (or lack of preferences).

 We feel that asking for opt in consent to disclose is the most patient centric approach to protecting privacy and today we agreed to do it for all our community practices, both private and owned.

 This practice mirrors what the Massachusetts public HIE will do as it evolves from a "push" model to a "pull" model" over the next few years.   Starting this month, we'll record opt in consents at the BIDMC community level, but by 2014 all consents will be recorded at the state level.

Opt in consent to disclose with the ease of opting out at any time will work well for private and public HIEs.

Assessing Risk

As part of the Summer of Compliance, we completed our first prioritization meeting.

We reviewed more than 50 risks in deal and devised a process to prioritize them.

After much discussion, we decided to assign 3 workgroups the task of intensively reviewing the risks as follows

Teams

There were fifty-five items in the list.   We clustered them into eight categories.

        1 - Access management (7 items)
        2 - Policy and other (7 items)
        3 - Content management (9 items)
        4 - Monitoring and containment (9 items)
        5 - Desktop (8 items)
        6 - Mobile computing (4 items)
        7 - Data network (6 items)
        8 - Facilities (5 items)

Those related to Facilities are part of our multi-year disaster recovery project.  They involve mechanical, electrical and environmental monitoring.    Although disaster recovery is a component of HIPAA's security rule, we'll decided to exclude these from our scoring activity.  The projects already underway and are largely managed by dedicated IS teams.

To collapse the rest into the three groups, we clustered our risks into categories and teams as follows:

        Team 1 - Access management and policy/other  (14 items)
        Team 2 - Content management and monitoring/containment (18 items)
        Team 3 - Desktop, mobile computing and data network (18 items)

We assigned 5 members to each team including appropriate representatives from IS and compliance.  We also designated team leader.

Deliverables

We created a scoring spreadsheet and gave each team the following instructions

"For items 1 to 5, please use a 1 to 5 Likert scale for your ratings.  As you can see, the lower the rating the less work, less impact, and less risk.   Vice versa for higher ratings.

        1.  Rate the workforce impact or "disruption factor".   Rate from 1 to 5; minimal to significant.   Do this for both the initial (first 6 months) and on-going impact.

        2.  Probability the vulnerability we are trying to protect against will occur.   Rate from 1 to 5; unlikely to very likely.

        3.  Impact if the vulnerability does manifest itself.   Rate from 1 to 5; minimal to significant.

        4.  Overall Compliance effort required.  Rate from 1 to 5; minimal to significant.
     
        5.  Overall Information Systems effort required.   Rate from 1 to 5; minimal to significant.

        6.  One-time capital estimate.   Consider application software, professional services, training, hardware, data base software, and other items   normally charged to one-time capital for projects such as these.

        7.  One-time internal labor.   Estimate in FTE's.   For example, a project requiring 520 hours of internal labor would be (520/2080) or .25 FTE.         Consider the full range of activities normally undertaken to bring a system into production.

        8.  Recurring internal labor.   Post-go live support also expressed in FTE.

        9.  Recurring maintenance and purchased services.    Annual cost.

        10.  Recurring - other.   Any remaining recurring support cost not included above.   Annual cost.

        11.  Overall priority - 1 to 14 for Team 1 and 1 to 18 for Teams 2 and 3.

In addition to filling in the spreadsheet, please document whatever other factors you considered or would recommend with regard to the risk item.   For example, you may suggest that an item be broken up into two or more projects to address the most important elements (80/20 rule) and keep parse the costs."

Deadlines

We asked the team leaders to submit their completed spreadsheets by June 22 so that everyone has a chance to review their work before our next planning meeting on June 27.

On June 26th, the team leaders will meet with me to consolidate all their recommendations into a single list.

On Wednesday, June 27th from 2-4pm, we will meet with all the stakeholders to present a summarization of Team deliverables, complete a consolidated ranking of all risk items, set a tentative timeline for each item by fiscal year, and identify a sponsor or lead for each item.

The end result will be a multidisciplinary compliance priority list and work plan for the next two years.

I'll let know if this formal process works to bring order to a large body of work.  At the point, I'm optimistic

Cool Technology of the Week

Generally I write about a cool technology that I have personally tried. This week, I'm looking for advice.

With 12 chickens and 24 guinea hens in our coop, we're looking for a hen cam to keep an eye on our flock.

At  hencam.com they use high end Toshiba IK-WB15A network cameras hardwired to an ethernet connection and uploaded to a web server.

Our coop has power but is about 100 feet away from our WiFi hotspot (and a hardwired connection would be challenging). A wireless IP camera that is web accessible would be ideal.

Does anyone have experience with products from Foscam or Lorex?

A simple, outdoor wireless camera with reasonable resolution and remote web accessibility will do the trick!

I look forward to your comments about the cool wireless cameras you've implemented.