Healthcare Quality Organizations

The the following are excerpts from an article by my friend Joshua Chu (MS Healthcare Management University of Texas Dallas)


American Healthcare Accreditation
In the United States, most hospitals are accredited through an organization that is known as the Joint Commission. Joint Commission accreditation holds a significant stake within the healthcare system in that it controls Medicaid reimbursements. Joint Commission is a nonprofit organization, operated by volunteers. This is the aspiration of the men and women of Joint Commission: Their mission is "To continuously improve health care for the public, in collaboration with other stakeholders, by evaluating health care organizations and inspiring them to excel in providing safe and effective care of the highest quality and value.” (4)
The organization of Joint Commission came from humble beginnings when Earnest Codman began to promote reforms in hospitals to be compensated financially based on the quality of performance outcome in patient care. Thus, the American College of Surgeons Hospital Standardization Program was born, being the first healthcare quality entity to be wide spread across the nation.
The way that Joint Commission works is that they have a three year cycle in which hospitals are inspected in intervals to gain Joint Commission’s accreditation. During this time, the hospital will be inspected to see if it meets all the requirements of accomplishing compliance with applicable standards. When a hospital does meet their demands, they will be awarded accreditation.
The unique part of Joint Commission’s inspection is that their surveys are surprised and unannounced. As such, hospitals are encouraged to be in top performance in order to avoid losing their accreditation. This has the effect of improving consistency for performance of hospitals that receives accreditation from Joint Commission. Another part about their accreditation is that it is mainly on a pass/fail basis, where the findings of the surveyor is not published and the public will only know whether the hospital was able to acquire their accreditation or not.
As of today, Joint Commission has expanded into the Joint Commission International, where they are still operating as a nonprofit organization with the goal and mission to improve patient quality care worldwide. They extended their influence and offer to help improve the quality of hospitals and enhance patient safety across the globe.
Despite the fact that Joint Commission is the significant portion of American Hospital accreditation, it is not a monopoly and that many alternatives do exist, but not as to the same extent. The fact that Joint Commission is the standard of how the U.S. government decides on which hospital to approve for Medicaid reimbursement has significant influence of the accreditation market.
An example of an alternative accreditation to Joint Commission which is recognized nationwide is the Healthcare Facilities Accreditation Program, which was founded in 1943, making the organization older than Joint Commission. The organization was quickly able to gain recognition, and by the mid 1960s, the United States Congress decided that hospitals being accredited by this group were qualified to participate in the Medicare and Medicaid Programs. Their organizational goals are not so different from Joint Commission in that they desire to help healthcare facilities which are under their accreditation deliver high quality patient care by means of meeting the standards set by the organization. They are committed to continuous improvement through the constant review and streamlining of their survey processes.

International Healthcare Accreditation
The desire for quality within the medical community is not exclusive to America. This fact factored along with growing trend towards globalization and medical tourism, there is significant interests in international accreditation of hospitals. Joint Commission is one of those examples, having already grown beyond the borders of America. They have established themselves across over 60 other countries around the world. This trend is more prevalent within the developed world where growing consumerism culture is making the patients, otherwise known as the consumers, more conscious of the care that they are given, or in the other terms, services given. As such, quality assurance is a critical part of the value chain of a healthcare provider and is not unique to the United States.
Healthcare delivery has always been defined by three distinct pillars. They are availability, cost, and quality. In much of the European Union, availability and cost of their healthcare systems has been relatively well managed. Thus, many Europeans are now looking towards quality as the next challenge to tame. This is evident as the Office of Public Health and Social Affairs stated, “... patients have ever-greater expectations of what health systems ought to deliver,” although there has been a “... continuous rise in costs of services determined by scientific and technological innovation.”(2) Healthcare being available in many countries around the world, it is imperative for these institutions to also deliver on quality. This is not only serving more people but also saving more people in the end.
Another issue that has lead to greater interest in international accreditation has been more closely tied into the new trend of Global Healthcare. As our world begins to get smaller and traveling becomes more and more easy, the law of economics and sociology only dictates that humans will ultimately seek out the sources of highest output for the lowest cost. And in this case, healthcare is no exception to this rule. Thus, we see more and more Americans traveling overseas for Medical Tourism and vice versa. Many people around the world also travel to the United States for treatment due to long established specialty. It is no easy decision for any individual, however, for such a trip takes time and commitment. We are seeing a new generation of patients who will do much greater research to find the best solutions to their problems. In order for overseas hospitals to get the patients there for medical tourism, they must have two advantages which will ultimately prompt the patient to travel to them. In this instance, the two factors include cost and quality. With the deficit in healthcare ever increasing in the United States, healthcare affordability has become a much heated issue. This factored in with the recent economic down turn, many people in the United States remain uninsured due to the costs issue. An attractive option will present to this group through the address of their problems with money. These hospitals will a lot of times be able to deliver care in a much more efficient manner due to cheaper infrastructure and support cost, thus the savings are given back to the customer. When the entire operation cost results in a price tag cheaper than what the patient would have to pay for in deductibles, this is usually good enough bait to lure in a customer. However, cost itself is not good enough to attract a customer. The question of quality has to be addressed, as not many people would be willing to take risks to their lives all in the name of costs alone. This is where international accreditation comes in. They can assure to the customers around the world that the hospitals standards within other nations are the same, if not better, than the quality of hospitals they have at home. With these two issues addressed, often times many people will then be willing travel to get healthcare at Great Value. Quality without addressing would not work simply because most consumers cannot afford them and will be seen as an activity that is overpriced. On the other hand, cost without quality will also be unacceptable, for patients will only be gambling their lives to save money. Only with the two pillars addressed will patients be willing to travel, and with international accreditation, many patients across the globe have a quality standard of these Medical Tourist Hospitals that they can relate to and are familiar with since they are the same accreditation at home.
So what is international accreditation exactly? In many developed nations around the world, hospital accreditation has been in the making internally for time now. An example would be Joint Commission within the United States. As such, many older nations have naturally become the guru of quality in the healthcare industry, setting the bar for others to follow. For an example, recently, China has begun on their set of healthcare reforms. When it came to the topic of quality, they used the United States accreditation standards as a precedence for which they can set and work with. (3) As such, accreditation standards used here in the United States are being used by foreign countries to access their own healthcare systems. Therefore, many new prosperous nations seek the services of major international healthcare accreditation group in order to bring their own hospitals up to the global standards. Aside from improvement of quality service to their own citizens among these countries that have seek international accreditation, they also seek the accreditation on the basis of quality assurance to medical tourists, hoping to market themselves better in the process and attract more medical tourists to their facilities. This will secure their competitive advantage to better deliver care as well. Many foreign governments are getting into the game also due to the fact that medical tourism is becoming a huge industry among these countries bringing in revenue and growth to their economy in the process. As such, international accreditation will enable them to better market themselves to foreign citizens and attract them thus fueling the growth of their own healthcare industries within their perspective borders.


International Healthcare Accreditation Agencies
As a result of increasing demand of accreditation, the Trent Accreditation Scheme came into the expansionist policy that it is right now. Based in the United Kingdom, it was the accreditation force behind much of the hospital systems within the nation and for her colonies. As a result, as England began losing control over much of their former colonies, the Trent Accreditation Scheme still remained as a huge player in many of those countries, including former colonies of the crown in Asia specifically Hong Kong. As such, the organization was pushed into the international stage.
Joint Commission International is a group that we are all familiar with. Recently, it has expanded to well over 60 other countries around the world, and through it international accreditation activities in many countries, it would bring an income to the parent company of Joint Commission which is based in the United States. This would further show how high the demand is for hospitals around the world to be recognized as on par with American hospitals thus being able to compete for patients to enter into their market.
The International Society for Quality in Health Care is an accreditation organization that operates as an umbrella organization for its accreditation groups across the globe. Being based in Ireland, the group operates as primarily a consulting group that would further the quality of healthcare of the hospitals that they are working with. (5)


The Government as a Healthcare Quality Control Entity
With such significant profound effect on the population of any society that health care have, government is definitely a significantly important stake holder. As such, a lot of times, government would demand quality from healthcare providers so that the patients going through those hospitals will get better and not worse and the way that government influence healthcare quality is by means of laws, legislations and rewarding of reimbursements.
An example of legislation that has an effect on quality care and patient safety is the Patient Safety and Quality Improvement Act that was passed in 2005. (5) Through this bill, it established a system of patient safety organizations in order to encourage the discussion of case complications and how to avoid them.
The legislation is attributed as a response to the publication of “To Err is Human” by the Institute of Medicine 1999 report. Within this report it points to the staggering numbers that medical errors have on people. The report’s finding suggests that most errors are not the result of human error, but as the result of error within the process, an error that can be fixed by administrative diligence. Therefore, the report recommend that administration on all levels work together to improve safety making it harder for all levels within the system to make a mistake while making it easier to avoid preventable errors.
Other initiative including bargaining power that the government has in the forms of reimbursements control where hospitals have to be eligible for them, and as a result, giving rise to powers such as Joint Commission, where the government will not qualify a hospital unless they have accreditation from Joint Commission or one of their major competitive alternatives.


BIBLIOGRAPHY
1. Raik, Eva. "Bmj.com Rapid Responses for Braithwaite, 323 (7310) 443-446." Bmj.com:. Aged Care Accreditation in Australia, 7 Nov. 2001. Web. 02 July 2010. .

2. "Contribution to the Reflection Process for a New EU Health Strategy." Venice Italy: Regional Health and Social Department, Web. 06 July 2010. .

3. Lipson, Roberta. "Investing in China's Hospitals -- CBR Nov-Dec 2004." The China Business Review: The Magazine of the US-China Business Council. Web. 03 July 2010. .

4. "Facts about The Joint Commission | Joint Commission." The Joint Commission. Joint Commission. Web. 13 Nov. 2009. .

5. "International Society for Quality in Health Care Inc, Accreditation." International Society for Quality in Health Care Ltd. Web. 01 Aug. 2010.

6. Six Sigma Job: Master Black Belt/Six Sigma Consultant- Telecommut." I Six Sigma Job Shop - Six Sigma Jobs. Web. 02 Aug. 2010. .

Process mapping in healthcare

A simple process map is depiction of sequence of information and material flow involving business entities (actors) using a standard set of symbols (BPMN/ADONIS) [1]. In 1921, Frank Gilberth introduced the first structured method for documenting process flows. Enhanced process mapping depicts functional units and roles using swim lanes. They start with level zero and progressively increase showing higher level of granularity. Although not exhaustive, the paper briefly describes the objectives, types, and best practices in process mapping.
Objectives of process maps
Process maps are fundamental to information capture. It is the building block of any new or improvement project.
 Even though not always entire objective, a process map reproduces pre-existing reality. It allows us to contrast actual flow to the ideal flow.
 They help getting past organizational silos [2].
 We may employ process maps in a variety of scenarios like B2B (between organizations as in case of revenue cycle management), B2C (hospital patient interaction like outpatient and inpatient procedures), and B2E (employee to hospital interaction).
 Discover complexity, redundancy, and blocks in the process, help to revaluate underlying assumption and predispositions
 Identify location where there is a need to collect additional data and investigate [3].
Different types of process map
Process map comes in several flavors each highlight a different aspect and intended for a different audience.
 High-level process flow shows core process within the organization. It shows the interaction between entities. Low-level process flow shows decision gates and loops
 Cross-functional maps that use swim lanes, which allow the slotting of the activities among department or roles indicating the organizational structure and complexity involved.
 Value stream maps that capture wait times, and additional attributes like inventory, throughput, and flow time.
 SIPOC diagram which shows the high-level visual between suppliers, inputs, process, outcomes, and customers (refer to appendix).
There may be other variations of process maps, either tailored or derived to meet specific circumstances
Best Practices
 Articulate the problem clearly and specifically using information available.
 Involve the stakeholder group to participate in the modeling process
 Determine the boundary or scope of the process to facilitate data collection and retain focus.
 Determine and sequence the steps identifying the start and the end-points and the customer.
 Start with high level and drill down progressively. Maintain consistency at each level.
 Test for completeness of the map at each level.
 The mapping exercise must be led by a facilitator who
 Must have a neutral stand
 Must set ground rules of engagement
 Will create an environment for brain storming
 Keep the exercise on track by parking contentious issues, keep focus on “value to the customer”

Conclusion
Process mapping spans across the “Define” and “Measure” phase of DMAIC framework of 6-Sigma and discovery of the “hidden plant” used in Lean. Define-Measure-Analyze-Improve-Control (DMAIC) is a framework for 6-Sigma implementation. The Define phase identifies the opportunity set for improvement and Measure phase quantifies the current state in terms of contextually relevant indicators. Hidden Plant is a lean construct denoting the unreported rework and scrap that goes into the outcome of a process.
Patient focused Integrated Care Pathways (ICP) is a good derivative of process map. They act templates to deliver care fostering evidence based medical practice. The ICP is not rigid but allows the variation in the clinical intervention depending on unique needs of the patient. The ICP serves as a reminder to document the variations in care from published guidelines. This in turn supports management of clinical risks and modification of the contents of the ICP.
Process mapping lays the foundation of any problem solving assignment. It also is an excellent tool to capture and transmit best practices in the organization and in the industry. Sophisticated information systems integrate process maps with packaged application making configuration and customization simpler and easy to maintain. Lean Six Sigma uses this methodology extensively to evaluate as-is state and create to-be state. It allows easy visualization of check- points to measure, monitor, and sustain activities in the process.

References
[1] eBusiness in Healthcare From eProcurement to Supply Chain Management Series: Health Informatics Hübner, Ursula; Elmhorst, Marc A. (Eds.)
[2] What’s in a care pathway? Towards a cultural cartography of the new NHS Ruth Pinder,Roland Petchey,Sara Shaw,Yvonne Carter. Sociology of Health & Illness Vol. 27 No. 6 2005 ISSN 0141–9889, pp. 759–779
[3] The Premier Healthcare Alliance. http://www.premierinc.com/about/mission/social-responsibility/cares/process-maps.pdf
[4] What is an integrated care pathway? Sue Middleton, Jane Barnett, David Reeves. Hayward Medical Communications. www.evidence-based-medicine.co.uk
[5] A toolkit for Redesign of healthcare. AHRQ. http://www.ahrq.gov/qual/toolkit/tkformf.htm
[6] http://facultyweb.berry.edu/jgrout/processmapping/Swim_Lane/swim_lane.html
[7] http://www.hfma.org/Templates/InteriorMaster.aspx?id=21198

History of healthcare quality

History of Healthcare Quality
The earliest notions of quality traces back to that of the “quality of life” elucidated in the Vedas. Subsequently, “quality of living” became the norm of a materialistically motivated society. Product and service quality are offshoots of this paradigm. However, in this brief paper we will focus on the history and evolution of quality in the recent past.
History of quality is probably as old as medical care itself.
Voluntary programs
 Explicit and systematic use of death rates as a quality indicator by Florence Nightingale in mid 1800s marks the emergence of the quality assurance in healthcare.
 The Flexner report in the early 1910[1] on the quality of medical education in the US was the first wake up call for reforming quality of medical education.
 In 1915s, Ernest Codman gave the idea of outcome oriented medical audit which led to the establishment of the Hospital Standardization Program of the American College of Surgeons in 1918s[2].
 Avedis Donabedian inspired by Codman conceived the Structure-Process-Outcome theory[3]. According to him, quality is a product of two factors. One is the science and technology of providing care and the second the application of first factor in practice. He proposed that the components of quality in healthcare consisted of efficacy, effectiveness, optimality, legitimacy, equity, and acceptability[4].
 In 1950-60s, JCO adopted Donabedian’s theory and created quality assessment and improvement framework based on physical and staffing characteristics of caring for patients, the method of delivery, and the results of care. Over the years, JCO’s mission grew to embrace most healthcare settings[4].
Government regulatory programs
 State licensing programs prevailed in 1800s.
 In 1906, the FDA (Food and Drug Administration) undertook the national regulation of medication.
 In 1935, the Social Security Act set the standards for maternal and child health.
 In 1965 Medicare was institutionalized mandating principles central to hospital operations, staff credentialing, round the clock nursing care, and utilization review.
 In 1980s, Healthcare Quality Improvement Initiative allowed professional standards review organizations to apply patient care algorithm to claims history and data set to screen cases and describe how well the care conforms to established guidelines[5].
 On March 23, 2010, President Barack Obama signed The Patient Protection and Affordable Care Act into law. One week later, he signed The Health Care and Education Reconciliation Act of 2010, which made numerous changes to PPACA. This is likely to bring forth into play new patient care model, continuum of care, new AHRQ programs, metrics based reporting and a data driven national quality strategy.
Applying evidence to health delivery
Institute of Medicine defines quality in healthcare service as being safe, effective, patient centered, timely, efficient, and equitable[6]. There is a lag between discovery of efficacious forms of treatment and its incorporation into routine patient care[7]. In the recent past several private public partnerships like the Cochrane Collaboration and evidence based practice centers supported by AHRQ have emerged providing excellent models for quality care. Evidence based practice was started by Archie Cochrane in 1950s. It became apparent that it was not effective to train and encourage clinicians to independently find and apply best clinical practices. Quantitative systematic reviews began to appeal to the physician’s scientific outlook over qualitative “suggestions.” This eventually paved the way for healthcare to embrace the six sigma and lean frameworks.
Since 1980s there has been a steady transition from a needs based to an efficient profit making industry by adopting quality concepts like TQM, quality trilogy, and zero defects. Deming, Juran, and Crosby were the three quality gurus whose expansive work in the field of quality brought radical changes in other industries especially automotive. During 1980s, the John Hartford Foundation and Harvard Community Health Plan sponsor the national demonstration project on quality improvement in healthcare to determine if industrial TQM applies to healthcare[8].
Conclusion
We see that astute individuals, federal regulations, and other industrial best practices have shaped the quality in healthcare. Everyone understands the notions of superior quality. The challenge has been to have create mass momentum to make sure quality is not a matter of adherence but rather a thing of constant engagement.
 
References
[1] The Flexner Report at the Century Mark. A Wake-Up Call for Reforming Medical Education. Mike Mitka JAMA. 2010; 303(15):1465-1466
[2] Evaluation of the care of patients Codman Revisited. John D. Porterfield, M.D. Director, Joint Commission on Accreditation of Hospitals. Vol. 52, No. 1, January 1976
[3] The evolution of quality in the US health care industry: an old wine in a new bottle. Patrick Asubonteng, Karl J. McCleary and George Munchus University of Alabama, Birmingham, Alabama, USA
[4] An introduction to quality assurance in health care. Avedis Donabedian, Rashid Bashshur
[5] Luce JM, Bindman AB, Lee PR: A brief history of health care quality assessment and improvement in the United States. West J Med 1994; 160:263-268
[6] Crossing the Quality Chasm: A New Health System for the 21st Century (2001)
Institute of Medicine (IOM)
[7] Balas E, Boren S. Managing clinical knowledge for health care improvement. In: Bemmel J, McCray AT (eds). Section 1: health and clinical management. In Yearbook of Medical Informatics: Patient Centered Systems. Stuttgart, Germany: Schattauer Verlagsgesellschaft; 2000:65-70
[8] Quality in health care: theory, application, and evolution. Edition: 3 - 1995 Nancy O. Graham

Addressing Quality in Health Delivery Part 2

IV. ELEMENTS OF QUALITY IN A PROVIDER SETTING

Within a provider setting, quality can be scrutinized in a number of functions.
1. Information Management – Any judgement is only as good as the information on which it is based. Healthcare is no exception. Disparities in provision of care can be minimized by carefully managing information. Some of the ways are given below[5]
a. Stratify clinical performance measures according to socioeconomic/ethnic disparities
b. Make information available for public reporting
c. Synchronize data collection efforts
2. Create an alternative for fee for service - The fee-for-service payment system in the United States leads to more care, but fails to create high-quality and efficient care. Some of the alternatives include
a. A new payment model based on a set of severity adjusted evidence-informed case rates (ECR). Risks maybe categorized as [6] –
i. Probability risk (Based on the likelihood of a negative event not controlled by the provider). Example: genetic makeup of the patient. This will be the financial responsibility of the insurer
ii. Technical risk (Providers responsibility). This includes readmissions. One of five Medicare beneficiaries discharged from the hospital is readmitted within 30 days, and half of non-surgical patients are readmitted to the hospital without having seen an outpatient doctor in follow-up [8].
3. Eliminate process waste through Lean management initiatives – The core idea is to replace waste with value. Value is defined as the capability to deliver exactly the (customized) product or service a customer wants with minimal time between the moment the customer asks for that product or service and the actual delivery at an appropriate price [11]. The key here is that value must be defined from a consumer perspective.
In sum, all quality endeavours point to incremental and sustained integration between interfacing entities in the healthcare provider space. Let us talk about the each of them in brief.
V. INFORMATION MANAGEMENT

Information has to be managed from creation to archival such that it is accurate, contextually relevant, and available in a timely manner. Only such information is of value. Example - Clinical performance measure is a subtype of quality measure and captures data on access, outcome, patient experience, process and structure during episodes of care. Non clinical data such as master patient index are also to be managed with care.
Pros
1. Quality measures are used for process improvement, higher accountability and research
2. Avoid repeat therapy. This is especially valuable in case of indigent care and charity care
Cons
1. Even though these data are collected by institutions they are largely for private use. Public sharing of such information is neither mandated nor voluntarily offered. The reason is that this genre of information is considered to be of competitive advantage and fiercely protected by the providers.
2. The physicians perceive that every patient with associated medical conditions is unique. The nature of relationship between physician and the hospitals are contractual and there are not enough incentives for the physicians to devote additional time towards such initiatives.
3. Data collection puts additional strain on human and technological resources. Smaller institutions may not have the resources to bring in these practices
VI. PAYMENT REFORM – BUNDLED PAYMENT
At the very heart of integrated care is the bundled payment. It would mean more collaborative care. Bundled payments provide a single payment to both hospitals and physicians thereby creating the need for synergy between hospitals and physicians.
Pros
1. 180 degree turnaround on the current mode of payment. Hospitals and physicians, currently paid on separate fee schedules, would now have financial incentives to collaborate and work together.
2. Is likely to bring down the number of readmission through shared accountability
3. Will pave the way for unified billing
Cons
1. Likely to cause a disruption in the current system. Adoption will be slow and recalcitrant. Needs the cultural change of “putting patients first”.
2. Will encourage more hospitals to have physicians on salary and will be resisted by the older generation of physician community. Smaller physician(s) or groups will eventually be driven to join larger groups
3. It is possible that short term cost cutting initiatives will result is degrading the value offered to patients resulting in delayed access.
The Medicare Payment Advisory Commission has created a policy path to transition to bundled payments. This includes [13] [14]:
1. Phasing-in various aspects of bundled payments first, to providers who are fairly well integrated, and then slowly encouraging other providers to adopt the payments.
2. Capture and share service and resource usage data
3. Adjust payment based on resource use over an episode of care on select conditions (acute care)
VII. LEAN MANAGEMENT

Lean is an innovative philosophy that can be applied to the health delivery processes to sustain operational quality and address socio technical issues. Operationally Lean management provides better organization, increased productivity and reduced waste – all encouraging process improvement by reducing process variation. The technical risks or artificial variability has a lot to do with the efficiency of health delivery and often contributes to “waste” in the system.
In the healthcare world, there are multiple definitions to value. The administration may have interest in the quality adjusted life year value while the physician may concern himself only with the clinical value. According to Lean the value is an inherent property of the system at work bounded by design and not by the individual talent or will. Lean initiatives are at the heart of Integrated Care Programs or Pathways.
Pros
1. Artificial variability related to controllable factors is minimized in the design and management of healthcare systems. One example of artificial variability is medication management.
2. By balancing operational and socio-technical aspects of Lean, exponential improvements are possible. Value stream analysis is a good way to make sure the process and the people performing the process are aligned.
3. Will naturally help the evolution of integrated pathways for care and administration
Cons
1. Natural variability of the process is caused by the fact that no two patients are identical. This has to be recognized while applying Lean management in healthcare.
2. The practice of Lean thinking could negatively impact the population of healthcare workers. WHO data suggests there are about 6-7 million healthcare workers in the US including, pharmacists, midwifes, physicians, nurses, lab workers, management and support workers. This can be pre-empted by fostering a culture of Lean and managing change responsibly.
3. Will need information standardization and sharing
4. Healthcare professional are trained to be fiercely independent and need to be aligned to the merits of collaborative care and working in an interdependent environment.
5. Qualified leaders and managers that foster creation of an environment of collaboration are scarce. This manpower is vital for success.
6. Lean is not a piece meal approach but system wide. So it requires top level endorsement. The senior management must trust Lean to increase value for the patient and drive profits.
Socio-technical aspects of Lean - Lean interventions have the potential to make jobs simple and accurately repeatable. Simple jobs may not be found to be challenging enough for highly trained physicians. Lean interventions may also give rise to jobs that require more thinking, planning and responsibility which may be resisted by workers depending on the nature of employer-employee relationship.
VIII. POLITICS AND POLICY OF REFORM – NOW AND ROAD AHEAD
A Commonwealth Fund survey shows the following [19]
1. 70% of the opinion leaders think that the fundamental payment reform is at the root of meaningful reform
2. 62% of the leaders feel that fostering integrated health delivery systems is the most effective way to bring down healthcare costs
The HITECH act is a great example of what the government can do to empower the health delivery systems to build quality in their domain. In the current reform drafts, the president has set a target of 155 billion in costs saving from the hospitals that translates roughly to about 2.6 million per year per hospital in cost savings. Interestingly the hospitals CEOs are upbeat on achieving this target using a variety of methods including Lean [18].
From 1912 till today there have been several attempts at tactical health reforms. These have not been strategic successes because they have been at odds with the core interest and benefits of the Americans at large. In my view, a high level roadmap could be as follows:
1. Bring on payment reform through bundled payments. Government must help providers to structure themselves to adopt the new payment mechanism. Hospitals will play along if they are incentivized as with HITECH Act to work in a collaborative model. It will bring up new models of nurses-physician-hospital/group engagement.
2. Create incentives to adopt integrated delivery systems with targets to reduce adjusted cost per episode of care, year on year. The government will struggle to make this objective and set up outcomes reporting mechanism.
3. Create health exchange to share information from both insurance and provider. It will have ample support from consumers and insurers, who will begin to enjoy more choices among providers. Hospitals will drag their feet because it would means sharing of competitive information. They will come along as they see its merits in providing indigent care. The government will have the opportunity to conduct evidence based research using this data to arrive at setting national levels of care and reimbursement guidelines.
Some of the factors that can aid the reform can be
• Continued tort reform like putting a limit of the economic damages
• Decrease “morale hazard” by getting the consumers to have a stake in keeping the cost of healthcare spending down (perhaps through health savings accounts)
• Putting a cap on the administrative costs of insurers.
The steps above is likely to result in reduction of redundant therapy (repeat imaging services), address over-reimbursements issues, expand the scope of practice for non physicians, reduce medical errors and create incentives for preventive medicine. Subsequent to the quality based reform, the government can proceed with legislations to increase coverage and introduce public option. For now moving the reform on the quality angle allows us to keep the value of healthcare proportional to the cost – a proposition that will resonate with the most Americans.

IX. REFERENCE
[1] Socialism vs. Capitalism: Which is the Moral System? On Principle, v1n3 October 1993 by: C. Bradley Thompson. [Available] http://www.ashbrook.org/publicat/onprin/v1n3/thompson.html

[2] Public Health Then and Now January 2003, Vol. 93, No. 1 | American Journal of Public Health by: Beatrix Hoffman, PhD [Available] http://www.ajph.org/cgi/content/abstract/93/1/75

[3] About that health-reform cost study Tuesday, October 20, 2009: by Karen Ignagni. [Available] http://www.washingtonpost.com/wp-dyn/content/article/2009/10/19/AR2009101902936.html

[4] Inequality in quality: addressing socioeconomic, racial, and ethnic disparities in health care. JAMA. 2000 May 17;283(19):2579-84: by Fiscella K, Franks P, Gold MR, Clancy CM. [Available] http://www.ncbi.nlm.nih.gov/pubmed/10815125

[5] Lean and Collaborative care at Thedacare. [Available] http://www.leanblog.org/2009/10/lean-collaborative-care-at-thedacare.html

[6] Francois de Brantes: A New Payment Model for the U.S. [Available] http://www.commonwealthfund.org/Topics/Health-Care-Quality.aspx

[7] The Nation’s Health Dollar, Calendar Year 2007: Where it Went? [Available] http://www.cms.hhs.gov/NationalHealthExpendData/downloads/PieChartSourcesExpenditures2007.pdf

[8] New Study: 20 Percent of Hospitalized Medicare Patients Readmitted To Hospital Within 30 Days; Half Rehospitalized Without Seeing a Doctor After Discharge. [Available] http://www.commonwealthfund.org/Content/News/News-Releases/2009/New-Study-20-Percent-of-Hospitalized-Medicare-Patients-Readmitted-To-Hospital-Within-30-Days.aspx

[9] Change the Microenvironment: Delivery System Reform Essential to Controlling Costs. [Available] http://www.commonwealthfund.org/Content/Publications/Commentaries/2009/Apr/Change-the-Microenvironment.aspx

[10] State wise per capita income. [Available] http://www.bea.gov/newsreleases/regional/spi/2009/pdf/spi1009pc_fax.pdf

[11] Application of lean thinking to health care: Issues and observations [Available]: International Journal for Quality in Health Care 2009; Volume 21, Number 5: pp. 341–347 Advance Access Publication: 19 August 2009

[12] Using Measures. [Available] http://www.qualitymeasures.ahrq.gov/resources/measure_use.aspx

[13] Bundled Payment. [Available] http://www.andrew.cmu.edu/user/aspark/policyarea.html

[14] MedPac [Available] http://www.medpac.gov/transcripts/0408_pathtobundling_public_pres.pdf

[15] WHO [Available] http://apps.who.int/globalatlas/dataQuery/reportData.asp?rptType=3

[16] Wikipedia QALY [Available] http://en.wikipedia.org/wiki/Quality-adjusted_life_year

[17] Going Lean in Health Care. IHI Innovation Series white paper. Cambridge, MA: Institute for Healthcare Improvement; 2005. [Available] http://www.IHI.org

[18] Hospital CEOs: Reform savings goals doable with lean, Six Sigma, Toyota methods. [Available]
http://www.fiercehealthfinance.com/story/hospital-ceos-reform-savings-goals-doable-lean-six-sigma-toyota-methods/2009-09-10

[19] Commonwealth Fund. Commonwealth Fund Health Care Opinion Leaders Survey, April 2009. HCOL_Slowing_Growth_of_HC_Costs__Chart_Pack_Slides_04242009_PF [Available] www.commonwealthfund.org

[20] AEI Outlook Series: The Politics and Principles of Health Care Reform by Joseph Antos [Available] http://www.aei.org/docLib/11-HPO-Antos-Sept-09-g.pdf

Addressing Quality in Health Delivery Part 1

Abstract: Understand the healthcare reform in the context of the social and economic factors. Analyse the alternatives in the reform and their tradeoffs. Provide a workable framework and discuss its sustainability.

I. BACKGROUND
The current efforts in reform have seen two proposals emerge. Both primarily address the issues around coverage and tried to resonate with American vote bank. This is quite akin to catching a tiger by its tail because the serious cost repercussions associated with addressing coverage is likely to bring on a financial disaster in the near future. A look into the social stratification will help us understand the economic and social preferences of the country.
A. Creation of classes - America has been neither a collectivist (socialist) nor an individualist (capitalist) state. History of America is dotted with experiments in creation of a mixed economy and welfare state - a system that permits private property at the discretion of government planners. As a consequence three classes of people have been created. First - a class that survives on the wealth sourced from the working class - typically includes the indigent and “habitually” unemployed (people who have no motive to earn a livelihood). Second - the working class which is a taxpaying, law abiding segment (includes the non working retirees). Third - a class of government planners and wealthy influencers who are typically at the top of the food chain. [1]
B. Social/Industrial/Economic/Movement – There has been a gap between the healthcare reformers and their political constituencies. So while grass root activism has won minor changes, it has not been able to alter the very nature of the system [2]. The demographics of the patient population, a 500 billion USD insurance industry, vested interests of the members of the Congress to get re-elected, gullibility of the people and dissemination of misinformation by media are some of the factors to be recognized while providing a critical analysis of the health reform.
The raison d'etre of the health reform is to make available a good quality healthcare infrastructure for the people of America and that is possible only when the reform is based on quality frameworks that will reduce cost and make it meaningful for people to get insured. The remainder of the paper will outline one such possible framework.

II. THE ECONOMIC AND SOCIAL FACTORS AT PLAY

The healthcare system today is unstructured and has misplaced financial incentives. The economic theory of “morale hazard” has played out among the players in the current system. As a result the system has been abused by all those who participate in it. Some of the current social and economic factors at work are listed below.
• Social factors
o Aging population, a small percentage of which is consumes most of the healthcare expenses
o Indigent, uninsured and underinsured population resulting in a skewed flow of finances for episodes of care.
o Distorted ratio of care givers between primary and specialty levels
o Providers preferring more number of diagnostic tests to appease patient sentiments and to practice defensive medicine
o Death is viewed not as a natural phenomenon but rather a scientific challenge that needs to be overcome.
• Economic factors
o Cost of care high with respect to outcomes in care rendered in comparison with other developed nations
o Insurance providers have more interest in return on equity than providing indemnity for patients. Currently there are no cross-state plans.
o High cost of medication and lack of medication management
o High cost of education leading to debts that the doctors seek to recover through fee for service reimbursements. The fee-for-service payment mechanism has been recognized as a challenge.
o High cost of compliance for numerous regulations, liability insurance and technology.
o Medication errors, re-admissions and death.
o Declining economy and earnings but increasing sickness is draining the state exchequer.
o Misplaced competition currently focuses on shifting of cost among government, insurer and provider. The competition must be brought back into the provider space so that they are able to bring value to the patients through low cost and high standard of care. This single value driver will give them competitive advantage and consequent market share. Transformation in this segment will positively impact other areas of the healthcare system.

III. STATE OF THE CURRENT REFORM

Coverage Pros
• Requires individuals to have health insurance. It is enforced through individual mandate and by raising the income limit for Medicaid eligibility. Insurance is proposed to be made available through state seeded health gateways or health exchanges. Includes penalties for non compliance and subsidies/exception for special cases
• Employers mandated to offer health insurance or pay a penalty if employee chooses to buy from exchange. Employers to pay at least 60% of the premium.
• Insurers cannot deny coverage on grounds of pre-existing conditions in non group market. Create a high risk pool for all people with pre-existing conditions and cover them through consumer driven co-operatives.
Coverage Cons
• Constitutional hurdle in warranting health insurance as a prerequisite for citizenship.
• Penalty may be lower than the overhead of providing insurance. This could also lead to unintended consequence like retrenching regular employees in favour of subcontractors.
Cost Pros
• No annual and lifetime limits on coverage. Limit on annual spending by the enrollee. Issue community rated insurance plans (premiums charged differ only on basis of age and gender)
• Higher scrutiny of insurance companies.
• Employ payment bundling to contain cost.
• Public option as a competition to private insurance companies
Cost Cons
• Will warrant major regrouping of the insurance companies and the providers. Smaller independent practices will have to merge into larger networks.
• May cause people to defer buying good insurance plans until they become sick.
• Insurance companies will find work around to “cherry pick and lemon drop”
• Younger population likely to pay inflated premiums for coverage not suitable to their circumstances.
• Government run program have historically shot over their budgets [3].
Quality Pros
• Explore bundled payment
• Preventive medicine and evidence based research
Quality Cons
• Objectives are not quantitative and the efforts may not give instant results.
• Unless quality drives are not driven by value directives (low cost, acceptable standard of care resulting in patient well being), it can be counterproductive.
• Hospital and physician services each account for about one third of private healthcare spending [7]. The outcomes do not commensurate to the level of spending seen.
The diagram below depicts a schematic interplay of different actors in healthcare. Though the issues of quality are quite pervasive, this paper will limit itself to the application of quality in the provider space. The problem statement is as follows: What needs to be done in the provider space to ensure every American can get affordable medical care based on their needs (and not on preferences, tastes or wants). In the diagram below, the arrows leaving the rectangle show an outflow of money (Expenses) and the arrows incoming to the rectangle show and inflow of money (Income)

HIPAA– Legal and Technological implications

Abstract: This paper covers fundamentals of the Health Insurance Portability and Accountability Act (HIPAA). Through case studies, it examines some of the practical aspects of administration and enforcement of HIPAA. It makes observations on how EHR (Electronic Health Record) and internet are posing new challenges to the healthcare community.

Keywords — PHI, EHR, HIPAA, Internet, Privacy, OCR, HHS, HITECH

I. EXECUTIVE SUMMARY

HIPAA is separated into two sections.
1. The first is called “Health Care Access, Portability, and Renewability”, It relates to two acts: the Employee Retirement Income Security Act and the Public Health Service Act. This part of the Act protects the insurance coverage of workers between jobs or periods of unemployment.
2. The second is called “Preventing Health Care Fraud and Abuse; Administrative Simplification,” It defines HIPAA offenses, sets penalties for HIPAA violations, HIPAA regulations, and creates programs to control fraud and abuse within the healthcare system. The scope of the paper is limited to this part of act.
A. HIPAA and EHR
EHR is a technology aid for automating (not replacing) activities in healthcare provisioning. It ensures better process control, reduces medication errors and provides controlled access to patient information (protected health information (PHI) and patient identifiable information (PII)) under HIPAA. However the very technology poses new risks like misuse of privileges, vulnerability of systems hacking (frail solutions), poor adoption among healthcare staff etc. This warrants organizations to train their staff and build awareness. This has been a challenge far bigger than what most would imagine.
In the next few years we will see rapid EHR rollouts as a result of the Health Information for Economic and Clinical Health Act (HITECH). This opportunity also presents new challenges to be addressed like stronger penalties, stringent enforcement and contractual ramifications for Business Associates.
B. HIPAA and Internet
Pervasive computing has touched almost all areas of our lives. It has altered the channels of communication and the speed at which information is exchanged. However this presents new challenges too. While internet facilitates instant communication, HIPAA has to do a fine balancing between freedom of communication and right to privacy. Some of points to note are below:
• With growing use of internet, social networking and third party PHI storekeepers, the risk of unwarranted PHI disclosure has increased. It is likely that Google and Microsoft will be liable under HIPAA if the provider community collaborates with them as its Business Associates.
• With changing social dynamics, it becomes meaningful to understand how the ownership of PHI has to be shared by both the patient and the provider. Some alternatives are explored in a search to seek answers for these questions.
The paper ends with a brief outline of enforcement statistics and the road ahead.

II. INTRODUCTION TO PRIVACY

The Privacy Protection Safety Commission states that privacy is a personal and fundamental right to the citizen protected by the US Constitution. Privacy violation results from information misuse arising from unauthorised collection and use of protected individual information. A victim of such a wrongdoing is likely to be impacted by one or more of the following:
• Vulnerability
• Emotionally distress
• Humiliation
• Loss of opportunities.
In an ongoing attempt to uphold privacy, a number of acts have been instituted. Some of them are below:
1. Privacy Act of 1974
2. Confidentiality of Alcohol and Drug Abuse Patient Records Regulations
3. Family Educational Rights and Privacy Act (FERPA)
4. Americans with Disabilities Act (ADA)
5. Genetic Information Nondiscrimination Act (GINA)
6. HIPAA
7. Patient Safety and Quality Improvement Act of 2005 (PSQIA).

III. PILLARS OF HIPAA

HIPAA shifts the responsibility of information privacy from the patients (through simple consent forms) to the covered entities. It addresses several major areas:
• Privacy – Prevent misuse of patient information by safeguards
• Security – Protect information during storage and provide authorised access to patient information.
• Master data – Unique identifiers for interacting entities in a healthcare setting
• Standardization - Industry standard information exchange to reduce manual effort and clerical error.
• Business associate contracts – Important in outsourced services.

IV. PENALTIES FOR HIPAA VIOLATION


1 Offender did not know, and by exercising reasonable diligence would not have known, that he or she violated the law(Ordinary negligence) $100 for each violation, except that the total amount imposed on the person for all such violations of an identical requirement or prohibition during a calendar year may not exceed $25,000
2 Violation was due to reasonable cause and not willful neglect(Ordinary Negligence) $1,000 for each violation not more than $100,000 cumulative
3 Violation was due to willful neglect and was corrected (Gross negligence) $10,000 for each violation not more than $250,000 cumulative.
4 Violation was due to willful neglect and was not corrected(Gross negligence) $50,000 for each violation and not more than $1,500,000 cumulative.


The Department of Justice (DOJ) says that criminal penalties for a violation of HIPAA are directly applicable to covered entities and even its employees (under “corporate criminal liability”). Where an individual of a covered entity is not directly liable under HIPAA, they can still be charged with conspiracy or aiding and abetting. In the HITECH Act HHS is provided with new audit authority to conduct periodic audits and ensure BAs and Covered Entities are compliant with new rules.

The DOJ interpreted the "knowingly" (wilfully) element of the HIPAA statute for criminal liability as requiring only knowledge of the actions that constitute an offense.

V. EXAMPLE - HIPAA VIOLATION –INFORMATION SECURITY
The case discussed below highlights the potential magnitude of the impact of a HIPAA violation.
A. Case
The Federal Trade Commission (FTC) opened its investigation into CVS Caremark following media reports from around the country that its retail pharmacies were disposing PHI into open, publicly accessible dumpsters. The PHI was contained on labels on pill containers. The information included patient names, addresses, physicians’ names, medication and dosages; consumers’ personal information, employment applications, social security numbers, payroll information; and credit card and insurance card information. Simultaneously HHS opened its investigation into the pharmacies’ disposal of health information protected by HIPAA.
CSV was charged with violations for the following
• Lack of sound processes and policies to ensure HIPAA compliance
• Lack of employee training for dealing with PHI
• Lack of internal measures to assess and assure compliance with its policies and procedures for disposing of personal information
• Misleading and superfluous privacy policy statement.
CVS paid HHS $2.25 million to settle the matter.
Discussion: Is CVS a covered entity? Yes it is. Under 1861(s) of the Act, 42 U.S.C. 1395x(s), CVS (Retail Pharmacy chain) provides medical supplies and biological that may not be self administered and that are furnished as an incident to the physician’s professional service. So HIPAA applies to it.
What is the nature of information that CVS failed to handle with reasonable? The FTC press release states that there was sensitive information pertaining to patients and its own employees. It is important to note that patient health information as well as employee medical information falls under HIPAA. CVS compromised PHI and PII.
Where did CVS fail? CVS violated the following tenets under HIPAA even though no discernable harm had been reported
• Security.
• Privacy.
CVS response has included a settlement amount higher than any other payout on HIPAA violation so far.
CVS Caremark made claims such as “CVS/pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your health information.” The FTC alleged that the claim was deceptive and that CVS Caremark’s security practices also were unfair. Unfair and deceptive practices violate the FTC Act. Subsequently CVS entered into a consent order with the FTC to resolve claims made by the latter. As a part of the Corporate Integrity Program, CVS agreed to institute a Corrective Action Plan (CAP). It requires CVS, in the next three years, to create processes for
• Correct disposal of PHI
• Institutionalize a training program
• Have a third party audit to certify the effectiveness of the CAP.
A similar example is found in the case against Providence Health and Services in June, 2008.
What is missing? Some of the missing facts that could have given us a better insight into the magnitude of violation are
1. Total number of records compromised
2. Number of locations where the breach took place
3. Number of medical or financial identity thefts following the time span from when the violation has been happening.

VI. EXAMPLE – LACK OF AWARENESS

As the concerns of HIPAA become pervasive, covered entities are reluctant to share information in a healthcare setting. This has been observed to hamper care in such situations. The case below illustrates this point.
B. Case
An emergency department requested the transfer of a 40-year-old homeless man with a history of schizophrenia and psychotropic dependence to a local hospital for undergoing inpatient treatment. In his psychotic state, the patient was unable to sign for the release of his records. The psychiatrist on call requested the emergency room (ER) to send across the test results and relevant records via fax for review before a decision could be made about transfer. The ER nurse refused to fax the records, stating that doing so would violate HIPAA. Furthermore, the nurse reported that even signed consent to fax the records would not protect her against a HIPAA violation. After the transfer was refused, the records were faxed with the patient's name blacked out.
Discussion: This is a case where the health worker was misinformed about HIPAA law. The Act does not forbid transfer of necessary and pertinent medical information to aid the treatment of the patient. Effective training program for healthcare workers is critical to the success of HIPAA.

VII. EXAMPLE - HIPAA AND INTERNET

With rapid adoption of unconventional communication channels, there is a need to re-assess the applicability of HIPAA laws. A few scenarios are presented below with observations.
A. Case: Patient participates in indiscriminate information sharing

Scenario One: The patient uses the hospital communication network (assuming it is made available) to share PHI to friends. Although the disclosure is by the patient but since the communication has happened over the hospital network which is under HIPAA rules, the hospital could be held liable.

Scenario Two: The patient communicates PHI using public internet and posts it on social networking sites. It is expected that patient will be discrete about his PHI. Should PHI be guarded under HIPAA only as long as the patient is not found being indiscrete, similar to the client-attorney privilege?

Scenario Three: The patient maintains PHI with a third party and not a covered medical entity. (For example Google Health). The privacy is guarded solely on the basis of authorised consent given by the individual to the third party and a declaration by the third party to be discrete with PHI. The PHI in this case is not protected by HIPAA regulations. Internet has always been an unsecured channel for storing and transmitting confidential information. Can HIPAA be extended to cover the third parties as well?

Scenario Four: Posting surgery updates on Twitter. There have been cases when the hospital surgeons have used Twitter to post surgery updates. It is likely that the patient would be discovered if the operation was a one of its kind or if it involved a novel procedure. How can we discourage such practices?

Scenario Five: YouTube advertising. In an attempt to avail lost cost marketing channels, the hospitals are seeking consent from patients to post their surgery on YouTube. It is possible that after the advertisement was posted, the patient develops a complication and suffers at the hands of the providers. Yet the advertisement continues to be featured in the YouTube without any mention of the post surgery complication. This leaves the patient traumatized. Even though the law may offer remedy, most patients are easily intimidated by idea of a legal recourse against their doctors, not to mention the time and money needed to go up against establishments.

VIII. ELECTRONIC HEALTH RECORD AND HIPAA

EHR solution is defined as a system of collecting, using, storing, disseminating and destroying PHI.
The challenges of implementing EHR are few but critical:
1. Adoption of technology by healthcare community. Physicians often find it difficult to work with technological limitations. All EHR rollouts need a strong technology change management to ensure speedy adoption. Health workers are notorious for their tendencies to skirt the process.
2. Under pressure to cut costs, HIPAA compliance may be compromised by undercutting features or robustness. This is particularly true when the solution is based on off the shelf products.
3. While EHR helps reduce human error, it makes HIPAA violations easier to commit. This is accentuated by the lack of organizational commitment to train and create awareness.

HIPAA safeguards in the EHR include the following:
1. Seamless integration to the billing system for transmitting EDI (Electronic Data Interchange) messages between payer and the payee.
2. Maintaining secure communication when employing outsourced talent with emphasis on business associate agreements
3. Instituting role based privileges for data access.
4. Proper budget to train and create awareness on HIPAA to avoid attacks through social engineering and breaches due to unauthorized information sharing. It is said that most unauthorized system access are through social engineering, an act of manipulating people into performing actions or divulging confidential information. This is an important point in a highly computerized environment.
5. Having routine and event based audits
6. Having a security officer to oversee HIPAA compliance and putting checks and balances for physical safeguard and back up of storage spaces for PHI.
7. Having technical safeguards for secure information exchange using encryption protocols and data corroboration
8. Implement privacy policies and risk management programs.

HIPAA violations today seldom remain limited to a violation of privacy. It is usually followed with either an identity theft or false claim or both. The case discussed below examines how HIPAA violations are easily committed with EHR solution in place and how it leads to felony. One critical point to note here is that the medical is owned by the covered entity
A. Case: Violation and Criminal Law

Without authorization or approval from United HealthCare, two of its employees gained access to the company’s electronic database and obtained names and dates of birth of certain patients. The patients had Flexible Spending Accounts and were covered by a prescription drug plan sponsored by the Federal Employees Health Benefit Plan (“FEHBP”). The employees used this information to create fake and unauthorized prescriptions. These were then presented to pharmacies to illegally obtain controlled substances. The drugs were then illegally sold to third parties. The defendants caused a loss of $72,746 to the Federal government by making false claims.
Discussion: In this case the defendants were guilty of HIPAA violation because they acquired the patient information and shared it with others who participated in their plan. Typically it would have been a civil case.
However defendants were guilty of identity theft which is a felony and the criminal law differs from one state to another. In the state of Texas, Fraudulent Use or Possession of Identifying Information is a felony whose degree varies based on the number of records stolen.
In addition, the defendants used the information to defraud the federal government by making false claims for reimbursement. Under False Claims Act this amounts to a felony. The defendants got a 10 year prison sentence and 250,000 in penalty.

IX. SOME MORE HIPAA

This section touches upon other areas where HIPAA has an impact.
• Under HIPAA, peer review documents are typically not discoverable. Unless there is a court issued subpoena, the hospital is not required to share the peer review documentation publicly. Peer review is a platform for physicians to discuss negligence and near negligence incidents without inhibition to ensure that patient safety standards and quality of care is consistently maintained.
• Medical records are owned by the covered entity although the patients have the right to suggest corrections to its contents. Providers may be free to use the information for treatment, operation and payment without any consent from the patient.

X. HIPAA AND HITECH ACT 2009

The HITECH Act has put in following checks and balances with respect to HIPAA. The section below mentions the notable areas impacted.
• Notifications in the event of confidentiality breach
• Business Associate liability
• Disclosures of PHI limited to the “Limited Data Set” or “Minimum Necessary”
• Expanded accountability for individuals
• Sale of EHR or PHI
• Limited use of PHI for marketing purposes and fund raising
• Expanded enforcement measures for HIPAA violations
• HIPAA compliance audits
• Business associate liability – The HITECH Act makes significant changes to the HIPAA laws and rules, many of which will impact relationships between covered entities and their business associates
• HITECH will require BAs to comply with administrative, technical and physical safeguard requirements
• BAs are also required to appoint a security official, develop written policies and procedures, and train its workforce on how to protect electronic protected health information (EPHI)
• BAs will now be directly liable under HIPAA for using and disclosing PHI in violation of their BA agreements
• A violation of the BA agreement will subject the BA to the same civil and criminal penalties as a Covered Entity who violates the Privacy Rule
In case of a breach of HIPAA guidelines, the following have been recommended under HITECH
• Perform a “Risk Assessment”
• Do an impact assessment resulting from the breach. This includes extent of misuse and tracking the parties involved in it. Type and amount of PHI involved -can it reasonably cause financial, reputational or other harm?
• Implement Risk Mitigation procedure
• The Covered Entity or BA has the burden of proof in demonstrating that no breach has occurred.
• Strong documentation of the risk assessment vital.
• Individual notification by first class mail required (unless individual has consented to electronic notice). Substitute notice is required if contact info is out of date. For 10 or more, notification must be either posted on website for 90 days or posted in major print/broadcast media for 90 days. Media and HHS notification required for breach involving 500 or more residents of a state or jurisdiction. For cases involving smaller number of breached records, log files must be maintained on an annual basis.

XI. SUMMARY STATISTICS OF HIPAA ENFORCEMENT

The Department of Health and Human Services (HHS) is under the executive branch of the US constitution charged with protecting the health of all Americans and providing essential human services, especially for those who are least able to help themselves. The OCR (Office of Civil Rights) is the primary agency under HHS to receive complaints on HIPAA violations and act upon them. Of the 45,630 complaints received so far, about 80% of the cases have been resolved. During the course of investigation, it has been discovered that almost 50% of the reported cases were not eligible to be tried under HIPAA. This statistics reflects two things
1. There may be gap in how the Act is interpreted. A good number of people do not understand the nuances of HIPAA in statement or spirit
2. There may be a gap in the jurisdiction of the law itself that needs to be addressed in the future.
The top reasons for HIPAA violations have been cited as
1. Unsecured PHI
2. Unauthorized access
3. Inappropriate and impermissible disclosures
4. Unauthorized disclosures
5. Lack of patient access to their PHI
6. Uses or disclosures of more than the minimum necessary protected health information

XII. HIPAA - DOWNSIDE

Restricted access to patient data has its drawbacks.
1. HIPAA has and will continue to have an impact on research as PHI becomes increasingly difficult to acquire. Consent forms have become longer ever since the regulations came into effect. Studies have shown that there is a decline in the participation rate in clinical trials and human research.
2. HIPAA compliance cost money. With static or diminishing healthcare budgets, there is a threat that HIPAA spending could be compensated by a compromise in the quality of care.

XIII. FUTURE – BENEFITS AND ROAD AHEAD

Benefits of HIPAA cannot be over-emphasized. The key ones are:
1. Allows patient information to be securely sent from one provider to another in a seamless and secure way. This will be more effectively felt when the percentage of providers on EHR solution increase.
2. By guarding patient privacy it protects patients from being victims of criminal wrong doings.
3. Patients are very vulnerable when they are in the hands of the providers. HIPAA safeguards ensure that information shared during patient-provider encounters are kept confidential

Its future depends on some best practices and legislations; some of which are mentioned below:
1. Effective training and awareness programs for members of the healthcare community.
2. Recognize that HIPAA is a not a one-time activity. It is part of corporate governance objective.

REFERENCES

[1] David Blumenthal, M.D., M.P.P. Stimulating the Adoption of Health Information Technology [Online] Available: http://healthcarereform.nejm.org/?p=436 , 2009.
[2] Consumer Union Report., To Err is Human - To Delay is Deadly: [Online] Available: http://www.consumersunion.org/pub/core_health_care/011324.html 2009.
[3] HHS Press Release, [Online] Available: http://www.hhs.gov/news/press/2009pres/08/20090819f.html, Aug. 2009.
[4] World Privacy Forum, [Online] Available, http://www.worldprivacyforum.org/hipaa/HipaaGuide3.html.
[5] Center for Democracy and Technology, HIPAA and Health Privacy: Myths and Facts Part 2 — January 2009 [Online] Available: http://www.cdt.org/healthprivacy/20090109mythsfacts.pdf
[6] Augustine Weekly - Holland & Knight HIPAA in Private Tort Litigation [Online] Available: http://www.informlegal.com/articles/view.php?article_id=519, 2008
[7] Press Release, CVS Caremark Settles FTC Charges: [Online] Available 2009. http://www.ftc.gov/opa/2009/02/cvs.shtm
[8] Biometrics Direct, Penalties for HIPAA violation [Online] Available: http://www.biometricsdirect.com/Biometrics/laws/HIPAA/hipaaviolations.htm
[9] American Medical Association, HIPAA Violation and Enforcement [Online] Available: http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.shtml.
[10] Bryan K. Touchet, M.D., Stephanie R. Drummond, D.O. and William R. Yates, M.D, Brief Report, The Impact of Fear on HIPAA violation on Patient Care [Online] Available: http://psychservices.psychiatryonline.org/cgi/content/full/55/5/575A.
[11] Internet Article, HIPAA Law and Guidelines for Employers, [Online] Available: http://www.hrhero.com/topics/hipaa.html
[12] Internet Article CVS Pays $2.25 Million in Record HIPAA Settlement [Online] Available: http://www.huntonprivacyblog.com/2009/02/articles/hipaa-1/cvs-pays-225-million-in-record-hipaa-settlement/
[13] Comments by World Privacy Forum, [Online] Available: http://www.ftc.gov/os/comments/cvscaremark/540386-00004.pdf
[14] Privacy Rights Clearing House, Chronology of Data Breaches [Online] Available: http://www.privacyrights.org/ar/ChronDataBreaches.htm
[15] Internet Article [Online] Available: http://www.law.uh.edu/healthlaw/perspectives/2008/(NA)%20blog.pdf
[16] OCR website. [Online] Available: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/highlights/numbersataglanceindex.html
[17] U.S. Department of Labor Employee Benefits
Security Administration [Online] Available: http://www.dol.gov/ebsa/publications/top15tips.html
[18] Google Definition [Online] Available: http://www.google.com/search?hl=en&rlz=1R2ADBF_enIN335&defl=en&q=define:Social+engineering+&ei=QfSqSo62B4KntgeEpKDzBw&sa=X&oi=glossary_definition&ct=title
[19] Healthcare Applications and HIPAA [Online] Available: http://citebm.business.uiuc.edu/TWC%20Class/Project_reports_Spring2007/HIPAA/mtmcinto/McIntosh.pdf