Lately, people have been asking me if they should upgrade their computer to the new Microsoft Windows Vista operating system (OS). Unless you recently bought a new computer preloaded with Vista, chances are your PC runs Windows XP (or an older OS such as Windows ME, 2000, or 98). Unlike a fine wine, computer operating systems do not get better with age. Security threats grow more pronounced over time as vulnerabilities are discovered and exploited by hackers. XP solved many of the security issues that plagued older Windows versions, so my first piece of advice is to upgrade your computer to XP if you haven’t already done so.

The next question is whether to take the plunge and upgrade to Windows Vista. Based on my own experiences with Vista, and given Microsoft’s well-known history of releasing buggy new operating systems, I would recommend that readers proceed with caution. Although Vista boasts a number of impressive features—including dramatic improvements in security, multimedia, and gaming abilities&mdash;it also has a few drawbacks. First and foremost is the significantly increased computing power and memory required to properly run Vista; if you install it on an older computer, you’ll just end up with a pretty interface that runs so slowly it can’t be used. To properly run Vista in your practice, you’ll need a computer with at least a 1GHz processor, 1GB of system memory, and a 40GB hard drive.

Although Vista takes OS security to the next level, this comes at a price: Vista continues Microsoft’s ignoble tradition of new operating systems that have less-than-stellar performance when it comes to compatibility with existing software, especially with non-Microsoft programs. For medical practices that rely on electronic health records and practice management software, this can be a real headache. Many popular programs will either not work at all with Vista or will need to be upgraded to properly function. For example, you will need to upgrade to Quickbooks 2007 if your computer is running Vista, an upgrade that costs hundreds of dollars. Microsoft offers Windows Vista: Upgrade Advisor, a program that will scan your computer and notify you which programs have known incompatibilities. If you are thinking about upgrading to Vista, run this utility to get a sense of how much frustration you may be about to experience.

Perhaps even more egregious is my experience using Microsoft’s own Office 2007 with Vista. Although you might think Microsoft programs would work smoothly with Microsoft’s newest OS, on my Vista-equipped computers, Microsoft Office 2007 has frequently experienced a host of bugs, ranging from incorrect visual effects to programs freezing and crashing to even an occasional system reboot without warning—serious errors that dramatically reduce efficiency while increasing blood pressure. Microsoft has been frequently criticized for releasing inadequately tested software, in effect turning early adopters into beta testers. All software has programming errors (bugs) that cause unexpected or incorrect results. The more complex and feature-rich the software, the more errors will be present. Th e rate of bug discovery is also directly proportional to the number of people using the software, since some users will perform a given task differently than other users, and often in a way not envisioned by the programmers. Thus, with Microsoft’s operating systems being both complex and ubiquitous, there are many bugs and problems discovered after release to the general public.

Microsoft releases “fixes” to correct some of these bugs. For serious problems, such as security vulnerabilities, these fixes are often immediately released. Intermittently, Microsoft will package all of its major and minor fixes together into a Service Pack (SP) and release this in one installation package, saving users the trouble of installing dozens of individual fixes. Although Microsoft officially doesn’t announce the date of SP releases (for fear that nobody would buy software until after the first service pack is released), they have implied that the first Vista SP (Vista SP1) will be released toward the end of 2007.

The bottom line is that Vista represents a significant step forward in terms of usability and security, yet the true cost of upgrading is more than just Vista’s sticker price. Your actual cost will include the price of upgrading older software as well as the frustration of being unable to run some of your software and hardware on Vista. When you are prepared to

pay this true price, it is time to upgrade. However, waiting for Microsoft to release a SP or two may help reduce your frustration.

Dr. Bertman is Physician Editor-in-Chief of 

. He is also a Clinical Assistant Professor of Family Medicine at Brown University and president of 

, a leading developer of Electronic Health Record (EHR) software. He also is the founder and president of 

on personal medical topics. He is in private practice in Hope Valley, RI.

Articles

Feature Articles

Lately, people have been asking me if they should upgrade their computer to the new Microsoft Windows Vista operating system (OS). Unless you recently bought a new computer preloaded with Vista...

Tech Talk: Is It Time to Upgrade to Microsoft Vista?

Might PDAs soon go the way of the dodo bird? It sure looks like it, at least according to 

a blog posted to the Ars Technica website

 on August 13, titled “PDA Sales Drop by 40 Percent in a Single Year, Vendors Bolt for Exit.” The post outlines a rather bleak future of declining success and popularity for the PDA. The author, Nate Anderson, not-so-subtly states that “there are two kinds of people in the world—those who believe in the power of the PDA and those who don’t&mdash; and the first group is shrinking faster than a cotton shirt in an industrial dryer.” An overall decline in PDA use may be a tough concept for many practitioners to wrap their minds around, especially when considering how useful the devices have proven to be in the healthcare setting.

It’s been said that numbers don’t lie, and, at first glance, the statistics in Anderson’s blog are hard to argue with. But he fails to take into account a couple of key caveats in the course of predicting the downfall of the PDA. One is that PDA use is actually increasing among certain key demographics, namely healthcare providers. His other oversight is a semantic one, but important nonetheless—PDA use is declining only if “PDA” is narrowly defined to encompass the technology as it existed in say, 2000. This, of course, misses the big picture. The ongoing success and shifting definition of “PDA” is being driven by new-generation devices with advanced capabilities and functionality.

 published a study in October 2005 that examined how physicians use PDAs for clinical decision making, finding “that even occasional PDA use had an impact on their clinical decision making and treatment choices.” More than 50% of the physicians surveyed “indicated PDA use helped change a patient’s treatment.” Sixteen percent stated that “using a PDA helped avoid unnecessary medical tests;” 10% of physicians reported that PDA use “had helped change a patient’s diagnosis.” Clearly, PDAs can have a beneficial effect on clinical practice, but the extent of that benefit depends on how many physicians are using the devices in practice.

Evidence of the PDA’s popularity among healthcare professionals can be found in the results of a study published in 2006 in the Journal of Medical Internet Research (JMIR). The authors conducted 

a systemic review of 816 full-text articles

, published between 2000 and 2006, on PDA use among healthcare providers. They found that “Younger physicians and residents and those working in large and hospital-based practices are more likely to use a PDA. The adoption rate is now at its highest rate of increase.” The study also revealed that PDA use was higher among those physicians who were wholly or partly hospital-based (33% and 29%, respectively) than among those who were office-based (23%). 

 hospitalists, who are younger as a group than other medical specialties, “will drive the [PDA] market in the next few years.”

Although the statistics reported in the JMIR article may be surprising to some, the authors point out that “a common problem with the evaluation of information technology [IT] is that use frequently precedes research. This is the case here, in which PDA adoption rates are already high and projections are for rapid growth in the short-term.” The article makes clear that, although PDA sales in general may be sputtering, physicians and other healthcare professionals are certainly not contributing to the drop.

, warned way back in 2005 that PDA sales were sliding (not counting “integrated phone-PDA devices”), noting that shipments had fallen by 13% between 2003 and 2004. He also noted that while sales of standalone PDAs were declining, manufacturers were introducing smartphones and cell phones with “PDA functionality,” further siphoning off PDA market share. In response, PDA makers began adding new features, including “built-in WiFi connectivity, interface improvements, faster processors, and better color screens,” according to Bangeman.

“An increasing number of cell phones offer a lot of basic PDA functionality,” observed Bangeman. “Throw in a cheap camera and have the cellular provider subsidize the cost and PDAs look a lot less compelling.” So much so that smartphone sales were up 60% in 2006 and growing, according to 

. “In fact, smartphone unit sales almost tripled from 2004 to 2005, and increased by 50 percent in the first half of 2006 over 2005.”

So, PDA sales are declining, smartphone sales are increasing, and yet both types of devices are increasingly incorporating similar features and functionality. It’s getting to where users can hardly tell some of the devices apart anymore. Are smartphones, in fact, really just PDAs with added telephone functionality? And are all smartphones created equal? Well, no. As InternetNews.com points out, “While many smartphones… serve as a combination phone and PDA and others have power and performance comparable to many laptops, most of the smartphones sold globally only enable the user to access the capabilities of basic wireless phones.” In other words, sometimes a smartphone is exactly that: a smart phone.

What explanation is there for the PDA’s drastic decline in popularity (except in the healthcare setting, of course)? There must be something about smartphones that led 

JupiterResearch to predict that smartphone sales

 “will grow at a compound annual growth rate of 28% through 2009,” accounting for nearly one in every 10 phones sold in 2009. One possible reason for the sharp contrast between the fortunes of these technologies is that standalone PDAs are incompatible with our increasingly interconnected world. As one 

 so aptly put it, “what really sets the smartphone apart from the PDA is connectivity. It’s the ability of software developers to integrate connectivity into their applications that’s going to offer the biggest boon to the user.”

editorial board members what they thought about all this and included their responses in a recent 

, titled “PDA Extinction? Not a Chance.” “It’s really a silly distinction, in my opinion,” said board member Daniel Z. Sands, MD, MPH, director of IBSG Healthcare and director of medical informatics for Cisco Systems. “The natural evolution of a handheld computer is from a device that just connects to a full-size computer toward one that connects with the Internet using wireless communication networks. As the price of these devices and the connections they require drops, users will trade in their PDAs for connected devices (smartphones). Smartphones perform all of the functions of standalone PDAs, but also are able to be used as communication devices and to connect to the Internet.”

We also surveyed MDNG readers to obtain their opinions on PDAs, related technology, and their role in the healthcare market going forward. Although 15% of our readers never have used a PDA in practice, the vast majority (74%) have a good 1-10 years’ worth of experience using handheld computing devices. When asked if they thought smartphones and other technology will eventually surpass PDAs in popularity among physicians for use in the clinical setting, 24% of surveyed MDNG readers said “no.” However, 71% of respondents do think newer devices such as the 

 will live up to their considerable potential and prove increasingly useful in practice.

When asked if they thought PDAs would soon no longer continue to meet their professional needs, many respondents singled out smartphones as the obvious competitor. “The primary need is to minimize the number of devices carried,” said one of our physician voters. Another echoed this perception, stating that the combination of a phone and PDA functions in a smartphone is too convenient for a PDA-only device to compete with. As another physician respondent put it, “Why carry two boxes when one will do?”

However, not all of our readers were ready to abandon their trusty handhelds just yet. “I can’t imagine practice without my PDA. We are getting ready to implement an EMR that synchronizes with PDAs to capture hospital charges. I see the role of my PDA actually expanding,” said one physician. We also wondered whether readers were concerned that the shrinking PDA hardware market might soon lead to fewer new software titles being released each year. Fifty-one percent of respondents to our survey said “yes.”

Will PDAs eventually go the way of the pager and other onc-essential technologies whose time has past? Or will their features and functionality evolve to the point where they merge into the smartphone product line, erasing any meaningful distinction between the two? Will vendors develop more software for smartphones, making them even more useful for physicians? Only time will tell. For now, enjoy your device, whatever it may be. 

Might PDAs soon go the way of the dodo bird? It sure looks like it, at least according to a blog posted to the Ars Technica website on August 13, titled "PDA Sales Drop by 40 Percent in a Single...

The Results Are In: The PDA is Here to Stay

Myth #1 Healthcare providers can share personal health information with employers.

The Privacy Rule absolutely prohibits healthcare providers and plans from disclosing personal health information to employers without a patient’s explicit, written authorization. A valid authorization under the law must include a description of the information to be shared, the name of the person allowed to use or disclose the information, an expiration date, and the signature of the individual.

Myth #2 One doctor’s office cannot send a patient’s medical records to another doctor’s office without that patient’s consent.

No consent is necessary for one doctor’s office to transfer a patient’s medical records to another doctor’s office for treatment purposes. The Privacy Regulation specifically states that a covered entity “is permitted to use or disclose protected health information” for “treatment, payment, or healthcare operations” without patient consent.

Myth #3 The HIPAA Privacy Regulation prohibits or discourages doctor—patient e-mails.

The Privacy Rule allows providers to use alternative means of communication, such as e-mail, with appropriate safeguards. Both the HIPAA Privacy and Security Regulations require providers to use reasonable and appropriate safeguards to “ensure the confidentiality, integrity, and availability” of any health information transmitted electronically, and to “protect against any reasonably anticipated threats” to the security of such information.

Myth #4 Hospitals are prohibited from sharing information with the patient’s family without the patient’s express consent.

Under the Privacy Rule, a healthcare provider may “disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual,” the medical information directly relevant to such person’s involvement with the patient’s care or payment related to the patient’s care.

Myth #5 A patient’s family member can no longer pick up prescriptions for the patient.

A family member or other individual may act on the patient’s behalf “to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.” The Department of Health and Human Services (HHS) specifically explains that the Rule “allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient.”

Myth #6 The Privacy Regulation mandates new disclosures of patient information.

Disclosure is mandated in only two situations: to the individual patient upon request, or to the Secretary of HHS for use in oversight investigations. Disclosure is permitted, not mandated, for other uses under certain limits and standards, such as to carry out treatment, payment, or healthcare operations, or under other applicable laws.

Myth #7 Patients can sue healthcare providers for not complying with the HIPAA Privacy Regulation.

Even if a person is the victim of an egregious violation of the HIPAA Privacy Rule, the law does not give people the right to sue. Instead, individuals must file a written complaint with the Secretary of HHS via the Office for Civil Rights. It is then within the Secretary’s discretion to investigate the complaint. HHS may impose civil penalties ranging from $100 to $25,000, and criminal sanctions ranging from $50,000 to $250,000—with corresponding prison terms&mdash;may be enforced by the Department of Justice.

Myth #8 Patients’ medical records can no longer be used for marketing.

Use or disclosure of medical information is explicitly permitted for certain health-related marketing under the HIPAA Privacy Rule. For example, communication about a plan’s health-related products or alternative treatments and services is not considered marketing for the purposes of the Rule—even if the healthcare provider is paid to encourage the patient to use the product or service.

Myth #9 If a patient refuses to sign an acknowledgment stating that he or she received the healthcare provider’s notice of privacy practices, the healthcare provider can, or must, refuse to provide services.

The HIPAA Privacy Rule grants the patient a “right to notice” of privacy practices for protected health information, and requires that providers make a “good faith effort” to get patients to acknowledge they have received the notice. The law does not grant healthcare providers the right to refuse to treat people who do not sign the acknowledgement, nor

does it subject the provider to liability if a good faith effort was made.

Myth #10 The HIPAA Privacy Rule imposes many new restrictions on hospitals’ fundraising efforts so that fundraising becomes almost impossible.

A hospital may use, or disclose to its “business associates” or an institutionally related foundation, demographic information and the dates of healthcare provided to an individual “for the purpose of raising funds for its own benefit, without an authorization [from the patient].” Such use or disclosure is not permitted unless disclosed in the notice of privacy practices. Any fundraising materials that the covered entity sends to an individual must include a description of how the individual may opt out of future fundraising communications. 

Top 10 Myths and Facts About the HIPAA Privacy Rule.

Top 10 Myths and Facts About the HIPAA Privacy Rule

Magma Pizza. No TD for Rice. Double Shots of SoCo. Jiff y Pop Jumpsuit. What the heck am I talking about, you ask? Quite simply, it’s fantasy football.

This column isn’t going to be a primer on fantasy football or explain how you can get involved. There are plenty of websites out there that will tell you everything you need to know, and like many things we talk about in this magazine, the Internet has revolutionized the “sport” and made it simple for anyone to find a league and get involved. So do so if you want to. I’ve been playing fantasy football for 10 years, and the names listed above are some of the team names I’ve used in my pursuit of a league championship. This year, my 

 are 2-1. If you’re one of the estimated 15-18 million people who play fantasy sports, you know how addicting it can be and how your interest in the real NFL season is dictated by your fantasy draft.

I am not kidding. My life from September until January is colored by the outcome of our annual live fantasy draft, an event that sends me into a deeper rage every year as I watch clueless owners waste 4th-round picks on the Chicago Bears defense/special teams, and squander 7th-round picks on kickers. Then I have to live with 16 weeks of fielding ridiculous trade offers, scouring injury reports, and exploiting the matchups that will give my fantasy team the best chance to win every week. Exhausting, frustrating, and maddening… and in the end, it means nothing.

Every week, I ask myself why I subject myself to this torture. Why do I worry about whether to play Laveranues Coles against the Dolphins? Why did I go against everything in my heart and pick up Maurice Jones-Drew with my second pick?

How many times should I bang my head against the wall for passing up Randy Moss and taking Donovan McNabb in the 3rd round? Why do I care if someone wants to pick up Todd Heap with their fourth pick? It’s their funeral, right? Should I remind the homer picking up all 

 that they’re not running Mike Martz’s offense anymore? Nah. And speaking of the Rams, what is up with Steven Jackson?

YOU ARE A NO. 2 OVERALL PICK!!! Kill me now.

Fantasy football also has me all twisted up inside every year because of my NFL team allegiances. I’m a Giants fan, and yet I’ll pick a player from a rival team (the Eagles’ McNabb) and then ROOT for this guy all year! And you know what’s worse? OK, yes, those brutal Eagles throwback jerseys are disgusting, but even worse than that is playing against a fantasy team that has a player going from my favorite real team (say, the Giants’ Jeremy Shockey) and REALIZING THAT I’M ACTUALLY ROOTING AGAINST HIM, HOPING HE DOESN’T SCORE. “No, throw it to Plaxico Burress, not Shockey, you idiot Eli Manning!” Th is is what fantasy football does to you. I can’t take it. Being commissioner of a fantasy football league is another great thing—I enjoy it about as much as I enjoy chewing on a nice big ball of aluminum foil. Still, I offer to handle it every year for whatever reason. Explaining the rules, scoring system, waiver wire pickups, free agency, playoff system, etc, every week of every year, to a bunch of grown men is like attending a 12-hour 

—yet I continue to subject myself to the agony.

That’s all bad enough, but my absolute favorite part of fantasy football is the guy who has to get an auto-picked team because he couldn’t draft like the rest of us due to the fact that he’s running Windows 95 on an eMachine with 128MB

and a 1600 baud modem—so of course he wins the whole freaking thing after finally sending me his league entry fee on Week 16. I’m getting sick just typing that sentence.

Fantasy football. The reality? It’s a love-hate relationship. 

Fantasy football also has me all twisted up inside every year because of my NFL team allegiances. I'm a Giants fan, and yet I'll pick a player from a rival team (the Eagles' McNabb and then ROOT...

Downtime: Fantasy Flippin' Football

This website is intended as a source of information for healthcare professionals who are treating patients with ADHD. It also provides information for patients, family members, and educators to help them better understand the disorder. The “For Parents & Caregivers” section provides answers to several commonly asked questions about ADHD, including “What is ADHD?” “How can ADHD be treated?” and “What can I do to help?” The answers review topics ranging from symptoms and behavior modification to parenting resources and quick facts. Visitors can complete a registration form and sign up to receive e-mailed suggestions about how to manage ADHD and up-to-date treatment and research news.

Patients who are interested in learning more about the clinical trials sponsored by Eli Lilly and Company and featuring one of the company’s pharmaceutical treatments can visit this website to learn more about the various types of clinical trials (eg, open-label study, doubleblind study) and the terminology associated with them. Patients can also search for open trials and read summaries of completed trials. When performing a search, patients can view trials by therapeutic area (eg, cardiology, endocrinology, neuroscience) or by the specific Eli Lilly and Company product being tested. Links to other clinical trial search engines are provided, as well as links to the FDA and World Health Organization websites.

At this website, healthcare professionals will find information about Lilly medications used to treat more than a dozen medical conditions, ranging from schizophrenia and osteoporosis to Turner syndrome and adult growth hormone

deficiency. Click on the name of a medical condition to view a list of websites containing information about the condition and related resources; some also include patient education resources, clinical reimbursement information, and interactive learning tools.

Direct your diabetic patients to this online resource to learn more about the disease and the Lilly products used to treat it. The site features three sections devoted to providing information about insulin: “Deciding to Take Insulin,” “Using Insulin,” and “Getting the Most From Insulin.” Also provided are print-friendly .PDF files containing prescribing, safety, and patient product information for nine insulin products developed by Lilly. Patients interested in receiving diabetes treatment and management e-mail updates can click “Sign up for E-mail Updates.” The website can also be viewed in Spanish.

The site is organized into nine main sections, with sub-sections devoted to important information about disease states and the Lilly medications available to treat them. Visitors will find information about each drug’s dosing, delivery, and formulation; side effects; and safety profile. Also available are links to Lilly’s grant office, information about clinical trials, and prescribing information for each product profiled. To access the website, registration is required.

View these webcasts to learn more about the disease states treated by Lilly products.

Originally aired on May 14, this webcast features a presentation given by Russell A. Barkley, PhD, Research Professor of Psychiatry at the State University of New York Upstate Medical University in Syracuse, about recent advancements in ADHD management and our understanding of the inattentive and hyperactive- impulsive ADHD subtypes. Barkley also reviews the affect coexisting disorders (eg, anxiety, conduct disorder, sleep disorder) can have on children, adolescents, and adults diagnosed with ADHD.

Bipolar Treatment: Integration of Study Data and Clinical Guidelines

Dr. John Cookson, Consultant and Honorary Senior Lecturer in Psychiatry, The Royal London Hospital, United Kingdom, discussed recently developed bipolar disorder treatments and the outcomes for people with bipolar disorder during this May 11 European Live Internet Conference. Cookson mainly focused on “how study results and clinical guidelines, such as study results and clinical guidelines within the [National Institute for Health and Clinical Excellence] NICE guideline, can be integrated in clinical practice. 

The PharmaTech section highlights online information and educational resources created by leading pharmaceutical companies. This month, we spotlight several resources from Eli Lilly and Company.

Pharma Tech: Eli Lilly and Company

Recent media coverage has raised awareness of a variety of our healthcare system’s problems and shortcomings. Increased exposure is often the first step in finding solutions. However, the most destructive force in our health system hasn’t yet made it to the front page. By stripping Americans of the right to control access to their electronic medical records, HIPAA is destroying our children’s and grandchildren’s futures. You may think that the HIPAA Privacy Rule actually protects privacy, but the truth is sobering. One single sentence in the 2002 Amended HIPAA Privacy Rule effectively eliminated privacy by “replacing” a patient’s right of consent. The 

Final Modifications to the Privacy Rule document in the Federal Register

 states “The consent provisions [in the previous version of HIPAA]… are replaced with a new provision… that provides regulatory permission for covered entities to use and disclose protected health information for treatment, payment, healthcare operations.”

We should call the HIPAA Privacy Rule what it really is: the “Exposure Rule.” The changes to HIPAA opened up the nation’s electronic health records to surveillance, snooping, unwanted uses, and disclosure by more than four million “covered entities,” including employers, financial institutions, insurers, schools, government agencies, and all of their business associates. Most of the public and the media aren’t even aware of this, and don’t realize the impact of the sentence that wiped out 2,400 years of medical ethics embodied in the Hippocratic Oath, and more than 200 years of strong privacy-protective American laws.

According to HIPAA, stronger privacy-protective state laws, common law, Constitutional law, the physician— patient privilege, and medical ethics are supposed to prevail over HIPAA. But our health data is so unbelievably valuable, most existing technology was designed as if we have no privacy rights. Today, doctors won’t treat patients unless they sign Privacy Notices that violate medical ethics and expose their records to the world. Worse, the current administration and some members of Congress are pretending that HIPAA is still an adequate privacy standard for the nation, even though it was gutted in 2002.

The problem is that covered entities and all of their business associates can use the data in health records to discriminate against everyone who gets sick. Data mining generates untold billions in revenues, but not one dime goes to help a single sick person. For the first time in our nation’s history, our health records may be regularly accessed and disseminated without our consent for all “routine” uses under HIPAA (defined as treatment, payment, and healthcare operations). This may sound reasonable until you realize that entities holding our sensitive personal health information can unilaterally decide to use it, and we cannot object or refuse access.

Any covered entity holding our health records has the right to determine— without consent and without reporting to anyone&mdash;the uses of our data that constitute “healthcare operations.” Even worse, there is no way for us to even find out what they are doing, because audit trails are not required for “routine” uses of personal health Data Mining and Personal Health Information 

 sell the nation’s most current prescription records daily to insurers and the pharmaceutical industry. IMS Health reported revenues of $1.75 billion dollars in 2005. Verispan LLC is privately owned, so its revenues are unknown. Blue Cross Blue Shield set up the 

 last year to sell the medical and claims data on all 79 million Blue Cross enrollees to large employers to help them reduce their costs. 

 also sells the data of millions of patients, including Medicare and Medicaid data, to large employers and drug companies.

Researchers, state and federal agencies, law enforcement, public health, prescription-switching companies, pharmacy benefits managers, technology vendors, data aggregators and data miners, hospital corporations, the transcription industry, and even data management corporations also use and sell our sensitive health data. There is no way to tell how many corporations and government agencies are accessing our PHI, because virtually all of these databases are secret, and we have no notice of their existence or chance to opt-out. As we receive care from many different specialists and institutions, our records are scattered in multiple locations. There is widespread agreement that having our records immediately available when needed will save lives, improve the efficiency and quality of medical care, save money, and revolutionize research. Electronic records can offer far stronger privacy protections than would ever be possible with paper systems. But making the transition to electronic health records (EHRs) will exponentially increase the risk of harm to everyone from rampant abuses of privacy unless we control access to our records.

Thankfully, there are straightforward and inexpensive technical solutions to restore privacy and gain the life-saving benefits of electronic health records: 

 and independent consent management tools. Health record banks can serve as designated agents to store and safeguard a complete copy of our medical records and make them available (in full or in part) solely as we direct. This approach would require institutions (I envision many health record banks competing for patients’ business) to hold the records (as opposed to having each person hold his or her own records) to allow for worldwide immediate availability of health records, coupled with ironclad computer security to protect against unauthorized disclosures and hackers.

Under such an arrangement, whenever patients receive care, their prior records would be available (with their permission) from the health record bank, and the new information generated could be deposited in their account. Health banks must be federally regulated to ensure that they operate in a safe, effective, and trustworthy manner. Regulation must first reinforce patient control—for both primary and secondary use of health records. Health banks must have state-of-the-art security and undergo regular independent audits&mdash;with serious penalties for violations. Community non-profit organizations and legislation can set up the regulations.

With health record banks, the immense value of aggregated medical data for research and public health could be unlocked. With informed consent, patients’ data could be included in statistical compilations without ever being released from the bank. Health banks could (and should) operate like the census bureau, which doesn’t release data, but runs the research and queries on the data, releasing only the results. Finally, it would be safe to conduct research and post-market surveillance of drugs and devices through a health bank without compromising our futures or our children’s futures because others would not be able to learn about familial illnesses or genetic vulnerabilities.

Any fees paid for the use of data would be shared by the bank and its customers. Also, patients could be notified about any clinical trials without the sponsors of the trial knowing their identity. Independent consent management tools would give us the power to move our PHI where we want it, at the right time, to the right person, for the right reasons. We would be able to define and manage in one place our consents regarding who can access or use our PHI, instead of setting up consents at every site of our interaction with the healthcare system (physicians’ offices, hospitals, etc).

Every holder of our PHI—physicians, hospitals, labs, health plans, pharmacies, clinics, x-ray facilities, etc&mdash;would always have to check electronically with our consent management tools before using or releasing any of our health records. Independent consent management tools would enable us to set standing consents for data to automatically be received from all providers, create advance directives detailing what data is to be shared in emergencies, and allow us to control the flow of information down to single data fields. These tools would also enable us to set up role-based access to our information. Because the consent management tools are electronic, consents can be changed instantly. They would also provide us with complete audit trails of every access or disclosure, so that we will finally be able to know exactly who has seen which parts of our health records.

Most importantly, we need Congress to set the nation’s privacy standards and guarantee Americans a federal right to health privacy. Unelected bureaucrats and industry appointees working at the behest of HHS have no business determining the extent of Americans’ health privacy rights. Only the people we elect to Congress should have the right to alter or eliminate our fundamental constitutional rights to privacy.

Powerful privacy-enhancing technologies can make healthcare more private, safer, more effective, and less costly. But as we make the transition from paper to electronic health records, we must restore and strengthen the right to health privacy and to control access to our health records. Smart consumers who know their privacy is at stake will press for smart technology and smart laws. Help us educate the nation and press Congress to restore our privacy.

Deborah C. Peel, MD, is a practicing physician and national expert on medical privacy. She founded 

, a medical privacy watchdog organization, in 2004, to educate and empower Americans to preserve and protect their fundamental human and civil rights to medical privacy. Dr. Peel was recently named as number 4 on the list of the 100 Most Powerful People in Health Care by 

Recent media coverage has raised awareness of a variety of our healthcare system's problems and shortcomings. Increased exposure is often the first step in finding solutions.

HIPAA: The Data Miner's Dream

Question: if you had a winning lottery ticket in your hands, a jackpot to change the course of your life—how much would you invest to keep it safe until you turned it in? Would an old shoebox do? A sock drawer? A state-of-the art, armor-plated vault under 24-hour armed surveillance? A similar question faces US physicians today as they work to keep their patients’ healthcare information safe yet accessible. Secure electronic healthcare records (EHRs) were once a nice thing to have&mdash;the hallmark of a practice ahead of the technology curve.

The potential benefits to be derived from electronic records convinced a small percentage of practices to become early adopters, with larger group practices, hospitals, and other institutions better equipped to absorb the costs of development and implementation leading the charge. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other oversight legislation included provisions governing the collection, use, and dissemination of electronic data. As adoption rates increased and new technologies were developed, every substantive healthcare proposal and legislation (such as the Medicare Modernization Act of 2003) was crafted with an increasingly computerized and automated healthcare landscape in mind. So much progress has been made that what was once a nice thing to have is now viewed as a virtual necessity by many healthcare stakeholders and opinion leaders. Even policy makers have jumped on the bandwagon, culminating with President Bush’s 2005 State of the Union Address calling for all US citizens to have access to EHRs by 2014.

The impetus behind the great push toward EHRs has been, according to HHS Secretary Mike Leavitt, “to make medical clipboards and prescription pads a thing of the past” and, as a result, increase the safety and efficiency of healthcare delivery in the United States. Rising healthcare costs mean greater-than-ever demand for uniform healthcare data with which to evaluate alternative coverage and treatment approaches and reduce the administrative costs of delivering care.

Reducing the administrative costs of delivering care, curiously enough, has not been a compelling reason for the vast majority of the country’s doctors to trade in their clipboards and prescription pads for computer screens and PDAs. That’s in part because single-physician and small-group practices are having a difficult time justifying the current cost and disruption to workflow of converting from traditional paper-based health records and files to EHRs. At the most basic level, many physicians simply don’t know where to start when it comes to EHRs. To help physicians choose from among the flood of hardware and software providers who were rushing to market in the hopes of serving them, the 

Certification Commission for Healthcare Information Technology

American Health Information Management Association

Healthcare Information and Management Systems Society

The National Alliance for Health Information Technology

 (Alliance). As of this writing, dozens of ambulatory EHR products had achieved 

“Eight to ten percent of our 93,000 members were using EHRs in their practices by 2003,” says Dr. Steven Waldren, director of the Center for Health Information Technology (CHiT) for the AAFP and one of the leading experts in the field. “Now we’re seeing about 50 percent: 37 percent of our member practices are fully implemented with EHR and another 13 percent are starting the process” [Figure 1]. Still, Dr. Waldren cautions that these percentages shouldn’t be used to draw a conclusion about all US physicians. The EHR usage rate for all physicians nationwide, he says, hovers somewhere around 15-25%.

“The main reason for the lag is the cost of these systems,” Waldren readily admits. “The average cost of adopting EHRs is somewhere between $35,000 to $40,000 per physician, and this can easily go as high as $80,000.” The cost varies widely because of tangible and not-so-tangible factors [see Figure 2 on the next page]. The purchase of the hardware and software alone needed to convert what may be decades of patients’ paper health records is certainly a big part of the cost, as well as annual licensing fees to use the vendor’s software (if it’s not a proprietary system), system maintenance, and record updating. Time lost due to training office staff on the new system is another, less directly measurable expense many doctors are loathe to incur.

Proponents of widespread EHR adoption, from government and the medical community alike, say the upfront monetary and time investment of migrating over to EHRs will eventually pay for itself. One early HHS report suggested ambulatory practices could save up to $70,000 during a nine-year period with EHRs, mostly by eliminating duplicate record entries and streamlining electronic billing. Even so, the incentive for a doctor just out of medical school facing enormous student loans—or, on the other end of the scale, a doctor who’s about to retire to invest in an EHR, is low. Combine this with the almost total lack of government or insurance industry reimbursement for doctors who do invest in EHR, and the appeal all but disappears.

“Another issue is vendor lock,” Waldren says. “Physicians are concerned they may pick the wrong EHR vendor and be contractually stuck with a system that doesn’t work for them or face having to start from scratch and re-keying their records into a new system all over again.”

This has created a chicken-and-egg scenario. “If only 10% of doctors are using EHR in their practices, the vendor’s sale price is going to be relatively high,” says CCHIT chair of security Soloman Appavu. “But as market adoption increases, the cost should either go down or stay the same. Competition may improve the cost of these products.”

In addition to cost outlay, ensuring the security and privacy of electronic medical information is another key issue in the current uphill battle to get physicians to warm up to EHRs. It is difficult, if not impossible, to separate the security component out of a larger EHR system—at least according to CCHIT. The CCHIT does not make this distinction when deciding which EHR systems get their stamp of approval&mdash;a system is either fully compliant with all CCHIT criteria, including the security component, or it is not. As evidenced by the 

 with which systems must comply if they hope to become CCHIT-certified, data security is a big part of EHR functionality. HIPAA also placed 

a premium on ensuring the security and privacy of electronic records

, designating four categories of requirements that a covered entity would have to address in order to safeguard the integrity, confidentiality, and availability of its electronic health information pertaining to individuals: administrative procedures, physical safeguards, technical security services, and technical mechanisms. Briefly, these encompass security polices and procedures to be followed by physicians and support staff, data integrity and backup, security measures to guard against unauthorized access to patient information inside or outside of the practice, and the control of individual access to patient information.

Patients’ confidence in the security of their healthcare information is perceived by many to be playing a part in the speed (or lack thereof) with which physicians make EHRs part of their practice. A 2005 survey conducted by the California Healthcare Foundation (CHCF) and Forrester Research revealed that, despite federal protections under HIPAA, two in three patients in the US were concerned about the 

confidentiality of their personal health information

 and were largely unaware of their privacy rights. One in eight patients surveyed said they were so concerned about the privacy of their personal health records that they’d omitted or lied about their medical history out of fear that employers may use the information against them when making hiring decisions. “As efforts to develop a nationwide health information network proceed, concerns about personal privacy could have major implications,” the survey said. Yet close to 60% of the same group said they would be willing to share personal health information if they believed it would result in better medical treatment.

Many health IT experts and EHR advocates are of the opinion that current barriers to greater EHR adoption are not insurmountable. They also agree that concerns over data security and privacy are valid and should be taken seriously. Accordingly, there are several minimum security standards all practices should follow. Likening EHR security standards to those used when people withdraw money from an ATM, pay bills online, or make purchases from Internet retailers, Appavu says there are a basic set of security measures any physician practice, large or small, should look for when selecting an EHR system. “Record authentication, authorization, accountability of people who have access to records, access control, audit trails, encryption, data backup and system recovery are the major security components that are critical to any EHR system,” he says.

“Look for a CCHIT-certifi ed product,” says Dr. Kenneth Adler, a longtime EHR supporter who writes and lectures frequently on the topic. Adler spearheaded the implementation process for an EHR system for his own 86-member physician team several years ago (you can read about 

). “The very minimum requirement you need to have is password protection. Password protection and user IDs should change every two months as part of an automated process.” For physicians who may want to go a step further and communicate with patients through e-mail, Adler says, a secure firewall is a must. “Any Internet-based product needs to be strong, especially if you’re a physician who will be accessing records outside of the office. You need a VPN connection in that case. Th is is where people can really have problems with security.” Wireless networks should also be secure.

“You probably don’t want to be accessing patient records from your laptop using Starbucks' wireless connection.” Anti-virus software and other protections are also a must. Virus protection will take on even greater importance once EHRs become truly interoperable and the barriers to rapid and reliable data exchange are removed. The potential dangers to data security and privacy are an order of magnitude greater when you’re talking about electronic data exchange between an ambulatory clinic and a hospital or a physician and a pharmacy, rather than have patients walk their own records from one office to another. But with physicians still only dipping their toe into the EHR waters, these more advanced capabilities will likely come into widespread use very, very gradually.

“You really need to make a clinical and business decision to move your practice forward,” Waldren says. “If you make those two decisions, you’re well on your way to getting an EHR. From a security standpoint, yet, there is a risk, but it is fairly small and by remaining diligent, you can keep your records secure. On the other hand, look at the doctors and patients in New Orleans who had paper records only and who now have no medical records because of Hurricane Katrina.” “In the end,” Waldren says, “you have to decide what is right for you and your practice.”

Diane West is a freelance healthcare journalist.

Despite evidence that implementing an EHR brings many benefits to a medical practice, cost and privacy concerns slow widespread EHR adoption by physicians. Even if they don't go completely...

Electronic Health Records: Finding the Perfect Lock and Key

More than four years removed from the end of the beginning of the national Health Insurance Portability and Accountability Act (HIPAA) experience, the legislation’s requirements regarding data security continue to baffle clinicians in thrilling new ways from month to month. To describe recent progress in this area as “glacial” would be a gross insult to glaciers. A recent poll by 

, found that 44% of providers are still not compliant with the HIPAA Security Rule finalized in February 2003—a stirring improvement of 1% since January 2006. Because failure to protect sensitive patient data may have practical and ethical implications quite apart from those associated with HIPAA, the issue of data protection has never been more critical. Changing interpretations of HIPAA guidelines, and the continuing evolution of the technology used by and against would-be data thieves, means that constant attention is necessary; a practice that is airtight today may be vulnerable tomorrow. Among the key issues of the moment:

By now, most practices are aware that the creation of backup copies of important data is a critical defense against data theft, destruction, or corruption. Generally, backups are created at pre-specified intervals; a typical practice might backup data once every 24 hours. Unfortunately, the eight-hour workday is fast becoming an outmoded concept; physicians may work at any time, and it is often the most recent data that is the most valuable. If a periodic backup is scheduled for 5:00pm, and data corruption occurs at 3:15pm, all changes entered in the 20+ hours since the last backup may be lost.

Continuous data protection (CDP) is a concept designed to deal with this problem. CDP solutions create a real-time record of all changes made to every file by automatically saving a fresh backup copy to a secure independent location after each change. In practical terms, this means that the user can instantly restore a file to any point in time— be it minutes, days, or weeks earlier. Because CDP systems save only the changes to a given file instead of saving the entire file each time

(if a user changes only three bytes of a 500GB file, CDP will save only three bytes), this approach will also save disk space. CDP is different from other data protection strategies, such as the Redundant Array of Independent Drives (RAID) concept or replication/mirroring, which create copies of the most recent changes only. Whereas CDP can restore data to a point prior to corruption or damage, these other approaches can only restore the corrupted or damaged data.

Until fairly recently, the market leader in the area of CDP was 

 exploring CDP in more detail may be found. In 2005, Goliath entered the ring with the launch of 

. Some products marketed as CDP allow only restoration to pre-specified time-points; users interested in the ability of CDP to restore to any point in time should be sure that any product they purchase actually has this ability.

Data theft is a significant concern for business in general. A 2005 Computer Security Institute/FBI report estimated that approximately one-quarter of all information security-related financial damages derived from the theft of proprietary information. In a simpler time, when storage devices were larger and limited in capacity, actual physical theft of computerized data was extremely difficult (imagine having to transfer a huge sensitive file onto dozens of 51/4" floppy disks). The recent proliferation of fl ash drives and other inconspicuous devices capable of storing very large amounts of information—a typical 51/4" fl oppy could store about 100KB of information, while the iPhone boasts internal fl ash memory of up to 8GB, or nearly one million times as much storage space&mdash;and interacting with a wide range of other devices has made it much easier for would-be information thieves.

, the Department of Health and Human Services suggests that “covered entities should be extremely cautious about allowing the off site use of, or access to, electronic protected health information (EPHI).” However, completely outlawing the use of removable media may be counterproductive—a flash drive may allow a physician to legitimately review a series of case files out-of-office, or allow for quick sharing of relevant data among treatment team members&mdash;so providers must develop policies and procedures for managing this kind of risk, including restricting use of removable media not justifiable from a work standpoint. In some cases, providers may wish to institute an IT system in which an administrator controls and monitors all access to removable hardware.

No aspect of the HIPAA Safety Rule is responsible for quite as much confusion and gnashing of teeth as the so-called “minimum necessary standard,” described by the 

University of Miami’s Data Protection Project

. In essence, this standard is a “need to know” rule; for situations in which providers must disclose, use, or request patient information in furtherance of patient care, it requires them to disclose, use, or request only the minimum necessary to accomplish the goal of the disclosure, use, or request. There are a host of exceptions to the minimum necessary standard, most importantly disclosures made for the purposes of treatment (information uses related to treatment are subject to this standard). Couldn’t be clearer, right?

The treatment exception affords practitioners considerable leeway, facilitating collaboration on patient care. However, there is much confusion over the proper application of the standard. Many providers may be unaware that the standard does not apply to disclosures for the purpose of treatment, or unfamiliar with the distinction between use and disclosure—thus leading them to apply 

. Further confusion stems from the absence of a system-wide definition of “minimum necessary;” left to develop individual definitions, institutions or providers may withhold information when they should not. Providers with electronic medical records tend to have an easier time adhering to this standard, as records with only the necessary information included can be readily generated. Providers with paper records “were having to print out copies of charts and manually redact information before faxing it,” according to the article linked above. Readers are urged to review their own minimum necessary policies to be sure they are adhering to, but not unduly limited by, the standard.

At its outset, many pundits expected that 2007 would be the year that meaningful health IT legislation finally saw the light of day (and the President’s desk). Earlier this year, a coalition of patient groups and other organizations formed 

, an advocacy group headed by a pair of former Congresspersons and dedicated to supporting this cause. In June, efforts of this and other groups were rewarded when a Senate Committee passed the 

, an initiative sponsored by a bipartisan group of Senators including Utah’s Orrin Hatch and New York’s Hilary Rodham Clinton. The Act would earmark $163 million in 2008 and 2009 to provide grants to healthcare professionals supporting health IT adoption, help establish state-level loan programs for other providers, and create a national coordinator for health information technology. Unfortunately, this legislation, like similar bills proposed in the past, has been hamstrung by concerns about privacy and data protection.

Patient Privacy Rights Foundation founder Deborah Peel says that the current Act is even worse in the area of patient privacy than the 2005 health IT bill that passed the Senate and died in the House of Representatives; the new bill “doesn’t even have a definition of what privacy is,” she notes. Peel says that at present, electronic medical records are more susceptible to theft than paper records. The Veterans Administration (VA) is well-known for its system-wide Vista Electronic Health Record system. In 2006, a VA laptop was stolen, resulting in the compromise of the private medical information of 26.5 million patients. Privacy advocates call for data protection measures to be built into any proposed health IT legislation; it seems unlikely that any such legislation will become a reality without addressing these issues directly.

Most practices are wise enough to require users to have passwords in order to access sensitive data. However, if it’s possible to wander by and access protected information every time a logged-on user needs a bio break, password protection is of little value. HIPAA regulations—and good data protection policy&mdash;mandate that all workstations should automatically log-off after a brief period of idleness.

Malware is a catchall term for viruses, spyware, and other software programs that infect your system and steal, alter, or damage data. Malware can enter your system through an open network connection with no precipitating user action, making it difficult to prevent. Antivirus and anti-spyware programs can help, but are useful only against known threats; a more reliable solution is the hardening of overall security using firewalls and related protections. For more, see the 

HIPAA requires you to obtain a signed form from each patient indicating that he or she has been informed of his or her privacy rights. Some may need guidance and clarification, and will naturally turn to their physician for both. For this reason, it is critical that providers become familiar not only with the rules and restrictions that affect them, but also with basic patient rights under HIPAA. The links in this article, especially the educational modules available through the Privacy/Data Protection Project, are an excellent place to start.

Frank Ferrara is a freelance writer and former editor of

More than four years removed from the end of the beginning of the national Health Insurance Portability and Accountability Act (HIPAA) experience, the legislation's requirements regarding data...

The Data Protection Primer 2007

How do you bring healthcare technology into your practice?

Technology is best introduced with patience and in a very systematic, measured fashion. Too many disruptions to a practice can have a catastrophic effect, not only on the bottom line, but on the willingness to move forward with other technologies. A “physician champion” is vital to any successful technology implementation and should be responsible for “test-driving” each aspect of any new technology solution. I joined a practice with a great deal of vision but no technology intuition. The first small step was to demonstrate cost savings and improved turn-around time through digital dictation. This simple initial success promoted confidence in technology and fueled the appetite for the fully paperless practice we have today.

What technologies do you utilize in your daily practice?

Text messaging and access to e-mail from handheld devices have made communications more efficient. The days of alpha-numeric paging on one-way devices are numbered. If you’re not versed in the benefits of text messaging, most 12-year-olds can teach you more than you’ll need to know! In the office, voice recognition for limited aspects of documentation has led to increased efficiency and productivity. When accessing our EMR remotely, SSL (

) access is a nice complement to VPN connections, which can be cumbersome or infeasible from within secure hospital networks.

What is the most significant recent development in healthcare technology for practicing physicians?

Web-based EMR applications, which allow physicians access to patient data from virtually anywhere, have revolutionized the practice of medicine. Not only are we able to provide better care to our patients through rapid response to refill request and result notification, physicians can also avoid costly duplication of tests, make more informed decisions, and limit liabilities. With the insatiable demand for instant information in our culture, medical practices will not be spared much longer. And don’t underestimate the lifestyle benefits—I hear time and again from physicians how they are leaving the office earlier with the help of efficient IT solutions!

What technological advancement do you foresee having the greatest impact on physicians in the near future?

Although realistically a few years away, industry standards for interconnectivity 

 (Healthcare Information Technology Standards Panel) will allow physicians to create electronic records faster while integrating a multitude of external information and data. “Digital paper” may offer a reasonable option for the less technologically proficient providers and can help patients enter historical data without computer interaction.

Is there anything else you’d like to say to our readers?

A successful technology implementation will not only save time and money, it has a proven return on investment if utilized to its potential. However, uninformed purchases and unrealistic expectations can be financially devastating to groups. Understand what aspects of your practice you wish to enhance and seek a product that has been proven to provide that solution in a similar practice setting. Never purchase a product based on a vendor’s promise to develop a solution—make the investment in the technology as it stands today. A “one size fits all” option, such as a hospital-based solution, is unlikely to work in a single or multi-specialty model since the needs and work-flow are very different. Take the time to visit a similar practice currently utilizing a product before you make an investment. You wouldn’t buy a car without driving it first! 

This month's Most Valuable Physician in Healthcare Technology.

DocMVP: Dan Neumann, MD

1 Why is there a general lack of attention devoted to HIT among the presidential candidates?

I think it’s really such an “inside baseball” story that it doesn’t have a lot of resonance. Most of the candidates are worried about global warming and oil consumption, but you don’t hear them talking about how to design engines for greater fuel efficiency. It’s the same thing with healthcare; they’re focused on issues of accessibility, quality, and cost. But how they achieve those things is inside the factory, and the candidates are just not that worried about that.

2 What can be done to increase the awareness and understanding of HIT among the voting public?

One of the things the Alliance has learned from talking with consumers is that they think this stuff already exists. We did a series of focus groups in New Orleans, and one of the groups believed their providers already had computerized medical records because when these patients went to the emergency room, someone entered their information into a computer. They had been with an admitting clerk and given their insurance information, but that’s not a medical record. Consumers typically assume their physicians have all of their relevant information, and so HIT just isn’t compelling to them.

I used to dream that we would get to the point where patients would walk into their doctor’s office and ask if they had an EHR system. Now, I don’t think that is going to happen. I see a lot of parallels to the efforts to “consumerize” quality in healthcare. Early on, quality advocates were saying, “If we can get consumers to really focus on this issue, they’re going to choose their providers on the basis of all sorts of quality information.” The reality is that consumers assume they’re seeing the highest quality provider, so when their leg is broken, they’re just not that fixated on going online to see who does the best job of setting a broken tibia. I think the same thing happens when it comes to HIT. We may increase consumers’ awareness that they can schedule appointments online or that their insurance and other information ought to be available to their provider, but I don’t think we’re going to get much beyond that. 

3 Is there a particularly deserving HIT proposal that hasn’t received much attention on Capitol Hill?

Hillary Clinton has been an HIT advocate for years. She has a sophisticated view of what’s going on; she and her staff were the architects of a lot of what’s contained in the Senate HIT bill. Senator Obama seems to have a pretty good idea of what HI could mean in terms of engaging more consumers and connecting outlying communities. I think his ideas get at the core of increasing accessibility through HIT. There hasn’t been nearly as much movement on the Republican side, I think in large measure because their political ideology is “get the government out of healthcare,” not “make new proposals for even more in-depth government involvement in healthcare.”

4 Which of the current HIT bills do you think is most likely to bear fruit?

I’m not sure. Th e Senate bill is through; it’s a mix of many different things, and it doesn’t really have a driving ideology. If you go back to the last session of Congress and look at Nancy Johnson’s bill, it was crafted with a consistent theme of what they wanted to achieve. I think the Senate bill that’s come out of the current session takes more of a “bread upon the waters” approach. The Democrats in the House don’t seem to be as enamored with that, and the Republicans seem to be dead set against a lot of it.

5 How can physicians encourage a greater focus in Washington on the benefits of HIT?

I think most of the policy makers understand the potential benefits of HIT. Th e bigger struggle is to get policy makers to understand the complexity of the current system’s structure. There seems to be this notion that “we’re going to talk about the benefits of HIT and somehow mandate the use of HIT, and then somebody is going to sprinkle pixie dust all over the country, and voilá, we’re going to have all these benefits of HIT.” The reality is that this will be far more complex than simply buying a computer system. It’s the transformation in care practices that really generates the benefit, and those transformations take an enormous amount of time, money, and effort. Yes, they’re supported by HIT, but it’s clear that simply putting the computer into a doctor’s office doesn’t really change anything. 

5 Questions with... Scott Wallace, President and CEO, the National Alliance for Health IT.

October 2007