The iTunes App Store offers an ever-expanding collection of iPhone and iPod touch applications that are specifi c to medicine. When we wrote this feature, there were 58 pages of 20 apps each—that’s nearly 1,200 apps! To give you an idea of how quickly the list is growing, consider that more than 200 apps were added between October 1 and October 23! With so many apps from which to choose, where do you start? Enter, App Wrap, our way of helping sort through it all. You’re welcome. 

Enter the titles below in the iTunes search window to easily fi nd and download them. 

Topping many medical iPhone apps lists—including our 

 back in May—Epocrates claims to be relied upon by more than 900,000 healthcare professionals, who use it to “make quick, confi dent decisions at the point of care.” The frequently updated app provides information on thousands of drugs, the ability to check drug interactions on up to 30 medications at a time, the physical characteristics and imprint code for numerous pills, a medical calculator, peer-reviewed disease management content that includes treatment options by patient type, interpretations for hundreds of lab tests, and more. The only app we’ve seen to receive more fi ve-star ratings than one-star ratings, Epocrates has received more than 50 reviews for this latest version. Among them: “Best app ever!” “This is a mandatory application for any healthcare provider. Each new version only reinforces this,” and “It’s a trusted app and used by all my doctor friends.” Among the negative reviews is one that reads, “This program requests too much personal information including your birthdate. There is no reason for this nor any data security.” 

iTunes App Store Average App Store Rating:

This free application provides clinicians, nurses, and other healthcare professionals with medical information and decision support tools. Resources include a drug guide, evidence-based information on hundreds of disease and symptom topics, a medical calculator, and a MedAlert feature, which ensures that clinicians receive the latest news and other information regarding their specialty. Reviews on the current version are mixed, with one reviewer experiencing bugs, one saying “rarely will this app give me the answers I’m looking for,” and another saying “Good [user interface], very helpful.” Reviews from previous versions are mostly positive, with some saying “Fast, functional and beautiful,” “Best yet,” and “Great resource for any medical professional.” 

This HIPAA-compliant e-prescribing application— available in the full version risk-free for six months, at writing&mdash;allows users to view medication history, lab results, and more while on the go. Physicians can also complete prescription ordering or renewal requests, add notes for follow-up, fi nd pharmacies, access patient demographics and problem lists, and mark lab results as reviewed. Reviews from the iTunes App Store include: “Very reliable and amazingly fast! I’ve gotten an iPhone for the sake of this application&mdash;it was worth it ‘big time’!” “So simple even a techno-challenged old guy like me was able to quickly get to the valuable info for my patients,” and “Who needs a computer in the room?” 

This app takes the FDA Mobile News and adds to it, combining news from the Centers for Disease Control and Prevention, Food & Drug Administration, Health & Human Services, National Cancer Institute, National Institutes of Health, and National Library of Medicine into one, easy-to-use resource. What else do you need to know? How about some user reviews? Although several reviewers had trouble downloading the app, one said “This application is well organized and provides me with all the info I needed. It may have had bugs initially but apparently they’ve been worked out.” 

ePocrates offers this challenging game in which users “race against the clock to diagnose the disease” as images are revealed. Receive scores based on speed and accuracy, submit your score to compete with top clinicians throughout the US, and test your own knowledge. The iTunes App Store reviews are mixed for this app, with some saying “It’s slow and buggy, takes too long to load” or “it only uses a limited image supply, so you can memorize each one,” and others saying “I thought this was a really clever idea! It was fun to try to guess the diseases and test my knowledge,” or “What a great way to sharpen your diagnostic skills! Just look at the photo and select one of three choices and get immediate feedback.” 

iTunes App Store Average App Store Rating Rating:

Don’t let the 2-star rating on this app—which turns your iPhone into a stethoscope thanks to the help of cardiologists who help developed it&mdash;fool you; the three of the fi ve ratings for the current version more or less say that the app doesn’t work, but the two others disagree, saying “This app works great! Takes some practice and defi nitely requires good, overthe- ear headphones” and “Couldn’t get it to work at fi rst but fi gured out I had to take case off b/c it was keeping the microphone from making a good seal contact on the skin. And after getting a good set of headphones I played with it for 3 hours! It works a lot better than I expected actually.” Now that we got that out of the way, let us provide some more info on the app’s features; users can hear the last eight seconds of recording by shaking their iPhone, as well as see a phonocardiograph display and spectrogram. The audio and spectrogram image can also be e-mailed to colleagues. A member of the MDNG staff experienced this app in use at a doctor’s visit and was “blown away.”

iTunes App Store Top 10 Medical Free Apps (as of 10/23/09) 

iTunes App Store Top 10 Medical Paid Apps (as of 10/23/09) 

6) Instant ECG: An Electrocardiogram Rhythms Interpretation Guide 

10) ACLS Wiz — Advanced Cardiovascular Life Support and Basic Life Support 

Articles

Pulse

The iTunes App Store offers an ever-expanding collection of iPhone and iPod touch applications that are specific to medicine. When we wrote this feature, there were 58 pages of 20 apps each-that's nearly 1,200 apps! To give you an idea of how quickly the list is growing, consider that more than 200 apps were added between October 1 and October 23! With so many apps from which to choose, where do you start? Enter, App Wrap, our way of helping sort through it all. You're welcome. 

App Wrap

When it comes to negotiating fees with health plans, practices and physicians have more leverage than they realize. The problem, says John Schmitt, a managed care expert with EthosPartners Healthcare Management Group, is that practices often don’t even try. “Groups negotiate an agreement with a payor and then, for whatever reason, just fi le it away. Most medical groups do not have a good, proactive methodology for negotiating for physician reimbursement,” Schmitt says. 

Schmitt says the adversarial fee negotiating environment that has existed between physicians and health plans is changing to a more cooperative partnership between payors and providers. As an example, Schmitt points to a Michigan-based orthopedic group whose contracts he helped renegotiate. He contacted the medical director of the group’s largest payor and indicated the group wanted to renegotiate its contract and fee schedule, and suggested talking about a pay-for-performance arrangement. Not only was the medical director receptive, he arranged to meet with members of the orthopedic group to further discuss the arrangement. “What used to be a poker game is now transparent,” Schmitt says. “The realization is, we all have an economic problem with respect to medical costs. But the doctors have the clinical solutions to those economic problems. Health plans are saying, ‘Let’s see if we can’t be better business partners not only for our sake, but for the sake of the patients and the community as well.’ It’s a new era of managed care, which is really what it should have been when it kicked off twenty years ago.” 

Taylor Moorehead, a partner with Zotec Partners, a leading medical billing company, suggests there are several ways physicians can begin renegotiating fees with health plans. If a physician is hospital-based, he or she has a little more leverage. For example, the physician is performing services at a hospital and being paid the health plans’ usual, customary rates for that location. The physician asks for an increase, and the health plan says no, so the physician cancels his or her contract and begins working non-contracted with the plan, knowing that the plan’s patients are going to come to the hospital regardless of whether he’s contracted with the payor or not. But now, the physician begins billing the patient for 100 percent of their fee schedule. The health plan will pay what it believes is appropriate, and the balance is owed by the patient. 

“Now, the patient becomes the physician’s advocate,” Moorehead says. “The patient is subject to paying a lot more money out of pocket, which is upsetting. They complain to the hospital, the hospital complains to the doctor, and the doctor complains to the carrier. Ultimately, it ends up in the lap of the carrier. So, if you can go non-contracted for a period of time, applying the pressure to the payor, the payor will bend and give you a better rate.” 

Negotiating is a bit more diffi cult for offi ce-based physicians, who rely on the carrier to direct its members to the physician’s practice. In those circumstances, where there isn’t as much leverage, building a business case is critical. That means shifting your strategy from reactive to proactive. “If you sit around and wait, you’re never going to get increases,” says John Haresch, MD, who runs 

, a micropractice based in Kill Devil Hills, NC. “I’ve had some success at it, but not enough to make it easy.” 

Haresch begins by sending a letter to the carrier outlining his case. He points out that costs are going up while the carrier’s reimbursement level is not. More importantly, he supplies data in support of the way he runs his practice— one physician who spends more time with his patients. He tells the carrier, “If you want full, patient-centered, medical home stuff that’s being proven out in studies, here’s the level of payment I need. Now, tell me what level of service you’re prepared to pay for.” 

It’s challenging, says Haresch, and sometimes frustrating. What keeps him going? “There’s the underlying, altruistic part that if we can keep the reimbursement going, keep the practice going, and keep fi nding ways to improve the quality of care, it’s good for people—and that’s why I originally got into all of this. It’s just the right thing to do.” 

Ed Rabinowitz is a veteran healthcare writer and reporter.

Columns

When it comes to negotiating fees with health plans, practices and physicians have more leverage than they realize. The problem, says John Schmitt, a managed care expert with Ethos Partners Healthcare Management Group,is that practices often don't even try.

Physician's Money Digest: Doctors: Be Proactive when You Negotiate Reimbursement Fees

New technologies can make healthcare more personalized, strengthen the patient—physician relationship, put the right information in the right hands at the right time, and potentially improve outcomes and efficiency across the healthcare spectrum. So why are so many physicians reluctant to embrace these changes? 

 as “the use of a specific set of Web tools (blogs, Podcasts, tagging, search, wikis, etc) by actors in healthcare including doctors, patients, and scientists, using principles of open source and generation of content by users, and the power of networks in order to personalize healthcare, collaborate, and promote health education.” 

“Health 2.0” isn’t just a buzz phrase; it’s fast becoming the essence of our medical system, whether we want to admit it or not. Many savvy patients and key subsets of the medical industry are already on board. What I find simultaneously intriguing and frustrating is that the one group that seems to be holding out on full implementation of Health 2.0 and all the power it can provide is the group that would benefit from it the most: physicians. 

Sure, there are a few patients who have computer and reading literacy issues; but by and large, today’s patients are not only health-, computer-, and reading-literate, but they are also utilizing social media and various high-tech tools to learn about healthcare, connect with healthcare providers and other patients, and negotiate the healthcare system. 

In doctor-land, however, except for a relatively small, tech-savvy group, one of the following two responses is the norm when Health 2.0 issues are raised: 

2. Total acceptance and excitement, an almost Zen-like state of “Yes! That’s it. That’s what I’ve been saying!” This is often followed by a lost look, as the physician has no idea what to do next or how to adopt any Health 2.0 tools in his or her practice.

The call to Health 2.0 is here. Getting all physicians on board will require breaking down four huge barriers: Fear. Many physicians are fearful of what they do not know and are worried that it will be difficult for them to learn about new technology. Many have not yet made the leap to using EMRs or even getting Internet access in their offices, so anything even remotely more exotic is scary. Cost and location are huge obstacles, depending on the size of one’s group and practice location. 

 Many docs worry that this new type of social media-driven medicine will lessen their control over their practices. Unfortunately, they don’t understand the power it gives them to control their day and help them be more efficient, so they shy away. From scheduling to e-mailing results to patients, they can’t look past the technology learning curve to see how much time will be saved by adopting systems that will actually decrease the busywork that wears them down. 

 Not understanding the world of social media and networking, many of these docs fear loss of connection with their patients. If physicians gave some of these systems a try, they would understand that they actually enhance communication and foster the doctor—patient relationship. 

 Some docs simply do not want to acknowledge the wave that is moving the healthcare system in a new direction. Despite not liking the current system much, they don’t want to embrace something new. This is, perhaps, the toughest barrier to break down, and only time and education will help them understand the value Health 2.0 can add to their lives. It’s time we admit that some of the problems we see in healthcare today are partly the result of our own resistance to technological innovations that are begging to become widespread, as well as to changes that are already occurring by virtue of our patients’ wishes. Our patients are embracing Health 2.0 now. If we all embrace it together, as an industry, think of all the systems issues we’d fix--from time management to patient communication. Put that way, how could anyone still be in favor of ignoring health 2.0? 

Gwenn Schurgin O’Keeffe, MD, FAAP, (aka “Dr. Gwenn”) is a pediatrician, health journalist, parenting and social media expert, and is CEO and Editor-In-Chief of

an online health and communications company dedicated to providing reliable information for today’s busy families. She also writes the blog 

Social Media Notebook: Are You Ready to Make the Health 2.0 Leap?

The Internet is filled with reports of remarkable cognitive enhancement with various nostrums. Many are not regulated, and the pages are typically associated with glowing testimonials and a link to sign up for uninterrupted (and uninterruptible) delivery of the miracle substance. More to the point of this post, other blogs, reports, and forum comments opine as to notable benefits of taking prescription medications marketed to treat conditions and diseases. Unfortunately, our patients often read these same reports with rather less skepticism than we may have about the purported benefits. What is our moral duty when asked to prescribe for this kind of purpose, now generally referred to as neuroenhancement? What are we to say to them when they request our opinion on such therapy? Have you considered your thoughts on using drugs to modify otherwise normal people? The American Academy of Neurology 

 for some time on advice to the practitioner on this matter, and a guideline was recently released (via electronic publication ahead of print publication). This report, crafted by the Ethics, Law and Humanities Committee, focused on the ethics of such prescribing, concluding that prescribing or recommending products is generally acceptable. 

The underlying issue is that persons with no clear disease or impairment are asking about ingesting substances for the purpose of improving attention, memory, and/or cognition. Often, neurologists and other practitioners are asked to prescribe medications for these purposes. Examples include methylphenidate (Ritalin and others) and donepezil (Aricept). Much has been said in quite abstract terms about the moral and ethical implications of neuroenhancement, but the Academy seeks to provide more practical guidance. 

This analysis proceeds by commenting on this prescribing being outside the traditional goals of medical practice, but notes that most would consider it acceptable, as the goal is the improvement of patient well-being. Principles of ethics of medicine (beneficence, autonomy, etc) in this setting are the primary focus. In general, as long as a prescriber carefully considers these principles, neuroenhancement prescribing is ethically permissible. One particular ethical consideration is the potential for confl ict of interest, especially if the prescriber has a financial interest, such as equity interest in the manufacturing company. In addition to the ability to ethically prescribe, a prescriber may, if he or she so chooses, ethically refuse to prescribe. One analogy used extensively in this guideline is cosmetic surgery. The moral and ethical framework between the two is quite similar. 

The role of regulation and the FDA is analyzed, as, at present, neuroenhancement is “off-label.” Medical liability is another concern. The authors believe that courts will apply the same standards regarding medical negligence that would obtain to more traditional practice. There is a possibility that medical expert testimony will not be required in litigation associated with this type of prescribing, as neuroenhancement is “elective.” Also of concern is the potential future alteration of rules for court proceedings regarding neuroenhancement to favor the plaintiff. 

One additional material future concern is neuroenhancement for children. The effects of substance ingestion on brain development will be difficult to characterize. And, resolving a difference of opinion about a proposed medication between the child and parent raises additional issues of autonomy. 

So, as prescribers, we are now operating within established ethical guidelines to prescribe medications for neuroenhancement. And, we are acting within the scope of current laws if we so prescribe. We are equally free to refuse to prescribe, if we explain to the patient why we are doing so. It is now up to the reader to exercise due clinical and ethical judgement in deciding how this applies to daily practice. 

Dr. Dostrow is a neurologist, epileptologist, and clinical neuropharmacologist, and has been practicing for many years. Previous and current academic appointments include neurology, psychiatry, and clinical pharmacy.

In each issue of MDNG, we will showcase a post by one of the HCPLive.com bloggers. This month, we have selected a post from The Nerve Center, written by Victor G. Dostrow, MD.

HCPLive.com Blog Spotlight: Neuroenhancement: One Pill Makes You Smarter...

In last month’s column, I talked about Microsoft’s newest desktop operating system, 

, and outlined several reasons why you might want to purchase it when it comes out this year. Windows 7 will include some really cool features—like multi-touch technology and usability improvements&mdash;that can benefit medical practitioners and their office staff. 

Because it is in Microsoft’s best interest to make the process of upgrading to Windows 7 simple and straightforward, you would think the software giant would put great effort into streamlining the experience. Unfortunately, it seems to me that Microsoft is hell-bent on driving its customers straight into the arms of its chief competitor, Apple, Inc. Microsoft engineers do this by making the software upgrade process excessively complex and difficult for the average non-techie user. 

Even if you decide to purchase a new computer that comes with Windows 7 pre-installed, you’ll still have to select which version of Windows 7 to get. Once again, Microsoft makes this overly complicated by selling a multitude of editions. There are six fl avors of Windows 7. One is for emerging-market countries, so unless you practice in Bulgaria or Uganda, that one is probably a bad choice. Another version is for people who work in large corporations, again a bad choice for most doctors. There is a stripped-down version called Starter that is available only on new machines. That version will likely be too minimal for the needs of most 

Most tech-savvy physicians will choose either Windows 7 Home Premium, which has all the important Windows 7 features, or Professional, which adds special networking capabilities and the capacity to run some older, specialized programs. Windows 7 Professional enables you to connect remotely to a network using a system called “domain joining,” which I doubt would be used by many practices with fewer than 100 physicians. But the ability to run older programs is important for those of us who haven’t yet upgraded our legacy practice management software. One last version, called Windows 7 Ultimate, combines all the features of the other versions. 

There is one more complication. There are 32-bit and 64- bit editions of each of the three main consumer versions of Windows 7 (ie, Home Premium, Professional, and Ultimate). The 32-bit editions are for computers with standard 32-bit processors, typically found in most medical offices. The 32- bit versions cannot recognize more than three gigabytes of RAM memory, which should be more than enough for the average user. The 64-bit editions for PCs with souped-up 64-bit processors can use much more memory, making the machine run faster when multiple applications are open or when doing CPU-intensive tasks like hi-def video playback. 

For those who want to upgrade existing machines to Windows 7, there is good news and bad, depending on what operating system you use today. Vista users face a relatively easy, direct upgrade process that preserves personal files, settings, and programs, although there are some restrictions on which versions of Vista can be upgraded to which versions of Windows 7. For the most part, you can only directly upgrade comparable versions of Vista and Windows 7—Vista Home Premium to Windows 7 Home Premium, Vista Business to Windows 7 Professional, etc. There are exceptions, and you can go to Microsoft’s website to learn more. 

For Windows XP users, the news is far worse. You will have to upgrade manually, which means that you have to reinstall and reconfigure all of your applications, settings, and personal files, assuming you kept and can find the original discs, download files, and software keys. I recently read about a third-party utility from 

 that can handle the manual process of moving from Windows XP to Windows 7. A new version of its popular 

 will be able to perform automated, in-place upgrades to Windows 7 on an existing Windows XP machine and preserve existing programs. I have not used the software and cannot attest to its efficacy, but the fact that Microsoft consistently produces complicated and difficult-to-adopt software remains great news for those companies that build user-friendly utilities that are designed to remedy these headaches. 

Dr. Bertman is Physician Editor-in-Chief of

He is a Clinical Assistant Professor of Family Medicine at Brown University and president of AmazingCharts.com, a leading developer of EHR software. He is also the founder and president of AfraidToAsk.com, a consumer website focusing on personal medical topics. He is in private practice in Hope Valley, RI.

It seems to me that Microsoft is hell-bent on driving its customers straight into the arms of its chief competitor, Apple, Inc. Microsoft engineers do this by making the software upgrade process excessively complex and difficult for the average non-techie user.

Tech Talk: Nothing Is Ever Simple with Windows

Health Information Technology for Economic and Clinical Health Act

 (HITECH), Congress has imposed a demanding new data security regime on all healthcare providers and organizations. Congress expects key healthcare industry stakeholders (hospitals, doctors’ offices, insurance companies, and other entities) to track and account for each and every time protected electronic patient information is accessed. To comply with the data security and patient notification provisions called for by HITECH, covered entities will be expected to enact policies and procedures (such as application-layer logs and audit trails) that enable them to track when, how, and by whom protected patient health information is accessed. 

Healthcare providers, payers, and administrators make extensive use of information technology. Although much medical information is still recorded on paper, computerized record systems are already ubiquitous in clinics, hospitals, and doctors’ offices; insurance companies and other third-party payers also use computers for all facets of record keeping. E-mail and other forms of electronic data collection and exchange are common. More personal medical information than patients and providers probably realize already is exchanged via e-mail today, whether intentionally or otherwise. 

Information technology is designed to facilitate the collection, storage, and sharing of data. Data sharing especially is critical to the effective delivery and administration of healthcare. Indeed, one of the major factors behind the push for wider adoption of electronic medical records and other forms of information technology in healthcare has been the realization that efficient, timely access to and sharing of information is critical to ensuring better healthcare quality and improving health outcomes. The healthcare industry already engages in extensive sharing and collaboration by way of computer technology and is actively seeking to expand on this. 

However, in some ways, a big-picture confl ict may be emerging. Although computers promote data sharing, HITECH is about data restraint and accountability. The essence of the data security requirements imposed by HITECH is that health entities must install lots of fine granular controls to monitor, regulate, or prevent the sharing of data. Just as new collaborative technologies are enabling easy data sharing, the security and privacy rules set out under HITECH may end up stifl ing the fl ow of key information as covered entities take steps to protect against data breaches. 

According to the HITECH Act, it’s as easy as 1-2-3-4 Under 

, a healthcare “covered entity” must notify the patient if the entity discovers that a patient’s unsecured data has been accessed without proper authority. How is this requirement to be satisfied in practice? All notifications must be made “without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach by the covered entity.” Notification of the individuals who have been affected by the information breach must take several forms, including written (or e-mail) communication, a “conspicuous posting” on the covered entity’s website, notices in “major print or broadcast media,” or even, if the situation is sufficiently urgent, direct telephone contact. To ensure that they are effectively monitoring and tracking access to protected data, 

 are going to have to “implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” 

 goes on to stipulate that a patient will have the right to receive from a covered entity an accounting, dating back three years, of all disclosures of his or her protected information to anyone outside the entity. A disclosure could include the sharing of information among healthcare entities for treatment, payment, or health operations. In other words, it could cover the exchange of treatment information from one doctor to another doctor who is not employed by the same entity as the first doctor--a very common event! This accounting requirement applies to information contained in any “electronic health record,” which section 

 expansively defines as “an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized healthcare clinicians and staff.” This could include a large volume of dayto- day internal e-mail in a clinic, a hospital, or a doctor’s office--or external e-mail among multiple healthcare providers. The effective date for this requirement varies, but could start for some data as early as 2011. As a practical matter of compliance, this step will require extensive logs and audit trails that 

 to “log all disclosures made through EHRs — including those made for treatment, payment and healthcare purposes &mdash; and report them to patients when requested.” 

Under Section 13405(a) of HITECH, a patient can request that a covered entity not disclose certain information to a “health plan.” The delivery and administration of healthcare is a very complex undertaking. Compliance with a patient request to allow X information to be disclosed but not Y information is difficult. Compliance will require careful attention and review; affected healthcare entities are going to need to implement proper information controls that include application-layer logs and audit trails so that this kind of patient request can be enforced and employee actions can be reviewed after the fact. 

, a covered entity shall be considered to be in compliance with these requirements regarding the use, disclosure, or request of protected health information “only if the covered entity limits such protected health information, to the extent practicable, to the limited data set… or, if needed by such entity, to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, respectively.” Although the law stipulates that “the covered entity or business associate disclosing such information shall determine what constitutes the minimum necessary to accomplish the intended purpose of such disclosure,” this is in fact a very subtle requirement. Effective compliance will require a great deal of human attention, supervision, and after-the-fact review, possible only if there is sufficient auditing and other data security architecture in place. 

For any organization, complete compliance with the HITECH requirements will be hard to achieve and sustain. The four steps/requirements outlined above should not be thought of as separate ideas; covered entities must view them in the aggregate if they want to 

implement data security policies and tools

 that achieve verifiable, real-world compliance. Healthcare organizations need to be archiving e-mail (and other e-messages such as text) for generous periods of time. Archival allows later review of which patient information was delivered to which provider, business associate, or other stakeholder subject to the HITECH requirements (not to mention other operational functions, such as review of who was consulted on a particular matter, at which time, and so on). Any healthcare e-mail archive application used by a covered entity must support audit trails that show who accessed a particular e-mail archive record at which time. Healthcare firms will similarly need 

 for other (non-e-mail) forms of electronic collaboration and data sharing. 

The call for certain groups of healthcare entities to maintain audit logs is not entirely new. The existing HIPAA Security Rule already requires that covered entities implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. And data access audit trails are already part of medical privacy law. 

New Mexico’s Electronic Medical Records Act, SB 278

, for example, requires a “record locator service” (a kind of clearinghouse for health records) to maintain detailed audit logs of the access of patient information. 

Nonetheless, the HITECH Act requires a substantial new layer of security for protected health information. Unlike anything before it, the Act impels extensive adoption of access logs and audit trails in healthcare computers. Hospitals, physicians, and all other groups to whom these new rules apply are urged to stay up to date with the latest guidance coming from the Department of Health and Human Services and other regulatory bodies and to be proactive in their efforts at compliance. 

. This feature is adapted from an article that originally appeared online at 

Feature Articles

HITECH says covered entities must be able to monitor and record every time that patient data is accessed, enabling the entity to comply with the new notification requirements should unauthorized access occur. Will the new rules end up restricting the efficient exchange of data that is crucial to providing high-quality healthcare?

Security Rules Put Providers on Notice

If your patient records aren’t already stored digitally, they are likely to be digitized soon. There is a tremendous push by the federal government—as well as by some private payors and self-insured employers&mdash;to get all healthcare providers wired in the near future, in order to better coordinate patient care, improve outcomes, and “bend the cost curve” all at the same time. There are some 

 in play to achieving “meaningful use” of “certified” EHR systems; those terms are to be defined in federal regulations later this year, but the outlines of those definitions are already pretty clear. 

Once all that patient data—or as it is known in HIPAA-speak, protected health information (PHI)&mdash;is stored electronically, it becomes exposed to potential data breaches. In late September, two sets of federal regulations took effect that address the way in which PHI should be maintained, and the steps that should be taken to prevent a data breach and to notify the government and affected individuals in the event there is a data breach. Compliance with these rules&mdash; issued under authority of the HITECH Act by the 

US Department of Health and Human Services

 (HHS) with respect to healthcare providers, and by the 

 (FTC) with respect to EHR vendors and other similar third parties—requires affected practices and businesses to assess and update their data privacy and security policies and procedures, as well as train all affected staff accordingly. 

The exposure in case of violation is significant, both in terms of fines and penalties and in terms of bad publicity—certain data breaches require notice to potentially affected individuals via the general media in addition to notices required to be filed with the regulators. The new rules&mdash;I call them Son of HIPAA&mdash; are layered on top of existing HIPAA privacy and security rules: the 

, regarding identity theft protections to be put in place by any “creditor” (which includes healthcare providers not paid in full at the time of service), and state privacy rules. While HHS and FTC took some pains to harmonize the new rules so that patients will not be bombarded with multiple data breach notifications about the same incident, for example, the other applicable rules out there have not been harmonized. 

The key concept in the new breach notification rules is that encryption of patient data will eliminate the need to notify patients and the federal regulators in case of an inappropriate release of data. Such a release, if the data is encrypted (ie, unusable, unreadable, or indecipherable), is not considered a breach. Encryption is not required, though, and each affected entity must engage in a cost-benefit analysis before deciding whether to encrypt all affected data. 

Another important aspect of the rule is the concept of harm—the regulators decided that not every data breach should trigger all of the notice requirements, just breaches that “pose a significant risk of financial, reputational, or other harm to the individual.” For example, if an employee of a healthcare provider accesses a patient record inappropriately, but immediately realizes his or her mistake, and exits the record quickly and does not retain any PHI, that is not a reportable data breach. 

Finally, “business associates” under HIPAA are now required to implement policies and procedures to maintain privacy and security of PHI, parallel to those that have been required of “covered entities” under HIPAA since the beginning. All business associate agreements and notice of privacy practices (NPPs) will have to be updated to account for the new requirements before February. Healthcare providers that wish to distinguish themselves should consider revising their NPPs to highlight the ease with which they will make copies of records available to patients. This is 

 for many patients, and ensuring that patients’ rights to their records are easily exercised () could be a way to build goodwill among patients and potential patients. 

By necessity, this is an extremely brief introduction to a very involved set of regulations. My hope is that you now have a sense of how important it is to be sure that your operations are fully compliant with the regulatory requirements before full enforcement and random field audits begin in February 2010. 

Mr. Harlow, Principal of The Harlow Group LLC, is a healthcare lawyer and consultant based in Boston, MA. He helps healthcare providers and related businesses of all shapes and sizes realize their goals in an increasingly regulated environment. His blog, HealthBlawg, is recognized as a leading healthcare law and policy blog. You should subscribe to his blog and follow him on Twitter: @healthblawg

Son of HIPAA: Who's Been Looking at My Data?

August has traditionally been a sleepy month for government regulatory agencies, but this year, Washington’s usual summer torpor was interrupted by a rush of new initiatives, as more than three-quarters of a trillion dollars from the 

 surged into a mind-boggling range of projects. One of these efforts, the Health Information Technology for Economic and Clinical Health Act (HITECH), provides a billion-dollar bolus of funding for EHRs. 

, Secretary of Health and Human Services Kathleen Sebelius explained, “We’re announcing $1.2 billion in grants directed to two primary areas; the first is helping doctors and hospitals adopt electronic health records and get assistance from regional health centers, and the second is to help support health information exchange—help states set up systems where we’ll be able to communicate across the lines of healthcare agencies.” Sebelius added that “this is just the first wave of resources invested in health technology, aimed at really transforming our paper-driven system to an electronic system over the next several years.” 

Health IT proponents cheered the new funding, but many have reservations about other aspects of the Act. In particular, HITECH is shining a spotlight on the problem of data security in health IT, an issue that has long been regarded as the field’s biggest challenge. 

HHS officials agree. “Security is absolutely essential, it’s foundational, and we are tasked by the law to develop new methods and to examine technologies for assuring security, and we are going to be asking our health information technology policy committee to look directly at that subject in the very near future, so we understand that that’s critical,” said 

David Blumenthal, MD, National Coordinator for Health Information Technology

Indeed, HITECH already implements some new security requirements. Most notably, the Act expands the coverage of the earlier Health Insurance Portability and Accountability Act (HIPAA). Previously, entities such as hospitals and clinics were covered by HIPAA, but their contractors, software vendors, and other business associates were not, a loophole that incensed many privacy advocates. 

, all of these business associates will now be subject to HIPAA’s stringent security requirements and legal penalties. 

“HITECH is a real game changer with respect to the legal obligations of business associates, and it’s going to have a significant impact on business associate relationships and all vendor relationships,” says Reece Hirsch, a partner in the law firm of Morgan, Lewis, & Bockius in San Francisco, CA. Hirsch, who specializes in healthcare regulation, adds that “there are a whole host of new individual rights with respect to [personal health information] for patients, and... they all relate to rights of patients with respect to electronic health records.” 

Most of the new rules will take effect in February, a deadline that has some vendors sweating. “For large business associate organizations like a major outsourcing company, let’s say, it’s highly likely that they’ve already implemented a comprehensive security compliance program, [but] for smaller business associates, particularly those who aren’t exclusively dedicated to the healthcare industry, they may have a lot of work to do, because between now and February 18, they’ll be required to get that kind of formal, comprehensive security compliance program in place,” says Hirsch, who recently presented a 

Although the business associate rules will affect most physicians indirectly, other HITECH measures will have a direct impact. For example, the new funding includes “almost $600 million of support for what are called regional extension centers... whose purpose is to support physicians and hospitals in the adoption and meaningful use of electronic health records, and... approximately $600 million in support for state-designated entities to promote health information exchange within their jurisdictions,” according to Blumenthal (http://tinyurl.com/yes4cgl). 

HITECH also provides for a series of incentive payments for Medicare and Medicaid providers to spur them to adopt EHRs between 2011 and 2015, after which the government will begin penalizing those who have not adopted electronic records (see Timeline). For cash-strapped hospitals and overworked physicians, those dates appear imminent, but public health officials argue that deadlines are an essential component of the legislation. 

“If you never have a deadline then you really will end up with people being all over the place; they might decide from one day to the next ‘well this isn’t such a priority if it doesn’t have to be done tomorrow, and we’ll use our resources somewhere else,’” says Rachel Block, Deputy Commissioner of Health Information Technology Transformation in the New York State Department of Health. 

Block adds that meeting the deadlines will require individual doctors and hospitals, as well as state governments, to tackle data security problems at several levels simultaneously. “Policy is one issue, but we really need to look as well at the implementation, support, and the... institutional or cultural variables that might determine whether security is considered important or not,” she says. In other words, sophisticated encryption systems become useless if a doctor’s password is “password.” 

To address those problems, New York and other states are now implementing a wide range of security measures to protect exchanges of health data between systems. “Ultimately, we will have audit policies and protocols, and we will be setting up monitoring systems to ensure that those audits are being conducted, and that any findings are followed up on,” says Block. 

Those efforts don’t come cheap, though. New York’s state government and hospitals will spend close to a half-billion dollars on health IT implementation over the next four years, and other large states will likely see similar expenditures. Block says that the $1.2 billion in new federal funding from HITECH, while helpful, will still leave states, hospitals, and individual physicians picking up a big tab. One way New York has reduced the overall cost is by storing records in a federated network rather than a centralized database. Each clinic or hospital stores its own patient records, and data are only exchanged across the network in response to specific, authenticated requests. Besides spreading and reducing costs, this approach could also provide better security; a breach of one server will not affect patient data on other nodes of the network. 

Potential data breaches are also a hot topic for federal regulators. In September, new HHS rules came into effect requiring data holders to notify patients when their information may have fallen into the wrong hands (http://tinyurl.com/m5ojt8). Any breach affecting more than 500 patient records triggers automatic notification of the media as well. The data breach rules are just the first of what will likely be a large body of new federal regulations on EHR security. At least 45 states already have laws covering various aspects of electronic health privacy (http://tinyurl.com/y8qecob), so a unified federal policy could actually simplify the regulatory situation—that is, if regulators can address some of the thorny questions still surrounding the issue. 

Many of those questions came to light at a 

 of the HHS’s Health IT Policy Committee in Washington, DC, and the ensuing debate hinted at the challenge now facing regulators. For example, Deborah Peel, MD, founder of the bipartisan Coalition for Patient Privacy, asked the committee to implement a straightforward and stringent policy based on patient consent. In Peel’s formulation, each request to access a patient’s information would have to be approved by the patient, who could selectively segment the data for different levels of access. 

However, Deven McGraw, Director of the Health Privacy Project at the Center for Democracy and Technology, argued that a purely consent-based system would fail: “It absolutely doesn’t surprise me that people in focus groups and in surveys say ‘give me control of the data,’ but consent doesn’t work as well to protect privacy as we would like it to.” She added that “healthcare doesn’t present us with good opportunities in a lot of cases to provide people with a meaningful right to say no.” Instead, McGraw advocates a robust framework of regulations—analogous to the security rules governing e-commerce websites&mdash;that would provide blanket prohibitions against certain types of abuse and also establish a strong enforcement mechanism to deal with violations. 

Formulating such a framework will be tricky, though. While few patients would object to doctors having general access to their immunization or allergy records, other types of information may need to be compartmentalized, and not just for the patients’ sake. “Our providers risk their personal safety by coming to work every day and doing their job,” said Eileen Twiggs, National Director of Information Systems and Technology at Planned Parenthood. Twiggs concedes, though, that simply walling off certain types of care will not solve the problem, as that information may become critical in a patient’s future treatment. 

As the meeting wrapped up, at least two things were clear about health IT: electronic health records are on the way, and the debates surrounding their security will not cool off anytime soon. 

Alan Dove is a freelance healthcare and science writer.

Health IT Still Seeks a Security Blanket

	It’s taken us a little while, but we recently launched a completely redesigned version of our website, HCPLive.com. The new site is designed to make it easier to fi nd the specialty-specifi c content you’re looking for, including: 

	• Exclusive articles and features on the latest healthcare information technology news and products, healthcare policy changes, social media tools and resources, and more 

	• Disease- and condition-specifi c resource centers that compile links to study results, ongoing clinical trials, multimedia resources, and more, all-in-one convenient, easy-to-access location 

	• A career center with information about job openings around the country 

	• Extensive onsite reports and daily coverage from key medical conferences and meetings 

	All content on the site is organized around a more intuitive navigation system that lets you fi nd what you want, when you want it. We’re adding new content every day, including videos and podcasts, that will truly make HCPLive.com the “Healthcare professionals homepage.” We’ve even developed HCPLive To Go, a free mobile app that enables you to access HCPLive content on your iPhone. 

	We’re excited about the features on the website and the opportunities they present for offering in-depth content, but we can’t do it all by ourselves. We’re going to need your help with some of the most exciting projects and initiatives at HCPLive.com to ensure they reach their fullest potential. 

	These projects offer participants the chance to: 

	Click the “Research” tab on the HCPLive.com homepage to learn more about HRA Research, a leading healthcare market research company that specializes in the pharmaceutical, biotechnology, and medical device industries. HRA Research is looking for physicians who are interested in being compensated for participation in online and traditional research studies on medical topics. You can sign up online to receive more information. 

	Were you one of the fi rst docs in your practice to get an iPhone? Is the iTunes App Store your homepage? Do you have strong opinions about some of the apps you’ve downloaded? If so, how would you like to become a medical app reviewer for MDNG? We’re looking for physicians who want to write candid, no-holds-barred reviews of medical apps for the iPhone (and other smartphones) that tell their colleagues everything they need to know before they decide to download. 

Share your opinions about the most important healthcare news and developments

	We are looking to expand our roster of bloggers, and we are looking for physicians in a variety of specialties who have something to say and only need an outlet for their writing. Want to blog, but don’t want to hassle with hosting fees and site upkeep? Become an HCPLive blogger and we’ll take care of all that for you. All you need to do is write. 

	Not interested in committing to an ongoing project like a blog, but still want to express your thoughts and engage your colleagues? Submit an editorial, rant, or commentary, and we’ll post it in the “Hot Topics” section of the website, feature it in the pages of 

, and send it out as a featured item in our eDigest newsletters. You’ll be surprised by the response. 

	If you are interested in becoming an app reviewer, starting a blog, or contributing a Hot Topic editorial, send an e-mail to managing editor Chris Cole at 

October 2009