Boulder Community Hospital computer records back on line - but something does not add up

This post is in followup to my March 20, 2013 post "Boulder Community Hospital computer system crash: Either you're in control of your information systems, or they're in control of you".

At a March 24, 2013 Denver Post article "Boulder Community Hospital computer records back on line" the following statements are made:

The computer system that Boulder Community Hospital uses to manage patient records, which had been down for almost two weeks, is now up and running again, hospital officials said Saturday.

Meditech, the system used by the hospital to manage patient records, went down March 12 and affected the hospital, its Foothills campus, eight laboratories and six imaging centers. It was put back into full service at about 3 p.m. Friday, according to hospital spokesman Rich Sheehan.

Sheehan said an investigation showed the outage was a result of a malfunction in one of the main computer servers ... the hospital has replaced the hard drives for the server that failed and are inspecting the remaining servers ... [the failure] resulted in the system being unable to access patient information. The malfunction affected both the primary server and a backup server kept off-site.

A hard drive failure led to a two-week outage of an entire EHR system and its offsite backup server?  A mission-critical system in a hospital is so fragile that a hard drive failure caused a two week outage?

If so, that itself shows, at best, poor overall system design with regard to reliability and redundancy (any server worth its salt has hard drives in a failure-tolerant configuration e.g., RAID), but also is not quite credible on its face.  A remote server should not be taken down by the failure of a local server.  I suspect the failure was more than just a hard drive failure, including software bugs or configuration errors, mass hardware and/or network failure, or even sabotage.

The following statement also lacks believability on its face:

... All patient data was recovered except for an eight-hour period the day of the outage. Sheehan said the hospital had to re-create, re-enter and validate the patient information for that eight-hour period before the system could resume normal operations.

If an information system is down for two weeks, there's two weeks worth of data lost.

... Sheehan said the hospital has replaced the hard drives for the server that failed and are inspecting the remaining servers. The hospital is also now doing data backups every four hours as opposed to every six hours, and is planning on doing hourly backups by the end of the week.

Replacing a failed hard drive is an inadequate precaution.  A 'system redundancy makeover' seems in order for when the next hard drive fails.   Hard drives have a very well known MTBF (mean time between failure) and annual failure rate.  (The very Seagate ST3750528AS hard drive in the PC I am typing this blog post on has an Annualized Failure Rate of 0.34%, per the manufacturer's publicly-available literature.) 

... An independent consulting firm also has been hired to conduct an investigation. The hospital said it expects a report within a few weeks. 

As other organizations are using Meditech products, Joint Commission Safety Standards (as I wrote in a 2009 JAMA letter to the editor "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" available at this link) call for sharing the results of that report with other organizations.  I had discussed this letter numerous times with senior Joint Commission leadership.

Will sharing of the independent consultant firm's report happen?  Probably not.

However, rest assured the Plaintiff's attorneys of Colorado will request it in malpractice suits that arose during the time period of outage.

-- SS

Healthcare IT Transparency Could Stand Some Improvement

Transparency in the health IT sector is akin to the transparency of Pb (lead).

The following report comes from the FDA Maude (Manufacturer and User Facility Device Experience) voluntary-reporting database, reported by a (likely unhappy) biomedical engineer a month after the "incident" - the nature of which is deliberately kept hidden.  This is regarding the PICIS "Pulsecheck" EHR for emergency departments:

Report Date     05/14/2010

PICIS INC. CARESUITE ED PULSECHECK S/W, TRANSMISSION & STORAGE PATIENT DATA
Event Type:  Other
Patient Outcome:  Required Intervention

Event Description

The customer has reported a patient incident that has prompted a review of their internal process and possible issues surrounding the incident. The customer report alleges the involvement of picis' ed (emergency dept. ) electronic health record application, whereby, duplicate results were received by the picis ehr application from an enterprise info system, which, when displayed in their entirety may have contributed to some degree of confusion for the treating physician - the context of which the customer has declined to clarify any further.  [What in the world? -ed.] At this time, we have been informed by the customer that they are restricted by senior leadership from disclosing any specific details regarding the patient's status, the specific type of result or evidence of application performance to support picis' investigation.

"Restricted by senior leadership from disclosing any specific details regarding the patient's status, the specific type of result or evidence of application performance to support Picis' investigation?"

That is perverse on its face, and probably in violation of Joint Commission safety standards on reporting of incidents that could affect other organizations.

Manufacturer Narrative

Picis' investigation into the reported incident is based on a limited exchange of info with the customer, as well as our internal review of the application design and current configuration in use at the reporting site. Review of configuration files, existing system build at the client site, interface specification documents and previous customer communications demonstrate that the customer implemented and accepted the picis edis in 2008. During this process, the picis edis system was configured to display all results sent from the customer's enterprise system rather than configuring the results display in 'overwrite' mode. Prior to acceptance, an investigation by picis and the client revealed that it was the sending system, sending multiple duplicate results messages [great quality - ed.] and a request was made by the customer of that enterprise vendor [I can only wonder who that was - ed.] to investigate. However, due to the enterprise system's protocol for 'add on' tests, it was not possible to utilize the 'overwrite' configuration due to the risk of filtering out unique results and subsequently not presenting the clinicians with important info. Therefore, the customer elected to have all results displayed.

A workaround that apparently, from the limited information provided, led to physician confusion..."the context of which the customer had", not very helpfully, "declined to clarify any further."

Hospitals also are required to have add'l safeguards in place for the handling of critical results including expedited reporting of critical results with a licensed responsible caregiver rather than relying solely on standard results reporting processes (joint commission national patient safety goal 02. 03. 01).

This is not a resounding statement of confidence in health IT...

The customer is currently working with a 3rd party integration consultant to improve the handling of results sent to picis' electronic health record application. We are providing support as it is requested. At this time, no corrective action is needed. 

The "senior leadership" that withheld details was protecting what, exactly?  Money and contracts, perhaps; conflicts of interest, possibly ... but not patients.

All I can say is:

Imagine if this was a report on a new drug suspected of harming people. 

What in heaven's name was going on here?

As I've written many times, and as illustrated by this MAUDE report, the health IT industry must first be transformed into one of evidence-driven IT practices and transparency before anyone touting its products has any business even speaking about the technology "transforming medicine."

-- SS

Did Joint Commission Accredit a Hospital Whose Understanding of Medication Reconciliation is Recklessly Superficial?

I submitted this complaint to the Joint Commission today.

I've been challenging them in recent years (especially since my JAMA letter "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" on hospital executive's violation of JC Safety Standards of July 2009) over the issue of their accreditation of hospitals using bad health IT.

Eventually, I hope, they will take a leadership role on health IT risk, lest they become a target for litigation.  (I think they're already there for their inaction on EHR problems despite admitted knowledge of the problems, in print, e.g., in their 2009 Sentinel Events Alert on Health IT Risks.)

Here is my complaint submitted both via email and via the Joint Commission "Report a Complaint online" page.  I added a few comments for readers in [bold red italics] that, of course, were not part of the submission:

------------------------------

Thank you for submitting your complaint!     Monday, August 20, 2012

Your complaint incident number is:     ########-########

------------------------------

Dear Joint Commission,

I also sent this complaint to PSchyve, AGiuntoli and MChassin via email.

You are already aware of the injury and death from Med Recon failure of my mother at [name redacted] Hospital, in an incident that began May 19, 2010.  Reference Incident #######-######.

I am also filing the issue below as a formal JC complaint:

As demonstrated in the sworn defense response by [name redacted] Hospital today, 8/20/12, the hospital has a very superficial understanding of Med Recon and Med Recon Failure. 

I am assuming they passed Joint Commission Accreditation that includes the ability to ensure continuity of care, including giving correct meds via Med Recon.

The hospital through defense counsel today (8/20/12) writes in a document I've placed at [URL redacted]:  

... 4.  As plead [sic -ed.], the gravamen [the basic gist of every claim or charge in a complaint - ed.] of Plaintiffs complaint is the allegation that he told the treating professionals about Mrs. Silverstein's Sotalol medication.

5.  Therefore, the central issue of this case is one of human communication- i.e., whether Dr. Silverstein told the various staff or not.  [In other words, their obligations to check medications end there - ed.]

In fact, the complaint was quite clear:

...32.  The tortious conduct of defendant [name redacted] Hospital consisted of the following:

a. vicarious liability for the actions of its agents [redacted], [redacted] and [redacted] to ensure continuation of the Sotalol therapy [can we all agree that's a primary responsibility of a hospital and its agents? - ed.];

b. vicarious liability for the actions of its agents [redacted], [redacted] and [redacted] to ensure proper operation of the defendant’s EMR system so as to ensure continuation of a presently active medication;

c. vicarious liability for the failure of its agents identified in this complaint to adequately communicate Ms. Silverstein’s complete medication history with the subsequent treating health care providers during this admission;

d. vicarious liability for the failure of its agents, identified in this complaint, to question why no Sotalol was ordered given the noted history of arrhythmia [a medical student-level question - ed.];

e. failure to have in place adequate procedures or policies to insure that presently active medications are continuously active in the EMR system unless deactivated by an appropriately qualified health care provider;

f. failure to have in place adequate procedures or policies to insure that the computer generates appropriate alerts for others to see when critical medications become inactive;

g. failure to properly assess the operational effectiveness of its EMR system so as to insure that presently active medications are automatically continued unless specifically deactivated by a qualified and authorized health care provider.

33. As a result of the above identified failures in medication administration and medical record charting, Ms. Silverstein has suffered the following:

a. Intracranial hemorrhage; b. atrial fibrillation; c. damage to her nerves and nervous system, including memory difficulties, and seizure activity; d. brain compression due to the intracranial hemorrhage; e. requirement for additional procedures; f. prolonged hospitalizations; g. need for rehabilitation; h. need for continuous therapies; i. pain, suffering, embarrassment, humiliation, and the loss of life’s pleasures; j. death.

While I gave the history of Sotalol to the clinicians on 5/19/10 (my mother had been on it dating to 2002) as I had done multiple times in this ED, this hospital seems to believe its Med Recon responsibilities end at the family - even when they have records in abundance in their paper records and EHRs (ED and floor), including from just a few weeks prior, with current med lists.

I note (as I had previously sent you) that Pennsylvania's Medicare QIO, Quality Insights, found the hospital had failed in medication continuity, and that the failure to administer Sotalol caused the recurrent A. fib and subsequent complications, the care not meeting professionally accepted standards. [The formal terminology for "malpractice" - ed.]

If you accredited this hospital, as I believe you did, this superficial understanding of Med Recon that you apparently missed or recklessly glossed over poses a serious danger to the community, and contributed materially to my mother's injuries, suffering and death.

Sincerely,

S. Silverstein, MD

Cc:  [attorney handling the malpractice lawsuit]

- end complaint -

--------------------

They defense is also trying to deflect the Judge from the issue of Metadata:

... At this point in time, it is respectfully submitted that the proposed electronic discovery is not relevant to the central issue of this case. For example, if the Triage Nurse and subsequent providers were all to testify that Dr. Silverstein never informed them that Sotalol was a current medication of Mrs, Silverstein, then the fact that medical record does not record this as a current medication has nothing to do with metadata.

Wrong.

"The fact that medical record does not record Sotalol as a current medication" after the ED encounter on 5/19/10 indicates a forensic examination of the metadata is crucial.

It is in fact only through metadata that it can be determined if the medication, listed as "current" only a few weeks prior and normally visible when the user brings up a patient's record to initiate triage, was deleted by the user (e.g., via "use error" per NIST, related to bad IT design) and how and when; if it ended up in another patient's chart due to malfunction (misidentification); if the EHR malfunctioned and simply erased the med; if the chart was altered to try to hide the mistake, etc.  These are all well known failure modes.  See an example of what metadata can show at this link in a case that settled for over $1 million before a trial even began.

In fact, over and above potentially misrepresenting my and my mother's stated medication history at ED triage:

Note their attempting to deflect attention away from health IT and the med recon failure of their own staff.  

Also note a reckless understanding of Medication Reconciliation, that seems to imply the hospital believes it had no duty to reconcile meds with itself, that is, check its own EHR or paper records from just a few weeks prior along with multiple others dating back 8 years, or check with the hospital-affiliated primary care and other physicians treating the patient for years, who were reachable via a simple phone call.  Instead, the issue of whether a family member told "them about the med or not" seems to be their central defense.   

On the issue of who's actually responsible (and liable) for Med Recon, from the American Medical Association monograph entitled "The physician’s role in medication reconciliation", pg. 3.  

... The essence of medication reconciliation is making sense of a patient’s medications and resolving conflicts between different sources of information [paper, electronic, verbal, information from other physicians treating the patient, etc. - ed.] to minimize harm and to maximize therapeutic effects. It is an ongoing, dynamic, episodic and team-based process that should be led by and is the responsibility of the patient’s attending or personal physician in collaboration with other health care professionals. Medication reconciliation is essential to optimize the safe and effective use of medications. It is one element in the process of therapeutic use of medications and medication management for which physicians are ultimately held legally accountable.

The AMA monograph has a special section starting on p. 20 on IT and Med Recon.  It warns explicitly about practicing medicine like a mindless robot:

... IT systems and applications do have the potential to streamline the medication reconciliation process—especially assembling and storing patient information—and to provide the means to effectively transfer patient medication information across the continuum of care. However, health care technology is fragmented and requires close attention by potential users to ensure that implementation does not create additional pressures and problems with accuracy of medications.

The apparent hospital misunderstanding of Med Recon could - and in my view, should - result in charges of gross negligence, perhaps criminal, against its medical leadership if other patients have been, or are, harmed as a result of resultant medication reconciliation errors.

Of course, it's also possible that the defense is just making stuff up again to try to blow smoke up the judge's behind.  However, what's sworn certainly should not be lightly dismissed. 

I also note that this hospital is making a spectacle of itself in front of the Judge, the President Judge in the county where it conducts operations, who already dismissed a boatload of meritless claims.  That does not bode well for them in the future.

-- SS

Joint Commission Should Be Named As Defendant If Patients Harmed by EHR "Outages"

At my recent post "Massive Health IT Outage: But, Of Course, Patient Safety Was Not Compromised" over a massive, outrageous Cerner outage to hospitals contracting their clinical IT via an ASP model (that is, 'software as a service'), I observed:

... The Joint Commission, for example, likely issued its stamp of approval for the affected hospitals, hospitals who had outsourced their crucial medical records functions to an outside party that sometimes went mute.  If someone was injured or died due to this outage, they would not care very much about the supposed advantages.

From the JC's page "About the Joint Commission":

An independent, not-for-profit organization, The Joint Commission accredits and certifies more than 19,000 health care organizations and programs in the United States. Joint Commission accreditation and certification is recognized nationwide as a symbol of quality that reflects an organization’s commitment to meeting certain performance standards.

It's time to up the ante regarding this accreditation body, fully aware of health IT risks (e.g., the Dec 2008 Sentinel Events Alert on Health IT) but to date having done little about them.  Through my legal work and my speaking to Plaintiff's attorneys, I am becoming increasingly aware of medical malpractice cases that  involve an EHR or related clinical IT systems at JC-accredited organizations.

In effect, the JC has accredited hospitals whose entire clinical command-and-control structure (the term EHR is an anachronism; these systems are in reality enterprise clinical resource management and clinician workflow control devices) can disappear in the blink of an eye, without warning, raising risk to patients greatly.

If I discover that a patient was harmed or killed as a result of, or related to, this massive recent outage of outsourced medical records/workflow control  infrastructure, I will be recommending that the Joint Commission, including its leadership, which likely certified the hospital(s) involved for safe operations in areas such as Information Management, be named as defendants.

I have informed the JC leadership by email.
 
-- SS

Doctors and EHRs: Reframing the "Modernists v. Luddites" Canard to The Accurate "Ardent Technophiles vs. Pragmatists" Reality

One manner by which Healthcare's core values are usurped is via distortions and slander about physicians and other clinicians.

At "Health IT: Ddulites and Irrational Exuberance" and related posts (query link) I've described the phenomenon of the:

'Hyper-enthusiastic technophile who either deliberately ignores or is blinded to technology's downsides, ethical issues, and repeated local and mass failures.'

I have called this personality type the "Ddulite", which is "Luddite" with the first four letter reversed. I have also pointed out that the two are not exact opposites, as the Luddites did not endanger anyone in trying to preserve their textile jobs, whereas the Ddulites in healthcare IT do endanger patients.

Yet, in the 20 years I've been professionally involved in health IT, I have frequently heard the refrain, usually from IT personnel and their management, that "Doctors resists EHRs because they are [backwards, technophobic, reactionary, dinosaurs, unable/unwilling to change, think they are Gods, ..... insert other slanderous/libelous comment].

I've heard this at Informatics meetings, at medical meetings, at commercial health IT meetings (e.g., Microsoft's Health Users Group, and at HIMSS), at government meetings (e.g., GS1 healthcare), and others.

The summary catchphrase I've heard and seen (even in the comments on this blog) is that doctors are "Luddites" while IT personnel are forward-thinking, know better than doctors, and are "Modernists."

This slander and libel of physicians and other clinicians needs to stop, and the entire issue needs to be reframed.

Doctors are pragmatists. When a new technology is rigorously shown to be beneficial to patients, and (perhaps more importantly) rigorously shown not to be of little benefit or worse, significantly harmful, doctors will embrace it. There are countless examples of this that I need not go into. They also have responsibilities, obligations, ethical considerations, liabilities, and other factors to consider in their decisions:

Pragmatism (Merriam-Webster):

: a practical approach to problems and affairs

The reality is not:

Luddite doctors <---- are in tension with ----> Modernist IT personnel

but is:

Pragmatist doctors <---- are in tension with ----> Ardent technophiles (Ddulites)

The technophiles' views may be due, on the one hand, to ignorance of medicine's true complexities and "innocent" overconfidence in technology. Unfortunately, it is a gargantuan leap of logic to go from "well, computers work in tracking FedEx packages and allowing me to withdraw money from my U.S. bank when I'm abroad, to "therefore with just a little work they will transform medicine."

Anyone familiar with even the most fundamental issues in Medical Informatics is aware of this. (This is the problem with "generic management" of healthcare IT - healthcare amateurs are unfamiliar with these issues.) Due to the complex, messy social, scientific, informational, ethical, cultural, emotional and other issues relatively unique to medicine, that leap from banking/widget tracking/mercantile computing --> medicine is probably more naive than the leap in logic, for instance, that would have a person believe since a hot air balloon can go high in the sky, it can take a person to the moon, as I observed here.

On the other hand the technophile's expressed views can also be a territorial ploy with full awareness of, and reckless disregard for, the consequences of technology's downsides.

(The CIO where I was a CMIO was well-known to be an aficionado of Sun Tzu's "Art of War" in his corporate politics - the polar opposite of a 'team player.' I might add that the doctors were fully expected to be 'team players'.)

Part of the struggle between the health IT industry and medical professionals has also been control of information flow about HIT.

This has been brought to the fore by my observation of the almost uniformly negative comments on today's HIT at the physician-only site Sermo.com. Sermo is populated, I might add, not by computerphobes but by physicians in a wide variety of specialties using computers for social networking. These comments will hopefully soon be published.

(They are not dissimilar to the many comments I reported in my Jan. 2010 post "An Honest Physician Survey on EHR's", although some might call the sponsor of the latter survey, AAPS, biased. I do not think the same can be said of Sermo.com, an open site for all physicians.)

I have mentioned on this blog the numerous impediments to flow of information about health IT's downsides, and these impediments are well described, for example, in the Joint Commission Sentinel Events Alert on Health IT (link), the FDA Internal Memorandum on H-IT Safety (link) and elsewhere (such as at link, link).

The Institute of Medicine of the National Academies noted this in their late 2011 study on EHR safety:

... While some studies suggest improvements in patient safety can be made, others have found no effect. Instances of health IT–associated harm have been reported. However, little published evidence could be found quantifying the magnitude of the risk.

Several reasons health IT–related safety data are lacking include the absence of measures and a central repository (or linkages among decentralized repositories) to collect, analyze, and act on information related to safety of this technology. Another impediment to gathering safety data is contractual barriers (e.g., nondisclosure, confidentiality clauses) that can prevent users from sharing information about health IT–related adverse events. These barriers limit users’ abilities to share knowledge of risk-prone user interfaces, for instance through screenshots and descriptions of potentially unsafe processes. In addition, some vendors include language in their sales contracts and escape responsibility for errors or defects in their software (i.e., “hold harmless clauses”). The committee believes these types of contractual restrictions limit transparency, which significantly contributes to the gaps in knowledge of health IT–related patient safety risks. These barriers to generating evidence pose unacceptable risks to safety.[IOM (Institute of Medicine). 2012. Health IT and Patient Safety: Building Safer Systems for Better Care (PDF). Washington, DC: The National Academies Press, pg. S-2.]

Also in the IOM report:

… “For example, the number of patients who receive the correct medication in hospitals increases when these hospitals implement well-planned, robust computerized prescribing mechanisms and use barcoding systems. But even in these instances, the ability to generalize the results across the health care system may be limited. For other products— including electronic health records, which are being employed with more and more frequency— some studies find improvements in patient safety, while other studies find no effect.

More worrisome, some case reports suggest that poorly designed health IT can create new hazards in the already complex delivery of care. Although the magnitude of the risk associated with health IT is not known, some examples illustrate the concerns. Dosing errors, failure to detect life-threatening illnesses, and delaying treatment due to poor human–computer interactions or loss of data have led to serious injury and death.”

I note that the 'impediments to generating evidence' effectively rise to the level of legalized censorship, as observed by Koppel and Kreda regarding gag and hold-harmless clauses in their JAMA article "Health Care Information Technology Vendors' Hold Harmless Clause: Implications for Patients and Clinicians", JAMA 2009;301(12):1276-1278. doi: 10.1001/jama.2009.398.

Pragmatist physicians are quite rightly very wary of the technology as it now exists.

Ultimately, even when information on HIT risks or defects does surface, it is highly inappropriately labeled as "anecdotal" (see this post on anecdotes for why this behavior is inappropriate).

This "anecdotalist" phenomenon occurs right up to the HHS Office of the National Coordinator for Health IT (ONC), as I described in my post "Making a Stat Less Significant: Common Sense on 'Side Effects' Lacking in Healthcare IT Sector" and elsewhere.

Therefore, another part of reframing the pragmatism vs. technophilia issue is for clinicians to put an end to censorship of HIT adverse experiences.

I have the following practical suggestions, used myself, to start to accomplish the latter goal.

These suggestions are in the interest of protecting public health and safety:

When a physician or other clinician observes health IT problems, defects, malfunctions, mission hostility (e.g., poor user interfaces), significant downtimes, lost data, erroneous data, misidentified data, and so forth ... and most certainly, patient 'close calls' or actual injuries ... they should (anonymously if necessary if in a hostile management setting):

(DISCLAIMER:  I am not responsible for any adverse outcomes if any organizational policies or existing laws are broken in doing any of the following.)

• Inform their facility's senior management, if deemed safe and not likely to result in retaliation such as being slandered as a "disruptive physician" and/or or being subjected to sham peer review (link).

• Inform their personal and organizational insurance carriers, in writing. Insurance carriers do not enjoy paying out for preventable IT-related medical mistakes. They have begun to become aware of HIT risks. See, for example, the essay on Norcal Mutual Insurance Company's newsletter on HIT risks at this link. (Note - many medical malpractice insurance policies can be interpreted as requiring this reporting, observed occasional guest blogger Dr. Scott Monteith in a comment to me about this post.)

• Inform the Joint Commission (or similar national accreditor of hospital safety if not in the U.S.) via their complaint site at http://www.jointcommission.org/report_a_complaint.aspx . Also consider writing the JC senior officers (link to officer's list), whose awareness of HIT issues I can personally attest to via our correspondences.

• Inform the FDA (or similar healthcare regulator if not in the U.S.) via the FDA Medwatch Form 3500 reporting site at https://www.accessdata.fda.gov/scripts/medwatch/medwatch-online.htm. An example of such an adverse event report I filed myself (when the involved hospital refused) is at this link in the FDA MAUDE (Manufacturer and User Facility Device Experience) database.

• Inform the State Medical Society and local Medical Society of your locale.

• Inform the appropriate Board of Health for your locale.

• If applicable (and it often is), inform the Medicare Quality Improvement Organization (QIO) of your state or region. Example: in Pennsylvania, the QIO is "Quality Insights of PA."

• Inform a personal attorney.

• Inform local, state and national representatives such as congressional representatives. Sen. Grassley of Iowa is aware of these issues, for example.

• As clinicians are often forced to use health IT, at their own risk even when "certified" (link), if a healthcare organization or HIT seller is sluggish or resistant in taking corrective actions, consider taking another risk (perhaps this is for the very daring or those near the end of their clinical career). Present your organization's management with a statement for them to sign to the effect of:

"We, the undersigned, do hereby acknowledge the concerns of [Dr. Jones] about care quality issues at [Mount St. Elsewhere Hospital] regarding EHR difficulties that were reported, namely [event A, event B, event C ... etc.]

We hereby indemnify [Dr. Jones] for malpractice liability regarding patient care errors that occur due to EHR issues beyond his/her control, but within the control of hospital management, including but not limited to: [system downtimes, lost orders, missing or erroneous data, etc.] that are known to pose risk to patients. We assume responsibility for any such malpractice.

With regard to health IT and its potential negative effects on care, Dr. Jones has provided us with the Joint Commission Sentinel Events Alert on Health IT at http://www.jointcommission.org/assets/1/18/SEA_42.PDF, the IOM report on HIT safety at http://www.modernhealthcare.com/Assets/pdf/CH76254118.PDF, and the FDA Internal Memorandum on H-IT Safety Issues at http://www.scribd.com/huffpostfund/d/33754943-Internal-FDA-Report-on-Adverse-Events-Involving-Health-Information-Technology.

CMO __________ (date, time)
CIO ___________ (date, time)
CMIO _________ (date, time)
General Counsel ___________ (date, time)
etc."

• If the hospital or organizational management refuses to sign such a waiver (and they likely will!), note the refusal, with date and time of refusal, and file away with your attorney. It could come in handy if EHR-related med mal does occur.

• As EHRs remain experimental, I note that indemnifications such as the above probably belong in medical staff contracts and bylaws when EHR use is coerced.

These measures can help "light a fire" under the decision makers, and "get the lead out" of efforts to improve this technology to the point where it is usable, efficacious and safe.

-- SS

Those Who Dismiss Healthcare (and Healthcare IT) Adverse Events Reports as Mere "Anecdotes" Have Lost - Supreme Court-Style

At my Sept. 2010 post "The Dangers of Critical Thinking in A Politicized, Irrational Culture" I wrote:

... It's the EMR "anecdotalists" (as opposed to the "Markopolists") who say that "anecdotes" of HIT-related injury are meaningless. They deem reports of safety issues and HIT-related misadventures and risk as simply "anecdotal", and that "anecdotes don't make evidence" (or "anecdotes don't make data").

For "anecdotes" of patient harm due to medical devices even from the most reliable of sources to be counted as "evidence" of device risk, apparently, the stories need to be blessed with Statistical Holy Water. The Holy Water must also be of a brand approved by the academic pundits.

For me, this is no longer merely a professional debate. My elderly relative became one of those "anecdotes" in May last year.

I address the casual, Dogbert-style, waving-of-the-hand "Bah!" dismissal of health IT harm "anecdotes" at numerous other posts as well, such as "EHR Problems? No, They're Merely Anecdotal" and "Health IT: On Anecdotalism and Totalitarianism".

Bah! Your Health IT adverse events reports are anecdotes, and anecdotes don't make data!

In those posts I also mention how Australian informatics professor Dr. Jon Patrick had essentially hit the flaws of this argument out of the Southern hemisphere with a short editorial in the journal "Applied Clinical Informatics" entitled "The Validity of Personal Experiences in Evaluating HIT." That essay is free at the link and is worth reading.

Interestingly and thankfully, the "anecdotes are meaningless" crowd have now lost, and lost big - Supreme Court style. In fact, the U.S. Supreme Court has shown far more common sense than many esteemed academics and industry pundits.

As noted in this post at Derek Lowe's pharmaceutical industry "In the Pipeline" blog, the company that made "Zicam", a zinc-based over-the-counter cold remedy, tried to defend shareholder suits that the company withheld case reports of Zicam causing permanent loss of smell via arguing that such reports "did not reach a level of statistical significance", i.e., were "anecdotal." The case went to the U.S. Supreme Court.

The Supreme Court would have none of that argument:

"Matrixx’s [Zicam's manufacturer - ed.] premise that statistical significance is the only reliable indication of causation is flawed. Both medical experts and the Food and Drug Administration rely on evidence other than statistically significant data to establish an inference of causation. It thus stands to reason that reasonable investors would act on such evidence.

The full court decision is at this link: http://www.supremecourt.gov/opinions/10pdf/09-1156.pdf (PDF file), but a passage I consider key to this issue is as follows:

... We conclude that the materiality of adverse event reports cannot be reduced to a bright-line rule ... Because adverse reports can take many forms, assessing their materiality is a fact-specific inquiry, requiring consideration of their source, content, and context.

This is common sense incarnate. It applies not just to drugs, but to medical devices, to health IT, and to other domains as well.

In essence, it is saying that adverse events reports, especially repeated ones, from trustworthy sources are not to be lightly dismissed, but should serve at the very least as red flags that there may be a systemic problem requiring further investigation.

One wonders how and if public healthcare IT vendors will begin disclosing "anecdotal" reports of their products causing patient harm to their own stockholders.

One also wonders if the academic anecdotalists (up to the level of the chair of the Office of the National Coordinator for Health Information Technology at HHS) will cease their unfettered dismissal of health IT AE reports as mere "anecdotes" and therefore let's roll out this 100% beneficent technology nationwide ASAP:

"Nothing [ONC has] found would give them any pause that a policy of introducing EMR's could impede patient safety." - David Blumenthal

That sounds a bit like the refrain of the makers of Zicam.

One might also wonder if the anecdotalists merely lack common sense, or are using this form of epistemological dementia to obscure conflict of interest.

On a final note, my favorite comment at the aforementioned "In the Pipeline" blog story is this by anonymous commenter "Still Scared of Dinosaurs":

One of the most important ideas real statisticians must get into their heads is "Thou shalt not worship the 0.05 threshold". The whole concept of "statistical significance" for AEs is idiotic and the fact that Matrixx based any part of their defense on it indicates that their stupidity did not end when they named the company.

Perhaps this Dilbert cartoon is apropos to the Supreme Court decision:


-SS

Addendum:

I thought it appropriate to share these thoughts with the leadership of the Joint Commission, the organization that accredits healthcare organizations in the United States:

From: Scot Silverstein
Sent: Sunday, March 27, 2011 10:41 AM
To: MGiuntoli, Anita; Chassin, Mark; Schyve, Paul; Legaspi, Shirley
Cc: Ross Koppel; 'David Kreda'
Subject: Re: MATRIXX INITIATIVES, INC., ET AL. v. SIRACUSANO ET AL.

Not a complaint this time [about health IT failure - ed.], but an observation.

The JC has noted health IT risks in the Sentinel Events Alert "Safely implementing health information and converging technologies" of 2008.

The company that made "Zicam", a zinc-based over-the-counter cold remedy, tried to defend shareholder suits that the company withheld case reports of Zicam causing permanent loss of smell via arguing that such reports "did not reach a level of statistical significance", i.e., were "anecdotal." The case went to the U.S. Supreme Court.

The Supreme Court would have none of that argument:

"Matrixx’s [Zicam's manufacturer] premise that statistical significance is the only reliable indication of causation is flawed. Both medical experts and the Food and Drug Administration rely on evidence other than statistically significant data to establish an inference of causation. It thus stands to reason that reasonable investors would act on such evidence.

The full court decision is at this link: http://www.supremecourt.gov/opinions/10pdf/09-1156.pdf (PDF file), but a passage I consider key to this issue is as follows:

... Because adverse reports can take many forms, assessing their materiality is a fact-specific inquiry, requiring consideration of their source, content, and context.

This is common sense incarnate. It applies not just to drugs, but to medical devices, to health IT, and to other domains as well.

I believe JC should start to pay serious attention to "anecdotal reports" of health IT-caused patient injury, and consider reliable reporting of these events as an Accreditation standard.

As I noted in my July 2009 JAMA letter to the editor "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" in response to Koppel and Kreda's JAMA article on HIT industry practices, "hold harmless" and "gag" clauses must go, and be replaced with proactive reporting of healthcare IT-related "events."

Scot Silverstein

-- SS

A Simple Lesson for the Health IT Industry

From an Op Ed "Living with the Electronic Car" in today's Wall Street Journal:

"A Toyota executive recently explained to a Congressional committee investigating claims of uncontrolled acceleration: "We need to reduce the number of things we ask our customers to do correctly." In fact, the exec was describing the essence of responsible engineering - though perhaps the balance in auto design has gotten out of whack."

Considering the feedback from physicians on the needless complexity of electronic medical records and other computerized medical devices for example at "An Honest Physician Survey on EHR's", it seems the healthcare IT industry has yet to learn this simple lesson.

I'm frankly not convinced there's "anyone home" in this complexity-loving industry who could fathom such advice as a good business practice.

It also seems that industry may not give a damn about such lessons, even in the most safety critical of environments, the intensive care unit, as long as profits are maintained.

See for example "A Lawsuit Over Healthcare IT Whistleblowing and Wrongful Discharge: Malin v. Siemens Healthcare." Also see "Third-Party Reviews of Medical Devices Come Under Scrutiny at the FDA - Except Healthcare IT Medical Devices, Which Get Special Accommodation" on political maneuvering by this industry to avoid the federal regulation other healthcare drug and device sectors have been subject to for decades (largely as a result of public health disasters such as this and this, I might add).

The interesting aspect of these issues is that the executives and officials behind these decisions and machinations are setting themselves up as near-indefensible defendants in future litigation by patients (and their estates) harmed or killed by healthcare IT-related problems.

For instance, I had communications with the Joint Commission leadership over issues I raised in my July 22, 2009 JAMA letter to the editor "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards." Namely, on how hospital executives were violating their fiduciary and Joint Commission safety standards obligations, and jeapardizing patient safety, in signing the traditional health IT contract calling for confidentiality about health IT malfunctions and defects. The JC Leadership is quite well aware of this letter and my more thorough essay here.

Nothing has been heard from the Joint Commission on these issues since.

Perhaps never before have the malpractice lawyers been provided a better scenario for taking the houses and personal property from irresponsible and/or conflicted healthcare and health IT regulators and other officials via lawsuits as health IT diffusion increases, with its "tip of the iceberg" injury and death occurrences now firmly established.

-- SS

Arguments for Maintaining the Health IT Status Quo on Defects Nondisclosure Clauses

As I wrote at Healthcare Renewal here, I recently posted a web petition "Transparency and Openness in Electronic Patient Records and Other Healthcare Information Technology Systems" at http://www.webpetitions.com/cgi-bin/print_petition.cgi?99504454 , calling for an end to Nondisclosure Clauses [of defects, problems, EHR-related adverse events, etc.] in HIT contracts. The petition reads:

We, the undersigned, believe in transparency, accuracy, and accountability in scientific research, especially in matters related to healthcare.

We believe contractual nondisclosure clauses [1] that prohibit or restrain unfettered disclosure and dissemination of information about healthcare information technology problems related to bugs, design defects, suboptimal user interfaces, other factors that can adversely affect care, and the adverse events and near accidents these problems cause, are unethical.

We believe that patients and clinicians have a right to knowledge of healthcare information technology problems and defects that can distract clinicians and/or reduce clinician effectiveness and productivity. We also believe that hospital governance personnel have the fiduciary responsibility as well as obligation under Joint Commission safety standards to protect patients, clinicians and others working within and for their organizations from the potential consequences of healthcare information technology problems [2].

We believe that only through transparency about healthcare information technology can medical ethics be maintained, the rights of patients to the best possible care be protected and medical science advanced.

Therefore, we call for such clauses to be refused by governance bodies, vendors of healthcare information technology to refrain from including such clauses in their contracts, and the U.S. Congress to prohibit nondisclosure clauses related to medical devices and healthcare information technology.

Furthermore, retaliatory actions against those who in good faith report such matters or incidents should be prohibited.

[1] Koppel R, Kreda D. Health Care Information Technology Vendors' "Hold Harmless" Clause: Implications for Patients and Clinicians, JAMA. 2009;301(12):1276-1278.

[2] Silverstein S. "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards." Letter to the Editor, JAMA. 2009; 302: 382.

As I had spelled out many months ago at "Health Care Information Technology Vendors' Hold Harmless and Keep Defects Secret Clauses" here, and in a July 22, 2009 letter to the editor in JAMA entitled "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards", I believe these clauses:

• Are responsible for stagnation in health IT industry thinking that requires an unrelenting focus on the needs of clinicians and patients;

• Cause hospital executives to violate their fiduciary and Joint Commission safety obligations to patients and staff;

• Perhaps even put clinicians themselves in a conflict of interest with their own professional ethics (that call for widely sharing information about potential risks to patients).

The Joint Commission nor any other healthcare regulatory body has done anything about such contract clauses since that time, to the best of my knowledge despite being made aware of these issues by direct email to JC leadership.

I've noted few signatures to the petition so far, but have received some feedback and noted other justifications for maintenance of the status quo. The arguments fall into several categories that defend the status quo of HIT defect/problem nondisclosure clauses. The categories of argument include:

• Legal arguments (or perhaps I should say 'legalistic'): e.g., HIT is not a "medical device", is not regulated, therefore such clauses are nobody's business but the seller and buyer.

• Semantic arguments (arguing about words): e.g., the Joint Commission safety standards calling for "the organization to communicate information related to safety and quality to those who need it, including staff, licensed independent practitioners, patients, families, and external interested parties" really do not mean communication to other healthcare organizations, regulatory bodies, the press, etc.

• Corporatist arguments: the clauses are needed to protect the industry and protect "innovation" - however, innovation without adherence to patient's rights and medical ethics is not innovation at all in my mind (cf. the Tuskegee Study of Syphilis).

• Statist arguments: e.g., we know what's best for medicine, and even if HIT today does have problems and hurt people, it's for the greater future good that their diffusion should be unimpeded by free dissemination of information on downsides.

• Logically fallacious or irrational arguments: e.g., the circular argument that there's no reason to prohibit nondisclosure clauses about HIT defects and patient incidents, since these problems do not occur in the first place -- or if they occur patient harm is "always" averted by clinicians.

While these type of arguments are interesting and may make for excellent debate, (and medical ethicist George Annas at BU taught his medical students, myself included, well on such issues): none of these arguments are aligned to the ethics, customs and traditions of medicine and the oaths taken by its practitioners.

The oaths taken by healthcare IT companies (i.e., to the speculators investing in this technology) leave much to be desired in that regard.

On the other hand, here is a sentinel reason for supporting their quick abolishment, a strong informatics-based reason to abolish nondisclosure clauses:

As admissions such as "We are unable to share documents [relating to likely problematic EHR's - ed.] as our contract with XXXX includes a confidentiality clause" at http://www.computerweekly.com/blogs/tony_collins/2009/11/claim-of-censorship-over-cerne.html indicate, to the point of rejecting a FOI request for information, there are unknowns in health IT (as Tim the proprietor at Histalk wryly noted, the refusal probably is not on the grounds of having glowing praise to report).

How many other data points have not made it to the literature, either peer reviewed or press? Does anyone know definitively?

Do we really know that Medical Informatics research therefore represents a valid sampling of the events that transpire when HIT is designed and implemented?

A parallel and currently controversial issue in pharma is the deliberate suppression of negative or neutral clinincal trials results, with an emphasis on the positive, to protect a drug candidate or an actual drug in postmarketing surveillance. Does this not potentially taint the science?

-- SS

Web Petition: Transparency and Openness in Electronic Patient Records and Other Healthcare Information Technology Systems

I have created a new Web petition "Transparency and Openness in Electronic Patient Records and Other Healthcare Information Technology Systems."

It is at WEBPETITIONS.COM at this link: http://www.webpetitions.com/cgi-bin/print_petition.cgi?99504454

Aimed at clinicians, hospital governance personnel and other healthcare stakeholders including patients, the petition states:

We, the undersigned, believe in transparency, accuracy, and accountability in scientific research, especially in matters related to healthcare.

We believe contractual nondisclosure clauses [1] that prohibit or restrain unfettered disclosure and dissemination of information about healthcare information technology problems related to bugs, design defects, suboptimal user interfaces, other factors that can adversely affect care, and the adverse events and near accidents these problems cause, are unethical.

We believe that patients and clinicians have a right to knowledge of healthcare information technology problems and defects that can distract clinicians and/or reduce clinician effectiveness and productivity. We also believe that hospital governance personnel have the fiduciary responsibility as well as obligation under Joint Commission safety standards to protect patients, clinicians and others working within and for their organizations from the potential consequences of healthcare information technology problems [2].

We believe that only through transparency about healthcare information technology can medical ethics be maintained, the rights of patients to the best possible care be protected and medical science advanced.

Therefore, we call for such clauses to be refused by governance bodies, vendors of healthcare information technology to refrain from including such clauses in their contracts, and the U.S. Congress to prohibit nondisclosure clauses related to medical devices and healthcare information technology.

Furthermore, retaliatory actions against those who in good faith report such matters or incidents should be prohibited.

[1] Koppel R, Kreda D. Health Care Information Technology Vendors' "Hold Harmless" Clause: Implications for Patients and Clinicians, JAMA. 2009;301(12):1276-1278.

[2] Silverstein S. "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards." Letter to the Editor, JAMA. 2009; 302: 382.

The signed petition will be sent to the U.S. Senate Finance Committee (currently investigating healthcare IT), the Secretary of HHS, the Director of AHRQ, the Director of the Office of the National Coordinator for Health IT, and the President of the Joint Commission.

Please sign at the WEBPETITIONS.COM link http://www.webpetitions.com/cgi-bin/print_petition.cgi?99504454, and spread the word.

-- SS

Addendum: as an example of the problems these nondisclosure clauses can create, see my post "We are unable to share documents relating to problematic EHR's as our contract with Cerner includes a confidentiality clause."

Making Hospitals Safer by Making Healthcare IT Safer

At my July 24, 2009 HC Renewal post "Inquiry to Joint Commission on points raised in my July 22, 2009 JAMA letter on HIT", I reproduced a letter I sent to the Joint Commission seeking their opinions on the issue of Health IT "hold harmless" and "defects nondisclosure" contractual terms. (See "Health Care Information Technology Vendors' Hold Harmless Clause - Implications for Patients and Clinicians", JAMA 2009;301(12):1276-1278 and my HIT difficulties website essay here.)

Those contractual terms cause hospital executives to violate Joint Commission safety standards and their own fiduciary responsibilities to people both providing and seeking care in hospitals. My inquiry was acknowledged, and I await a reply.

In Making Hospitals Safer for Patients, New York Times, Aug. 2, 2009 , Mark R. Chassin, president of The Joint Commission, wrote:

To the Editor:

Jim Hall makes an important point about the costs and preventability of harm caused by medical errors, but his suggestion for a National Medical Safety Board is not the answer. It is not sufficient to investigate health care “crashes” one at a time and hope to transform the health care system into one that performs more reliably.

Too often, the lessons learned are not easily transferable to other hospitals or even to other problems within the same organization.

The key to transforming our health care system into a safer one is to use proven quality improvement methods — already in use in high-risk fields like aviation and nuclear power — as part of everyday work ...

In a followup email to the Joint Commission, I pointed out to Dr. Chassin that this is the same key to improving the quality and safety of EHR, CPOE and other information technology-based medical devices.

I also pointed out that "Hold harmless" and "Defects nondisclosure" -- a.k.a. "gag clause" -- contractual methods (unless I'm mistaken, in which case we're all in jeopardy) are not used in building and deploying safety-critical devices found in the aviation and nuclear energy industries.

-- SS

Inquiry to Joint Commission on points I raised in my July 22, 2009 JAMA letter on HIT

As I posted here, my letter "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" was published in JAMA on July 22, 2009. A preview of the letter can be seen here, or a full version here if you subscribe to JAMA.

This JAMA letter covered some of the same points I addressed extensively at my Drexel HIT website essay "Hold Harmless and Keep Defects Secret Clauses", including the major point that hospital executives signing HIT "Hold Harmless" and "Defects Nondisclosure" contracts are in violation of Joint Commission standards for conduct related to safety, and in violation of their fiduciary responsibilities towards patient and employee safety and freedom from undue liability.

I've sent the following inquiry to Paul M. Schyve, M.D., Senior Vice President, The Joint Commission:

July 24, 2009

Paul M. Schyve, M.D.
Senior Vice President
The Joint Commission
schyve@jointcommission.org

Cc: MChassin@jointcommission.org, otrippi@jointcommission.org

Dear Dr. Schyve,

In testimony to the House Committee on Veterans' Affairs on July 22, 2009 at this link , you state:

... The Joint Commission has established standards that require the hospital to:

• Create a culture in which adverse events are reported and evaluated for underlying ("root") causes, and preventative actions are taken.
• Identify high-risk processes and prospectively determine their possible modes of failure, the effects of those failures, and the actions that will prevent the failures or mitigate their effects.
• Establish a culture of safety throughout the hospital. This accreditation standard became effective January 1, 2009, although its purpose and expectations were publicized for over a year in advance.

In my JAMA letter to the editor of July 22, 2009 entitled " Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards" ( link ), I point out that the Hold Harmless and Defects Nondisclosure clauses signed by hospital executives in contracting for healthcare information technology (such as CPOE and EHR systems) are in violation of Joint Commission safety standards, as well as hospital executive fiduciary responsibilities to patients and clinicians. These clinical IT systems can and do cause medical errors and patient harm.

My letter was in response to Koppel and Kreda's March 25, 2009 article " Health Care Information Technology Vendors' "Hold Harmless" Clause: Implications for Patients and Clinicians ", JAMA. 2009;301(12):1276-1278.

I am interested in the Joint Commission's response to the issues I raise.

I await a response.

-- SS

Health IT "Hold Harmless" and Defects Gag Clauses: Have Hospital Executives Violated Their Fiduciary Responsibilities By Signing Such Contracts?

July 2009 - Note: also see my letter to the editor in JAMA on this same topic, "Health Care Information Technology, Hospital Responsibilities, and Joint Commission Standards", published July 22, 2009, available online at this link.

Regarding healthcare IT "Hold Harmless" and Defects Gag Clauses as revealed by the JAMA article Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians by Koppel and Kreda:

Have hospital executives violated their fiduciary responsibilities by signing such contracts, and violated Joint Commission standards of hospital leadership conduct as well?

Fiduciary (fidOO'shēe"rē), in law, a person who is obliged to discharge faithfully a responsibility of trust toward another. Among the common fiduciary relationships are guardian to ward, parent to child, lawyer to client, corporate director to corporation, trustee to trust, and business partner to business partner. In discharging a trust, the fiduciary must be absolutely open and fair. Certain business methods that would be acceptable between independent parties dealing with one another “at arm's length” may expose a fiduciary to liability for having abused a position of trust.

Hospital management conduct is not bound by traditional business law only, just as physicians and other clinicians hold additional obligations. In both cases, obligations go beyond that of, say, a manager or worker at a McDonald's or a Wal-Mart. In healthcare there are "special" third parties involved with critical rights and responsibilities, namely, patients and clinicians.

At Health Care Information Technology Vendors' "Hold Harmless" Clause I expressed great concern about the remarkable revelations in Koppel and Kreda's expose of arguably unethical and clearly inexcusable contracting practices by healthcare IT producers and vendors.

The vendors have declared themselves off limits from liability even if patients die as a result of software defects and malfunctions, pushing that liability onto clinicians. Vendors have simultaneously declared themselves the Ministry of Information, Soviet style, on such defects.

I also expressed my concern that the contractual suppression of information dissemination on health IT problems and defects may be one reason websites on health IT difficulties, such as the site I started in 1998 (in fact cited by Koppel and Kreda) remain uncommon on the Web. This is despite my documentation of continued, ongoing, world wide interest in this topic (see my 2006 AMIA abstract on this issue here, PDF, and poster here, PPT).

It is not just the vendors who may be acting against the best interests of medical science and patient safety, however.

It also seems to me that hospital executives, boards and counsel have fiduciary responsibilities, as well as obligations under principles of due diligence, Joint Commission and other regulatory guidelines, etc. to protect not just patients from defective technologies but also to protect their staffs from unfair risks and legal liabilities. I note that these health IT contracts have apparently been signed willingly by hospital executives, against the best interests of patients and medical staffs. Nobody is holding a gun to their heads, and nobody is forbidding negotiation of terms.

As a former CMIO/Director of Informatics I would never have signed such a contract. Period. (Of course, CMIO's and Directors of Informatics don't generally sign or even see health IT contracts, as they are Chiefs and Directors of Nothing.)

Have hospital executives, boards of directors and counsel been violating their responsibilities and obligations every time they've signed a healthcare IT "hold vendors harmless, it's all on your docs" and "shhhh! keep the defects secret" contract? Have they abused their positions of trust?

NIH research leaders and grant reviewers, as an example, consider seriously any problems with research that might place not just research subjects but also investigators at risk, medically, legally and otherwise. I perform this function on NIH study section panels.

Let's look at the Joint Commission Hospital Accreditation Program Leadership Chapter, and its standards for hospital leadership (link, PDF):

Leadership
LD.01.03.01

Standard LD.01.03.01
The governing body is ultimately accountable for the safety and quality of care, treatment, and services.

Rationale for LD.01.03.01
The governing body’s ultimate responsibility for safety and quality derives from their legal responsibility and operational authority for [organization] performance. In this context, the governing body provides for internal structures and resources, including staff, that support safety and quality.

The governing body has a legal responsibility for safety and quality, not just a moral obligation. One of the "internal structures" is healthcare IT that is safe and effective and that does not expose patients or staff to undue risks.

How does signing "hold harmless" and "defects gag order" clauses with an HIT vendor serve such a purpose, exactly?

Hospital executives know, should know, or should have known that such provisions would remove incentives for health IT vendors to produce the best products and to correct deficiencies rapidly, thus increasing risk to patients and clinicians.

Elements of Performance for LD.01.03.01
5. The governing body provides for the resources needed to maintain safe, quality care, treatment, and services.

One of those resources is health IT.

Standard LD.02.01.01
The mission, vision, and goals of the [organization] support the safety and quality of care, treatment, and services.

Rationale for LD.02.01.01
The primary responsibility of leaders is to provide for the safety and quality of care, treatment, and services. The purpose of the [organization]’s mission, vision, and goals, is to define how the [organization] will achieve safety and quality. The leaders are more likely to be aligned with the mission, vision, and goals when they create them together. The common purpose of the [organization] is most likely achieved when it is understood by all who work in or are served by the [organization].

How is a contract with an HIT vendor that calls for hiding defects in health IT and exposing staff to liability for defects in same serving the above purposes?

Standard LD.02.03.01
The governing body, senior managers and leaders of the organized medical staff regularly communicate with each other on issues of safety and quality.

Does that include communication on health IT defects? Can a medical staff member ask to see a database of such defects when the hospital has signed a nondisclosure of defects agreement with an HIT vendor?

Rationale for LD.02.03.01
Leaders, who provide for safety and quality, must communicate with each other on matters affecting the [organization] and those it serves.

I ask the same question as above.

Standard LD.03.01.01
Leaders create and maintain a culture of safety and quality throughout the [organization].

Safety for whom, exactly? Patients, or patients and staff?

How is exposing professional staff to undeserved liability from defective health IT serving the creation of a culture of safety and quality for them? How is suppressing information on health IT defects and problems helping patient safety and care quality?

How is lack of seeking informed consent on health IT use from patients whose care is mediated by health IT devices with known but undisclosable defects creating a culture of quality?

How is hiding such defects creating a culture of quality in the community's other hospitals, that may be considering purchase of the very same health IT?

Standard LD.03.04.01
The [organization] communicates information related to safety and quality to those who need it, including staff, licensed independent practitioners, [patient]s, families, and external interested parties.

Rationale for LD.03.04.01
Effective communication is essential among individuals and groups within the [organization], and between the [organization] and external parties. Poor communication often contributes to adverse events and can compromise safety and quality of care, treatment, and services. Effective communication is timely, accurate, and usable by the audience.

Are physicians and nurses explicitly informed by administration that clinicians are liable for bad outcomes due to software problems? Are they informed of the gag clause? Are patients informed of unremediated health IT defects existing at time of service?

This standard seems a veritable smoking gun regarding breach of fiduciary responsibility and Joint Commission obligations when hospital leadership signs agreements specifically excluding the sharing information about health IT defects and complaints. It is already known that hospitals maintain lists of health IT defects, some in the thousands of items. A number of the defects rise to the level of creating considerable risk to patients, and nobody is in a hurry to remediate them. (See my proposed although somewhat tongue in cheek "HIT Informed Consent" that describes some of these known defect categories here).

Standard LD.04.04.03
New or modified services or processes are well-designed.

... 3. The hospital's design of new or modified services or processes incorporates: Information about potential risks to patients.

4. The hospital's design of new or modified services or processes incorporates: Evidence-based information in the decision-making process. Note: For example, evidence-based information could include practice guidelines, successful practices, information from current literature, and clinical standards.

How does the contractual inability to communicate about health IT defects, which its executives willingly sign, serve this purpose?

Standard LD.04.04.05
The [organization] has an organization-wide, integrated [patient] safety program.

... 12. The hospital disseminates lessons learned from root cause analyses, system or process failures, and the results of proactive risk assessments to all staff who provide services for the specific situation.

Disseminates lessons learned, except when the HIT contract they've signed with a vendor forbids it, that is.

The practices of the health IT industry, and the dealings of the hospital leadership with that industry, may in fact be a scandal of national (or international) proportions.

I urge physicians and concerned others reading this to read the Univ. of PA press release "Why Are Healthcare Information Manufacturers Free of All Liability When Their Products Can Result in Medical Errors?" here, obtain the JAMA article by Koppel and Kreda, and call their congressional and other representatives to have these self-serving industry practices that ignore protection of patients and practitioners from undue jeopardy stopped.

I also believe any clinician under lawsuit related to hospital HIT malfunction, and/or patients harmed, should consider suit against the management that signed the contracts allowing the defective IT's entry into the hospital and mandated clinicians to use the HIT.

I, for one, already have begun discussing these issues with my representatives in Washington, and they've expressed great surprise at these revelations.

-- SS