Disastrously conceived, managed, and implemented U.S. Coast Guard EHR leaves our Coast Guard heroes safer ... after reversion to paper records

Sometimes, the typical EHR mismanagement debacles that I have been writing about since at least 1999 leave patients safer.  This is one such example.

I note that the contents of this blog, as well as my still-extant Drexel website "Contemporary Issues in Medical Informatics: Good Health IT, Bad Health IT, and Common Examples of Healthcare IT Difficulties" (http://cci.drexel.edu/faculty/ssilverstein/cases/) and many other resources about healthcare IT mismanagement and failure, are available free of cost.  They could have saved the Coast Guard many millions of dollars if their contents had been reviewed and taken seriously.

(I take no pleasure in making these observations.)

As a consequence of just the latest example of gross health IT mismanagement, a forced reversion back to paper will be far safer than this catastrophically bad health IT would have been, had it been turned on:

After failure of EHR program, Coast Guard needs to find new solution ASAP, watchdog says
Zaid Shorbajee

Fedscoop News
January 31, 2018
https://www.fedscoop.com/failure-ehr-program-coast-guard-needs-find-new-solution-asap-watchdog-says/

The U.S. Coast Guard must urgently find and implement a new electronic health records system, the Government Accountability Office says in a report, after a past project that took half a decade failed and left the organization using a paper process.

The Coast Guard began working with Wisconsin-based Epic Systems in 2010 to implement a new EHR system, dubbed Integrated Health Information System (IHiS). Over the following five years, the project faced multiple setbacks and delays, according to the GAO. IHiS was ultimately scrapped in 2015, with nearly $60 million spent as of August 2017 and some payments still to be made.

The Coast Guard came away with no software or equipment from the project to be used for the future. To make matters worse, in the two years since IHiS’s cancellation, the Coast Guard had to also decommission its two legacy EHR systems because they did not comply with international standards.

Put more simply, $60 million and counting went down like the Titanic in a five-year project.  Why?

The GAO report says the project failed because of “financial, technical, schedule, and personnel risks.” At a House Transportation and Infrastructure Committee hearing on Tuesday, Coast Guard representatives admitted fault.
“What began as a project to develop a simple electronic health record increased in scope and expanded into a much larger concept which added work life and safety services,” said Rear Adm. Erica Schwartz, the Coast Guard’s director of health, safety and work-life. “This project lacked appropriate oversight and governance and resulted in a project that had significant mission creep, untimely delays and increased cost.”

First, I am impressed that Coast Guard representatives took some responsibility. 

However, health IT projects with deficient oversight, governance, financial, technical and other defects have been the constant topic of my writings, and that of some others in Medical Informatics, dating back two decades.  It seems the lessons learned from past failures such as at http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases and at this blog via query link http://hcrenewal.blogspot.com/search/label/Healthcare%20IT%20failure may be beyond the comprehension of what can be called "the usual IT suspects."

With no system to fall back on, the Coast Guard has been working with a mostly paper-based process to manage health records for about 50,000 service members.

I find that, in fact, comforting.  The Coast Guard service members are safer compared to what would have transpired if this Frankenstein system (as with the fictional Golem by that name) had actually become "live."

The report doesn’t identify the names of any of the vendors. Epic Systems did not respond to request for comment, but the company’s website says it fulfilled the terms of the agreement and that its software was ready to live when IHiS was cancelled.

The Coast Guard did not respond to request for comment on whether the software was indeed ready.

I believe the vendors to be the usual Beltway Bandit suspects, and I am not sanguine about EPIC's reports.  That's just my personal opinion, of course.  However, just prior to embarking on this post I have begun to review an EPIC chart of a deceased patient, and find a pile of legible gibberish that, had I documented that way as a medical student, would have earned me the "Professor Kingsfield" treatment regarding a U.S. ten-cent piece and a phone call to my mother (https://www.youtube.com/watch?v=_wOUMd3bMRI).

Testifying at the same hearing, David Powner, who directs IT management issues at the GAO, listed several indicators of IHiS’s poor management. Among the things that slowed it down were questions about whether the Coast Guard was using appropriate funding sources, limited security features in the system, failure of the Coast Guard to properly follow its own acquisition process, and the non-involvement of executives who should have been involved.

The GAO report notes while the Coast Guard created several governance boards to oversee the planning of IHiS, the Chief Information Officer was not included on any of them.

That omission is, in a word, an extreme example of IT mismanagement.

“You could have the best project management on these technology projects, but if you don’t have executives that are accountable and breathing down the neck of project managers – that’s what makes this stuff work,” Powner said at the hearing.

He also expressed concern about the paper process currently in place, calling it “inefficient and dangerous.”

It is a shame that the IT world seems to lack altruism, teamwork, cooperation, etc. and instead needs to be brow-beaten into producing reasonable products.   (In what field is altruism, cooperation, shared responsibility and teamwork relatively common?  Answer - medicine.)

As far as paper being "inefficient and dangerous", I ask: compared to what?  Bad health IT?  See my Jan. 31, 2018 essay "The inevitable downgrading of burdensome, destructive EHRs back to paper & document imaging" at http://hcrenewal.blogspot.com/2018/01/the-inevitable-downgrading-of.html for more on that issue.

In fact, I hope the Coast Guard is using a efficient document imaging management system at present with their paper.  If not, that is yet another blunder.

The GAO report says that the Coast Guard did not formally identify any lessons learned from the failed IHiS project.

Perhaps because bureaucracies and their IT personnel are unteachable?  That is perhaps not an entirely unreasonable conclusion after all the writing I've done or read since my entry into Medical Informatics at Yale School of Medicine in 1992.

Finally, if the Coast Guard needs a new leader for this initiative, I offer my services. 

I would demand, however, unfettered hire/fire authority, as well as a Sherman tank as my office, such as my father (lower right) used to transport around Europe in WW2.

My father, lower right, somewhere in Europe ca. 1944-5.

-- SS

Patient Safety & Quality Healthcare: "Malpractice Claims Analysis Confirms Risks in EHRs"

Two "EHR beneficence is not exactly as advertised" stories in one day.  It's hard to keep up:

After my earlier post today "EHRs: The Real Story" - Sobering assessment from Medical Economics, now there's this.

From the journal "Patient Safety & Quality Healthcare" (PSQH):

Malpractice Claims Analysis Confirms Risks in EHRs
Jan/Feb 2014

Article available at this link.

[Short header on several EHR-related care foul ups]

... Distressing situations like those described above are happening around the country as healthcare organizations adopt electronic health records (EHRs) in growing numbers. Although these systems promise to reduce costs and improve quality and safety, they’ve also ushered in unintended consequences as a result of human error, design flaws, and technology glitches.

Recognizing these emerging risks, CRICO—the patient safety and medical malpractice insurer for the Harvard medical community— is taking action. The Massachusetts-based company has expanded its proprietary coding system to capture EHR-related problems that have contributed to patient harm, and to guide the hospitals, physicians, and other providers it serves toward addressing vulnerabilities in their systems.

I had previously written about another Med Mal insurer who had noted these problems at http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=norcal.

... CRICO recently analyzed a year’s worth of medical malpractice claims in its comparative database and found 147 cases in which EHRs were a contributing factor. Computer systems that don’t “talk” to each other, test results that aren’t routed properly, and mistakes caused by faulty data entry or copying and pasting were among the EHR-related problems found in the claims, which represented $61 million in direct payments and legal expenses.

The article notes this:

... Half of the 147 cases resulted in severe injury.

Patient deaths were a likely result, too, I note.

Note that this is just one insurer's data and assuming a good number of them were local to Massachusetts, could represent a significant percentage of the annual medical malpractice lawsuits in the state (Pennsylvania, a much larger state, has about 1500 med mal lawsuits filed annually). 

Note also that most cases of harm never make it to litigation due to the harsh economics of medical malpractice.

Numbers such as this will be going up as implementation, driven by HITECH incentives and penalties, accelerates in coming years.  This is especially true as medical centers and physician practices with far less clinical IT expertise and savvy than Harvard's become HIT users, and as the ability to capture such events increases.

The ECRI Institute "Deep Dive" study of health IT risk also speaks to a rise in numbers, with its finding of 171 health IT "events" in just 36 hospitals over 9 weeks voluntarily reported (i.e., just a fraction of the total), with 8 injuries and 3 possible deaths as a result (http://hcrenewal.blogspot.com/2013/02/peering-underneath-icebergs-water-level.html).

... The team asked its CRICO and Strategies members, “What vulnerabilities are you seeing? What are your risk managers worried about? What are your doctors complaining about?”

It used that feedback to draft a set of EHR-specific codes and then tested them in three datasets: CRICO (Harvard users) and two of Strategies’ larger clients, !e Doctors Company and Princeton Insurance. Based on those results, CRICO revised and approved 15 new EHR codes that went “live” in January 2013.

That means CRICO’s cadre of nurse coders can now identify EHR as a contributing factor to a malpractice claim, instead of using one of the less specific factors available in the past. [It's about time for a dose of transparency in the health IT sector - ed.]  And they can flag whether the problem involved user issues, system/technology issues, or both. “In some cases,” Sato points out, “the system design sets up humans to make errors.”

This should all be no surprise to any reader of this blog.  Read the whole article.

A more comprehensive list of "EHR harm modes" are at my posts "Internal FDA memorandum of Feb. 23, 2010 to Jeffrey Shuren on HIT risks. Smoking gun? I report, you decide" (http://hcrenewal.blogspot.com/2010/08/smoking-gun-internal-fda-memorandum-of.html) and "Cart Before the Horse, Part 3: AHRQ's Health IT Hazard Manager" (http://hcrenewal.blogspot.com/2012/06/cart-before-horse-part-3-ahrqs-health.html).

The actual Hazards Manager report is at http://healthit.ahrq.gov/sites/default/files/docs/citation/HealthITHazardManagerFinalReport.pdf. It contains this summary of known hazards:

AHRQ's taxonomy of health IT hazards.  Click to enlarge.

-------------------

Having written on these issues since 1998 as a "health IT iconoclast" (http://rtg.cis.upenn.edu/MDCPS/Posters/IT%20Iconoclasts.pdf) and having been largely ignored by the cognoscenti, can I now say "I told you so?"

-- SS

"24", This Computer Project Was Not

A fascinating case study of IT failure in another life-critical domain has come to my attention.

I think if the words "FBI" were replaced with "hospitals" and "healthcare IT", this could be a study of IT failure in the latter organizations. Many of the familiar issues are there:

The Failure of Virtual Case File and the FBI

Background

The FBI first sought to embrace technology in the 1980s during the onset of computer availability and hoped to have a paperless office where agents could quickly pull up case files, information, and photographs at the comfort of their desks without having to sift and sort through numerous paper files. The infrastructure in that time was limited to text based search engines and there were no provisions for photo storage or the ability to scan written reports. As a result, the FBI found its agents decided not to rely on the existing technology and were reverting back to paper.

After the attacks on September 11, 2001, the FBI was placed under scrutiny for being ineffective and inefficient in its operations due to the time it would take to share information with other law enforcement agencies, locate reports, and transmit them from one location to another (usually done via fax or by mailed CDs). To combat this, the FBI developed a plan known as Trilogy, which aimed for three primary goals: A new computer network, personal computers for most agents, and an online criminal database that would be titled Virtual Case File (VCF). An external contractor by the name of Science Applications International Corp. (SAIC) was contracted in June 2001 to begin the project with an estimated schedule of three years for completion and a first year budget of $14 million. The project continued until early 2005 (7 months over schedule), at which time the project scope had expanded by 80% with costs of $170 million and was riddled with issues. Ultimately, in early 2005, the project was cancelled but not after escalation and persistence on the part of the FBI.

The Problems and Failure of VCF

The FBI wanted SAIC to create the database from scratch instead of using off-the shelf Oracle programs that could have been customized. A study by the National Research Council (NRC) after the planned 3-year period in late 2004 was conducted to gauge the success of the program, and while the first two goals had been achieved (personal computers for most agents and the creation of a new network), VCF was found to be problematic and incomplete. The project plan was incomplete and there were no monitoring controls regarding finances or the schedule. The FBI threw quality out the window by wanting to bypass testing and release the product upon its ready date.

However, VCF failed the most basic functionality tests under the NRC and had not included network management, security, and storage systems, or basic sorting capabilities. The study also found that most of the FBI's skilled managers had left for the private sector and there were little to no individuals who had the IT experience or knowledge to interact effectively with contractors to achieve what was needed. The definition and scope of operations and processes were ultimately entrusted to SAIC who were outsiders.

In an attempt to salvage the project, the FBI immediately hired a federally funded R&D firm (Aerospace Corp.) costing $2 million to conduct an assessment of the project who concluded that the project needed to be scrapped and shut down due to the severity of the software issues. Upon investigation by Congress, there was a lack of financial controls and safeguards on the part of the FBI, enabling SAIC to continue to develop a program which was lacklustre and failed to meet objectives.

200 programmers from SAIC were used on the project when only a dozen were required and SAIC was not being properly monitored by the FBI. They felt as long as money was being funnelled to them by the government on the project, they did not need to be responsible for the effectiveness or viability of the program [was there a "hold harmless" clause as in health IT? - ed.] they were building and fired staff who expressed concerns over the direction of the program. [They must have been Luddites and IT skeptics who just refused to change the way they do things - ed.]

Further, the FBI took a trial by error approach to the project without truly understanding their end goal and without setting benchmarks for evaluating the progress of the project and took a nearly hands off approach by entrusting SAIC entirely. SAIC claimed the FBI were indecisive in what they wanted and there had been 19 government personnel changes over the project tenure which brought on scope creep and the focus of the project in a state of flux, in addition to a clear lack of leadership. A further $17 million was then spent by the FBI to perform more rigorous testing to try to salvage the project once more, which was another missed opportunity to cancel the project. It was only in early 2005 that the decision was made by Congress to terminate the project.

Source: Eggen, Dan; Witte, Griff. 'The FBI Upgrade that wasn't'. August 8, 2006. Website: http://www.washingtonpost.com/wp-dyn/content/article/2006/08/17/AR2006081701485.html (accessed on November 7, 2009).

"24" this was not.

Chloe O'Brian, where were you?

In the FBI's case, the failure exposes us to potential crime. In a hospital's case, the stakes are even more personal.

Even worse, at least here Congress intervened; health IT is a virtually unregulated industry and nobody is minding the store.

The UK's National Programme for IT (NPfIT) in the NHS paid the price of failure through problems such as above.

Will the "NPfIT in the HHS" meet a similar fate?

-- SS

Oct. 13, 2011 Addendum: where have we seen SAIC before?

How about here?

Case 3: Bedlam

Meanwhile, Science Applications International Corporation disclosed that computer backup tapes containing medical data for 4.9 million military patients [that number also amounts to almost 2% of the total U.S. population - ed.] had been stolen from an employee’s car in San Antonio. The data included Social Security numbers, clinical notes, laboratory test results and prescriptions.

-- SS

Who was at fault here? UK Woman left to die after computer decision support blunder

Who was at fault here? Those who modified the fall height parameters, those who designed the decision support system such that it could override life threatening problems based on a single parameter, endusers, their managers, or all?

Or was the problem the syndrome of inappropriate confidence in computers (SICC syndrome)?

I opine all of the above, in this cautionary tale:

Woman left to die after 999 ambulance blunder
By Laura Donnelly, Health Correspondent
Telegraph.co.uk
Published: 9:00AM GMT 21 Mar 2010

An investigation into a woman’s death has exposed a catastrophic decision by ambulance chiefs which may have cost hundreds of lives.

The blunder arose when call centre staff were not warned of flaws with a computer system that prioritises emergencies before dispatching ambulances.

Bonnie Mason, 58, fell down the stairs and died from a head injury after 999 controllers in Suffolk failed to identify her situation as “life-threatening”.

An investigation by The Sunday Telegraph has uncovered a critical danger placed in the software used by most ambulance services. For years, 999 calls in life-threatening situations like Mrs Masons’s were accidentally “downgraded”, with call handlers told not to send the most urgent response.

While some services spotted the risk, ordering operatives to override the computer’s orders manually, five of England’s 12 ambulance trusts did not allow call handlers to upgrade such calls [A belief that "the computer is omniscient" seems to be the only basis for such an exclusion of human judgment - ed.] They include the East of England ambulance service, which covers Suffolk and which only identified the risk after Mrs Mason’s death.

The danger in the system was created by the country’s most senior ambulance officials as they altered the program used by most control centres in an attempt to manage demand for 999 services.

Most ambulance services use an international computerised system designed in America. In the US version, a fall of more than 6ft receives the maximum priority response. However, the government committee which governs its use in this country decided that such cases should be deemed less urgent [what were they thinking? - ed], and excluded from an eight minute category A target response time.

In doing so, they created a potentially lethal flaw in the system. It meant that if a call involved a fall of more than 6ft it was designated a lower priority – a category B response – despite the presence of life-threatening conditions which were supposed to receive the most urgent category A response.

[NOTE: If the other life threatening conditions were ignored by the computer system after its "first-pass" look at the height of the fall, then who actually created the most severe flaw is unclear to me, those who altered the parameter or those who designed the overall decision support logic - ed.]

As a result, Mrs Mason lay unconscious for more than 38 minutes. The first ambulance sent to her home in the village of Eye, Suffolk, was diverted to attend to a drunk woman who had fallen on a pavement 22 miles away in Thetford, Norfolk. Because the inebriated woman had fallen at ground level, her situation was prioritised over that of Mrs Mason [perhaps because their was no entry of a "height of fall" - ed.], who was close to death by the time paramedics arrived. The East of England ambulance service, which also covers Bedfordshire, Cambridgeshire, Essex, Hertfordshire and Norfolk, said its operatives were instructed never to “override” the advice of the automated system.

Ambulance dispatchers instructed to "never override the advice of the automated system?" Simply stunning if true.

Read the whole story at the link above.

On another note: government committees have rarely worked well in domains where critical thinking is essential. (I can't wait for the comparative effectiveness committees using flawed data from flawed EMR's to start their work. I'd written about that issue here.)

Finally, "Our policy is to always trust the computer" is not a way to run life-critical healthcare services. Ever.

-- SS