That was the first topic from last night's #HITsm chat. Sparked by, of all things, this article. My brain exploded, my blood pressure quickly rose and I almost asked "What planet are you from?" (See what I did write). The discussion devolved from there into one about security and patient consent and never really rose above it with a few rare exceptions. The last calm thing I'll say in this post is that this is my personal hot button issue, not the opinions of anybody I work for or am otherwise involved with in any way.
Patients NEED access to their data. This is both a story my tweople tell, and one I know quite well myself.
A few years ago, my mother-in-law wound up spending her vacation weekend; instead of with her daughter; in the hospital, raving, with a 104 degree fever. The hospital staff couldn't figure out why the antibiotics weren't working because they didn't get the information that she was immuno-compromised until Monday when her primary care physician told the hospital a few hundred miles away that she'd just gotten off of 6 weeks of chemo. [Her family learned from that experience quite well. Between that any many other events, we got into the habit of asking her, and her healthcare providers routinely about her CBC results. Oh what a challenge that was for her provider's at first. But Mama was stubborn like bull. She got the hospital security officer to sign a note posted above her bed at one point: "Please share Mrs. ____'s blood test results with ANYONE in the family who asks".]
Then there was the time that my step-father spent two days in the hospital up my way because they weren't sure his pacemaker hadn't moved, and couldn't get the images until... you guessed it. Monday when Medical Records opened up.
That's just a few stories from my family, and ones with happy endings at that. My friends in Health IT all have stories of their own, and some of them ended not nearly so well.
This is pure BS.
In both cases I reported, the hospitals had the necessary consent to access and share the data [AND both my sister-in-law and my mother had power-of-attorney and knew how to use it]. In both cases, the patients received expensive, unnecessary, and while we are at it, POOR care. In one case, the lack of care related to missing information introduced a mildly life-threatening risk. In the other case, it was mostly a miserable way to spend a weekend that resulted in a delay in obtaining the right treatment.
In both cases, the data wasn't available because it needed to be accessed by a person, instead of using Health IT to exchange it. Hell, even a FAX would have been fine. The problem was that there was nobody at the other end who could get TO the data to even FAX it. In both cases, the people needed worked "normal shifts." That means that patients who don't get sick on their schedule get stuck better than half the time waiting for an office to open.
If you truly want patient-centered care, don't hold my (or my family member's) data hostage to LOUD and mostly useless discussions about security and privacy. There are privacy and security laws on the books. Enforce them. There is privacy and security technology and frameworks out there. Use them. Stop making me wait to get my damn data.
In my own experience, it takes at least three times longer to work out the legal framework in an HIE that it does to actually implement the security requirements. And the same basic technology shows up over and over again.
Please, "don't invent the wheel over and over and over again"
Instead: "identify what's working, where it's working and adopt it and adapt it."
A million dollars on a consent pilot? What a waste. Go inspect and explore what's been done -- over and over and over again. Then see what works, and adopt and adapt. There are at least 10 HIEs out their that have already done consent -- using standards. Check it out.
If you recognize the quote, then the irony of where the story came from that started off T1, and my focus on trying to bring it back to being patient-centered should make it readily apparent why I'm so angry right now.
I'll put it quite plainly. The number one issue for patients (and consumers) with regard to their health information is ACCESS. The second issue is SECURITY. If you can remember that order of priority, all else is easy. But we forget. And if you don't believe me, take this simple test: Ask the next HIT expert you see what the most pressing issue for patients is about their healthcare information. I'll bet most of them get it wrong.
Update: July 30th, 2011
Here's Regina's rendition of this story:
Keith, what a GREAT post. You are absolutely correct. Accessing data, even for oneself, can be unnecessarily complicated. (I have my fair share of stories as well.)
ReplyDeleteThanks again for your enthusiastic response. Your passion is contagious.
Thanks Erica (@TheGr8Chalupa) for the feedback.
ReplyDeleteI'm rereading the post now in calmer moments and I still stand by what I said. I'll make one additional recommendation.
Rather than developing a pilot that focuses on the technology for Consents, what ONC should be doing is developing a usable framework for consent policy.
What is really needed is a way to get past the 6-9 months it takes to develop the consent policies for an HIE. If ONC can lick that problem, the technology already exists that can support it.
You might want to take a look at what happened in the UK - and the concerns over privacy. This isn't a huge deal really most if not all of the ONC funded HIE's have already done much of this work.
ReplyDeleteThe challenge is that many HIE's came up with different models.. Not an infinite number but enough to make it complicated for people in areas that cross two state lines or even with multiple HIE's in the same state.. Tell me what model they are using where you live?
Sounds like providers need access in the situations you mentioned not patients. and that the patients didn't keep themself informed in other cases. How would you feel if your doctor came to your job and told you how to do it?