Saving Lives: One Person At A Time

Bibb Allen, Jr., MD FACR Diagnostic Radiologist Trinity Medical Center


About 450 Americans die every day from lung cancer. Lung cancer kills more of us than any other type of cancer – 160,000 people every year – more than breast, colorectal, prostate and pancreas cancers combined! But we know that if we can catch lung cancer in its earliest stages, it can be cured. The problem has always been how to find it early because for the vast majority, by the time lung cancer causes symptoms, it is already in an advanced stage and much more difficult to treat.


Well that’s about to change. We now have a tool that will actually save lives in lung cancer patients by detecting the disease in its earliest stages. Recent scientific studies show we can lower the overall mortality of lung cancer by 20% through early detection of the disease in high-risk individuals. Tobacco use continues to be the highest risk factor for lung cancer, and by targeting this group of individuals for early detection, we can save 50 lives a day. A study sponsored by the National Cancer Institute and the National Institutes of Health conclusively demonstrates that screening for lung cancer in high-risk individuals with low dose computed tomography would save lives – ten to twenty thousand lives – each and every year. Early detection through screening high-risk patients will save more lives than the decades of work we have spent on new ways of treating lung cancer.


Who should be screened? Current or former smokers who smoked a pack of cigarettes per day for 30 years or more are considered at high risk for lung cancer. Our veterans, rescue workers, firefighters and construction workers are unfortunately over-represented in this group and make up a significant portion of our population in Alabama. Even former smokers who have quit smoking in the last 15 years remain at risk and should be screened as well. So beginning at 55, these individuals should be screened for cancer every year until they are 80. This is the recommendation of the United States Preventative Services Task Force and because of this recommendation insurance carriers are required by the Affordable Care Act to provide coverage and we expect this to happen beginning in 2015 or even sooner.


How does screening work? Lung cancer screening is easy. We use standard computed tomography (CT) equipment, and the CT scan takes less than 10 seconds to perform – no medicines, no needles. Although the CT scan uses x-rays to look at the lungs, the examination is considered very safe. We use the lowest possible amount of radiation for satisfactory examination, and it is an amount similar to that used for a routine screening mammogram. Considering the overwhelming benefits, risk of radiation exposure should not deter high-risk patients from being screened.


How good is screening? When an early lung cancer is detected, patients have a 93% chance of being cured, and while that’s exciting news, no test, including CT screening for lung cancer is perfect. Sometimes patients can have a cancer or other medical condition that will not be detected by the screening examination. Sometimes, the screening examination detects an abnormality that could be cancer but is not. In order to make sure these findings are not cancer, patients may need to have some follow-up tests that will only be performed after consultation with he patient. Most times this may be short interval follow-up CT scan to make sure a likely benign finding is not changing. Sometimes, more invasive procedures are required to determine a diagnosis including bronchoscopy and/or biopsy. Finally, in 5 to 10% of cases the screening CT examination may detect abnormalities in areas of the body adjacent to the lungs including the kidneys, adrenal glands, liver or thyroid. These findings may not be serious, but sometimes need to be examined further.


Overall, about 1 out of 4 lung screening exams will find something in the lung that may require additional imaging or evaluation, and most times these findings are lung nodules. Lung nodules* are very small collections of tissue in the lung that are quite common, and almost always – 97% of the time – they are not cancer. Most are small areas of scarring from past infections. But less commonly, lung nodules are cancer. If a small lung nodule is found to be cancer, the cancer can be cured in the vast majority of cases. But to distinguish the large number of noncancerous nodules from the few nodules that are in fact cancer, we may need to get more images before the next yearly screening exam usually in about six months. If the nodule has suspicious features (for example, it is large, has an odd shape or grows over time), patients are referred to a specialist for further testing.


At Trinity Medical Center, we have put together a Lung Cancer Screening Program that is dedicated to saving lives of people with lung cancer in Alabama. Our program is a multi-specialty effort between radiology, pulmonary medicine, medical and radiation oncology, thoracic surgery and primary care. We offer all of our enrollees a smoking cessation counseling to help them stop smoking. Our equipment specifications and protocols exceed all of the minimum standards for lung cancer screening, and our personnel are trained and highly qualified to perform and interpret the examinations. We have a structured reporting system that ensures appropriate and standardized management and multi-specialty follow-up of nodules and other abnormalities detected in the examination.


As a radiologist, who for years has seen mostly advanced lung cancers, it is an exciting time to finally be able to help the people of our state by offering a way to make a dent in mortality from our country’s largest cancer killer. My hope is that the folks in our state will take advantage of this opportunity to beat lung cancer.



*For more information on Lung Nodules see September 2014 blog by Dr. Karl Schroeder, Pulmonologist.

Objectivity in Communication

By Jane Mock, Risk Management Specialist NORCAL Group


There is no doubt that physicians have a lot on their plates. Regular challenges include providing quality care to each patient within a fully booked schedule; keeping up with medical record documentation; learning new systems; maintaining current awareness of regulations and laws; and navigating reimbursement issues. In addition, physicians spend a great deal of time educating patients and managing expectations for treatment, yet they still encounter the non-compliant, demanding or dissatisfied patient.

These circumstances can create a charged environment. Add into the mix a disagreement with a colleague, an unanticipated outcome in patient care, or a notice of a lawsuit, and the environment gets even hotter. Many providers have rushed to confess their shortcomings or criticize a colleague’s care (which can appear to be self-serving), only to learn later that the outcome was unrelated to the care given or, in the case of criticizing a colleague, that there were additional factors that influenced treatment choices. In the tense environment after an adverse outcome, providers may say things to patients or document opinions in the chart that are not objective and do not serve to promote patient care.


Sometimes a subsequent treating physician (knowingly or unknowingly) acts as a trigger for the filing of a lawsuit when he or she makes a remark to the patient that is critical of a prior physician’s care. In addition to a physician verbalizing his or her subjective opinion to the patient, similar comments expressed in the medical record do not meet the patient’s clinical needs. Some physicians have actually found themselves pulled into the litigation process when they make remarks to a patient about another provider’s care, only to learn that there is an active suit in progress. The following scenario shows how disparaging remarks can help a plaintiff’s case that is already underway.


A surgeon performed an angioplasty and stenting on a 55 year-old male patient who had suffered an acute myocardial infarction. One week later, the patient experienced a pulmonary embolism and a chest infection. He also developed an aortic aneurysm. He was then treated at a clinic over a two-week period. The physicians at the clinic were able to resolve the chest infection with a drain, but did not address the aortic aneurysm. Following the patient’s clinic stay, he returned to the surgeon, who performed a second procedure to address the aortic aneurysm. Because the patient had enjoyed a good rapport with the physicians at the clinic, he decided to see them for follow-up care. During one of these visits, his primary treating physician told him that he was “lucky to be alive” because the surgeon clearly did not perform the first procedure properly. The physician documented this conversation in the medical record. Unbeknownst to the physician, the patient and his family had recently filed a claim against the surgeon, alleging negligence resulting in his poor post-surgical course and need for additional surgery.


In addition to speaking negatively about another provider’s care and documenting those comments, this physician—who did not know that the patient was entering into litigation with the surgeon—was soon subpoenaed for deposition by the patient’s attorney.


A physician’s ability to respond appropriately to patient care situations involving other providers is crucial. Expressing oneself objectively in both written and oral communication is key to promoting continued patient care and, if applicable, defense of a malpractice claim.


Risk Management Recommendations

Communicating with the Patient

• Contact your professional liability carrier’s risk management department for assistance with communicating with patients.
• If the patient asks you to comment on the treatment or role of other healthcare providers, only comment on your own care and interaction with the patient.
• When conveying to the patient and family what is known about an unanticipated outcome, avoid speculation and blaming anyone.
• If a patient asks a specific question about an unanticipated outcome, and the cause is not yet known, an honest answer might be, “I don’t know” or “I don’t know yet.”

Communicating with a Colleague

• Access your clinical quality committee or medical director/medical staff leadership, as appropriate, for assistance with handling concerns regarding clinical patient care provided or with patient inquiries regarding a physician’s care provided.
• Review the patient’s record, previous studies, etc., to prepare for the discussion. The better prepared you are with the facts, the more likely you are to maintain a cool head; conversely, plunging into a conversation with little information and a lot of emotion pulls attention away from proper patient care and management of the event.
• Find a quiet place to have a discussion; this demonstrates respect for the work environment and also protects patient confidentiality.
• Discuss disagreements about care objectively; ask for clarification.

Documenting in the Medical Record

• Document in a timely fashion.
• Focus your chart documentation on your care of the patient.
• Document discrepancies using objective language.
• If addressing the contents of comparison reports, prepare a formal, written report for all studies that includes review of previous reports and, if indicated, comparison of previous images when possible. State if previous reports and images are not available and any attempts to obtain them.

• DO NOT:

o Blame or disparage other providers or the patient in the chart
o Offer personal (other than medical) opinions o Speculate on causes of poor outcomes
o Make observations, notes or entries unrelated to patient care
o Make derogatory statements or use language that blames another healthcare provider (e.g., “error,” “mistake in judgment”)
o Engage in professional disputes in the chart
o Include references to incident reports, legal actions, and attorney or risk management activities in the medical record (These should be maintained in a separate, confidential file.)

In the Event of a Claim or a Potential Claim

• Never alter the medical record in any way.
• If you are involved in an adverse or unanticipated outcome, contact your professional liability carrier’s claims department to report the medical incident. An experienced claims professional can guide you through the process of how to communicate with your carrier and defense attorney, as well as how to document appropriately.

Does Your Banker Make House Calls?

By: Maggie Tanner – Vice President of Private Banking, HeritageBank of the South; Wife of (non-traditional) 3rd year Medical Student at UASOM


Would you compare your banking relationship to a trip to the Emergency Room or a House Call with your Internist at a concierge practice? The ER banking experience is one in which a major event is transpiring and financing is needed by close of business yesterday. It’s bloody, chaotic and high stakes. Regular office hours are over, so you are stuck. You have no idea what banker will be “on call”, which location you should direct the ambulance to, and if the institution still goes by the same name. Will they take your form of payment? You find yourself in a painful, frantic scramble of paperwork, waiting and frustration. When you finally hear your name called, you have to explain your situation and your history. Your records with your other specialists will have to be faxed on Monday. You quickly realize that this is not the experience you were seeking, things will fall through the cracks and your opportunity may be lost.


On the flip side, you have the cell phone number of your Internist. You are contemplating a major financial decision. She knows you were on call last night and all day, so your concierge banker arranges to meet you at home. She brings your file with her. Comprehensive care is the standard because she knows your attorney, your CPA, and your financial planner by name. She is already up to speed on your records. You spend the next couple hours in a strategy session with tangible, customized solutions, perfect for your unique situation. The ideas fit within the framework of your comprehensive financial plan, other specialists are in the loop, and your stress level is low. The opportunity is captured and objectives are maintained.


Unfortunately for many busy physicians, they don’t have their banker’s cell phone number and their banker doesn’t know their name. They treat their banking relationship like an uninsured trip to an emergency room chosen at random. With a good Private Banker, it is possible to have a banking experience that much more closely resembles concierge medicine where house calls are the norm. All aspects of a banking relationship, commercial and personal, are handled with one single point of contact who is engaged with other professional partners for cohesive, comprehensive financial care. In many cases, physicians and their practices are so closely intertwined that the banker needs to know all financial aspects of both.


When choosing a banker, look for a Private Banker who is accessible, flexible, creative and proactive. Choose one who seeks to deliver comprehensive care on an ongoing basis. Choose to have the concierge experience with house calls.

Sleepy Heads

By: Kelli Tapley M.D. _ Physician at Birmingham Pediatric Associates


While we encourage our adolescent patients to get enough sleep, we are aware that few are actually getting the recommended 8.5-9.5 hours each night. Results from a National Sleep Foundation poll showed that as many as 59% of 6th-8th-graders and 87% of high school students in U.S. get less than the recommended amount of sleep on school nights and the average amount of school-night sleep obtained by high school seniors is fewer than 7 hours. However, 71% of parents believed that their teen was getting sufficient sleep.


For the first time the American Academy of Pediatrics has weighed in on the topic of adolescent sleep. In August the AAP issued a policy statement on school start times, urging middle schools and high schools to “begin classes no earlier than 8:30 am”, citing research showing the “average teenager in today's society has difficulty falling asleep before 11 p.m. and is best suited to wake up at 8 a.m. or later.”


But why is it happening and why weigh in now? Is it simply that they have too much to do before going to sleep (i.e. homework and after school activities)? Or is it due to electronic devices (i.e. iphone, ipad, TV) in their bedrooms?


Yes, to all of the above but there’s more going on here. Hormonal changes in adolescents result in a delay in the secretion of nocturnal melatonin causing a decrease in “sleep drive.” Additionally, there is potential link between screen time and disruption of circadian rhythm. Caffeine also plays a role in shorter sleep duration, increased wake time after sleep onset and increased daytime sleepiness.


The effects of sleep insufficiency are long lasting and potentially fatal. Restricted sleep has been found to increase risk of car crashes, delinquent behavior, depression, and difficulty maintaining focus and attention, and obesity.


While there are schools in the US that currently delay starting their day until after 0830, most do not. The Center for Applied Research and Educational Improvement, citing a study done in Minnesota in which school districts delayed start times for 9-12 grades until 0830, reported higher GPAs, significant increase in attendance rates as well as graduation rates, statistically less depression, as well as fewer school counselor visits for emotional problems and psycho somatic complaints. Not to be understated, 92% of their parents reported they were “easier to live with.”


The problem won’t be resolved simply by delayed school start times. The AAP also suggests Pediatricians make sleep part of their well-child care visits with adolescents by educating parents and young people on how much sleep they need on a regular basis and that extra sleep on weekends and caffeine use are not substitutes for regular sufficient sleep. Parents should set bedtimes and enforce a “media curfew.”



  For more information on the UM study http://www.cehd.umn.edu/carei/sleepresources.html

What Do the Recent Election Mean For Healthcare

By: Bill Cockrell with Cockrell and Associates, LLC


The fact that the Senate will now be under Republican leadership means there are a lot of thoughts about what will happen with the Affordable Care Act (ACA or “Obamacare”). This includes questions ranging from Medicaid enrollment to incentives (federal and by payer) to the elimination of the entire program all together. While there a good and bad parts of the program, there are many parts to the bigger picture. Here are some thoughts on that.


Overall – While the ACA is viewed to be a major thorn in the sides of providers, and many individuals, here are just a few elements to consider.


The House and Senate are both now in the hands of Republicans but that does not give them the freedom to do what they want. The President still has veto power and the Republicans did not receive enough seats, unless some Democrats cross over, to eliminate the program altogether.

Many people, millions, did receive healthcare coverage they did not have before. Rather they were without insurance because of individual cost, the lack of employer support or other reasons, they did see benefits which will be hard to take away.

The role of mandates, subsidies and taxes on certain healthcare items are those where the most change will occur.

Medicaid expansion, in most states, has too much steam to change, again, because of coverage being expanded to more individuals. What Alabama will do remains to be seen but don’t be surprised to see some expansion here at some point.

Bottom line, expect some fine tuning, some of it significant, but don’t expect the ACA to go away.


Meaningful Use and EHR Incentives – These were not part of the ACA. They had their beginnings before the ACA and were not part of it. Again, some fine tuning will occur along with additional delays (this will not require congressional legislation), but this will remain part of our healthcare environment.

Payers – With little of these individual program’s (Medicare Advantage plans, etc.) elements driven by government regulations, the process of restricted networks and individual incentive plans, will continue. From the Alabama BCBS Value Based Program and other incentive plans introduced by other providers, to Medicare’s, and other provider’s annual risk assessments as part of their Medicare Advantage plans. Expect further expansion. These are in place to control costs and will continue.

Medical Homes, ACO’s, and other special programs – Again, not driven by the ACA, these programs will continue to expand. There is evidence to support their value although the market itself (financial issues) may restrict the growth of ACO’s. Indeed, an SGR fix (see below) may hasten them.

Alabama Medicaid and Regional Care Organizations (RCO’s) in Alabama are coming and, with success seen in Oregon, one of the models the Alabama ACO’s are based on, they will occur. What potential Medicaid expansion and the difficulties in managing the many elements involved, this will be something providers.

The SGR fix – The Sustainable Growth Rate program for Medicare predates many of the above programs and will not be impacted by any changes in their programs. Last year proposed fix, driven by a combined Republican / Democrat (rare as it is) agreement, pushed more to reducing annual fee adjustments to increasing the role of Alternative Payment Models. This pushes more on the Pay for Performance program models (Medical Homes, shared savings, episode of care reimbursement, etc.) and we can expect more of this. A bright side will be combining many of the existing programs (PQRS, ePrescibe, etc.) into a consolidated model. This fix will occur, again with some possible modifications, with the question being whether or not a lame duck Congress finish what they started, or will it be delayed again until after the new Congress steps in.

ICD-10 – Expect this to finally occur in 2015. There have been many delays but a lot of money has been spent by system vendors and providers to prepare for this. The detail provided by enhanced coding plays well in many of the above programs.

Hepatitis C 101 - What you need to know

By: Rishi K. Agarwal, MD with Birmingham Gastroenterology Associates


What is hepatitis? Hepatitis is a general term for inflammation of the liver, which can occur from a number of different sources including toxins, medications, heavy alcohol use, and viruses. Hepatitis C (HCV) is the most common viral hepatitis in the US with an estimated 3.2 million individuals with chronic HCV. There are an estimated 17,000 new cases of HCV per year.


 Hepatitis C is classically known as a chronic disease, though there is a phase of acute HCV which occurs during the first 6 months of exposure. In the vast majority of cases this acute phase will lead to chronic hepatitis C. Why is the chronicity of this disease so important? It is because until recently, hepatitis C was considered a lifelong illness, and one of the leading causes of cirrhosis and liver cancer. Different patient populations are considered to be at high risk for hepatitis C. Those are namely current or former injection drug users, recipients of blood transfusions or solid organ transplants prior to 1992, chronic hemodialysis patients, persons with known exposure to HCV (healthcare works after needle sticks with HCV-positive blood), persons with HIV, and children born to HCV-positive mothers. Hepatitis C can be transmitted sexually but the risk is significantly lower compared to those listed above.


Given how common hepatitis C is in our population, the next obvious question is: "what symptoms should we be looking for?" That is a bit more challenging since approximately 70-80% of patients with acute hepatitis C, and a large percentage of patients with chronic hepatitis C, do not have any symptoms. For acute hepatitis C, some patients may have mild to severe symptoms including fever, fatigue, loss of appetite, nausea, vomiting, abdominal pain, joint pain, and jaundice. For chronic hepatitis C, the majority of patients will not have symptoms until they begin to have liver damage, even in the setting of normal liver function tests. With this being said, asymptomatic patients can still spread the virus to other individuals.


Chronic hepatitis C is a serious disease than can lead to long-term health problems. Of every 100 people infected with hepatitis C, 75-85 people will develop chronic hepatitis C. Of those, 60-70 people will go on to develop chronic liver disease, 5-20 will go on to develop cirrhosis over a 20-30 year period, and 1-5 people will die from cirrhosis or liver cancer. With this data, approximately 15,000 people die every year from hepatitis C related liver disease.


Because HCV infection is frequently asymptomatic, screening patients who may have an increased likelihood of being infected with HCV is an important step toward improving the detection and ultimately the treatment of infected individuals. Screening for HCV generally focuses on testing those who have an individual risk factor for exposure, who have evidence of liver disease, and who belong to certain demographic groups that have a high-prevalence of infection-including individuals born in the United States between 1945 and 1965. Several organizations have provided guidelines for who should be tested/screened for HCV infection.


Screening is performed initially via a hepatitis C antibody test. A positive antibody test is followed by an RNA test. If positive, it is important to discern the genotype, as treatment regimens are tailored to the genotype the patient has. It is important to avoid alcohol if diagnosed with hepatitis C, as alcohol and hepatitis C can have a synergistic effect on disease progression. Vaccinations are very important as well, thus patients should be vaccinated against hepatitis A and B, as well as against the flu (once a year), pneumonia (at least once), diphtheria and tetanus (once every 10 years) and pertussis (once during adulthood).


Treatment for hepatitis C has come a long way from where we started. Approximately 20% of patients with hepatitis C will spontaneously clear the virus; however the remaining 80% of patients will be looking for treatment options. In the early days, our options were limited, typically committing patients to 2-drug (and even 3-drug) therapy from anywhere between 6 and 12 months with the primary medications being interferon and ribavirin. In some cases, we were only able to offer successful treatment ~50% of the time. These medications were noted to have multiple side effects ranging from anemia, to fatigue, to depression, which decreased compliance. Over the last few years great strides have been made in the treatment of hepatitis C, to the point that depending on the genotype, we can potentially offer non-interferon treatment regimens (i.e. an all-oral regimen) and have a near 90% chance of clearing the virus – thus providing not only treatment but a cure.


In summary, hepatitis C is a global health problem that can progress to cirrhosis and end stage liver disease in a substantial proportion of patients. Screening can play a major role in identifying patients and ultimately treating them with ever-evolving and improving therapies.

OA? NO WAY!

By: Dr. Ryan Cordry, DO, MBA Orthopaedic Surgery at Medical West


For just about everyone, our body is our main mode of transportation. Whether if you are physically active exercising several times a week, if you walk to work, or just going back and forth from the kitchen to the couch - it takes your body moving to get there. And that involves all those bones inside rotating around, rubbing on each other, and stabilizing your body. Your joints are where all this happens.


I want to bring to your attention a common disorder called osteoarthritis (OA). It develops from aging and prolonged or extreme activity on a joint. It typically appears in the hips, knees, shoulders, and spine - all places that bear weight and stress.


First, know that OA is a normal occurrence of aging, and the symptoms usually begin showing up around middle age. And if you are 70 years old or older - I would be pretty positive that you are showing at least some symptoms of OA. Also people who have a family history, are obese, or have suffered trauma also see increased risk of OA.


What are symptoms of OA?

1) Pain in the joints. Especially after exercise or when putting weight/pressure on the joint.

2) Stiffness in your joints, and they have become difficult to move. Perhaps you could begin noticing rubbing, cracking, or scraping sounds when you move the joint.

3) "Morning Stiffness" - for almost 30 minutes after you wake up, all those joints are stiff and you have difficulty or pain getting around. After some activity, it goes away. (You've 'warmed up' the joint.)

4) Joint pain wakes you up at night. While OA is a normal occurrence as we age, it is possible to both expedite the onset of OA and to reduce the effects of OA. And you guessed it - it has a lot to do with your lifestyle choices.


Offsetting OA:

1) I mentioned above about how your body is your main mode of transportation. Some of us have bigger bodies than others. And some of us have bodies that are too big for our personal frames. Preventing obesity will help prevent osteoarthritis. Which makes sense, right? The less inactive weight you carry around with you is still pressing down on those joints. The ratio goes at 1 lb of body weight = 5 lbs on the hip/knee joints.

2) Exercising. Some light impact exercises such as cycling, swimming, elliptical machines, and walking can decrease stress on your joints. (Remember, at its core, it's the joint stress that causes OA.)

3) You can control the symptoms of OA by keeping the arthritic joint mobile and strengthen the muscle around it. Give that hurting joint a little bit of help - it will probably reward you with less pain. For OA treatment, it's best to discuss with your personal doctor. They can help you best get a plan that works you individually.


OA Treatments Include:

1) Ice/heat the afflicted area

2) Compression

3) Just resting the joint

4) Changing your activities (do a different exercise, stop going down to the paint and banging around during your church league basketball game…)

5) Braces can assist with joint relief and provide stability

6) Medications can be prescribed

7) Physical therapy

8) Injections

9) Surgery. Joint replacement is an option for severe cases.


For just about all of us, OA is something we are going to have to deal with at some point. But do what you can in order to lessen the effects of it. Staying healthy, avoiding excess weight, and making smart decisions when it comes to your activities can help you live a more pain-free life.


Take Care, Dr. Cordry

HIPAA Compliance: Never a Final Word

By: Susan Pretnar, President, KeySys Health, LLC


How is it possible that when new guidance is issued from CMS around the Meaningful Use core objective to conduct a security risk analysis, the message ends up muddled? On Oct 6, 2014, CMS issued a new FAQ on their web site to respond to a question that states:

How can a provider meet the “Protect Electronic Health Information” core objective in the       Electronic Health Records (EHR) Incentive Programs?

The first sentence of the response seems clear enough (emphasis added):

To meet the “Protect Electronic Health Information” core objective for Stage 1, eligible professionals (EP), eligible hospitals or critical access hospitals (CAH) must conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of the provider's risk management process.


However, the next paragraph is truly a puzzler:

In Stage 2, in addition to meeting the same security risk analysis requirements as Stage 1, EPs and hospitals will also need to address the encryption and security of data stored in the certified EHR technology (CEHRT).


One has to wonder how the ‘certified’ EHR technology got certified in the first place if it had weaknesses in how it handled encryption and security of the data stored in its databases. Or, why isn’t your ‘uncertified’ PACs system, unencrypted emails and text messages, of greater concern than software that was supposed to be ‘certified’? Why does CMS single out only the EHR systems, when the HIPAA Security Rule does not? But, I digress.


Further down the FAQ comes the following statement, which in my limited experience, has been taken to heart by those who are actually conducting the audits of HIPAA compliance and Meaningful Use attestations:

This meaningful use objective complements, but does not impose new or expanded requirements on the HIPAA Security Rule.


What does this mean? If you are complying with 45 CFR 164.308(a)(1) you have done a comprehensive job of assessing or reviewing the policies and procedures that constitute your ‘risk management process’, analyzing any gaps in your program against the HIPAA requirements in 45 CFR, and you’ve established a risk remediation plan that assures you are closing known vulnerabilities.

CMS concedes that ‘Once the risk analysis is completed, providers must take any additional “reasonable and appropriate” steps to reduce identified risks to reasonable and appropriate levels.’ This statement is the crux of what is required of CEs and their Business Associates.

If CMS is not imposing new or expanded requirements on the HIPAA Security Rule, then it must accept that a new ‘risk analysis’ need not be conducted in every year of attestation as long as the ongoing risk management process includes review of policies, procedures and plans, not just annually, but whenever significant changes are made to technology, facilities or staff that impact ePHI in particular.

If you have attested to Meaningful Use and accepted incentive payments, but you have not implemented a security risk management process, or, you have never conducted a security risk assessment and have no documented plan to remediate gaps in your security posture, perhaps it is time to secure expert legal advise.

The risk of audit is not the compelling reason to implement a risk management program, however, any more than averting a lawsuit is the sole purpose of conducting clinical risk reviews. The business of healthcare requires ‘doing no harm’, by keeping patients safe, including their protected health information. The financial and reputational impact of failing either task can be significant.

For various reasons, a large number of healthcare entities and their business associates feel no compunction about shelving efforts to identify their risks and securely manage their data and information systems. It’s as if that effort, unlike their other business activities, can be suspended without impact.