Lab Soft News

The Continuing Problem of Duplicate EHR Records for the Same Patient

I have previously blogged about the chronic and continuing problem of duplicate EHR records (see: Duplicate Patient Records as a Major and Costly EHR and EMPI Problem). Think of the problem in this way: it's relatively easy for a hospital registrar to create a new patient record but very risky to merge two nominally identical patient records because they may not represent the same person. This reluctance to merge records results in hidden data that may be critical in the care of a particular patient. A recent article dealt with this problem (see: Why Is It So Hard to Match Patients With Their Medical Records?) and below is an excerpt from it:

In the half-century since EHR technology tiptoed into health care, hospitals and doctors have used hundreds of vendors, each of which is constantly updating its technology, thereby creating new opportunities for inconsistencies. Today, on average, 18 percent of patient records within organizations are duplicates....And the match rates between organizations — for example, between a doctor’s office and the hospital — can be extremely low....That means physicians are often unaware of information that patients assume they know: test results, diagnoses, medications, and more....

On its face, patient-matching looks like a simple problem to fix, until you look closely. One root problem is that the health care industry has been consolidating for years, and the pace of mergers is only speeding up. Take the example of Northwell Health. Already the largest health care provider in New York State, Northwell is growing rapidly through acquisitions. Every time the system adds a new hospital, their medical records are integrated — and duplicates proliferate.... Meanwhile, Northwell’s 23 hospitals and more than 700 clinics are creating new duplicate records every day....Rather than try to figure out which of those 50 is the right one, [the registrar] will create a new case, knowing that there’s a way to reconcile it later on....In 2016, Harris Health System in Houston reported it had 2,488 records with the name “Maria Garcia;” of those, 231 shared the same birthdate, suggesting some of them refer to the same individual. ....

Pew did a deep dive into these and other potential solutions. Its finding: None of the ideas are as easy as they look at first glance. All the opportunities we examined to address matching have benefits and drawbacks — and none of the opportunities alone can solve this problem ....[One idea that has been] suggested but never implemented nationwide: data standardization. If all health care organizations collected certain pieces of demographic data in a uniform way, patient-match rates would increase significantly. Just a little bit of standardization could go a long way....[A] unique patient identifier — a single number, possibly linked to an iris scan or other biometric, that distinguishes one [person from another] might be the most logical solution to the problem. .... In the U.S., however, it is essentially against the law for the government to invest in a unique health identifier. 

On the face of it, artificial intelligence could possibly provide a solution for this problem by using algorithms to scrutinize multiple duplicate records and determine which ones represent a single patient and which ones do not. However, a recent article introduced a note of caution into such process. It emphasized that bad data can produce worse models and it's a certainty that many of the duplicate records considered for merger may be replete with incorrect data (see: AI can improve EHRs and analytics, but physician input is a must). Here the relevant quote from this latter article:

...[A]utomation has its perils too, of course. For instance, when developing predictive models, "there is nothing more critical than the data. Bad data (such as from the EMR) can be amplified into worse models. Simply allowing machine learning to run without human intervention presents clear risks. Instead, clinicians should seek a partnership in which the machine predicts (at a demonstrably higher accuracy), and the human explains and decides on action.

Duplicate Patient Records as a Major and Costly EHR and EMPI Problem

I have posted a number of notes about the use of IT to improve efficiency and effectiveness in healthcare. A gnarly but persistent problem has been duplicate patent records and substantial IT resources are required to correct the problem. Below is an excerpt from an article on this topic (see: Artificial Intelligence and ethics will drive a patient matching revolution in 2019):

Existing patient matching technologies are failing, as evidenced by skyrocketing rates of duplicate records in electronic health record (EHR) and enterprise master patient index (EMPI) systems. In fact, duplicate record rates have nearly doubled in the past decade, from an average of 10 percent in 2008 to 18 percent today....These patient matching technologies are failing at the worst possible time—as more and more of a health system’s strategic initiatives fundamentally rely on accurate and complete patient data. The dire consequences of these failures include a third of claims being denied costing $1.5 million annually; massive operational inefficiencies costing $200,000 annually; lowered return on investment (ROI) of EHR deployments; inhibited value-based care initiatives; and drastic consequences to patient safety, care quality, and patient satisfaction....

Yet nowhere can AI have a more immediate and accessible impact than in patient matching. Currently, health systems have teams of data stewards and health information management (HIM) professionals dedicated to finding, reviewing, researching, and resolving records that their EHR or EMPI has flagged as “potential duplicates.” Essentially, these employees are spending hours each day looking at, for example, a record for Jane Jones and another for Jane Smith, trying to decide if both Janes are actually the same person and if her records should be merged. Referential matching technology can automate 50-to-75 percent of this manual effort by being an intelligent and data-driven technology. It can automatically find and resolve duplicate records that EHRs and EMPIs have missed, enabling data stewards and HIM staff to focus on higher-value projects—while simultaneously lowering the operational costs and inefficiencies plaguing health systems by automating manual work.

Here's the way that a company called Verato has tried to solve the patient matching problem (see: Referential Matching: The Silver Bullet for Patient Identity and Patient Matching):

Verato has pioneered a powerful new patient matching technology called “Referential Matching.” Rather than directly comparing the demographic data from two patient records to see if they match, Verato instead matches that demographic data to its comprehensive and continuously-updated reference database of identities. This proprietary database contains over 300 million identities spanning the entire U.S. population, and each identity contains a complete profile of demographic data spanning a 30-year history.

I am sure that there will be many new solutions to this patient matching problem utilizing AI and ever more sophisticated algorithms that do not require a large, remote, proprietary patient database. Nevertheless, attention is now being paid to this major medical record problem that endangers patient lives -- that's the right direction. I will continue to monitor this field to see what other solutions emerge.

Proposed Classification for Health Information Systems: Provider and Individual

Recent events and some of my recent blog notes have caused me to question whether we need a new, high-level classification that encompasses all health information systems. I am going to give this idea a try. The goal of such a large scale systematic plan is to understand the functionality of current and future health information systems. Details are listed below:

1. Provider health systems (PHS's): The common feature of PHS's is that they are designed as tools for use by healthcare providers. The largest and most complex of these systems are EHR's which are deployed in hospitals and health systems. Also included in this category are office health systems (OHS's) designed to support the office functions needed by physicians and other providers like nurse practitioners. PHS's provide all the necessary IT functionality in health systems ranging from hospital inpatient units to the PCP's managing ambulatory patients.

Subcategories of PHS's include departmental systems deployed in hospitals such as LIS's, RIS's, and PAC's. In recent blog notes, I proposed that standalone LIS's, as opposed to LIS's that are part of the software suites of EHR vendors, could perhaps evolve into LIS-A's (see: Predicting the Future Functions of the LIS-Analytic (LIS-A); Continuing Discussion about the LIS of the Future; Analytics as a Key Feature?). Such systems would change from classic, best-of-breed LIS's to systems that support descriptive, predictive, and diagnostic algorithms. By developing such LIS-A's, LIS companies may cede ground to the LIS's provided by large EHR vendors as part of their enterprise-wide offerings. 

2. Individual (or personal) health systems (IHS's): These are systems designed primarily for consumers. I blogged recently about the Rally system of UnitedHealth Group that initially provided coaching and other health services (see: UnitedHealth Group to Launch Its Own Variant of an EHR in 2019). It's similar to Apple Health which is an app that runs on iPhones and the Apple Watch. Analytics will be a major thrust in the consumer healthcare market and delivered via IHS's (see: The Future of the LIS: Reflections about Consumers Ordering Their Own Lab Tests) particularly when PHS/EHR clinical data can be downloaded by consumers from their EHR accounts. Apple is already providing such a feature for iPhones in collaboration with selected health systems (see: Apple Has Plans to Copy EHR Records to iPhones and Apple Watches).

3. Hybrid health systems (HHS's): These would be systems such as the one being developed by UnitedHealth Group mentioned above that span physican office health systems (OHS's) and individual health systems. The advantage of such systems is that they fulfill the desire of patients to share health measurements obtained in their homes such as EKG tracings recorded by their smart watches or home lab testing performed by devices that plug into their iPhones. 

As to the future of health information systems, most of the development (and consumer market) is going to be related to IHS's and perhaps relatively simple hybrid systems. This is where consumers will be operating as well as health wearables and home testing devices. EHR's are expensive and accessed only via complex user interfaces. Hospitals will continue to use them because they have no substitute products. Consumers will never use them directly because of their complexity and because of the security concerns of the health systems that own and operate them.

Amazon Launches New Medical Record Language Processing Service

One of the most significant factors in extracting information from EHR record is the use of natural language processing (NLP) which I have referred to in a number of previous  notes (see, for example: EMRs and the Data Entry Paradox; Same Concept Not Applicable in the LIS World; Assessing Drugs Using "Real World Evidence" in Addition to Clinical Trials; AI Allows Computers to "Read" EHR Records and Make Predictions). A recent article discussed why one should "care" about Amazon's new medical language processing service (see: Why Should You Care About Amazon's New Medical Language Processing Service). Below is an excerpt from it:

Keeping track of your medical records can be a complex task....One of the significant challenges of handling medical records is that for each patient there is a variety of types of "notes" entered over time by health care professionals. These may include prescriptions, observation and administration of drugs and therapies, test results, x-rays, CT-scans, heart rate measured over months, surgical history, immunization history and family history. So the data type can be anything from a string, or a time-series data to an image or a very high definition video.The second challenge of handling data is accessibility. Although there is a generic set of rules in the US under Health Insurance Portability and Accountability Act (HIPAA) governing access to medical records, that states that the patient and the health-care providers directly involved in delivering care have the right to view the record.

The patient, however, may grant consent for any person or external entity to access the record. Given the complexity of handling and managing medical record, the holy grail of health records is perhaps a global electronic health directory that has both interoperability and liability built into it...Amazon [has] announced a new service called AWS Comprehend Medical...that can potentially impact the whole medical records ecosystem. Although electronic health records (EHR) exist for more than a decade, the majority of historical patient data is still stored today as unstructured medical text, such as medical notes, prescriptions, audio interview transcripts, and printed pathology and radiology reports. Extracting meaningful information from these is still a time-consuming process, and either requires data entry by high skilled medical experts, or teams of developers writing custom code. Comprehend Medical leverages Amazon’s AI technology to build a health record industry-specific solution, that uses natural language processing (NLP) to extract health-related text and data from virtually any medical record. 

Here's a key passage from the Amazon Comprehend Medical landing page about its services:

You can use the extracted medical information and their relationships to build applications for use cases like clinical decision support, revenue cycle management (medical coding), and clinical trial management. Because Amazon Comprehend Medical is HIPAA eligible and can quickly identify protected health information (PHI), such as name, age, and medical record number, you can also use it to create applications that securely process, maintain, and transmit PHI. You pay only for what you use, and there are no minimum fees or upfront commitments.

It's no surprise that Amazon singles out clinical trial management as a suitable use case for the company's new language processing service. For patients enrolled in clinical trials, EHR notes are extremely important. Pharmaceutical companies spend billions on such trials and will not be bothered by the costs involved in using such a service. I will be sure to track the future activities of this new company.

Faulkner Touts "Interoperability" at Annual Epic Users Conference

I have posted a number of previous notes about the need for interoperability among the various hospital and health system EHRs (see, for example: Do Hospitals Really Want Interoperable E-Health Records?; NYT Op-Ed on EHR Interoperability Blames Vendors and Greedy Hospitals). I believe that the lack of such a solution has partly been the fault of hospital executives who did not want to make their hospital records portable and partly the fault of EHR vendors who wanted to enhance their market position and please their client base. Well, a decade has passed and Judy Faulkner, the CEO of Epic, has suggested at her annual users conference that the global "interoperability" is the wave of the future but particularly for Epic clients (see: Judy Faulkner touts interoperability at Epic users conference). Below is an excerpt from the article:

Epic is working to take interoperability global, CEO Judy Faulkner told more than 10,000 attendees at the company's annual Users Group Meeting. "You've eliminated the silos from within your organization," said Faulkner, speaking at Epic's headquarters in Verona, Wisconsin...."Now it's time to eliminate the silos from outside." Faulkner was referring to Epic's One Virtual System Worldwide initiative, which it launched early this year. The initiative enables "clinicians across all organizations using Epic" to more easily gather, share and interact with health data no matter the location and presents it in a unified view....As is often the knock against the company, the focus on exchange across Epic customers is not quite the same as true interoperability. But Epic said the initiative does include "organizations that use other EHRs." It certainly represents an Epic-esque approach to the idea of more widespread data sharing. Given the scope of Epic's customer footprint, with nearly two-thirds of U.S. patients and increasingly more in Europe, it's on a scale that could credibly live-up to the project's bold name.

I think that we are still at a point where Faulkner's vision of interoperability puts Epic customers first in line. Given that Epic's footprint covers nearly 2/3 of U.S. patients, the company has achieved a kind of de facto EHR integration. However, it's never been a wise approach in the hospital IT market to put "all of your eggs in one basket." Such a strategy gives too much power to one company and also sets the stage for more frequent EHR crashes across entire health systems (see: Sutter Health System EHR Crash Reported by Nursing Union). Exacerbating this problem is the fact that news about EHR crashes tends to be downplayed by EHR vendors and hospitals executives alike, compounding the criticality of the problem. 

In my opinion, the solution to EHR interoperability does not rest with any proprietary vendor solution despite any the puffery used to describe it. The problem is complex but is dependent in part in the enforcement of health IT interoperability standards across all care settings and facilities (see: Top 5 Challenges to Achieving Healthcare Interoperability). Another element in the solution is the adoption of a universal health identifier for patients (see: The Quest for a Fail-Safe Patient Identification Solution in the U.S.). This will require a continuing and coordinated effort on the part of the federal government to robust health policy which will never happen with the current administration. Therefore, the efforts of Epic to achieve interoperabiliity across its installed client base are appropriate. This is the best that we can hope for at the present time.  

The Quest for a Fail-Safe Patient Identification Solution in the U.S.

A recent article on the challenges posed by mistakes in patient identification was rather pessimistic about the amount of progress that has been made in the field (see: Fail-safe patient ID matching remains just out of reach patient-id). This boils down to the challenge of ensuring that the EHR record of "Mary Smith" who is admitted today is uncorrupted by data from a different "Mary Smith" who was admitted to the hospital yesterday. Below is an excerpt from the article. It's long so read the whole thing if you are interested.

[D]igital technologies—electronic health records in particular—have greatly exacerbated the challenge of ensuring that clinicians not only accurately identify patients but match them to their medical records. There's a lot more data flowing around and between health systems now than ever before. At a time when healthcare organizations are looking for every advantage to cut costs while improving quality and safety, patient matching is a challenge that can cause problems on a lot of levels. When a hospital has a patient's correct health record, it not only provides better care but it can cut down on the costly inefficiency of having multiple records for one patient or a single— erroneous—record for one patient. Estimates of patient-matching accuracy vary, but most say that it hovers around 90%. The problems posed by the remaining 10% are costly, both in terms of safety and money....

[H]ealth systems are searching for a combination of digital and manual fixes. They're using tools that run probabilistic matching on records, and they're also training patient access staff to match records by hand. Most health systems use a combination of demographic information and internally assigned patient identifiers to match patients to their records. At Geisinger Health, for instance, staff use a master patient index database that spans the entire enterprise to match patients to their records. Every day, several people work to keep the master patient index data “clean” so it can probabilistically match patients correctly more than 90% of the time....Just because a patient has a name matching one of the clinic's records doesn't mean that patient is the one who's in the records.... Some health systems are layering software on top of their EHRs to address the problem, at least internally.....In early 2018, Apple launched a new version of its Health app that allows patients of certain health systems to download their health records onto their iPhones. It's one big step toward making patients the agents of interoperability.

Here is a definition for the enterprise master patient index:

An enterprise master patient index (EMPI) is a database that is used to maintain consistent and accurate information about each patient registered by a healthcare organization. It may link several smaller MPIs together, such as those from outpatient clinics and rehabilitation facilities. An EMPI can also aggregate patient data contained in separate systems within one facility.

The search for as solution to the patient ID problem has been exacerbated by the broad adoption of EHRs with a single system spanning a large health system and scores of people responsible for the correct patient ID when entering data. I have blogged about the Apple initiative, mentioned in the first excerpt, that enables patients to view their EHR records with their iPhones (see: Apple Getting Traction with Its App to Access EHR Records with iPhones). Unfortunately, I don't think that making patients the "agents of interoperability" for monitoring the quality of their own records is a practical solution to this problem. Too few patients will use such a system and its not practical to ask them to scan their entire record and determine if any of the entries possibly belong to another patient. The sole solution to the problem is the adoption of universal health identifier such as that being used in countries like Australia but there is little chance of such a system being adopted in the U.S. One reason is that there is too much distrust of the government at this time, exacerbated by the political rhetoric of Donald Trump.

During an EHR Crash, Don't Disturb the Worker Bees

In response to my blog note yesterday suggesting the need for frequent updates during major EHR crashes (see: Hospital Computer Crashs Show EHR Vulnerabilities; Need for Better Explanations), a reader of Lab Soft News submitted the following comment:

I suspect those who desire frequent updates have never lived on the "IT" side of one of these crashes. Interrupting the staff who are working to resolve the issue will only delay the resolution. It is not practical to have them stop "frequently" to give their leadership updates, unless that is considered a higher priority than restoring the system.

I personally lived on the IT side of the equation for 24 years as the director of an LIS in a major health system. During that time, I was involved in a number of system crashes, all for relatively short periods of time. During each of them, physicians and nurses were deprived of rapid and easy access to critical lab test results and patient care suffered. In my note referenced above, I did not discuss exactly "who" would be responsible for developing frequent bulletins about progress in the resolution of the nature of an EHR crash, the remedies that were being undertaken, and when service would be restored.

In the case of the crash at Sutter Health, the "who" would be obvious in terms of communication with affected hospital personnel and patients. With a system-wide EHR crash that persists for more than 24 hours, I assume that the CIO of the health system and all of his her deputies will be on-site, observing and communicating continuously with EHR personnel as well as representatives of the EHR vendor. It seems to me logical that responsibility would fall to such EHR leadership to closely observe the situation and then to collaborate with the health system public relations and patient communications personnel in developing the necessary and relevant communications that I recommended in my note.

Restoring service during an EHR crash will always be the first priority and no mission-critical IT personnel should be distracted from their continuing effort to resolve the problem. I think that it would be highly unlikely that the CIO of a major health system would be pivotal in resolving the cause of such a crash. If this were indeed the case, a mere 24-hour EHR crash would be considered a miracle.

Data Breach Reported at LabCorp, One of the Two Largest Reference Labs

LabCorp, one of the nation’s two largest reference labs in the U.S., is investigating a security breach that could have put health records of millions of patients at risk (see: LabCorp Investigates a Possible Data Breach). The company, in a filing with the Securities and Exchange Commission, says it detected “suspicious activities” on its network the weekend of July 14 and “immediately took certain systems offline as part of its comprehensive response to contain the activity.” LabCorp says it has not yet discovered any evidence of the unauthorized transfer or misuse of data it holds. The company added it has notified authorities and will cooperate in any investigation. 

Data breaches are not unknown for reference labs. In December, 2016, Quest Diagnostics, LabCorp's major  competitor, announced that an "unauthorized third party" hacked into the MyQuest patient portal, accessing protected health information (PHR) for about 34,000 patients including name, date of birth, lab results and in some cases, phone numbers (see: Quest data breach exposes private health information of 34,000 patients). It said the breach did not include Social Security numbers or credit card, insurance or other financial information. MyQuest is used by the patients of physicians who submit specimens to Quest to view their personal test results.

Update on 7/30/2018: LabCorp still recovering from ransomware, won't say if it's SamSam

 

Equifax Releases Credit Locking App That May Not Work; Try Credit Freeze

Equifax is giving software a bad name. First there was the huge database breach of the company in the Fall of 2017 (see: Massive Equifax Data Breach Could Affect Half of the U.S. Population). Not only was this a major database security mishap but the company did not endear itself to consumers in terms of the remedies proposed to correct the problem. It also brought to light the fact that some big and often anonymous companies like Equifax can be the cause of many bad days for consumers through no fault of their own. Now comes news that the company has released a faulty app that is designed to allow consumers to lock access to their credit files from a mobile phone but doesn't seem to work (see: New Service, Same Old Equifax: Credit Locking App Freezes Up Your Money). Below is an excerpt from the article. Its long and detailed and refer to it for a more comprehensive view of the problem.

Amid that mess [of the security breach] came a promise from Equifax that it would create a simple app that allowed people to “lock” their credit files without all the hassle and without a fee....It was supposed to be simple: You download the app and swipe the lock to the right, which restricts access to your file. [There were multiple problems with the app.]....That’s when we told Equifax. About 90 minutes later, a spokeswoman said the company had identified the issue and resolved it. Except that it hadn’t. The locking mechanism still wouldn’t lock. A company spokeswoman said Equifax had not experienced widespread issues with the service, but, as with any new product, there had been isolated problems they were working to resolve.....Equifax’s new app offers a lock instead of a freeze. Locks works similarly to freezes — both restrict access to your credit file — but it should be easier to unlock your credit file since you can do it from your phone with a swipe, and doesn’t require a 10-digit pin or a fee. What is not clear, however, is what disadvantages may come with locks. Many state laws exist that govern freezes, offering consumers protection. By creating locks, the companies avoid them.....So, after I tried to lock my husband’s file five times with no luck, I changed course and obtained what we’ve been telling people to get for years: a freeze. It took all of a minute on Equifax’s website. Maybe in a year or two, Equifax will have its act locked up once and for all.

What I find most interesting about Equifax is that it's both a record storage and a software company with enormous responsibilities and potentially huge liabilities, almost all of it outside of the control of consumers. And in spite of its importance, it seems to lack basic expertise in its core businesses. I am sure that it's not alone in this regard compared to similar companies but it has certainly vaulted into the eye of the public with disastrous results. Get ready to hear similar stories like this in the future. Hospitals come to my mind as institutions that acts as stewards for critically important data but may be relatively incompetent in terns of data security. For example, hospitals seem to be one of the major targets for ransomware attacks (see: WHY HOSPITALS ARE THE PERFECT TARGETS FOR RANSOMWARE).