The Risk Factor

Yesterday, Google formally announced it plans for creating a personal health record (PHR) service at the Healthcare Information & Management Systems Society conference in Orlando. Google's announcement was three days after Microsoft announced at the same conference a $3 million initiative "designed to empower providers with targeted funding to stimulate the research and development of online tools that improve health" in support of its four-month-old HealthVault PHR offering. Both companies say their objective is "to put you in control of your health information."

Google is currently piloting its system at the Cleveland Clinic, and hopes to have a commercial offering later this year.

Both Microsoft and Google have come under pressure about how secure their PHR systems will be as well as how patient information will be used. For instance, this week the World Privacy Forum (WPF) issued a report and a consumer advisory warning of the risks that PHRs pose.

As the advisory notes, "Consumers need to know that not all PHRs protect privacy in the same way, and some PHR systems can undermine consumer privacy in serious ways that consumers may not be expecting... Few consumers understand that their health care files are not always protected under HIPAA (Health Insurance Portability and Accountability Act of 1996) when their files are in a PHR."

The Centers for Medicare and Medicaid Services said recently that by 2017, consumers and taxpayers will spend more than $4 trillion on health care, accounting for 20% of every dollar spent. According to a story in the Boston Globe, in 2006, individuals and the government spent $2.1 trillion on health care, an average of $7,026 a person, while 2017, health spending will cost an estimated $13,101 a person.

In the face of these huge projected costs, President Bush has reiterated his call in newly proposed legislation for a national inter-operable electronic health record (EHR) system and making electronic personal health records (PHR) available to Medicare beneficiaries. The PHR proposed legislation, according to news reports, could be used as a back door approach to force doctors and hospitals to implement EHRs.

The Bush Administration has consistently viewed EHRs as a critical means for controlling Medicare costs (some in administration believe that EHRs will "save" Medicare), as well as other medical costs that the government pays for. However, if your primary design criterion for a national EHR system is to control costs, then do not be surprised that the quality of patient care is likely to come in a distant second place as a result. This risk and others has not been examined in any detail; at least in comparison to the supposed benefits.

The benefits of EHRs are not unsubstantial, but they shouldn't be seen as magic elixirs. There is serious doubt by many (including me) that EHRs will reduce health care costs as much as expected. As one health care economist told me, "As long as demand for health care outstrips supply, costs are going to continue to increase."

And as the US population continues to age, new medical technology emerges that promises new cures and treatments, and legal liabilities stay the same, to name only a few health care cost drivers, demand and the resultant cost for health care will continue spiraling upward.

Kaiser Permanente announced Monday that all of its 8.7 million enrollees in nine states, including Hawaii, and the District of Columbia have access to HealthConnect, an outpatient electronic health record (EHR).

Kaiser said that its 13,000 physicians nationwide now have electronic access to patients' medical records across its 421 medical offices and clinics.

According to reports, the EHR system's deployment cost so far has been are now approximately $4 billion, including $1 billion for maintenance. Kaiser claims that HealthConnect is the world's largest private EHR system.

Kaiser still needs to finish up the inpatient (i.e., hospitalized patients) side of its EHR system, however. Kaiser said that 13 of its 36 hospitals (34 of them in California) have installed the EHR software, giving 3.2 million enrollees the advantages of an inpatient EHR system. Some 14 hospitals are scheduled to do so this year, including 13 in California and one in the Portland, Ore., metropolitan area.

The remaining nine hospitals, including the Moanalua clinic on Oahu, will follow in 2009 and early 2010.

According to Kaiser, "Physicians reported that, in many cases, electronic health records enabled them to identify and resolve patients' health issues in the first contact. One survey showed that, with the use of electronic health records, medication administration times and doses were more legible and correct (85 percent), and clinicians believed the electronic medication administration system provided a safer and more reliable communication tool (75 percent)."

It will be interesting to see if the Kaiser news will make it into the Presidential campaign, given that the candidates are touting health IT as a means to improve health care as well as reduce its costs.

After a year and a half of development, Google announced yesterday that it was now offering personal health records on-line.

According to Google's Health website, "Google Health allows you to store and manage all of your health information in one central place. And it's completely free. All you need to get started is a Google username and password.

"Google believes that you own your medical records and should have easy access to them. The way we see it, it's your information; why shouldn't you control it?"

"With Google Health, you manage your health information — not your health insurance plan or your employer. You can access your information anywhere, at any time."

So, why is Google doing this?

“It’s what we do. Our corporate mission is to organize the world’s information and make it universally accessible and useful. Health information is very fragmented today, and we think we can help.”

Google has partnered with over two dozen organizations, including hospitals (Beth Israel Deaconess Medical Center, The Cleveland Clinic), pharmacies ( Longs Drugs, Medco Health Solutions, RxAmerica, Walgreens), diagnostic laboratories (Quest Diagnostics) and medical information providers (SafeMed, Heathgrades) which have agreed to provide electronic copies of medical information (or help interpret the information) to add to your Google personal medical record. You can go here to get profiles of Google's partners.

Google also promises to keep your medical information private:

"You should know two main things up front:"

"1. We will never sell your personal health information or data"

"2. We will not share your health data with individuals or third parties unless you explicitly tell us to do so or except in certain limited circumstances described in our privacy policy."

"We make it a point to let you know what information we collect when you use Google Health, how we use it, and how we keep it safe."

I personally would take this assurance with a grain of salt. A person's Google health record is not covered by HIPAA (Health Insurance Portability and Accountability Act of 1996).

So how is Google going to make money on the effort if it is free? It says:

“Much like other Google products we offer, Google Health is free to anyone who uses it. There are no ads in Google Health. Our primary focus is providing a good user experience and meeting our users' needs.”

That is a good, very coy, non-answer if I ever saw one. I will remain skeptical, if you don't mind, about Google not deciding in the future to change its, “We will never sell your personal health information or data” tune to one more like “We will never sell your personally-identifiable health information or data.” Aggregated health data is seen as a gold mine by medical researchers, pharmaceutical companies, and the government alike.

Of course, the value of the data depends on how accurate it is. Google makes a big deal that the individual is in charge of their medical record; that the individual decides how much is actually going to be disclosed to whom, and; that the individual can edit their medical information as well.

This is where it gets interesting to me. How much will doctors trust Google (or Microsoft’s or anyone else's) personal health records if they start encountering a number of patients who are wholesale editing their personal medical information? Or do doctors just assume that the information provided is incomplete or biased?

It occurs now with paper-records, but I wonder if the perception of selective editing of medical records will change with an electronic health record.

Also, will insurance companies start demanding that patients disclose to them all their Google-stored information if the patient wants to get a doctor’s visit paid for? And what happens when an insurance company finds a record that is edited?

The US Congressional Budget Office (CBO) released a controversial report last week questioning how much information technology use in health care (especially electronic health records) would actually save.

The CBO report, while acknowledging there are benefits from using IT in health care, argues that the savings are over-stated. Quoting from a CBO blog summary of the report,

"Research does indicate that in some instances, health IT appears to have reduced the cost of providing health care, helped eliminate inappropriate services, and improved the quality of care. In general, however, health IT appears to be necessary but not sufficient to generate cost savings; that is, health IT can be an essential component of an effort to reduce cost (and improve quality), but by itself it typically does not produce a reduction in costs."

"The most auspicious examples involving health IT have tended to involve relatively integrated health systems. For providers and hospitals that are not part of integrated systems, however, the benefits of health IT are not as easy to capture, and perhaps not coincidentally, those physicians and facilities have adopted electronic health records (EHRs, the primary health IT package commonly purchased by a provider) at a much slower rate. For example, office-based physicians in particular may see no benefit if they purchase such a product – and may even suffer financial harm. Even though the use of health IT could generate cost savings for the health system at large that might offset the EHR’s cost, many physicians might not be able to reduce their office expenses or increase their revenue sufficiently to pay for it."

The report goes on to question the widely-quoted 2005 RAND study and its claims of about a $80 billion in net annual savings if health IT were widely employed.

About a week and half ago, the UK National Audit Office (NAO) released a review of the progress made since 2006 on the National Health Service’s (NHS) National Program for IT (NPfIT), its national electronic health record (EHR) program. The NAO concluded that while some aspects seemed to be working just fine (the N3 broadband network and data spine, the Choose and Book appointment booking service, a Picture Archiving and Communications System (PACS) digital x-ray scheme and an electronic prescription service have been deployed on schedule, if not exactly working perfectly), the Summary Care Records functionality will not be deployed until 2014-2015, some four years late. (It should be noted that the original schedule was 2006.)

However, the NHS confirmed in the past day that one of the major NPfIT suppliers, Fujitsu, was pulling out of its £896 million, 10-year contract to supply a Cerner-based EHR system to the south of England. The cost to Fujitsu is estimated to be at least £340 million.

When the NPfIT program was set up, the NHS took great pains in saying that it was going to be tough with suppliers. From news reports, NHS wanted changes in the scope of the contract without paying what Fujitsu's board thought was fair given the risks involved, so it decided to quit. Accenture too walked away from its £2 billion NPfIT contract in 2006 for some of the same reasons.

I suspect the pull-out by Fujitsu is not only likely to push the NPfIT program schedule back past the 2014-15 time frame, but probably end up costing the NHS more than if it had paid Fujitsu what it wanted.

Go figure.

Last week, the California State Senate approved a bill that would allow pharmacies in the state "to sell confidential patient prescription information to third-party marketing firms working for drug companies," according to news reports.

The idea is being framed by the pharmacies and drug companies as a way to increase the quality of patient care. The drug companies would send patients mailings as reminders to take their prescriptions and to get them refilled. A patient could opt out of the mailings if they so desired.

Of course, the drug companies are lukewarm about having patients opt-in instead, for obvious reasons.

And both the pharmacies and drug companies are playing down how much money they are going to make by being able to directly target patients with advertising.

Expect to see patient medical information increasingly being sold and bought as more and more of it becomes electronic. Expect too to see future attempts to sell confidential information couched in this "increasing the quality of patient care" rhetoric. This currently seems to be a winning approach to overcoming privacy concerns.

My worry is if this becomes law in California which has one of the strongest medical privacy laws in the country, how quickly do you think this idea will spread across the nation?

And how quickly do you think Google and Microsoft will start arguing about the benefits to patients of their selling personal health record information to third parties?

There is a story in today's Wall Street Journal about the bi-partisan congressional effort that "would take a carrot-and-stick approach that would first grant doctors additional Medicare payments if they adopt digital-prescribing technology, then in later years dock their fees if they have failed to make the shift."

The story notes that that only about 35,000, or less than than 10%, of U.S. doctors use e-prescribing. The advantage to e-prescribing is that it can reduce administrative overheads as well as look for dangerous drug interactions.

The idea is that since most doctors see Medicare patients, this approach would create momentum not only for e-prescribing for all patients but for electronic health records.

Although the details are not yet finalized, it is likely that Medicare payments to doctors would be increased 2% in 2009 and 2010, then less over the next three years for those who use e-prescribing, while for those that don't use would see their payments cut by 1% in 2011, ramping up to 2% (and probably more) for 2013 and beyond.

I suspect that this same approach will be used for electronic health records as well.

Various news outlets ran stories on the New England Journal of Medicine's (NEJM) survey results published yesterday regarding doctors' usage of electronic health record (EHR) in the US. The survey, which involved 2758 doctors, found that while doctors who use EHRs overwhelmingly believe that they improve the timeliness and quality of patient care, less than 20% of all doctors actually are using them.

However, the NEJM survey found that only 4% of US doctors have access to what would be considered to be a "fully functional" EHR system as opposed to a "basic" EHR system. The survey report noted that, "The principal differences between a fully functional system and a basic system were the absence of certain order-entry capabilities and clinical-decision support in a basic system."

The report breaks down usage by medical practice size. Doctors working in medical practices having 50 or more doctors, some 50.5% of those practices have installed EHR systems. Those with 11 to 50 in the practice, the percentage drops to 29.3%. Those medical practices consisting of 1 to 3 doctors, the percentage which have installed EHR systems is only 8.6%.

Unsurprisingly, the main reason for the low EHR adoption rate is mainly financial, although other factors were cited in the NEJM survey report: "Among physicians who did not have access to an electronic-records system, the most commonly cited barriers to adoption were capital costs (66%), not finding a system that met their needs (54%), uncertainty about their return on the investment (50%), and concern that a system would become obsolete (44%)."

Without major financial incentives, I don't see the wide-spread adoption of EHR systems in the US anytime soon, and definitely not by the 2014 deadline President Bush set out in 2004.

The Baltimore Sun has an article today about faulty software in medical devices. It states that, "Of 23 recalls last year that the FDA classified as life-threatening, three involved faulty software."

The article notes that the US Food and Drug Administration (FDA) set up a forensic software unit in 2004 to help investigate potential software problems in medical devices after noticing that manufacturers were increasingly sending out recall notices related to software.

The story also noted that an implantable defibrillator might contain over 100,000 lines of code.

Given that for Class III medical devices, the US Supreme Court has this year made manufacturers essentially immune from lawsuits once the FDA has approved them for use, I hope the FDA forensic team is working hand-in-glove with the FDA internal organization approving those devices about what it is finding and what needs to be checked before approval is given.